@straiffi/archon 1.8.21 → 1.8.23

package/dist/server/lib/gitPushApprovals.js

@@ -0,0 +1,367 @@
+import { realpathSync } from 'node:fs';
+import { consumeApprovalRequest, createApprovalRequestInTransaction, emitApprovalRequestCreated, getApprovalRequest, invalidateApprovalRequest } from './approvalRequests.js';
+import { consequentialActionAuthorityBinding, createConsequentialActionAuthority } from './consequentialActionAuthority.js';
+import { getExecutionRun, transitionExecutionRun, withExecutionRunTransaction } from './executionRuns.js';
+import { fetchRemoteBranchState, getAutomationRemoteIdentity, getCurrentGitBranch, pushCurrentBranch, resolveExistingWorktreePath, } from './git.js';
+import { getProjectById } from './projects.js';
+import { autoParkTicketIfStale, clearAutoParkDismissalIfNeeded, getBundle, getTicket, isProjectRootBundle, listTicketsInRunContext, } from './tickets.js';
+import { captureWorkspaceIdentity } from './workspaceIdentity.js';
+export const GIT_PUSH_APPROVAL_TTL_MS = 15 * 60 * 1000;
+const originFingerprint = (identity) => {
+    const match = /^sha256:([0-9a-f]{64})$/.exec(identity);
+    if (!match?.[1]) {
+        throw new Error('Origin identity is unavailable');
+    }
+    return match[1];
+};
+const canonicalWorkspace = (cwd) => realpathSync(cwd);
+const resolveCurrentWorkspace = (request) => {
+    if (request.action.kind !== 'git_push') {
+        throw new Error('Approval request is not a Git push');
+    }
+    const target = request.action.target;
+    if (!target.project_id || !target.source_kind || !target.source_id || !target.target_kind || target.bundle_id === undefined) {
+        throw new Error('Git push approval context is incomplete');
+    }
+    const project = getProjectById(target.project_id);
+    if (!project || project.id !== request.project_id) {
+        throw new Error('Git push project is unavailable');
+    }
+    if (target.source_kind === 'project') {
+        if (target.source_id !== project.id) {
+            throw new Error('Git push project context changed');
+        }
+        if (project.active_target_kind !== target.target_kind
+            || (project.active_target_bundle_id ?? null) !== target.bundle_id) {
+            throw new Error('Selected project target changed');
+        }
+    }
+    else {
+        const ticket = getTicket(target.source_id);
+        if (!ticket || ticket.project_id !== project.id || (ticket.worktree_bundle_id ?? null) !== target.bundle_id) {
+            throw new Error('Git push ticket or bundle context changed');
+        }
+    }
+    let cwd;
+    let branch;
+    if (target.target_kind === 'bundle') {
+        if (!target.bundle_id) {
+            throw new Error('Git push bundle context is incomplete');
+        }
+        const bundle = getBundle(target.bundle_id, project.id);
+        const path = bundle && !isProjectRootBundle(bundle)
+            ? resolveExistingWorktreePath(bundle.branch, project)
+            : null;
+        if (!bundle || !path) {
+            throw new Error('Git push bundle workspace is unavailable');
+        }
+        cwd = path;
+        branch = bundle.branch;
+    }
+    else if (target.target_kind === 'ticket') {
+        const ticket = target.source_kind === 'ticket' ? getTicket(target.source_id) : null;
+        const path = ticket?.branch ? resolveExistingWorktreePath(ticket.branch, project) : null;
+        if (!ticket || ticket.worktree_bundle_id || !ticket.branch || !path) {
+            throw new Error('Git push ticket workspace is unavailable');
+        }
+        cwd = path;
+        branch = ticket.branch;
+    }
+    else {
+        if (target.source_kind === 'ticket' && target.bundle_id) {
+            const bundle = getBundle(target.bundle_id, project.id);
+            if (!bundle || !isProjectRootBundle(bundle)) {
+                throw new Error('Git push project-root bundle context changed');
+            }
+        }
+        cwd = project.repo_path;
+        branch = request.action.workspace_git.branch ?? '';
+    }
+    if (!branch || canonicalWorkspace(cwd) !== request.action.workspace_git.workspace_path) {
+        throw new Error('Git push workspace was moved or recanonicalized');
+    }
+    return { project, cwd: canonicalWorkspace(cwd), branch };
+};
+const buildAction = async (input) => {
+    const cwd = canonicalWorkspace(input.cwd);
+    if (getCurrentGitBranch(cwd) !== input.branch) {
+        throw new Error('Git push branch no longer matches the reviewed branch');
+    }
+    const identity = await captureWorkspaceIdentity(cwd);
+    if (identity.state !== 'available' || identity.components.head === 'unborn') {
+        throw new Error(`Git push workspace identity is unavailable${identity.state === 'unavailable' ? `: ${identity.message}` : ''}`);
+    }
+    const originIdentity = getAutomationRemoteIdentity(cwd);
+    const remote = await fetchRemoteBranchState(cwd, input.branch, originIdentity);
+    const capabilities = ['remote_git_write'];
+    return {
+        schema_version: 1,
+        kind: 'git_push',
+        workspace_git: {
+            workspace_path: cwd,
+            branch: input.branch,
+            head_sha: identity.components.head,
+            remote_head_sha: remote.state === 'observed' ? remote.sha : null,
+            state_fingerprint: identity.fingerprint,
+        },
+        authority: consequentialActionAuthorityBinding(input.authority),
+        logical_secret_references: ['git:origin'],
+        target: {
+            remote_name: 'origin',
+            remote_url_fingerprint: originFingerprint(originIdentity),
+            ref: `refs/heads/${input.branch}`,
+            force: true,
+            project_id: input.project.id,
+            source_kind: input.source.kind,
+            source_id: input.source.id,
+            target_kind: input.source.targetKind,
+            bundle_id: input.source.bundleId,
+            effective_git_authority: 'remote_git_write',
+            capabilities,
+            degradations: [],
+            expires_at: input.expiresAt,
+        },
+    };
+};
+const requestContext = (request) => {
+    if (request.action.kind !== 'git_push'
+        || !request.action.target.source_kind
+        || !request.action.target.source_id
+        || !request.action.target.target_kind
+        || request.action.target.bundle_id === undefined) {
+        throw new Error('Git push approval context is incomplete');
+    }
+    return {
+        kind: request.action.target.source_kind,
+        id: request.action.target.source_id,
+        targetKind: request.action.target.target_kind,
+        bundleId: request.action.target.bundle_id,
+    };
+};
+const finish = (request, status, domainStatus, emitter, failure) => {
+    const run = getExecutionRun(request.project_id, request.execution_run_id);
+    if (!run || ['completed', 'failed', 'cancelled', 'interrupted'].includes(run.status)) {
+        return run;
+    }
+    return transitionExecutionRun({
+        projectId: request.project_id,
+        runId: request.execution_run_id,
+        status,
+        domainStatus,
+        failure: failure ?? null,
+        eventType: `git_push_${domainStatus}`,
+    }, emitter);
+};
+const reconcileTicketContext = (request, emitter) => {
+    if (request.action.kind !== 'git_push' || request.action.target.source_kind !== 'ticket') {
+        return;
+    }
+    const ticket = getTicket(request.action.target.source_id ?? '');
+    if (!ticket) {
+        return;
+    }
+    for (const previous of listTicketsInRunContext(ticket)) {
+        clearAutoParkDismissalIfNeeded(previous);
+        const updated = autoParkTicketIfStale(previous.id);
+        if (updated) {
+            emitter?.emit('ticket:updated', updated);
+        }
+    }
+};
+const reconcileTicketContextAfterOutcome = (request, emitter) => {
+    try {
+        reconcileTicketContext(request, emitter);
+    }
+    catch {
+        // Ticket housekeeping is secondary and must not change the persisted push outcome.
+    }
+};
+const expectedRemote = (action) => (action.workspace_git.remote_head_sha
+    ? { state: 'observed', sha: action.workspace_git.remote_head_sha }
+    : { state: 'absent' });
+const remoteMatches = (left, right) => (left.state === right.state && (left.state === 'absent' || (right.state === 'observed' && left.sha === right.sha)));
+const observe = async (request) => {
+    if (request.action.kind !== 'git_push') {
+        throw new Error('Approval request is not a Git push');
+    }
+    const workspacePath = canonicalWorkspace(request.action.workspace_git.workspace_path);
+    if (workspacePath !== request.action.workspace_git.workspace_path) {
+        throw new Error('Git push workspace was moved or recanonicalized');
+    }
+    const branch = request.action.workspace_git.branch;
+    if (!branch || request.action.target.ref !== `refs/heads/${branch}`) {
+        throw new Error('Git push branch evidence is unavailable');
+    }
+    const identity = `sha256:${request.action.target.remote_url_fingerprint}`;
+    return fetchRemoteBranchState(workspacePath, branch, identity);
+};
+export const admitForcePush = async (input) => {
+    const now = input.now ?? new Date();
+    const expiresAt = new Date(now.getTime() + GIT_PUSH_APPROVAL_TTL_MS).toISOString();
+    const authority = createConsequentialActionAuthority({
+        projectId: input.project.id,
+        effectiveCapabilities: ['remote_git_write'],
+    });
+    const action = await buildAction({ ...input, authority, expiresAt });
+    let executionRun;
+    let approvalRequest;
+    withExecutionRunTransaction(transaction => {
+        executionRun = transaction.createExecutionRun({
+            projectId: input.project.id,
+            kind: 'git_push',
+            initiatedBy: 'user',
+            sourceReference: { kind: input.source.kind, id: input.source.id },
+            links: input.source.bundleId
+                ? [{ entityType: 'bundle', entityId: input.source.bundleId, relationship: 'context' }]
+                : [],
+            domainStatus: 'admitted',
+            metadata: {
+                target_kind: input.source.targetKind,
+                workspace_path: action.workspace_git.workspace_path,
+                branch: input.branch,
+            },
+            eventType: 'git_push_admitted',
+        });
+        approvalRequest = createApprovalRequestInTransaction({
+            projectId: input.project.id,
+            executionRunId: executionRun.id,
+            action,
+            authority,
+            expiresAt,
+        }, transaction);
+    }, input.emitter);
+    emitApprovalRequestCreated(input.emitter, approvalRequest);
+    return {
+        execution_run: getExecutionRun(input.project.id, executionRun.id) ?? executionRun,
+        approval_request: approvalRequest,
+    };
+};
+export const finalizeGitPushApproval = async (projectId, requestId, emitter) => {
+    const request = getApprovalRequest(projectId, requestId, { emitter });
+    if (!request || request.action_kind !== 'git_push') {
+        return false;
+    }
+    if (request.status === 'invalidated') {
+        finish(request, 'failed', 'invalidated', emitter, { code: 'git_push_stale', message: 'Force-push approval no longer matches the target state.' });
+    }
+    else if (request.status === 'expired') {
+        finish(request, 'cancelled', 'expired', emitter);
+    }
+    else if (request.status === 'denied' || request.status === 'cancelled') {
+        finish(request, 'cancelled', request.status, emitter);
+    }
+    return true;
+};
+export const resumeGitPushApproval = async (projectId, requestId, emitter) => {
+    let request = getApprovalRequest(projectId, requestId, { emitter });
+    if (!request || request.action_kind !== 'git_push' || request.status !== 'approved') {
+        return false;
+    }
+    try {
+        const workspace = resolveCurrentWorkspace(request);
+        const expiresAt = request.action.kind === 'git_push' ? request.action.target.expires_at : undefined;
+        if (!expiresAt) {
+            throw new Error('Git push approval expiry evidence is unavailable');
+        }
+        const currentAction = await buildAction({
+            ...workspace,
+            source: requestContext(request),
+            authority: request.authority,
+            expiresAt,
+        });
+        const consumed = consumeApprovalRequest({ projectId, requestId, currentAction, emitter });
+        if (!consumed.ok) {
+            if (consumed.request) {
+                await finalizeGitPushApproval(projectId, requestId, emitter);
+            }
+            return false;
+        }
+        request = consumed.request;
+        const action = request.action;
+        const originIdentity = `sha256:${action.target.remote_url_fingerprint}`;
+        try {
+            await pushCurrentBranch(workspace.cwd, workspace.branch, {
+                forceWithLease: true,
+                expectedRemoteSha: action.workspace_git.remote_head_sha,
+                targetSha: action.workspace_git.head_sha,
+                expectedOriginIdentity: originIdentity,
+            });
+        }
+        catch (error) {
+            const observed = await observe(request).catch(() => null);
+            if (!observed || !remoteMatches(observed, { state: 'observed', sha: action.workspace_git.head_sha })) {
+                const unchanged = observed && remoteMatches(observed, expectedRemote(action));
+                finish(request, unchanged ? 'failed' : 'interrupted', unchanged ? 'failed' : 'ambiguous', emitter, {
+                    code: unchanged ? 'git_push_failed' : 'git_push_outcome_ambiguous',
+                    message: error instanceof Error ? error.message : 'Force push failed with an uncertain outcome.',
+                });
+                return false;
+            }
+        }
+        let observed;
+        try {
+            observed = await observe(request);
+        }
+        catch (error) {
+            finish(request, 'interrupted', 'ambiguous', emitter, {
+                code: 'git_push_outcome_ambiguous',
+                message: error instanceof Error ? error.message : 'The remote force-push outcome could not be observed.',
+            });
+            return false;
+        }
+        if (!remoteMatches(observed, { state: 'observed', sha: action.workspace_git.head_sha })) {
+            finish(request, 'interrupted', 'ambiguous', emitter, {
+                code: 'git_push_outcome_ambiguous',
+                message: 'The exact remote force-push result could not be proven.',
+            });
+            return false;
+        }
+        finish(request, 'completed', 'succeeded', emitter);
+        reconcileTicketContextAfterOutcome(request, emitter);
+        return true;
+    }
+    catch (error) {
+        request = getApprovalRequest(projectId, requestId, { emitter }) ?? request;
+        if (request.status === 'approved') {
+            request = invalidateApprovalRequest({ projectId, requestId, reason: 'git_push_revalidation_failed', emitter });
+        }
+        finish(request, 'failed', 'invalidated', emitter, {
+            code: 'git_push_stale',
+            message: error instanceof Error ? error.message : 'Force-push target revalidation failed.',
+        });
+        return false;
+    }
+};
+export const reconcileConsumedGitPush = async (request, emitter) => {
+    if (request.action.kind !== 'git_push' || request.status !== 'consumed') {
+        return false;
+    }
+    try {
+        const remote = await observe(request);
+        if (remoteMatches(remote, { state: 'observed', sha: request.action.workspace_git.head_sha })) {
+            finish(request, 'completed', 'reconciled_succeeded', emitter);
+            reconcileTicketContextAfterOutcome(request, emitter);
+            return true;
+        }
+        if (remoteMatches(remote, expectedRemote(request.action))) {
+            finish(request, 'interrupted', 'reconciled_absent', emitter, {
+                code: 'git_push_side_effect_absent',
+                message: 'The consumed force push was not observed on the remote and was not replayed.',
+            });
+            return false;
+        }
+        finish(request, 'interrupted', 'reconciled_ambiguous', emitter, {
+            code: 'git_push_outcome_ambiguous',
+            message: 'The remote branch differs from both approved states; the force push was not replayed.',
+        });
+        return false;
+    }
+    catch (error) {
+        finish(request, 'interrupted', 'reconciled_ambiguous', emitter, {
+            code: 'git_push_outcome_ambiguous',
+            message: error instanceof Error ? error.message : 'The remote force-push outcome could not be observed.',
+        });
+        return false;
+    }
+};
+//# sourceMappingURL=gitPushApprovals.js.map

package/dist/server/lib/gitPushApprovals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitPushApprovals.js","sourceRoot":"","sources":["../../../server/lib/gitPushApprovals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,sBAAsB,EAAE,kCAAkC,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAC7K,OAAO,EAAE,mCAAmC,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAA;AAC3H,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AACzG,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,mBAAmB,EACnB,iBAAiB,EACjB,2BAA2B,GAE5B,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAC9B,SAAS,EACT,SAAS,EACT,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,cAAc,CAAA;AAQrB,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAEjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAqBtD,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAE,EAAE;IAC7C,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;AAE7D,MAAM,uBAAuB,GAAG,CAAC,OAAwB,EAAa,EAAE;IACtE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAA;IACpC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5H,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACpD,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACrD,CAAC;QACD,IACE,OAAO,CAAC,kBAAkB,KAAK,MAAM,CAAC,WAAW;eAC9C,CAAC,OAAO,CAAC,uBAAuB,IAAI,IAAI,CAAC,KAAK,MAAM,CAAC,SAAS,EACjE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,IAAI,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5G,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC;IAED,IAAI,GAAW,CAAA;IACf,IAAI,MAAc,CAAA;IAClB,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;YACjD,CAAC,CAAC,2BAA2B,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;YACrD,CAAC,CAAC,IAAI,CAAA;QACR,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC7D,CAAC;QACD,GAAG,GAAG,IAAI,CAAA;QACV,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IACxB,CAAC;SAAM,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACnF,MAAM,IAAI,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,2BAA2B,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACxF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,kBAAkB,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC7D,CAAC;QACD,GAAG,GAAG,IAAI,CAAA;QACV,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IACxB,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;YACtD,IAAI,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;YACjE,CAAC;QACH,CAAC;QACD,GAAG,GAAG,OAAO,CAAC,SAAS,CAAA;QACvB,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,IAAI,EAAE,CAAA;IACpD,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;AAC1D,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,KAAK,EAAE,KAIzB,EAA+C,EAAE;IACjD,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACpD,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACjI,CAAC;IACD,MAAM,cAAc,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IAC9E,MAAM,YAAY,GAAG,CAAC,kBAAkB,CAAU,CAAA;IAClD,OAAO;QACL,cAAc,EAAE,CAAC;QACjB,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE;YACb,cAAc,EAAE,GAAG;YACnB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;YAClC,eAAe,EAAE,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YAChE,iBAAiB,EAAE,QAAQ,CAAC,WAAW;SACxC;QACD,SAAS,EAAE,mCAAmC,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/D,yBAAyB,EAAE,CAAC,YAAY,CAAC;QACzC,MAAM,EAAE;YACN,WAAW,EAAE,QAAQ;YACrB,sBAAsB,EAAE,iBAAiB,CAAC,cAAc,CAAC;YACzD,GAAG,EAAE,cAAc,KAAK,CAAC,MAAM,EAAE;YACjC,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;YAC5B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YAC9B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;YAC1B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;YACpC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;YAChC,uBAAuB,EAAE,kBAAkB;YAC3C,YAAY;YACZ,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,KAAK,CAAC,SAAS;SAC5B;KACF,CAAA;AACH,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,OAAwB,EAAiB,EAAE;IACjE,IACE,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU;WAC/B,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW;WAClC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS;WAChC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW;WAClC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW;QACvC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS;QACnC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW;QAC7C,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS;KAC1C,CAAA;AACH,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CACb,OAAwB,EACxB,MAA4D,EAC5D,YAAoB,EACpB,OAA6B,EAC7B,OAA2C,EAC3C,EAAE;IACF,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACzE,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACrF,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,OAAO,sBAAsB,CAAC;QAC5B,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,KAAK,EAAE,OAAO,CAAC,gBAAgB;QAC/B,MAAM;QACN,YAAY;QACZ,OAAO,EAAE,OAAO,IAAI,IAAI;QACxB,SAAS,EAAE,YAAY,YAAY,EAAE;KACtC,EAAE,OAAO,CAAC,CAAA;AACb,CAAC,CAAA;AAED,MAAM,sBAAsB,GAAG,CAAC,OAAwB,EAAE,OAA6B,EAAE,EAAE;IACzF,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACzF,OAAM;IACR,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAM;IACR,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,8BAA8B,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;QAC1C,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAED,MAAM,kCAAkC,GAAG,CAAC,OAAwB,EAAE,OAA6B,EAAE,EAAE;IACrG,IAAI,CAAC;QACH,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,mFAAmF;IACrF,CAAC;AACH,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,MAA0C,EAAqB,EAAE,CAAC,CACxF,MAAM,CAAC,aAAa,CAAC,eAAe;IAClC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,eAAe,EAAE;IAClE,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CACxB,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,IAAuB,EAAE,KAAwB,EAAE,EAAE,CAAC,CAC3E,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAClH,CAAA;AAED,MAAM,OAAO,GAAG,KAAK,EAAE,OAAwB,EAAE,EAAE;IACjD,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAA;IACrF,IAAI,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAA;IAClD,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,cAAc,MAAM,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAA;IACzE,OAAO,sBAAsB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAChE,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,KAAqB,EAGtD,EAAE;IACJ,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAA;IACnC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,wBAAwB,CAAC,CAAC,WAAW,EAAE,CAAA;IAClF,MAAM,SAAS,GAAG,kCAAkC,CAAC;QACnD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;QAC3B,qBAAqB,EAAE,CAAC,kBAAkB,CAAC;KAC5C,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;IACpE,IAAI,YAA2B,CAAA;IAC/B,IAAI,eAAiC,CAAA;IACrC,2BAA2B,CAAC,WAAW,CAAC,EAAE;QACxC,YAAY,GAAG,WAAW,CAAC,kBAAkB,CAAC;YAC5C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;YAC3B,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,MAAM;YACnB,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE;YACjE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;gBAC1B,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;gBACtF,CAAC,CAAC,EAAE;YACN,YAAY,EAAE,UAAU;YACxB,QAAQ,EAAE;gBACR,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;gBACpC,cAAc,EAAE,MAAM,CAAC,aAAa,CAAC,cAAc;gBACnD,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB;YACD,SAAS,EAAE,mBAAmB;SAC/B,CAAC,CAAA;QACF,eAAe,GAAG,kCAAkC,CAAC;YACnD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;YAC3B,cAAc,EAAE,YAAY,CAAC,EAAE;YAC/B,MAAM;YACN,SAAS;YACT,SAAS;SACV,EAAE,WAAW,CAAC,CAAA;IACjB,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACjB,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;IAC1D,OAAO;QACL,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,IAAI,YAAY;QACjF,gBAAgB,EAAE,eAAe;KAClC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAC1C,SAAiB,EACjB,SAAiB,EACjB,OAA6B,EAC7B,EAAE;IACF,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACrE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACnD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACrC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAA;IACnJ,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;IAClD,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACzE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,SAAiB,EACjB,SAAiB,EACjB,OAA6B,EAC7B,EAAE;IACF,IAAI,OAAO,GAAG,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACnE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACpF,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;QACnG,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QACrE,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC;YACtC,GAAG,SAAS;YACZ,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS;SACV,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAA;QACzF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,uBAAuB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAA4C,CAAA;QACnE,MAAM,cAAc,GAAG,UAAU,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAA;QACvE,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,EAAE;gBACvD,cAAc,EAAE,IAAI;gBACpB,iBAAiB,EAAE,MAAM,CAAC,aAAa,CAAC,eAAe;gBACvD,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ;gBACxC,sBAAsB,EAAE,cAAc;aACvC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;YACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;gBACrG,MAAM,SAAS,GAAG,QAAQ,IAAI,aAAa,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAA;gBAC7E,MAAM,CACJ,OAAO,EACP,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,EACpC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAClC,OAAO,EACP;oBACE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,4BAA4B;oBAClE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8CAA8C;iBACjG,CACF,CAAA;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QACD,IAAI,QAA2B,CAAA;QAC/B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE;gBACnD,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sDAAsD;aACzG,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YACxF,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE;gBACnD,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,yDAAyD;aACnE,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QAClD,kCAAkC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACpD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,OAAO,CAAA;QAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClC,OAAO,GAAG,yBAAyB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,CAAC,CAAA;QAChH,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE;YAChD,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wCAAwC;SAC3F,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAAE,OAAwB,EAAE,OAA6B,EAAE,EAAE;IACxG,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACxE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC7F,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAA;YAC7D,kCAAkC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACpD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,OAAO,EAAE;gBAC3D,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,8EAA8E;aACxF,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,OAAO,EAAE;YAC9D,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,uFAAuF;SACjG,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,OAAO,EAAE;YAC9D,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sDAAsD;SACzG,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA"}

package/dist/server/lib/mobileAccess.js

@@ -15,6 +15,9 @@ import { submitPlanTicketFollowUp, submitTicketFollowUp } from './ticketFollowUp
 import { resolveTicketPlanQuestionSet } from './planQuestionOperations.js';
 import { updateTicketAgentSettings } from './ticketSettingsOperations.js';
 import { listAgentRunsForParent } from './agentRuns.js';
+import { ApprovalRequestConflictError, ApprovalRequestCursorError, decideApprovalRequest, getApprovalRequest, listApprovalRequestEvents, listApprovalRequests } from './approvalRequests.js';
+import { finalizeProductionCheckApproval, resumeProductionCheckApproval } from './checkRunner.js';
+import { finalizeGitPushApproval, resumeGitPushApproval } from './gitPushApprovals.js';
 const DEFAULT_MOBILE_PORT = 43111;
 const MOBILE_PORT_FALLBACK_COUNT = 20;
 const PAIRING_TTL_MS = 2 * 60 * 1000;
@@ -37,6 +40,10 @@ const MOBILE_REALTIME_EVENTS = new Set([
     'spec-session:updated',
     'spec-session:deleted',
     'agent-runs:updated',
+    'approval-request:created',
+    'approval-request:updated',
+    'execution-run:updated',
+    'lifecycle-event:created',
 ]);
 const hashSecret = (value) => {
     return createHash('sha256').update(value).digest('hex');
@@ -887,12 +894,119 @@ export const createMobileAccessController = (options = {}) => {
                     res.status(404).json({ error: 'Not found' });
                     return;
                 }
-                res.json(summary);
+                const pendingApprovalRequests = [];
+                let cursor;
+                do {
+                    const page = listApprovalRequests({
+                        projectId: req.params.projectId,
+                        statuses: ['pending'],
+                        limit: 200,
+                        cursor,
+                        emitter: operationBroadcaster,
+                    });
+                    pendingApprovalRequests.push(...page.approval_requests);
+                    cursor = page.next_cursor ?? undefined;
+                } while (cursor);
+                res.json({
+                    ...summary,
+                    ...(pendingApprovalRequests.length > 0 ? { pending_approval_requests: pendingApprovalRequests } : {}),
+                });
             }
             catch {
                 res.status(500).json({ error: 'Unable to load project summary.' });
             }
         });
+        app.get('/mobile/projects/:projectId/approval-requests', (req, res) => {
+            if (!validateMobileRequest(req)) {
+                res.status(401).json({ error: 'Authentication required.' });
+                return;
+            }
+            const cursor = typeof req.query.cursor === 'string' ? req.query.cursor : undefined;
+            if (req.query.cursor !== undefined && (!cursor || cursor.length > 1024)) {
+                res.status(400).json({ error: 'Invalid approval request cursor', reason: 'invalid_cursor' });
+                return;
+            }
+            try {
+                res.json(listApprovalRequests({
+                    projectId: req.params.projectId,
+                    statuses: ['pending'],
+                    limit: 200,
+                    cursor,
+                    emitter: operationBroadcaster,
+                }));
+            }
+            catch (error) {
+                if (error instanceof ApprovalRequestCursorError) {
+                    res.status(400).json({ error: error.message, reason: 'invalid_cursor' });
+                    return;
+                }
+                throw error;
+            }
+        });
+        app.get('/mobile/projects/:projectId/approval-requests/:requestId', (req, res) => {
+            if (!validateMobileRequest(req)) {
+                res.status(401).json({ error: 'Authentication required.' });
+                return;
+            }
+            const request = getApprovalRequest(req.params.projectId, req.params.requestId, { emitter: operationBroadcaster });
+            if (!request) {
+                res.status(404).json({ error: 'Approval request not found.' });
+                return;
+            }
+            res.json({ approval_request: request, events: listApprovalRequestEvents(req.params.projectId, req.params.requestId) });
+        });
+        for (const decision of ['approve', 'deny', 'cancel']) {
+            app.post(`/mobile/projects/:projectId/approval-requests/:requestId/${decision}`, async (req, res) => {
+                if (!requireMobileWriteSession(req, res)) {
+                    return;
+                }
+                const fingerprint = req.body?.expected_action_fingerprint;
+                const reason = req.body?.reason;
+                if (typeof fingerprint !== 'string'
+                    || !/^[0-9a-f]{64}$/.test(fingerprint)
+                    || (reason !== undefined && (typeof reason !== 'string' || reason.trim().length === 0 || Buffer.byteLength(reason.trim(), 'utf8') > 2_000))) {
+                    res.status(400).json({ error: 'Invalid approval decision request.' });
+                    return;
+                }
+                try {
+                    const request = decideApprovalRequest({
+                        projectId: req.params.projectId,
+                        requestId: req.params.requestId,
+                        decision: decision === 'approve' ? 'approved' : decision === 'deny' ? 'denied' : 'cancelled',
+                        expectedActionFingerprint: fingerprint,
+                        actorReference: 'paired_mobile_operator',
+                        reason,
+                        emitter: operationBroadcaster,
+                    });
+                    if (request.action_kind === 'custom_check') {
+                        if (request.status === 'approved') {
+                            await resumeProductionCheckApproval(request.project_id, request.id, operationBroadcaster);
+                        }
+                        else {
+                            await finalizeProductionCheckApproval(request.project_id, request.id, operationBroadcaster);
+                        }
+                    }
+                    else if (request.status === 'approved') {
+                        await resumeGitPushApproval(request.project_id, request.id, operationBroadcaster);
+                    }
+                    else {
+                        await finalizeGitPushApproval(request.project_id, request.id, operationBroadcaster);
+                    }
+                    res.json({ approval_request: getApprovalRequest(request.project_id, request.id, { emitter: operationBroadcaster }) ?? request });
+                }
+                catch (error) {
+                    if (error instanceof ApprovalRequestConflictError) {
+                        res.status(409).json({ error: error.message, reason: error.reason, approval_request: error.request });
+                        return;
+                    }
+                    if (error instanceof Error && error.message.includes('not found')) {
+                        res.status(404).json({ error: 'Approval request not found.' });
+                        return;
+                    }
+                    throw error;
+                }
+            });
+        }
         app.get('/mobile/projects/:projectId/target-options', async (req, res) => {
             const session = validateMobileRequest(req);
             if (!session) {