@vercel/factory 0.0.3 → 0.0.4

package/dist/eve/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/eve/conflict.ts","../../src/eve/finding.ts","../../src/eve/deepsec.ts","../../src/eve/fetch.ts","../../src/eve/invoke.ts","../../src/eve/review.ts","../../src/eve/verification.ts","../../src/eve/index.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { taskIdSchema } from \"../schema/id\";\nimport type { FactoryStores } from \"../store/engine\";\nimport { defineTool } from \"eve/tools\";\nimport type { CommandSandbox } from \"./fetch\";\n\nconst gitShaSchema = z.string().regex(/^[0-9a-f]{40}$/);\nconst gitBranchSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._/-]*$/).refine((value) => !value.includes(\"..\"));\n\nexport const mergeConflictPayloadSchema = z.strictObject({\n  repository: z.string().regex(/^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$/),\n  prNumber: z.number().int().positive(),\n  prUrl: z.url(),\n  headBranch: gitBranchSchema.refine((value) => value.startsWith(\"factory/\")),\n  headSha: gitShaSchema,\n  baseBranch: gitBranchSchema,\n  baseSha: gitShaSchema,\n});\n\nexport type MergeConflictPayload = z.infer<typeof mergeConflictPayloadSchema>;\n\nexport interface MergeConflictToolOptions<S extends CommandSandbox = CommandSandbox> {\n  withCredential: (\n    sandbox: S,\n    repository: string,\n    command: string,\n  ) => Promise<{ stdout: string; stderr?: string; exitCode?: number }>;\n  repoPath?: string;\n}\n\nexport function mergeConflictTools<S extends CommandSandbox>(\n  stores: FactoryStores,\n  options: MergeConflictToolOptions<S>,\n) {\n  const repoPath = options.repoPath ?? \"repo\";\n\n  async function context(taskId: z.infer<typeof taskIdSchema>) {\n    const task = await stores.tasks.get(taskId);\n    if (task === null) throw new Error(`task ${taskId} does not exist`);\n    if (task.kind !== \"merge_conflict\") throw new Error(`task ${taskId} is ${task.kind}, not merge_conflict`);\n    if (task.state !== \"running\") throw new Error(`task ${taskId} is ${task.state}, not running`);\n    if (task.origin.signalId === undefined) throw new Error(`task ${taskId} has no conflict signal`);\n    const signal = await stores.signals.get(task.origin.signalId);\n    if (signal === null || signal.source !== \"github_merge_conflict\") {\n      throw new Error(`task ${taskId} has no GitHub merge conflict signal`);\n    }\n    return { task, conflict: mergeConflictPayloadSchema.parse(signal.payload) };\n  }\n\n  return {\n    fetch_merge_conflict: defineTool({\n      description:\n        \"Fetch the conflicted factory pull request and its current base, check out the PR head, and start the merge. Resolve every file returned in conflictedFiles, then test and commit the merge.\",\n      inputSchema: z.object({ taskId: taskIdSchema }),\n      async execute({ taskId }, ctx) {\n        const { conflict } = await context(taskId);\n        const sandbox = (await ctx.getSandbox()) as unknown as S;\n        const git = `git -C ${repoPath}`;\n        const headRef = `refs/remotes/origin/conflict-pr-${conflict.prNumber}`;\n        const baseRef = `refs/remotes/origin/conflict-base-${conflict.prNumber}`;\n        const fetch = await options.withCredential(\n          sandbox,\n          conflict.repository,\n          `${git} fetch --depth 100 origin +refs/pull/${conflict.prNumber}/head:${headRef} +refs/heads/${conflict.baseBranch}:${baseRef}`,\n        );\n        if (typeof fetch.exitCode === \"number\" && fetch.exitCode !== 0) {\n          throw new Error(`could not fetch pull request: ${(fetch.stderr ?? \"\").trim()}`);\n        }\n        const fetched = await sandbox.run({\n          command: `${git} rev-parse ${headRef} && ${git} rev-parse ${baseRef}`,\n        });\n        const [headSha, baseSha] = fetched.stdout.trim().split(\"\\n\");\n        if (headSha !== conflict.headSha || baseSha !== conflict.baseSha) {\n          throw new Error(\"pull request or base changed while conflict resolution was starting; retry from a new task\");\n        }\n        await sandbox.run({ command: `${git} checkout -B conflict-pr ${headRef}` });\n        const merge = await sandbox.run({ command: `${git} merge --no-commit --no-ff ${baseRef}` });\n        const conflicts = await sandbox.run({ command: `${git} diff --name-only --diff-filter=U` });\n        const conflictedFiles = conflicts.stdout.trim().split(\"\\n\").filter(Boolean);\n        if (conflictedFiles.length === 0) {\n          throw new Error(\n            typeof merge.exitCode === \"number\" && merge.exitCode !== 0\n              ? `merge failed without file conflicts: ${(merge.stderr ?? \"\").trim()}`\n              : \"pull request no longer has merge conflicts\",\n          );\n        }\n        return { ...conflict, conflictedFiles };\n      },\n    }),\n    publish_merge_resolution: defineTool({\n      description:\n        \"Publish a tested, committed conflict resolution to the existing pull request branch. Fails if the remote branch changed since this task started.\",\n      inputSchema: z.object({\n        taskId: taskIdSchema,\n        summary: z.string().min(1).max(2000),\n      }),\n      async execute({ taskId, summary }, ctx) {\n        const { conflict } = await context(taskId);\n        const sandbox = (await ctx.getSandbox()) as unknown as S;\n        const git = `git -C ${repoPath}`;\n        const clean = await sandbox.run({ command: `${git} status --porcelain` });\n        if (clean.stdout.trim() !== \"\") throw new Error(\"commit the conflict resolution before publishing\");\n        const unresolved = await sandbox.run({ command: `${git} diff --name-only --diff-filter=U` });\n        if (unresolved.stdout.trim() !== \"\") throw new Error(\"merge conflicts remain unresolved\");\n        const push = await options.withCredential(\n          sandbox,\n          conflict.repository,\n          `${git} push --force-with-lease=refs/heads/${conflict.headBranch}:${conflict.headSha} origin HEAD:refs/heads/${conflict.headBranch}`,\n        );\n        if (typeof push.exitCode === \"number\" && push.exitCode !== 0) {\n          throw new Error(`could not update pull request branch: ${(push.stderr ?? \"\").trim()}`);\n        }\n        await stores.tasks.transition(taskId, \"verifying\", { reason: summary });\n        await stores.tasks.transition(taskId, \"succeeded\", { reason: summary });\n        return { updated: true as const, prNumber: conflict.prNumber, prUrl: conflict.prUrl };\n      },\n    }),\n  };\n}\n","import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { defaultApprovalPolicy, requiresApproval, type ApprovalPolicy } from \"../approval\";\nimport { findingFingerprint, findingSchema, type Finding } from \"../schema/finding\";\nimport { repositoryIdSchema } from \"../schema/id\";\nimport type { FactoryStores } from \"../store/engine\";\n\n// Matched by name, not instanceof: the Blob driver is a separate package entry\n// point, so its error classes are distinct objects from any imported here.\nfunction isLostRaceError(error: unknown): boolean {\n  return (\n    error instanceof Error &&\n    (error.name === \"VersionConflictError\" || error.name === \"InvalidTransitionError\")\n  );\n}\n\nexport interface RecordFindingOptions {\n  /** Signal source the findings are recorded under. Defaults to security_scan. */\n  source?: string;\n  /** Which resulting tasks wait for a human. Defaults to the standard policy. */\n  approval?: ApprovalPolicy;\n}\n\nexport type RecordFindingResult =\n  | { recorded: false; reason: string; duplicate?: true; signalId?: string }\n  | { recorded: true; signalId: string; taskId: string; approval: \"required\" | \"not_required\" };\n\n/**\n * Turn one finding into a signal and a fix task. The fingerprint is the\n * signal's delivery id, so the same problem reported twice is a no-op. The\n * signal is accepted on the reporter's own verification (a human gate follows\n * when the approval policy says so), and the task carries the approval\n * decision from the moment it exists. Shared by record_finding and scanner\n * tools that record on the agent's behalf.\n */\nexport async function recordFinding(\n  stores: FactoryStores,\n  repositoryId: string,\n  finding: Finding,\n  options: RecordFindingOptions = {},\n): Promise<RecordFindingResult> {\n  const source = options.source ?? \"security_scan\";\n  const policy = options.approval ?? defaultApprovalPolicy;\n  const repository = await stores.repositories.get(repositoryId);\n  if (repository === null) {\n    return { recorded: false, reason: `repository ${repositoryId} does not exist` };\n  }\n\n  const fingerprint = findingFingerprint(repositoryId, finding);\n  const signal = await stores.signals.create({\n    repositoryId,\n    source,\n    deliveryId: fingerprint,\n    replyTo: { channel: \"finding\", address: fingerprint },\n    payload: finding,\n  });\n  if (signal.outcome !== \"pending\") {\n    return { recorded: false, duplicate: true, signalId: signal.id, reason: `already recorded as ${signal.id}` };\n  }\n\n  // Overlapping scanner sessions can record the same finding. The signal is\n  // created idempotently by fingerprint; accepting it is the compare-and-swap.\n  try {\n    await stores.signals.decide(signal.id, \"accepted\", {\n      detail: finding.priority,\n      reason: `${finding.tool ?? \"scanner\"} reported it, ${finding.verification.level} by ${finding.verification.method}`,\n    });\n  } catch (error) {\n    // Lost the race: if the winner already decided the signal, this is a\n    // duplicate; only a still-pending signal is a real failure to re-raise.\n    if (isLostRaceError(error)) {\n      const current = await stores.signals.get(signal.id);\n      if (current !== null && current.outcome !== \"pending\") {\n        return { recorded: false, duplicate: true, signalId: signal.id, reason: `already recorded as ${signal.id}` };\n      }\n    }\n    throw error;\n  }\n\n  const approval = requiresApproval(policy, { source, kind: \"code_change\", priority: finding.priority });\n  const task = await stores.tasks.create({\n    repositoryIds: [repositoryId],\n    kind: \"code_change\",\n    origin: { signalId: signal.id },\n    replyTo: signal.replyTo,\n    ...(approval ? { approval: \"required\" as const } : {}),\n  });\n\n  return { recorded: true, signalId: signal.id, taskId: task.id, approval: approval ? \"required\" : \"not_required\" };\n}\n\n/**\n * The scanner's outcome tool: turns one finding into a signal and a fix task\n * in a single deterministic step. The finding's fingerprint is the signal's\n * delivery id, so reporting the same problem twice is a no-op. The signal is\n * accepted on the reporter's own verification (a human gate follows when the\n * approval policy says so), and the task carries the approval decision from\n * the moment it exists.\n */\nexport function recordFindingTool(stores: FactoryStores, options: RecordFindingOptions = {}) {\n  return defineTool({\n    description:\n      \"Record one problem you found in the repository. Creates a fix task (which may wait for human approval) unless the same finding was already recorded. Report every finding separately; never batch.\",\n    inputSchema: z.object({\n      repositoryId: repositoryIdSchema,\n      finding: findingSchema,\n    }),\n    execute({ repositoryId, finding }) {\n      return recordFinding(stores, repositoryId, finding, options);\n    },\n  });\n}\n","import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { findingSchema, type Finding, type FindingPriority } from \"../schema/finding\";\nimport { repositoryIdSchema } from \"../schema/id\";\nimport type { FactoryStores } from \"../store/engine\";\nimport type { CommandSandbox } from \"./fetch\";\nimport { recordFinding, type RecordFindingOptions, type RecordFindingResult } from \"./finding\";\n\nexport interface DeepsecScanOptions<S extends CommandSandbox = CommandSandbox> extends RecordFindingOptions {\n  /**\n   * Runs one shell command with the model credential deepsec's gateway route\n   * expects, and removes it again before resolving. Supplied by the app, which\n   * owns where the credential comes from: on Vercel it is the deployment's own\n   * OIDC identity (VERCEL_OIDC_TOKEN), so nothing has to be configured.\n   */\n  withModelCredential: (sandbox: S, command: string) => Promise<{ stdout: string; stderr?: string; exitCode?: number }>;\n  /** deepsec agent backend: claude, codex, or pi. */\n  agent?: \"claude\" | \"codex\" | \"pi\";\n  /** Model deepsec's investigation agent uses, through the AI Gateway (e.g. claude-sonnet-4-6). */\n  model?: string;\n  /** Reasoning effort for the investigation: minimal, low, medium, high, or xhigh. */\n  thinkingLevel?: \"minimal\" | \"low\" | \"medium\" | \"high\" | \"xhigh\";\n  /** Parallel investigation batches. */\n  concurrency?: number;\n  /** deepsec version to install. */\n  version?: string;\n  /** Repository checkout inside the sandbox. Defaults to `repo`. */\n  repoPath?: string;\n  /** deepsec workspace inside the sandbox. Defaults to `deepsec`. */\n  workspacePath?: string;\n  /** Shell run before every deepsec command, e.g. to put a Node 24 on PATH. */\n  commandPrefix?: string;\n  /**\n   * Candidate files investigated per run. deepsec keeps state, so successive\n   * scans continue where the last one stopped; the cap keeps one run inside\n   * the deployment's time limit on large repositories. Defaults to 40.\n   */\n  filesPerRun?: number;\n}\n\n/** deepsec's exported finding shape, as far as we depend on it. */\nconst deepsecFindingSchema = z.looseObject({\n  title: z.string().min(1),\n  description: z.string().min(1),\n  severity: z.string().min(1),\n  metadata: z\n    .looseObject({\n      filePath: z.string().min(1).optional(),\n      lineNumbers: z.array(z.number().int().min(1)).optional(),\n      vulnSlug: z.string().min(1).optional(),\n      confidence: z.string().optional(),\n      runId: z.string().optional(),\n    })\n    .optional(),\n});\n\nconst deepsecExportSchema = z.union([\n  z.array(deepsecFindingSchema),\n  z.looseObject({ findings: z.array(deepsecFindingSchema) }).transform((value) => value.findings),\n]);\n\nconst priorityBySeverity: Record<string, FindingPriority> = {\n  CRITICAL: \"P0\",\n  HIGH: \"P1\",\n  MEDIUM: \"P2\",\n  HIGH_BUG: \"P2\",\n  BUG: \"P3\",\n  LOW: \"P3\",\n};\n\n/** Convert one deepsec finding into the factory's Finding. Pure; exported for tests. */\nexport function findingFromDeepsec(raw: z.infer<typeof deepsecFindingSchema>): Finding {\n  const meta = raw.metadata ?? {};\n  const confidence = (meta.confidence ?? \"\").toLowerCase();\n  const line = meta.lineNumbers?.[0];\n  const endLine = meta.lineNumbers === undefined ? undefined : Math.max(...meta.lineNumbers);\n  return findingSchema.parse({\n    title: raw.title.replace(/^\\[[A-Z_]+\\]\\s*/u, \"\").slice(0, 200),\n    body: raw.description.slice(0, 8000),\n    ...(meta.filePath === undefined ? {} : { path: meta.filePath.slice(0, 500) }),\n    ...(line === undefined ? {} : { line }),\n    ...(endLine === undefined || endLine === line ? {} : { endLine }),\n    priority: priorityBySeverity[raw.severity.toUpperCase()] ?? \"P3\",\n    category: \"security\",\n    verification: {\n      // deepsec's agent reads the code; it does not run it. Say so.\n      level: confidence === \"high\" ? \"supported\" : \"unverified\",\n      method: \"static_analysis\",\n      summary: `deepsec ${meta.vulnSlug ?? \"finding\"} with ${confidence || \"unknown\"} confidence${meta.runId === undefined ? \"\" : ` (run ${meta.runId})`}.`,\n      limitations: \"AI-assisted static analysis of the checkout; not reproduced at runtime.\",\n    },\n    tool: \"deepsec\",\n    ...(meta.vulnSlug === undefined ? {} : { ruleId: meta.vulnSlug }),\n  });\n}\n\nconst findingsPath = \"/tmp/deepsec-findings.json\";\n\n/** Parse \"N file(s) with candidates\" out of deepsec scan output; null when absent. */\nfunction candidateCount(output: string): number | null {\n  const match = /(\\d+)\\s+file\\(s\\) with candidates/u.exec(output);\n  return match?.[1] === undefined ? null : Number(match[1]);\n}\n\n/** The last few meaningful lines of a command's output, ANSI stripped, for a receipt. */\nfunction tail(output: string, lines = 4): string {\n  // eslint-disable-next-line no-control-regex -- stripping terminal colour codes\n  const ansi = /\\u001b\\[[0-9;]*m/gu;\n  return output\n    .replaceAll(ansi, \"\")\n    .split(\"\\n\")\n    .map((line) => line.trim())\n    .filter((line) => line !== \"\")\n    .slice(-lines)\n    .join(\" | \")\n    .slice(0, 600);\n}\n\n/**\n * Runs deepsec (vercel-labs/deepsec) against the sandbox checkout and records\n * what it finds through the same path as record_finding, so every deepsec\n * finding becomes a fix task subject to the approval policy. Trusted code\n * owns the command sequence and the credential; the agent chooses when to\n * scan and reports the outcome.\n */\nexport function deepsecScanTool<S extends CommandSandbox>(stores: FactoryStores, options: DeepsecScanOptions<S>) {\n  const repoPath = options.repoPath ?? \"repo\";\n  const workspace = options.workspacePath ?? \"deepsec\";\n  const version = options.version ?? \"2.3.8\";\n  const agent = options.agent ?? \"claude\";\n  const model = options.model ?? \"claude-sonnet-4-6\";\n  const thinkingLevel = options.thinkingLevel ?? \"medium\";\n  const concurrency = options.concurrency ?? 4;\n  const prefix = options.commandPrefix === undefined ? [] : [options.commandPrefix];\n  const filesPerRun = options.filesPerRun ?? 40;\n\n  return defineTool({\n    description:\n      \"Run deepsec, the AI-powered vulnerability scanner, over the repository checkout and record every finding it reports as a fix task. Takes minutes. Call once per scan; then summarize the result.\",\n    inputSchema: z.object({\n      repositoryId: repositoryIdSchema,\n      limit: z\n        .number()\n        .int()\n        .min(1)\n        .max(500)\n        .optional()\n        .describe(\"Candidate files to investigate this run (default 40; deepsec resumes where it left off next time).\"),\n    }),\n    async execute({ repositoryId, limit }, ctx) {\n      const repository = await stores.repositories.get(repositoryId);\n      if (repository === null) {\n        return { scanned: false as const, reason: `repository ${repositoryId} does not exist` };\n      }\n      const sandbox = (await ctx.getSandbox()) as unknown as S;\n      const projectId = repository.slug.replace(/[^a-z0-9]+/gu, \"-\");\n      const startedAt = Date.now();\n\n      // One receipt per phase, so the ledger answers \"where is the scan\" while\n      // deepsec runs and shows what each phase cost afterwards.\n      const phase = async (state: string, reason: string): Promise<void> => {\n        await stores.receipts.append({\n          repositoryIds: [repositoryId],\n          kind: \"deepsec\",\n          state,\n          phase: \"security_scan\",\n          reason: `${reason} (${Math.round((Date.now() - startedAt) / 1000)}s in)`,\n        });\n      };\n      await phase(\"started\", `deepsec ${version} on ${repository.slug}, ${agent}/${model}`);\n\n      // Workspace: scaffolded once per sandbox, installed from npm. deepsec\n      // needs Node 24; the sandbox bootstrap is expected to provide it.\n      const prepare = await sandbox.run({\n        command: [\n          ...prefix,\n          \"set -e\",\n          `if [ ! -f ${workspace}/deepsec.config.ts ]; then`,\n          `  npx -y deepsec@${version} init ./${workspace} ./${repoPath} --id ${projectId} --scaffold-only --headless --yes --skip-install`,\n          `  (cd ${workspace} && npm install --no-audit --no-fund --loglevel=error)`,\n          \"fi\",\n          // deepsec resolves deepsec.config.ts from the current directory, so\n          // every deepsec command runs inside the workspace. No --root: it is a\n          // one-off override that skips the project's file records, leaving\n          // `process` with nothing to investigate.\n          `cd ${workspace}`,\n          `./node_modules/.bin/deepsec scan --project-id ${projectId}`,\n        ].join(\"\\n\"),\n      });\n      if (typeof prepare.exitCode === \"number\" && prepare.exitCode !== 0) {\n        const detail = (prepare.stderr ?? prepare.stdout).trim().slice(-1500);\n        await phase(\"failed\", `scan phase failed: ${detail.slice(-300)}`);\n        return { scanned: false as const, reason: `deepsec scan failed: ${detail}` };\n      }\n      const candidates = candidateCount(prepare.stdout);\n      await phase(\n        \"scanned\",\n        `${candidates === null ? \"scan output\" : `${candidates} files with candidates`}: ${tail(`${prepare.stdout}\\n${prepare.stderr ?? \"\"}`)}`,\n      );\n\n      // Investigation talks to the model through the AI Gateway (deepsec's\n      // default route); this is the only step that needs a credential.\n      const investigate = await options.withModelCredential(\n        sandbox,\n        [\n          ...prefix,\n          \"set -e\",\n          `cd ${workspace}`,\n          `./node_modules/.bin/deepsec process --project-id ${projectId} --agent ${agent} --model ${model} --thinking-level ${thinkingLevel} --concurrency ${concurrency} --limit ${limit ?? filesPerRun}`,\n          `./node_modules/.bin/deepsec export --project-id ${projectId} --format json --out ${findingsPath}`,\n        ].join(\"\\n\"),\n      );\n      if (typeof investigate.exitCode === \"number\" && investigate.exitCode !== 0) {\n        const detail = (investigate.stderr ?? investigate.stdout).trim().slice(-1500);\n        await phase(\"failed\", `process phase failed: ${detail.slice(-300)}`);\n        return { scanned: false as const, reason: `deepsec process failed: ${detail}` };\n      }\n\n      const exported = await sandbox.run({ command: `cat ${findingsPath}` });\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(exported.stdout);\n      } catch {\n        return { scanned: false as const, reason: \"deepsec export was not valid JSON\" };\n      }\n      const raw = deepsecExportSchema.safeParse(parsed);\n      if (!raw.success) {\n        return { scanned: false as const, reason: `deepsec export had an unexpected shape: ${raw.error.issues[0]?.message ?? \"unknown\"}` };\n      }\n\n      const results: { finding: Finding; result: RecordFindingResult }[] = [];\n      for (const entry of raw.data) {\n        const finding = findingFromDeepsec(entry);\n        results.push({ finding, result: await recordFinding(stores, repositoryId, finding, options) });\n      }\n      const recorded = results.filter(({ result }) => result.recorded);\n      await phase(\n        \"completed\",\n        `${results.length} findings, ${recorded.length} new. process output: ${tail(`${investigate.stdout}\\n${investigate.stderr ?? \"\"}`, 6)}`,\n      );\n      return {\n        scanned: true as const,\n        tool: \"deepsec\",\n        found: results.length,\n        recorded: recorded.length,\n        duplicates: results.length - recorded.length,\n        awaitingApproval: recorded.filter(({ result }) => result.recorded && result.approval === \"required\").length,\n        findings: results.map(({ finding, result }) => ({\n          title: finding.title,\n          priority: finding.priority,\n          path: finding.path,\n          line: finding.line,\n          ...(result.recorded ? { taskId: result.taskId, approval: result.approval } : { duplicate: true }),\n        })),\n      };\n    },\n  });\n}\n","import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { changeIdSchema } from \"../schema/id\";\nimport type { FactoryStores } from \"../store/engine\";\n\n/** The subset of the eve sandbox handle a credentialed git operation needs. */\nexport interface CommandSandbox {\n  run(options: { command: string }): PromiseLike<{\n    stdout: string;\n    stderr?: string;\n    exitCode?: number;\n  }>;\n}\n\nexport interface FetchPullRequestOptions<S extends CommandSandbox = CommandSandbox> {\n  /**\n   * Runs one git command against `slug` with a credential the sandbox does not\n   * otherwise have, and removes it again before resolving. Supplied by the\n   * app, which owns how credentials are minted and where they are injected;\n   * the library only decides what is fetched.\n   */\n  withCredential: (\n    sandbox: S,\n    slug: string,\n    command: string,\n  ) => Promise<{ stdout: string; stderr?: string; exitCode?: number }>;\n  /** Path of the checkout inside the sandbox. Defaults to `repo`. */\n  repoPath?: string;\n  /** Fetch depth for the pull request head. Defaults to 50. */\n  depth?: number;\n}\n\nexport type FetchPullRequestResult =\n  | { fetched: false; reason: string }\n  | { fetched: true; prNumber: number; prUrl: string; branch: string; headSha: string };\n\n/**\n * The verifier's way in to the change under review. The sandbox has no\n * GitHub credential while the agent runs, so trusted code does the one fetch\n * the agent cannot: the pull request number and repository come from the\n * change record, never from the agent, and the credential is gone again\n * before control returns. Mirrors how publication reads commits out of the\n * sandbox instead of letting the agent push.\n */\nexport function fetchPullRequestTool<S extends CommandSandbox>(\n  stores: FactoryStores,\n  options: FetchPullRequestOptions<S>,\n) {\n  const repoPath = options.repoPath ?? \"repo\";\n  const depth = options.depth ?? 50;\n  return defineTool({\n    description:\n      \"Fetch the pull request under review into the checkout and check it out as the local branch `pr`. Call this after get_task, before inspecting or testing the change. Returns the PR number, URL, and the commit you are now on.\",\n    inputSchema: z.object({\n      changeId: changeIdSchema.describe(\"The change under review, from your starting message.\"),\n    }),\n    async execute({ changeId }, ctx): Promise<FetchPullRequestResult> {\n      const change = await stores.changes.get(changeId);\n      if (change === null) {\n        return { fetched: false, reason: `change ${changeId} does not exist` };\n      }\n      if (change.state !== \"verifying\" && change.state !== \"ready\") {\n        return { fetched: false, reason: `change is ${change.state}, not open for review; nothing to fetch` };\n      }\n      const repository = await stores.repositories.get(change.repositoryId);\n      if (repository === null) {\n        return { fetched: false, reason: `repository ${change.repositoryId} does not exist` };\n      }\n\n      // Fetch into a remote-tracking ref (never the checked-out branch, which\n      // git refuses to update), then move the local `pr` branch onto it so a\n      // repeated call picks up a force-pushed head.\n      const sandbox = (await ctx.getSandbox()) as unknown as S;\n      const tracking = `refs/remotes/origin/pr-${change.prNumber}`;\n      const git = `git -C ${repoPath}`;\n      const result = await options.withCredential(\n        sandbox,\n        repository.slug,\n        `${git} fetch --depth ${depth} origin +refs/pull/${change.prNumber}/head:${tracking} && ${git} checkout -B pr ${tracking}`,\n      );\n      if (typeof result.exitCode === \"number\" && result.exitCode !== 0) {\n        return {\n          fetched: false,\n          reason: `git fetch of pull request ${change.prNumber} failed: ${(result.stderr ?? \"\").trim()}`,\n        };\n      }\n\n      const head = await sandbox.run({ command: `${git} rev-parse HEAD` });\n      return {\n        fetched: true,\n        prNumber: change.prNumber,\n        prUrl: change.prUrl,\n        branch: \"pr\",\n        headSha: head.stdout.trim(),\n      };\n    },\n  });\n}\n","import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { dispatchTask } from \"../dispatch\";\nimport { changeIdSchema, repositoryIdSchema, taskIdSchema } from \"../schema/id\";\nimport type { FactoryStores } from \"../store/engine\";\n\nexport interface InvokeAgentOptions {\n  /** The factory task kind the handoff creates, e.g. \"verification\". */\n  kind: string;\n  /** Model-facing description of what the target agent does and when to invoke it. */\n  description: string;\n  /**\n   * Base URL of the target agent's eve transport, e.g.\n   * `https://factory.example.com/eve/agents/verifier`. Resolved at call time so\n   * a deployment can derive it from its own origin.\n   */\n  targetUrl: () => string;\n  /** Bearer token for the target agent's eve channel, when it requires auth. */\n  token?: () => Promise<string | undefined>;\n  /** Extra headers for the session request, e.g. a deployment protection bypass. */\n  headers?: () => Record<string, string> | Promise<Record<string, string>>;\n  fetch?: typeof fetch;\n}\n\n/**\n * A tool that lets one agent hand work to another, NMA-style: the caller\n * decides to invoke; trusted code owns the how. The handoff is recorded as a\n * factory task (single-winner dispatch, receipts), then a fresh session is\n * started on the target agent carrying only the task id — never the caller's\n * context. The session start is create-once on the task id, so a retried\n * tool call cannot start a second session.\n */\nexport function invokeAgentTool(stores: FactoryStores, options: InvokeAgentOptions) {\n  const doFetch = options.fetch ?? fetch;\n  return defineTool({\n    description: `${options.description} Hands the work to a separate agent in a fresh session; you will not see its reasoning. Returns the handoff task id.`,\n    inputSchema: z.object({\n      repositoryIds: z.array(repositoryIdSchema).min(1),\n      parentTaskId: taskIdSchema.optional().describe(\"Your own task, when this work continues it.\"),\n      changeId: changeIdSchema.optional().describe(\"The change the target agent should work on.\"),\n      channel: z.string().min(1).describe(\"Reply connector, e.g. github.\"),\n      address: z.string().min(1).describe(\"Reply address, e.g. acme/web#41.\"),\n      brief: z\n        .string()\n        .min(1)\n        .max(4000)\n        .describe(\"What the target agent needs to know. Facts and references only, not your reasoning.\"),\n    }),\n    async execute(input) {\n      const task = await stores.tasks.create({\n        repositoryIds: input.repositoryIds,\n        kind: options.kind,\n        origin:\n          input.parentTaskId === undefined ? { operator: \"factory\" } : { parentTaskId: input.parentTaskId },\n        replyTo: { channel: input.channel, address: input.address },\n      });\n\n      const running = await dispatchTask(stores, task.id, {\n        // Handoffs are launched by the caller, not the sweep, so a refused\n        // session must fail now — no sweep would pick a re-queued handoff up.\n        maxLaunchAttempts: 1,\n        launch: async (dispatched) => {\n          const headers: Record<string, string> = {\n            \"content-type\": \"application/json\",\n            ...(await options.headers?.()),\n          };\n          const token = await options.token?.();\n          if (token !== undefined) {\n            headers.authorization = `Bearer ${token}`;\n          }\n          const message = [\n            `You are assigned factory task ${dispatched.id}.`,\n            input.changeId === undefined ? null : `Change under review: ${input.changeId}.`,\n            `Reply address: ${input.channel} ${input.address}.`,\n            \"\",\n            input.brief,\n            \"\",\n            \"Read the task with get_task first, do the work, and record the outcome with your factory tools.\",\n          ]\n            .filter((line) => line !== null)\n            .join(\"\\n\");\n          const response = await doFetch(`${options.targetUrl()}/eve/v1/session`, {\n            method: \"POST\",\n            headers,\n            body: JSON.stringify({ message, operationId: `factory-task:${dispatched.id}` }),\n          });\n          if (!response.ok) {\n            throw new Error(`target agent refused the session: ${response.status}`);\n          }\n        },\n      });\n\n      return { taskId: running.id, kind: running.kind, state: running.state };\n    },\n  });\n}\n","import { answerReviewComment, readReviewComment } from \"../github\";\nimport { changeIdSchema } from \"../schema/id\";\nimport type { FactoryStores } from \"../store/engine\";\nimport { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\n\nexport interface ReviewCommentToolOptions {\n  tokenForRepository: (repository: string) => Promise<string>;\n  fetch?: typeof globalThis.fetch;\n}\n\nexport function reviewCommentTools(stores: FactoryStores, options: ReviewCommentToolOptions) {\n  const commentInputSchema = z.object({\n    changeId: changeIdSchema.describe(\"The change under review, from your starting message.\"),\n    commentId: z.number().int().positive().describe(\"The GitHub review comment id.\"),\n  });\n\n  async function context(changeId: z.infer<typeof changeIdSchema>) {\n    const change = await stores.changes.get(changeId);\n    if (change === null) {\n      throw new Error(`change ${changeId} does not exist`);\n    }\n    if (change.state !== \"verifying\" && change.state !== \"ready\") {\n      throw new Error(`change is ${change.state}, not open for review`);\n    }\n    const repository = await stores.repositories.get(change.repositoryId);\n    if (repository === null) {\n      throw new Error(`repository ${change.repositoryId} does not exist`);\n    }\n    return {\n      repository: repository.slug,\n      token: await options.tokenForRepository(repository.slug),\n      fetch: options.fetch,\n      pullRequestNumber: change.prNumber,\n    };\n  }\n\n  return {\n    read_review_comment: defineTool({\n      description:\n        \"Read an inline review comment on a change under verification or ready for human review. By default this refuses to return comments from people without write access to the repository.\",\n      inputSchema: commentInputSchema,\n      async execute({ changeId, commentId }) {\n        return readReviewComment({ ...(await context(changeId)), commentId });\n      },\n    }),\n    answer_review_comment: defineTool({\n      description:\n        \"Reply to an inline review comment on a change under verification or ready for human review. The repository and pull request come from the ledger, and the comment author must have write access.\",\n      inputSchema: commentInputSchema.extend({\n        body: z.string().min(1).max(5000).describe(\"The Markdown reply to post.\"),\n      }),\n      async execute({ changeId, commentId, body }) {\n        return answerReviewComment({ ...(await context(changeId)), commentId, body });\n      },\n    }),\n  };\n}\n","import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { changeEvidenceSchema, levelSchema } from \"../schema/change\";\nimport { changeIdSchema, taskIdSchema } from \"../schema/id\";\nimport type { FactoryStores } from \"../store/engine\";\n\n/**\n * The verifier's outcome tool. Writes evidence onto the change and moves it\n * to ready only when the verdict is pass; a failed verdict leaves the change\n * verifying with the evidence recorded, and the verification task itself\n * ends with a receipt either way. The change's own code_change task follows\n * the verdict too: succeeded on pass, failed on fail with the verifier's\n * summary as the reason, so the ledger never shows a verified-and-rejected fix\n * as still in progress. Fail closed: the agent cannot mark a change ready\n * without supplying every evidence field.\n */\nexport function recordVerificationTool(stores: FactoryStores) {\n  return defineTool({\n    description:\n      \"Record the outcome of a verification task: the evidence you gathered and whether the change passed. Pass moves the change to ready for human review; fail keeps it out of review.\",\n    inputSchema: z.object({\n      taskId: taskIdSchema.describe(\"Your verification task.\"),\n      changeId: changeIdSchema.describe(\"The change you verified.\"),\n      verdict: z.enum([\"pass\", \"fail\"]),\n      evidence: changeEvidenceSchema,\n      confidence: levelSchema.describe(\"How certain you are in the verdict.\"),\n      summary: z.string().min(1).max(2000).describe(\"What you checked and what you found.\"),\n    }),\n    async execute({ taskId, changeId, verdict, evidence, confidence, summary }) {\n      const change = await stores.changes.get(changeId);\n      if (change === null) {\n        return { recorded: false as const, reason: `change ${changeId} does not exist` };\n      }\n      if (change.state !== \"verifying\") {\n        return {\n          recorded: false as const,\n          reason: `change is ${change.state}, not verifying; nothing to record`,\n        };\n      }\n\n      const task = await stores.tasks.get(taskId);\n      if (task === null || task.kind !== \"verification\") {\n        return { recorded: false as const, reason: `${taskId} is not a verification task` };\n      }\n\n      let updatedChange = change;\n      if (verdict === \"pass\") {\n        updatedChange = await stores.changes.transition(changeId, \"ready\", {\n          patch: { evidence, confidence },\n          reason: summary,\n        });\n      }\n\n      // The task machine has no running -> succeeded edge; a passing\n      // verification walks running -> verifying -> succeeded, a failing one\n      // ends directly at failed.\n      let finished;\n      if (verdict === \"pass\") {\n        await stores.tasks.transition(taskId, \"verifying\", { reason: summary });\n        finished = await stores.tasks.transition(taskId, \"succeeded\");\n      } else {\n        finished = await stores.tasks.transition(taskId, \"failed\", { reason: summary });\n      }\n\n      // The fix task that produced the change. It sat in verifying while the\n      // verifier worked; settle it the same way. A missing or already-settled\n      // parent is not the verifier's problem, so tolerate it.\n      if (change.taskId !== undefined) {\n        const parent = await stores.tasks.get(change.taskId);\n        if (parent?.state === \"verifying\") {\n          await stores.tasks\n            .transition(\n              change.taskId,\n              verdict === \"pass\" ? \"succeeded\" : \"failed\",\n              verdict === \"pass\" ? {} : { reason: `verification failed: ${summary}` },\n            )\n            .catch(() => undefined);\n        }\n      }\n\n      return {\n        recorded: true as const,\n        verdict,\n        changeState: updatedChange.state,\n        taskState: finished.state,\n      };\n    },\n  });\n}\n","import { defineHook } from \"eve/hooks\";\nimport { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { changeIdSchema, repositoryIdSchema, signalIdSchema, taskIdSchema } from \"../schema/id\";\nimport { levelSchema } from \"../schema/change\";\nimport { vocabularySchema } from \"../schema/common\";\nimport { taskQuestionSchema } from \"../schema/task\";\nimport type { FactoryStores } from \"../store/engine\";\n\nconst decidedOutcomeSchema = z.enum([\n  \"accepted\",\n  \"duplicate\",\n  \"unactionable\",\n  \"low_confidence\",\n  \"ignored\",\n]);\n\nconst recordChangeInputSchema = z.object({\n  taskId: taskIdSchema,\n  repositoryId: repositoryIdSchema,\n  prNumber: z.number().int().min(1),\n  prUrl: z.url(),\n  risk: levelSchema.describe(\"Blast radius of the change if it is wrong.\"),\n  confidence: levelSchema.describe(\"How certain you are the change is correct.\"),\n  summary: z.string().min(1).describe(\"One-sentence description of the change.\"),\n});\n\nexport type RecordChangeInput = z.infer<typeof recordChangeInputSchema>;\n\nexport type GateVerdict = { ok: true } | { ok: false; reason: string };\n\nexport interface FactoryToolsOptions {\n  /**\n   * Pre-action gate for record_change, run as an eve approval policy before\n   * the tool executes. Refusals reach the model as a denial with the reason.\n   * Gates must fail closed: when they cannot verify, they refuse.\n   */\n  recordChangeGate?: (input: RecordChangeInput) => Promise<GateVerdict>;\n}\n\n/**\n * The factory's store operations wrapped as eve tools. Expose a tool to an\n * agent by re-exporting it from a file under agent/tools/, e.g.\n * `export default factoryTools(stores).get_task;`. Every write goes through\n * the engine, so agents inherit transition legality and receipts.\n */\nexport function factoryTools(stores: FactoryStores, options: FactoryToolsOptions = {}) {\n  const recordChangeGate = options.recordChangeGate;\n  return {\n    get_task: defineTool({\n      description:\n        \"Read one factory task by id: its kind, state, repositories, origin, and results.\",\n      inputSchema: z.object({ taskId: taskIdSchema }),\n      async execute({ taskId }) {\n        const task = await stores.tasks.get(taskId);\n        return task ?? { found: false as const, taskId };\n      },\n    }),\n\n    decide_signal: defineTool({\n      description:\n        \"Record the triage decision for a pending signal. A signal is decided exactly once.\",\n      inputSchema: z.object({\n        signalId: signalIdSchema,\n        outcome: decidedOutcomeSchema,\n        reason: z.string().min(1).describe(\"Why this outcome was chosen.\"),\n        detail: z\n          .string()\n          .min(1)\n          .optional()\n          .describe(\"Severity if accepted, or the duplicate-of signal id.\"),\n      }),\n      execute({ signalId, outcome, reason, detail }) {\n        return stores.signals.decide(signalId, outcome, { reason, detail });\n      },\n    }),\n\n    record_change: defineTool({\n      description:\n        \"Record the pull request produced for a code_change task. Creates the change, links it to the task, and moves the task to verifying.\",\n      inputSchema: recordChangeInputSchema,\n      ...(recordChangeGate === undefined\n        ? {}\n        : {\n            approval: async ({ toolInput }: { toolInput?: unknown }) => {\n              const parsed = recordChangeInputSchema.safeParse(toolInput);\n              if (!parsed.success) {\n                return {\n                  type: \"denied\" as const,\n                  reason: \"record_change input is malformed; fix the arguments and retry\",\n                };\n              }\n              const verdict = await recordChangeGate(parsed.data);\n              return verdict.ok\n                ? (\"not-applicable\" as const)\n                : { type: \"denied\" as const, reason: verdict.reason };\n            },\n          }),\n      async execute({ taskId, repositoryId, prNumber, prUrl, risk, confidence, summary }) {\n        const change = await stores.changes.create({\n          repositoryId,\n          taskId,\n          prNumber,\n          prUrl,\n          author: \"factory\",\n          risk,\n          confidence,\n          evidence: {\n            reproVerified: false,\n            testsAdded: 0,\n            checksGreen: false,\n            attackPassed: false,\n            scopeMatches: false,\n          },\n        });\n        const task = await stores.tasks.transition(taskId, \"verifying\", {\n          patch: { changeId: change.id },\n          reason: summary,\n        });\n        return { change, task };\n      },\n    }),\n\n    finish_task: defineTool({\n      description:\n        \"Mark your task finished with a summary, for task kinds that have no other outcome tool (for example a security_scan). Not for code_change or verification tasks: those end with record_change and record_verification.\",\n      inputSchema: z.object({\n        taskId: taskIdSchema,\n        summary: z.string().min(1).max(4000).describe(\"What you did and found, for the ledger.\"),\n      }),\n      async execute({ taskId, summary }) {\n        const task = await stores.tasks.get(taskId);\n        if (task === null) {\n          return { finished: false as const, reason: `${taskId} does not exist` };\n        }\n        if (task.kind === \"code_change\" || task.kind === \"verification\") {\n          return { finished: false as const, reason: `${task.kind} tasks end with their own outcome tool` };\n        }\n        if (task.state !== \"running\") {\n          return { finished: false as const, reason: `task is ${task.state}, not running` };\n        }\n        // The task machine has no running -> succeeded edge; walk through verifying.\n        await stores.tasks.transition(taskId, \"verifying\", { reason: summary });\n        const finished = await stores.tasks.transition(taskId, \"succeeded\", { reason: summary });\n        return { finished: true as const, taskState: finished.state };\n      },\n    }),\n\n    report_blocked: defineTool({\n      description:\n        \"Mark a running task as needing a human because the work cannot continue without help.\",\n      inputSchema: z.object({\n        taskId: taskIdSchema,\n        reason: z.string().min(1).describe(\"What is blocking, written for the human.\"),\n      }),\n      execute({ taskId, reason }) {\n        return stores.tasks.transition(taskId, \"needs_human\", { reason });\n      },\n    }),\n\n    ask_question: defineTool({\n      description:\n        \"Raise a question a human operator must answer. Creates a question task that waits for the answer.\",\n      inputSchema: z.object({\n        repositoryIds: z.array(repositoryIdSchema).min(1),\n        parentTaskId: taskIdSchema\n          .optional()\n          .describe(\"Task the answer unblocks, when there is one.\"),\n        channel: z.string().min(1).describe(\"Reply connector, e.g. github.\"),\n        address: z.string().min(1).describe(\"Reply address, e.g. acme/web#41.\"),\n        question: taskQuestionSchema.omit({ answer: true, answeredBy: true }),\n      }),\n      async execute({ repositoryIds, parentTaskId, channel, address, question }) {\n        const task = await stores.tasks.create({\n          repositoryIds,\n          kind: \"question\",\n          origin: parentTaskId === undefined ? { operator: \"factory\" } : { parentTaskId },\n          replyTo: { channel, address },\n          question,\n        });\n        return stores.tasks.transition(task.id, \"needs_human\");\n      },\n    }),\n\n    append_receipt: defineTool({\n      description:\n        \"Append one immutable audit receipt for an event worth remembering. Receipts can never be edited or deleted.\",\n      inputSchema: z.object({\n        repositoryIds: z.array(repositoryIdSchema).min(1),\n        taskId: taskIdSchema.optional(),\n        changeId: changeIdSchema.optional(),\n        kind: vocabularySchema.describe(\"What the receipt is about, e.g. investigation.\"),\n        state: vocabularySchema.describe(\"What happened, e.g. flag_ramped.\"),\n        reason: z.string().min(1).max(2000).optional(),\n        dedupeKey: z\n          .string()\n          .min(1)\n          .optional()\n          .describe(\"Same key twice records one receipt instead of two.\"),\n      }),\n      execute(input) {\n        return stores.receipts.append(input);\n      },\n    }),\n  };\n}\n\nexport type FactoryTools = ReturnType<typeof factoryTools>;\n\n/**\n * Observe-only eve hooks that keep the ledger honest about session outcomes.\n * Mount by re-exporting from agent/hooks/, e.g.\n * `export default factoryHooks(stores).factory;`.\n *\n * turn.completed: a turn that ends while its task is still running means the\n * agent finished talking without recording an outcome; the task moves to\n * needs_human instead of rotting. The task is found by the session's\n * channel address, which dispatch set from the task's replyTo.\n */\nexport function factoryHooks(stores: FactoryStores) {\n  return {\n    factory: defineHook({\n      events: {\n        async \"turn.completed\"(_event, ctx) {\n          const address = ctx.channel.continuationToken;\n          if (address === undefined) {\n            return;\n          }\n          const tasks = await stores.tasks.list();\n          const abandoned = tasks.filter(\n            (task) => task.state === \"running\" && task.replyTo.address === address,\n          );\n          for (const task of abandoned) {\n            // A hook throw fails the turn, so a lost race here is swallowed;\n            // the task either moved legally elsewhere or the sweep catches it.\n            await stores.tasks\n              .transition(task.id, \"needs_human\", {\n                reason: \"agent turn ended without recording an outcome\",\n              })\n              .catch(() => undefined);\n          }\n        },\n      },\n    }),\n  };\n}\n\nexport type FactoryHooks = ReturnType<typeof factoryHooks>;\n\nexport {\n  mergeConflictPayloadSchema,\n  mergeConflictTools,\n  type MergeConflictPayload,\n  type MergeConflictToolOptions,\n} from \"./conflict\";\nexport { deepsecScanTool, findingFromDeepsec, type DeepsecScanOptions } from \"./deepsec\";\nexport { recordFinding, recordFindingTool, type RecordFindingOptions, type RecordFindingResult } from \"./finding\";\nexport {\n  fetchPullRequestTool,\n  type CommandSandbox,\n  type FetchPullRequestOptions,\n  type FetchPullRequestResult,\n} from \"./fetch\";\nexport { invokeAgentTool, type InvokeAgentOptions } from \"./invoke\";\nexport { reviewCommentTools, type ReviewCommentToolOptions } from \"./review\";\nexport { recordVerificationTool } from \"./verification\";\n"],"mappings":";;;;;;;AAMA,MAAM,eAAe,EAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;AACtD,MAAM,kBAAkB,EAAE,OAAO,CAAC,CAAC,MAAM,+BAA+B,CAAC,CAAC,QAAQ,UAAU,CAAC,MAAM,SAAS,IAAI,CAAC;AAEjH,MAAa,6BAA6B,EAAE,aAAa;CACvD,YAAY,EAAE,OAAO,CAAC,CAAC,MAAM,oCAAoC;CACjE,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACpC,OAAO,EAAE,IAAI;CACb,YAAY,gBAAgB,QAAQ,UAAU,MAAM,WAAW,UAAU,CAAC;CAC1E,SAAS;CACT,YAAY;CACZ,SAAS;AACX,CAAC;AAaD,SAAgB,mBACd,QACA,SACA;CACA,MAAM,WAAW,QAAQ,YAAY;CAErC,eAAe,QAAQ,QAAsC;EAC3D,MAAM,OAAO,MAAM,OAAO,MAAM,IAAI,MAAM;EAC1C,IAAI,SAAS,MAAM,MAAM,IAAI,MAAM,QAAQ,OAAO,gBAAgB;EAClE,IAAI,KAAK,SAAS,kBAAkB,MAAM,IAAI,MAAM,QAAQ,OAAO,MAAM,KAAK,KAAK,qBAAqB;EACxG,IAAI,KAAK,UAAU,WAAW,MAAM,IAAI,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM,cAAc;EAC5F,IAAI,KAAK,OAAO,aAAa,KAAA,GAAW,MAAM,IAAI,MAAM,QAAQ,OAAO,wBAAwB;EAC/F,MAAM,SAAS,MAAM,OAAO,QAAQ,IAAI,KAAK,OAAO,QAAQ;EAC5D,IAAI,WAAW,QAAQ,OAAO,WAAW,yBACvC,MAAM,IAAI,MAAM,QAAQ,OAAO,qCAAqC;EAEtE,OAAO;GAAE;GAAM,UAAU,2BAA2B,MAAM,OAAO,OAAO;EAAE;CAC5E;CAEA,OAAO;EACL,sBAAsB,WAAW;GAC/B,aACE;GACF,aAAa,EAAE,OAAO,EAAE,QAAQ,aAAa,CAAC;GAC9C,MAAM,QAAQ,EAAE,UAAU,KAAK;IAC7B,MAAM,EAAE,aAAa,MAAM,QAAQ,MAAM;IACzC,MAAM,UAAW,MAAM,IAAI,WAAW;IACtC,MAAM,MAAM,UAAU;IACtB,MAAM,UAAU,mCAAmC,SAAS;IAC5D,MAAM,UAAU,qCAAqC,SAAS;IAC9D,MAAM,QAAQ,MAAM,QAAQ,eAC1B,SACA,SAAS,YACT,GAAG,IAAI,uCAAuC,SAAS,SAAS,QAAQ,QAAQ,eAAe,SAAS,WAAW,GAAG,SACxH;IACA,IAAI,OAAO,MAAM,aAAa,YAAY,MAAM,aAAa,GAC3D,MAAM,IAAI,MAAM,kCAAkC,MAAM,UAAU,GAAA,CAAI,KAAK,GAAG;IAKhF,MAAM,CAAC,SAAS,YAAW,MAHL,QAAQ,IAAI,EAChC,SAAS,GAAG,IAAI,aAAa,QAAQ,MAAM,IAAI,aAAa,UAC9D,CAAC,EAAA,CACkC,OAAO,KAAK,CAAC,CAAC,MAAM,IAAI;IAC3D,IAAI,YAAY,SAAS,WAAW,YAAY,SAAS,SACvD,MAAM,IAAI,MAAM,4FAA4F;IAE9G,MAAM,QAAQ,IAAI,EAAE,SAAS,GAAG,IAAI,2BAA2B,UAAU,CAAC;IAC1E,MAAM,QAAQ,MAAM,QAAQ,IAAI,EAAE,SAAS,GAAG,IAAI,6BAA6B,UAAU,CAAC;IAE1F,MAAM,mBAAkB,MADA,QAAQ,IAAI,EAAE,SAAS,GAAG,IAAI,mCAAmC,CAAC,EAAA,CACxD,OAAO,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,OAAO;IAC1E,IAAI,gBAAgB,WAAW,GAC7B,MAAM,IAAI,MACR,OAAO,MAAM,aAAa,YAAY,MAAM,aAAa,IACrD,yCAAyC,MAAM,UAAU,GAAA,CAAI,KAAK,MAClE,4CACN;IAEF,OAAO;KAAE,GAAG;KAAU;IAAgB;GACxC;EACF,CAAC;EACD,0BAA0B,WAAW;GACnC,aACE;GACF,aAAa,EAAE,OAAO;IACpB,QAAQ;IACR,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI;GACrC,CAAC;GACD,MAAM,QAAQ,EAAE,QAAQ,WAAW,KAAK;IACtC,MAAM,EAAE,aAAa,MAAM,QAAQ,MAAM;IACzC,MAAM,UAAW,MAAM,IAAI,WAAW;IACtC,MAAM,MAAM,UAAU;IAEtB,KAAI,MADgB,QAAQ,IAAI,EAAE,SAAS,GAAG,IAAI,qBAAqB,CAAC,EAAA,CAC9D,OAAO,KAAK,MAAM,IAAI,MAAM,IAAI,MAAM,kDAAkD;IAElG,KAAI,MADqB,QAAQ,IAAI,EAAE,SAAS,GAAG,IAAI,mCAAmC,CAAC,EAAA,CAC5E,OAAO,KAAK,MAAM,IAAI,MAAM,IAAI,MAAM,mCAAmC;IACxF,MAAM,OAAO,MAAM,QAAQ,eACzB,SACA,SAAS,YACT,GAAG,IAAI,sCAAsC,SAAS,WAAW,GAAG,SAAS,QAAQ,0BAA0B,SAAS,YAC1H;IACA,IAAI,OAAO,KAAK,aAAa,YAAY,KAAK,aAAa,GACzD,MAAM,IAAI,MAAM,0CAA0C,KAAK,UAAU,GAAA,CAAI,KAAK,GAAG;IAEvF,MAAM,OAAO,MAAM,WAAW,QAAQ,aAAa,EAAE,QAAQ,QAAQ,CAAC;IACtE,MAAM,OAAO,MAAM,WAAW,QAAQ,aAAa,EAAE,QAAQ,QAAQ,CAAC;IACtE,OAAO;KAAE,SAAS;KAAe,UAAU,SAAS;KAAU,OAAO,SAAS;IAAM;GACtF;EACF,CAAC;CACH;AACF;;;AC7GA,SAAS,gBAAgB,OAAyB;CAChD,OACE,iBAAiB,UAChB,MAAM,SAAS,0BAA0B,MAAM,SAAS;AAE7D;;;;;;;;;AAqBA,eAAsB,cACpB,QACA,cACA,SACA,UAAgC,CAAC,GACH;CAC9B,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,SAAS,QAAQ,YAAY;CAEnC,IAAI,MADqB,OAAO,aAAa,IAAI,YAAY,MAC1C,MACjB,OAAO;EAAE,UAAU;EAAO,QAAQ,cAAc,aAAa;CAAiB;CAGhF,MAAM,cAAc,mBAAmB,cAAc,OAAO;CAC5D,MAAM,SAAS,MAAM,OAAO,QAAQ,OAAO;EACzC;EACA;EACA,YAAY;EACZ,SAAS;GAAE,SAAS;GAAW,SAAS;EAAY;EACpD,SAAS;CACX,CAAC;CACD,IAAI,OAAO,YAAY,WACrB,OAAO;EAAE,UAAU;EAAO,WAAW;EAAM,UAAU,OAAO;EAAI,QAAQ,uBAAuB,OAAO;CAAK;CAK7G,IAAI;EACF,MAAM,OAAO,QAAQ,OAAO,OAAO,IAAI,YAAY;GACjD,QAAQ,QAAQ;GAChB,QAAQ,GAAG,QAAQ,QAAQ,UAAU,gBAAgB,QAAQ,aAAa,MAAM,MAAM,QAAQ,aAAa;EAC7G,CAAC;CACH,SAAS,OAAO;EAGd,IAAI,gBAAgB,KAAK,GAAG;GAC1B,MAAM,UAAU,MAAM,OAAO,QAAQ,IAAI,OAAO,EAAE;GAClD,IAAI,YAAY,QAAQ,QAAQ,YAAY,WAC1C,OAAO;IAAE,UAAU;IAAO,WAAW;IAAM,UAAU,OAAO;IAAI,QAAQ,uBAAuB,OAAO;GAAK;EAE/G;EACA,MAAM;CACR;CAEA,MAAM,WAAW,iBAAiB,QAAQ;EAAE;EAAQ,MAAM;EAAe,UAAU,QAAQ;CAAS,CAAC;CACrG,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO;EACrC,eAAe,CAAC,YAAY;EAC5B,MAAM;EACN,QAAQ,EAAE,UAAU,OAAO,GAAG;EAC9B,SAAS,OAAO;EAChB,GAAI,WAAW,EAAE,UAAU,WAAoB,IAAI,CAAC;CACtD,CAAC;CAED,OAAO;EAAE,UAAU;EAAM,UAAU,OAAO;EAAI,QAAQ,KAAK;EAAI,UAAU,WAAW,aAAa;CAAe;AAClH;;;;;;;;;AAUA,SAAgB,kBAAkB,QAAuB,UAAgC,CAAC,GAAG;CAC3F,OAAO,WAAW;EAChB,aACE;EACF,aAAa,EAAE,OAAO;GACpB,cAAc;GACd,SAAS;EACX,CAAC;EACD,QAAQ,EAAE,cAAc,WAAW;GACjC,OAAO,cAAc,QAAQ,cAAc,SAAS,OAAO;EAC7D;CACF,CAAC;AACH;;;;ACtEA,MAAM,uBAAuB,EAAE,YAAY;CACzC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC7B,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,UAAU,EACP,YAAY;EACX,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;EACrC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;EACvD,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;EACrC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;EAChC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,CAAC,CAAC,CACD,SAAS;AACd,CAAC;AAED,MAAM,sBAAsB,EAAE,MAAM,CAClC,EAAE,MAAM,oBAAoB,GAC5B,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,EAAE,CAAC,CAAC,CAAC,WAAW,UAAU,MAAM,QAAQ,CAChG,CAAC;AAED,MAAM,qBAAsD;CAC1D,UAAU;CACV,MAAM;CACN,QAAQ;CACR,UAAU;CACV,KAAK;CACL,KAAK;AACP;;AAGA,SAAgB,mBAAmB,KAAoD;CACrF,MAAM,OAAO,IAAI,YAAY,CAAC;CAC9B,MAAM,cAAc,KAAK,cAAc,GAAA,CAAI,YAAY;CACvD,MAAM,OAAO,KAAK,cAAc;CAChC,MAAM,UAAU,KAAK,gBAAgB,KAAA,IAAY,KAAA,IAAY,KAAK,IAAI,GAAG,KAAK,WAAW;CACzF,OAAO,cAAc,MAAM;EACzB,OAAO,IAAI,MAAM,QAAQ,oBAAoB,EAAE,CAAC,CAAC,MAAM,GAAG,GAAG;EAC7D,MAAM,IAAI,YAAY,MAAM,GAAG,GAAI;EACnC,GAAI,KAAK,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,MAAM,GAAG,GAAG,EAAE;EAC3E,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;EACrC,GAAI,YAAY,KAAA,KAAa,YAAY,OAAO,CAAC,IAAI,EAAE,QAAQ;EAC/D,UAAU,mBAAmB,IAAI,SAAS,YAAY,MAAM;EAC5D,UAAU;EACV,cAAc;GAEZ,OAAO,eAAe,SAAS,cAAc;GAC7C,QAAQ;GACR,SAAS,WAAW,KAAK,YAAY,UAAU,QAAQ,cAAc,UAAU,aAAa,KAAK,UAAU,KAAA,IAAY,KAAK,SAAS,KAAK,MAAM,GAAG;GACnJ,aAAa;EACf;EACA,MAAM;EACN,GAAI,KAAK,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,SAAS;CACjE,CAAC;AACH;AAEA,MAAM,eAAe;;AAGrB,SAAS,eAAe,QAA+B;CACrD,MAAM,QAAQ,qCAAqC,KAAK,MAAM;CAC9D,OAAO,QAAQ,OAAO,KAAA,IAAY,OAAO,OAAO,MAAM,EAAE;AAC1D;;AAGA,SAAS,KAAK,QAAgB,QAAQ,GAAW;CAG/C,OAAO,OACJ,WAAW,sBAAM,EAAE,CAAC,CACpB,MAAM,IAAI,CAAC,CACX,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAC1B,QAAQ,SAAS,SAAS,EAAE,CAAC,CAC7B,MAAM,CAAC,KAAK,CAAC,CACb,KAAK,KAAK,CAAC,CACX,MAAM,GAAG,GAAG;AACjB;;;;;;;;AASA,SAAgB,gBAA0C,QAAuB,SAAgC;CAC/G,MAAM,WAAW,QAAQ,YAAY;CACrC,MAAM,YAAY,QAAQ,iBAAiB;CAC3C,MAAM,UAAU,QAAQ,WAAW;CACnC,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,gBAAgB,QAAQ,iBAAiB;CAC/C,MAAM,cAAc,QAAQ,eAAe;CAC3C,MAAM,SAAS,QAAQ,kBAAkB,KAAA,IAAY,CAAC,IAAI,CAAC,QAAQ,aAAa;CAChF,MAAM,cAAc,QAAQ,eAAe;CAE3C,OAAO,WAAW;EAChB,aACE;EACF,aAAa,EAAE,OAAO;GACpB,cAAc;GACd,OAAO,EACJ,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,SAAS,CAAC,CACV,SAAS,oGAAoG;EAClH,CAAC;EACD,MAAM,QAAQ,EAAE,cAAc,SAAS,KAAK;GAC1C,MAAM,aAAa,MAAM,OAAO,aAAa,IAAI,YAAY;GAC7D,IAAI,eAAe,MACjB,OAAO;IAAE,SAAS;IAAgB,QAAQ,cAAc,aAAa;GAAiB;GAExF,MAAM,UAAW,MAAM,IAAI,WAAW;GACtC,MAAM,YAAY,WAAW,KAAK,QAAQ,gBAAgB,GAAG;GAC7D,MAAM,YAAY,KAAK,IAAI;GAI3B,MAAM,QAAQ,OAAO,OAAe,WAAkC;IACpE,MAAM,OAAO,SAAS,OAAO;KAC3B,eAAe,CAAC,YAAY;KAC5B,MAAM;KACN;KACA,OAAO;KACP,QAAQ,GAAG,OAAO,IAAI,KAAK,OAAO,KAAK,IAAI,IAAI,aAAa,GAAI,EAAE;IACpE,CAAC;GACH;GACA,MAAM,MAAM,WAAW,WAAW,QAAQ,MAAM,WAAW,KAAK,IAAI,MAAM,GAAG,OAAO;GAIpF,MAAM,UAAU,MAAM,QAAQ,IAAI,EAChC,SAAS;IACP,GAAG;IACH;IACA,aAAa,UAAU;IACvB,oBAAoB,QAAQ,UAAU,UAAU,KAAK,SAAS,QAAQ,UAAU;IAChF,SAAS,UAAU;IACnB;IAKA,MAAM;IACN,iDAAiD;GACnD,CAAC,CAAC,KAAK,IAAI,EACb,CAAC;GACD,IAAI,OAAO,QAAQ,aAAa,YAAY,QAAQ,aAAa,GAAG;IAClE,MAAM,UAAU,QAAQ,UAAU,QAAQ,OAAA,CAAQ,KAAK,CAAC,CAAC,MAAM,KAAK;IACpE,MAAM,MAAM,UAAU,sBAAsB,OAAO,MAAM,IAAI,GAAG;IAChE,OAAO;KAAE,SAAS;KAAgB,QAAQ,wBAAwB;IAAS;GAC7E;GACA,MAAM,aAAa,eAAe,QAAQ,MAAM;GAChD,MAAM,MACJ,WACA,GAAG,eAAe,OAAO,gBAAgB,GAAG,WAAW,wBAAwB,IAAI,KAAK,GAAG,QAAQ,OAAO,IAAI,QAAQ,UAAU,IAAI,GACtI;GAIA,MAAM,cAAc,MAAM,QAAQ,oBAChC,SACA;IACE,GAAG;IACH;IACA,MAAM;IACN,oDAAoD,UAAU,WAAW,MAAM,WAAW,MAAM,oBAAoB,cAAc,iBAAiB,YAAY,WAAW,SAAS;IACnL,mDAAmD,UAAU,uBAAuB;GACtF,CAAC,CAAC,KAAK,IAAI,CACb;GACA,IAAI,OAAO,YAAY,aAAa,YAAY,YAAY,aAAa,GAAG;IAC1E,MAAM,UAAU,YAAY,UAAU,YAAY,OAAA,CAAQ,KAAK,CAAC,CAAC,MAAM,KAAK;IAC5E,MAAM,MAAM,UAAU,yBAAyB,OAAO,MAAM,IAAI,GAAG;IACnE,OAAO;KAAE,SAAS;KAAgB,QAAQ,2BAA2B;IAAS;GAChF;GAEA,MAAM,WAAW,MAAM,QAAQ,IAAI,EAAE,SAAS,OAAO,eAAe,CAAC;GACrE,IAAI;GACJ,IAAI;IACF,SAAS,KAAK,MAAM,SAAS,MAAM;GACrC,QAAQ;IACN,OAAO;KAAE,SAAS;KAAgB,QAAQ;IAAoC;GAChF;GACA,MAAM,MAAM,oBAAoB,UAAU,MAAM;GAChD,IAAI,CAAC,IAAI,SACP,OAAO;IAAE,SAAS;IAAgB,QAAQ,2CAA2C,IAAI,MAAM,OAAO,EAAE,EAAE,WAAW;GAAY;GAGnI,MAAM,UAA+D,CAAC;GACtE,KAAK,MAAM,SAAS,IAAI,MAAM;IAC5B,MAAM,UAAU,mBAAmB,KAAK;IACxC,QAAQ,KAAK;KAAE;KAAS,QAAQ,MAAM,cAAc,QAAQ,cAAc,SAAS,OAAO;IAAE,CAAC;GAC/F;GACA,MAAM,WAAW,QAAQ,QAAQ,EAAE,aAAa,OAAO,QAAQ;GAC/D,MAAM,MACJ,aACA,GAAG,QAAQ,OAAO,aAAa,SAAS,OAAO,wBAAwB,KAAK,GAAG,YAAY,OAAO,IAAI,YAAY,UAAU,MAAM,CAAC,GACrI;GACA,OAAO;IACL,SAAS;IACT,MAAM;IACN,OAAO,QAAQ;IACf,UAAU,SAAS;IACnB,YAAY,QAAQ,SAAS,SAAS;IACtC,kBAAkB,SAAS,QAAQ,EAAE,aAAa,OAAO,YAAY,OAAO,aAAa,UAAU,CAAC,CAAC;IACrG,UAAU,QAAQ,KAAK,EAAE,SAAS,cAAc;KAC9C,OAAO,QAAQ;KACf,UAAU,QAAQ;KAClB,MAAM,QAAQ;KACd,MAAM,QAAQ;KACd,GAAI,OAAO,WAAW;MAAE,QAAQ,OAAO;MAAQ,UAAU,OAAO;KAAS,IAAI,EAAE,WAAW,KAAK;IACjG,EAAE;GACJ;EACF;CACF,CAAC;AACH;;;;;;;;;;;ACrNA,SAAgB,qBACd,QACA,SACA;CACA,MAAM,WAAW,QAAQ,YAAY;CACrC,MAAM,QAAQ,QAAQ,SAAS;CAC/B,OAAO,WAAW;EAChB,aACE;EACF,aAAa,EAAE,OAAO,EACpB,UAAU,eAAe,SAAS,sDAAsD,EAC1F,CAAC;EACD,MAAM,QAAQ,EAAE,YAAY,KAAsC;GAChE,MAAM,SAAS,MAAM,OAAO,QAAQ,IAAI,QAAQ;GAChD,IAAI,WAAW,MACb,OAAO;IAAE,SAAS;IAAO,QAAQ,UAAU,SAAS;GAAiB;GAEvE,IAAI,OAAO,UAAU,eAAe,OAAO,UAAU,SACnD,OAAO;IAAE,SAAS;IAAO,QAAQ,aAAa,OAAO,MAAM;GAAyC;GAEtG,MAAM,aAAa,MAAM,OAAO,aAAa,IAAI,OAAO,YAAY;GACpE,IAAI,eAAe,MACjB,OAAO;IAAE,SAAS;IAAO,QAAQ,cAAc,OAAO,aAAa;GAAiB;GAMtF,MAAM,UAAW,MAAM,IAAI,WAAW;GACtC,MAAM,WAAW,0BAA0B,OAAO;GAClD,MAAM,MAAM,UAAU;GACtB,MAAM,SAAS,MAAM,QAAQ,eAC3B,SACA,WAAW,MACX,GAAG,IAAI,iBAAiB,MAAM,qBAAqB,OAAO,SAAS,QAAQ,SAAS,MAAM,IAAI,kBAAkB,UAClH;GACA,IAAI,OAAO,OAAO,aAAa,YAAY,OAAO,aAAa,GAC7D,OAAO;IACL,SAAS;IACT,QAAQ,6BAA6B,OAAO,SAAS,YAAY,OAAO,UAAU,GAAA,CAAI,KAAK;GAC7F;GAGF,MAAM,OAAO,MAAM,QAAQ,IAAI,EAAE,SAAS,GAAG,IAAI,iBAAiB,CAAC;GACnE,OAAO;IACL,SAAS;IACT,UAAU,OAAO;IACjB,OAAO,OAAO;IACd,QAAQ;IACR,SAAS,KAAK,OAAO,KAAK;GAC5B;EACF;CACF,CAAC;AACH;;;;;;;;;;;ACjEA,SAAgB,gBAAgB,QAAuB,SAA6B;CAClF,MAAM,UAAU,QAAQ,SAAS;CACjC,OAAO,WAAW;EAChB,aAAa,GAAG,QAAQ,YAAY;EACpC,aAAa,EAAE,OAAO;GACpB,eAAe,EAAE,MAAM,kBAAkB,CAAC,CAAC,IAAI,CAAC;GAChD,cAAc,aAAa,SAAS,CAAC,CAAC,SAAS,6CAA6C;GAC5F,UAAU,eAAe,SAAS,CAAC,CAAC,SAAS,6CAA6C;GAC1F,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,+BAA+B;GACnE,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,kCAAkC;GACtE,OAAO,EACJ,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,GAAI,CAAC,CACT,SAAS,qFAAqF;EACnG,CAAC;EACD,MAAM,QAAQ,OAAO;GACnB,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO;IACrC,eAAe,MAAM;IACrB,MAAM,QAAQ;IACd,QACE,MAAM,iBAAiB,KAAA,IAAY,EAAE,UAAU,UAAU,IAAI,EAAE,cAAc,MAAM,aAAa;IAClG,SAAS;KAAE,SAAS,MAAM;KAAS,SAAS,MAAM;IAAQ;GAC5D,CAAC;GAED,MAAM,UAAU,MAAM,aAAa,QAAQ,KAAK,IAAI;IAGlD,mBAAmB;IACnB,QAAQ,OAAO,eAAe;KAC5B,MAAM,UAAkC;MACtC,gBAAgB;MAChB,GAAI,MAAM,QAAQ,UAAU;KAC9B;KACA,MAAM,QAAQ,MAAM,QAAQ,QAAQ;KACpC,IAAI,UAAU,KAAA,GACZ,QAAQ,gBAAgB,UAAU;KAEpC,MAAM,UAAU;MACd,iCAAiC,WAAW,GAAG;MAC/C,MAAM,aAAa,KAAA,IAAY,OAAO,wBAAwB,MAAM,SAAS;MAC7E,kBAAkB,MAAM,QAAQ,GAAG,MAAM,QAAQ;MACjD;MACA,MAAM;MACN;MACA;KACF,CAAC,CACE,QAAQ,SAAS,SAAS,IAAI,CAAC,CAC/B,KAAK,IAAI;KACZ,MAAM,WAAW,MAAM,QAAQ,GAAG,QAAQ,UAAU,EAAE,kBAAkB;MACtE,QAAQ;MACR;MACA,MAAM,KAAK,UAAU;OAAE;OAAS,aAAa,gBAAgB,WAAW;MAAK,CAAC;KAChF,CAAC;KACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,qCAAqC,SAAS,QAAQ;IAE1E;GACF,CAAC;GAED,OAAO;IAAE,QAAQ,QAAQ;IAAI,MAAM,QAAQ;IAAM,OAAO,QAAQ;GAAM;EACxE;CACF,CAAC;AACH;;;ACpFA,SAAgB,mBAAmB,QAAuB,SAAmC;CAC3F,MAAM,qBAAqB,EAAE,OAAO;EAClC,UAAU,eAAe,SAAS,sDAAsD;EACxF,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,+BAA+B;CACjF,CAAC;CAED,eAAe,QAAQ,UAA0C;EAC/D,MAAM,SAAS,MAAM,OAAO,QAAQ,IAAI,QAAQ;EAChD,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,UAAU,SAAS,gBAAgB;EAErD,IAAI,OAAO,UAAU,eAAe,OAAO,UAAU,SACnD,MAAM,IAAI,MAAM,aAAa,OAAO,MAAM,sBAAsB;EAElE,MAAM,aAAa,MAAM,OAAO,aAAa,IAAI,OAAO,YAAY;EACpE,IAAI,eAAe,MACjB,MAAM,IAAI,MAAM,cAAc,OAAO,aAAa,gBAAgB;EAEpE,OAAO;GACL,YAAY,WAAW;GACvB,OAAO,MAAM,QAAQ,mBAAmB,WAAW,IAAI;GACvD,OAAO,QAAQ;GACf,mBAAmB,OAAO;EAC5B;CACF;CAEA,OAAO;EACL,qBAAqB,WAAW;GAC9B,aACE;GACF,aAAa;GACb,MAAM,QAAQ,EAAE,UAAU,aAAa;IACrC,OAAO,kBAAkB;KAAE,GAAI,MAAM,QAAQ,QAAQ;KAAI;IAAU,CAAC;GACtE;EACF,CAAC;EACD,uBAAuB,WAAW;GAChC,aACE;GACF,aAAa,mBAAmB,OAAO,EACrC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,6BAA6B,EAC1E,CAAC;GACD,MAAM,QAAQ,EAAE,UAAU,WAAW,QAAQ;IAC3C,OAAO,oBAAoB;KAAE,GAAI,MAAM,QAAQ,QAAQ;KAAI;KAAW;IAAK,CAAC;GAC9E;EACF,CAAC;CACH;AACF;;;;;;;;;;;;;ACzCA,SAAgB,uBAAuB,QAAuB;CAC5D,OAAO,WAAW;EAChB,aACE;EACF,aAAa,EAAE,OAAO;GACpB,QAAQ,aAAa,SAAS,yBAAyB;GACvD,UAAU,eAAe,SAAS,0BAA0B;GAC5D,SAAS,EAAE,KAAK,CAAC,QAAQ,MAAM,CAAC;GAChC,UAAU;GACV,YAAY,YAAY,SAAS,qCAAqC;GACtE,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,sCAAsC;EACtF,CAAC;EACD,MAAM,QAAQ,EAAE,QAAQ,UAAU,SAAS,UAAU,YAAY,WAAW;GAC1E,MAAM,SAAS,MAAM,OAAO,QAAQ,IAAI,QAAQ;GAChD,IAAI,WAAW,MACb,OAAO;IAAE,UAAU;IAAgB,QAAQ,UAAU,SAAS;GAAiB;GAEjF,IAAI,OAAO,UAAU,aACnB,OAAO;IACL,UAAU;IACV,QAAQ,aAAa,OAAO,MAAM;GACpC;GAGF,MAAM,OAAO,MAAM,OAAO,MAAM,IAAI,MAAM;GAC1C,IAAI,SAAS,QAAQ,KAAK,SAAS,gBACjC,OAAO;IAAE,UAAU;IAAgB,QAAQ,GAAG,OAAO;GAA6B;GAGpF,IAAI,gBAAgB;GACpB,IAAI,YAAY,QACd,gBAAgB,MAAM,OAAO,QAAQ,WAAW,UAAU,SAAS;IACjE,OAAO;KAAE;KAAU;IAAW;IAC9B,QAAQ;GACV,CAAC;GAMH,IAAI;GACJ,IAAI,YAAY,QAAQ;IACtB,MAAM,OAAO,MAAM,WAAW,QAAQ,aAAa,EAAE,QAAQ,QAAQ,CAAC;IACtE,WAAW,MAAM,OAAO,MAAM,WAAW,QAAQ,WAAW;GAC9D,OACE,WAAW,MAAM,OAAO,MAAM,WAAW,QAAQ,UAAU,EAAE,QAAQ,QAAQ,CAAC;GAMhF,IAAI,OAAO,WAAW,KAAA,GAEhB;SAAA,MADiB,OAAO,MAAM,IAAI,OAAO,MAAM,EAAA,EACvC,UAAU,aACpB,MAAM,OAAO,MACV,WACC,OAAO,QACP,YAAY,SAAS,cAAc,UACnC,YAAY,SAAS,CAAC,IAAI,EAAE,QAAQ,wBAAwB,UAAU,CACxE,CAAC,CACA,YAAY,KAAA,CAAS;GAAA;GAI5B,OAAO;IACL,UAAU;IACV;IACA,aAAa,cAAc;IAC3B,WAAW,SAAS;GACtB;EACF;CACF,CAAC;AACH;;;AC/EA,MAAM,uBAAuB,EAAE,KAAK;CAClC;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,0BAA0B,EAAE,OAAO;CACvC,QAAQ;CACR,cAAc;CACd,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;CAChC,OAAO,EAAE,IAAI;CACb,MAAM,YAAY,SAAS,4CAA4C;CACvE,YAAY,YAAY,SAAS,4CAA4C;CAC7E,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,yCAAyC;AAC/E,CAAC;;;;;;;AAqBD,SAAgB,aAAa,QAAuB,UAA+B,CAAC,GAAG;CACrF,MAAM,mBAAmB,QAAQ;CACjC,OAAO;EACL,UAAU,WAAW;GACnB,aACE;GACF,aAAa,EAAE,OAAO,EAAE,QAAQ,aAAa,CAAC;GAC9C,MAAM,QAAQ,EAAE,UAAU;IAExB,OAAO,MADY,OAAO,MAAM,IAAI,MAAM,KAC3B;KAAE,OAAO;KAAgB;IAAO;GACjD;EACF,CAAC;EAED,eAAe,WAAW;GACxB,aACE;GACF,aAAa,EAAE,OAAO;IACpB,UAAU;IACV,SAAS;IACT,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,8BAA8B;IACjE,QAAQ,EACL,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,sDAAsD;GACpE,CAAC;GACD,QAAQ,EAAE,UAAU,SAAS,QAAQ,UAAU;IAC7C,OAAO,OAAO,QAAQ,OAAO,UAAU,SAAS;KAAE;KAAQ;IAAO,CAAC;GACpE;EACF,CAAC;EAED,eAAe,WAAW;GACxB,aACE;GACF,aAAa;GACb,GAAI,qBAAqB,KAAA,IACrB,CAAC,IACD,EACE,UAAU,OAAO,EAAE,gBAAyC;IAC1D,MAAM,SAAS,wBAAwB,UAAU,SAAS;IAC1D,IAAI,CAAC,OAAO,SACV,OAAO;KACL,MAAM;KACN,QAAQ;IACV;IAEF,MAAM,UAAU,MAAM,iBAAiB,OAAO,IAAI;IAClD,OAAO,QAAQ,KACV,mBACD;KAAE,MAAM;KAAmB,QAAQ,QAAQ;IAAO;GACxD,EACF;GACJ,MAAM,QAAQ,EAAE,QAAQ,cAAc,UAAU,OAAO,MAAM,YAAY,WAAW;IAClF,MAAM,SAAS,MAAM,OAAO,QAAQ,OAAO;KACzC;KACA;KACA;KACA;KACA,QAAQ;KACR;KACA;KACA,UAAU;MACR,eAAe;MACf,YAAY;MACZ,aAAa;MACb,cAAc;MACd,cAAc;KAChB;IACF,CAAC;IAKD,OAAO;KAAE;KAAQ,MAAA,MAJE,OAAO,MAAM,WAAW,QAAQ,aAAa;MAC9D,OAAO,EAAE,UAAU,OAAO,GAAG;MAC7B,QAAQ;KACV,CAAC;IACqB;GACxB;EACF,CAAC;EAED,aAAa,WAAW;GACtB,aACE;GACF,aAAa,EAAE,OAAO;IACpB,QAAQ;IACR,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,yCAAyC;GACzF,CAAC;GACD,MAAM,QAAQ,EAAE,QAAQ,WAAW;IACjC,MAAM,OAAO,MAAM,OAAO,MAAM,IAAI,MAAM;IAC1C,IAAI,SAAS,MACX,OAAO;KAAE,UAAU;KAAgB,QAAQ,GAAG,OAAO;IAAiB;IAExE,IAAI,KAAK,SAAS,iBAAiB,KAAK,SAAS,gBAC/C,OAAO;KAAE,UAAU;KAAgB,QAAQ,GAAG,KAAK,KAAK;IAAwC;IAElG,IAAI,KAAK,UAAU,WACjB,OAAO;KAAE,UAAU;KAAgB,QAAQ,WAAW,KAAK,MAAM;IAAe;IAGlF,MAAM,OAAO,MAAM,WAAW,QAAQ,aAAa,EAAE,QAAQ,QAAQ,CAAC;IAEtE,OAAO;KAAE,UAAU;KAAe,YAAW,MADtB,OAAO,MAAM,WAAW,QAAQ,aAAa,EAAE,QAAQ,QAAQ,CAAC,EAAA,CACjC;IAAM;GAC9D;EACF,CAAC;EAED,gBAAgB,WAAW;GACzB,aACE;GACF,aAAa,EAAE,OAAO;IACpB,QAAQ;IACR,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,0CAA0C;GAC/E,CAAC;GACD,QAAQ,EAAE,QAAQ,UAAU;IAC1B,OAAO,OAAO,MAAM,WAAW,QAAQ,eAAe,EAAE,OAAO,CAAC;GAClE;EACF,CAAC;EAED,cAAc,WAAW;GACvB,aACE;GACF,aAAa,EAAE,OAAO;IACpB,eAAe,EAAE,MAAM,kBAAkB,CAAC,CAAC,IAAI,CAAC;IAChD,cAAc,aACX,SAAS,CAAC,CACV,SAAS,8CAA8C;IAC1D,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,+BAA+B;IACnE,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,kCAAkC;IACtE,UAAU,mBAAmB,KAAK;KAAE,QAAQ;KAAM,YAAY;IAAK,CAAC;GACtE,CAAC;GACD,MAAM,QAAQ,EAAE,eAAe,cAAc,SAAS,SAAS,YAAY;IACzE,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO;KACrC;KACA,MAAM;KACN,QAAQ,iBAAiB,KAAA,IAAY,EAAE,UAAU,UAAU,IAAI,EAAE,aAAa;KAC9E,SAAS;MAAE;MAAS;KAAQ;KAC5B;IACF,CAAC;IACD,OAAO,OAAO,MAAM,WAAW,KAAK,IAAI,aAAa;GACvD;EACF,CAAC;EAED,gBAAgB,WAAW;GACzB,aACE;GACF,aAAa,EAAE,OAAO;IACpB,eAAe,EAAE,MAAM,kBAAkB,CAAC,CAAC,IAAI,CAAC;IAChD,QAAQ,aAAa,SAAS;IAC9B,UAAU,eAAe,SAAS;IAClC,MAAM,iBAAiB,SAAS,gDAAgD;IAChF,OAAO,iBAAiB,SAAS,kCAAkC;IACnE,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS;IAC7C,WAAW,EACR,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,oDAAoD;GAClE,CAAC;GACD,QAAQ,OAAO;IACb,OAAO,OAAO,SAAS,OAAO,KAAK;GACrC;EACF,CAAC;CACH;AACF;;;;;;;;;;;AAcA,SAAgB,aAAa,QAAuB;CAClD,OAAO,EACL,SAAS,WAAW,EAClB,QAAQ,EACN,MAAM,iBAAiB,QAAQ,KAAK;EAClC,MAAM,UAAU,IAAI,QAAQ;EAC5B,IAAI,YAAY,KAAA,GACd;EAGF,MAAM,aAAY,MADE,OAAO,MAAM,KAAK,EAAA,CACd,QACrB,SAAS,KAAK,UAAU,aAAa,KAAK,QAAQ,YAAY,OACjE;EACA,KAAK,MAAM,QAAQ,WAGjB,MAAM,OAAO,MACV,WAAW,KAAK,IAAI,eAAe,EAClC,QAAQ,gDACV,CAAC,CAAC,CACD,YAAY,KAAA,CAAS;CAE5B,EACF,EACF,CAAC,EACH;AACF"}

package/dist/github-5qQPCaXj.d.mts

@@ -0,0 +1,123 @@
+import { a as NormalizedSignal, s as WebhookEvent } from "./index-WNGZJRRH.mjs";
+//#region src/github.d.ts
+interface GitHubRepositoryRequest {
+  repository: string;
+  token: string;
+  fetch?: typeof globalThis.fetch;
+}
+interface CreatePullRequestInput extends GitHubRepositoryRequest {
+  title: string;
+  head: string;
+  base: string;
+  body?: string;
+  draft?: boolean;
+}
+interface CreatedPullRequest {
+  prNumber: number;
+  prUrl: string;
+}
+type ReviewCommentAuthorPolicy = "write" | "any";
+interface ReviewCommentTrustInput {
+  /** Defaults to `write`. Use `any` only when untrusted review text is handled as data. */
+  authorPolicy?: ReviewCommentAuthorPolicy;
+}
+interface ReadReviewCommentInput extends GitHubRepositoryRequest, ReviewCommentTrustInput {
+  commentId: number;
+}
+interface GitHubReviewComment {
+  id: number;
+  body: string;
+  url: string;
+  author: string;
+  inReplyToId: number | null;
+}
+interface AnswerReviewCommentInput extends GitHubRepositoryRequest, ReviewCommentTrustInput {
+  pullRequestNumber: number;
+  commentId: number;
+  body: string;
+}
+interface PullRequestLabelInput extends GitHubRepositoryRequest {
+  pullRequestNumber: number;
+  label: string;
+}
+interface ConflictedPullRequest {
+  prNumber: number;
+  prUrl: string;
+  headBranch: string;
+  headSha: string;
+  baseBranch: string;
+  baseSha: string;
+}
+type ListConflictedPullRequestsInput = GitHubRepositoryRequest;
+declare class GitHubReviewCommentAuthorError extends Error {
+  readonly author: string;
+  constructor(author: string);
+}
+/** Create a pull request from an existing head branch. */
+declare function createPullRequest(input: CreatePullRequestInput): Promise<CreatedPullRequest>;
+/** Read one inline review comment after applying the author policy, which requires write access by default. */
+declare function readReviewComment(input: ReadReviewCommentInput): Promise<GitHubReviewComment>;
+/** Reply to an inline review comment after applying the author policy, which requires write access by default. */
+declare function answerReviewComment(input: AnswerReviewCommentInput): Promise<GitHubReviewComment>;
+/** List open, same-repository pull requests by one author that GitHub reports as conflicting. */
+declare function listConflictedPullRequests(input: ListConflictedPullRequestsInput): Promise<ConflictedPullRequest[]>;
+/** Add one label to a pull request. */
+declare function addLabel(input: PullRequestLabelInput): Promise<string[]>;
+/** Remove one label from a pull request. */
+declare function removeLabel(input: PullRequestLabelInput): Promise<string[]>;
+/**
+ * Verify a GitHub webhook HMAC signature (the x-hub-signature-256 header)
+ * against the raw request body. Returns false for missing or malformed
+ * signatures instead of throwing.
+ */
+declare function verifyGitHubSignature(options: {
+  secret: string;
+  payload: string;
+  signature: string | null;
+}): boolean;
+interface GitHubDefaultBranchPush {
+  source: "github_default_branch_push";
+  deliveryId: string;
+  repositorySlug: string;
+  defaultBranch: string;
+}
+/** Normalize a push to a repository's default branch for deterministic reconciliation. */
+declare function normalizeGitHubDefaultBranchPush(options: {
+  deliveryId: string;
+  event: string;
+  payload: unknown;
+}): GitHubDefaultBranchPush | null;
+interface GitHubIssueSignal extends NormalizedSignal<"github_issue"> {
+  repositorySlug: string;
+  issue: {
+    number: number;
+    title: string;
+    body: string | null;
+  };
+}
+interface GitHubCIFailureSignal extends NormalizedSignal<"github_ci_failure"> {
+  repositoryDefaultBranch: string;
+  repositorySlug: string;
+  workflowRun: {
+    id: number;
+    name: string;
+    trigger: string;
+    branch: string | null;
+    headRepositorySlug: string | null;
+    headSha: string;
+    url: string;
+    conclusion: string;
+    attempt: number;
+  };
+}
+/**
+ * Normalize a GitHub issues webhook into the factory's signal shape. Returns
+ * null for payloads that are not an opened issue. The caller supplies the
+ * repository id; the payload stays untrusted data.
+ */
+declare function normalizeGitHubIssueOpened(options: WebhookEvent): GitHubIssueSignal | null;
+/** Normalize a completed, unsuccessful GitHub Actions run into a CI failure signal. */
+declare function normalizeGitHubWorkflowRunFailure(options: WebhookEvent): GitHubCIFailureSignal | null;
+//#endregion
+export { removeLabel as C, readReviewComment as S, createPullRequest as _, GitHubCIFailureSignal as a, normalizeGitHubIssueOpened as b, GitHubRepositoryRequest as c, ListConflictedPullRequestsInput as d, PullRequestLabelInput as f, answerReviewComment as g, addLabel as h, CreatedPullRequest as i, GitHubReviewComment as l, ReviewCommentAuthorPolicy as m, ConflictedPullRequest as n, GitHubDefaultBranchPush as o, ReadReviewCommentInput as p, CreatePullRequestInput as r, GitHubIssueSignal as s, AnswerReviewCommentInput as t, GitHubReviewCommentAuthorError as u, listConflictedPullRequests as v, verifyGitHubSignature as w, normalizeGitHubWorkflowRunFailure as x, normalizeGitHubDefaultBranchPush as y };
+//# sourceMappingURL=github-5qQPCaXj.d.mts.map

package/dist/github.d.mts

@@ -0,0 +1,2 @@
+import { C as removeLabel, S as readReviewComment, _ as createPullRequest, a as GitHubCIFailureSignal, b as normalizeGitHubIssueOpened, c as GitHubRepositoryRequest, d as ListConflictedPullRequestsInput, f as PullRequestLabelInput, g as answerReviewComment, h as addLabel, i as CreatedPullRequest, l as GitHubReviewComment, m as ReviewCommentAuthorPolicy, n as ConflictedPullRequest, o as GitHubDefaultBranchPush, p as ReadReviewCommentInput, r as CreatePullRequestInput, s as GitHubIssueSignal, t as AnswerReviewCommentInput, u as GitHubReviewCommentAuthorError, v as listConflictedPullRequests, w as verifyGitHubSignature, x as normalizeGitHubWorkflowRunFailure, y as normalizeGitHubDefaultBranchPush } from "./github-5qQPCaXj.mjs";
+export { AnswerReviewCommentInput, ConflictedPullRequest, CreatePullRequestInput, CreatedPullRequest, GitHubCIFailureSignal, GitHubDefaultBranchPush, GitHubIssueSignal, GitHubRepositoryRequest, GitHubReviewComment, GitHubReviewCommentAuthorError, ListConflictedPullRequestsInput, PullRequestLabelInput, ReadReviewCommentInput, ReviewCommentAuthorPolicy, addLabel, answerReviewComment, createPullRequest, listConflictedPullRequests, normalizeGitHubDefaultBranchPush, normalizeGitHubIssueOpened, normalizeGitHubWorkflowRunFailure, readReviewComment, removeLabel, verifyGitHubSignature };

package/dist/github.mjs

@@ -0,0 +1,286 @@
+import { z } from "zod";
+import { createHmac, timingSafeEqual } from "node:crypto";
+//#region src/github.ts
+const gitHubApiUrl = "https://api.github.com";
+const repositorySlugPattern = /^[^/\s]+\/[^/\s]+$/;
+const pullRequestSchema = z.object({
+	number: z.number().int().positive(),
+	html_url: z.url()
+});
+const reviewCommentSchema = z.object({
+	id: z.number().int().positive(),
+	body: z.string(),
+	html_url: z.url(),
+	user: z.object({ login: z.string().min(1) }),
+	in_reply_to_id: z.number().int().positive().nullish()
+});
+const labelsSchema = z.array(z.object({ name: z.string().min(1) }));
+const pullRequestCandidateSchema = z.object({
+	number: z.number().int().positive(),
+	user: z.object({ type: z.string().min(1) }),
+	head: z.object({
+		ref: z.string().min(1),
+		repo: z.object({ full_name: z.string().min(1) })
+	})
+});
+const openPullRequestsSchema = z.array(pullRequestCandidateSchema);
+const pullRequestDetailSchema = pullRequestCandidateSchema.extend({
+	html_url: z.url(),
+	mergeable: z.boolean().nullable(),
+	mergeable_state: z.string().min(1),
+	head: pullRequestCandidateSchema.shape.head.extend({ sha: z.string().min(1) }),
+	base: z.object({
+		ref: z.string().min(1),
+		sha: z.string().min(1)
+	})
+});
+const collaboratorPermissionSchema = z.object({ permission: z.enum([
+	"admin",
+	"maintain",
+	"write",
+	"triage",
+	"read",
+	"none"
+]) });
+const writePermissions = /* @__PURE__ */ new Set([
+	"admin",
+	"maintain",
+	"write"
+]);
+var GitHubReviewCommentAuthorError = class extends Error {
+	author;
+	constructor(author) {
+		super(`GitHub user ${author} does not have write access to the repository`);
+		this.name = "GitHubReviewCommentAuthorError";
+		this.author = author;
+	}
+};
+/** Create a pull request from an existing head branch. */
+async function createPullRequest(input) {
+	const pull = pullRequestSchema.parse(await gitHubRequest(input, "/pulls", {
+		method: "POST",
+		body: JSON.stringify({
+			title: input.title,
+			head: input.head,
+			base: input.base,
+			...input.body === void 0 ? {} : { body: input.body },
+			...input.draft === void 0 ? {} : { draft: input.draft }
+		})
+	}));
+	return {
+		prNumber: pull.number,
+		prUrl: pull.html_url
+	};
+}
+/** Read one inline review comment after applying the author policy, which requires write access by default. */
+async function readReviewComment(input) {
+	const comment = parseReviewComment(await gitHubRequest(input, `/pulls/comments/${positiveInteger(input.commentId, "commentId")}`));
+	await assertReviewCommentAuthor(input, comment.author);
+	return comment;
+}
+/** Reply to an inline review comment after applying the author policy, which requires write access by default. */
+async function answerReviewComment(input) {
+	await readReviewComment(input);
+	return parseReviewComment(await gitHubRequest(input, `/pulls/${positiveInteger(input.pullRequestNumber, "pullRequestNumber")}/comments/${positiveInteger(input.commentId, "commentId")}/replies`, {
+		method: "POST",
+		body: JSON.stringify({ body: input.body })
+	}));
+}
+/** List open, same-repository pull requests by one author that GitHub reports as conflicting. */
+async function listConflictedPullRequests(input) {
+	const candidates = openPullRequestsSchema.parse(await gitHubRequest(input, `/pulls?state=open&per_page=100`)).filter((pull) => pull.user.type === "Bot" && pull.head.ref.startsWith("factory/") && pull.head.repo.full_name.toLowerCase() === input.repository.toLowerCase());
+	const conflicted = [];
+	for (const candidate of candidates) {
+		const pull = pullRequestDetailSchema.parse(await gitHubRequest(input, `/pulls/${candidate.number}`));
+		if (pull.mergeable === false || pull.mergeable_state === "dirty") conflicted.push({
+			prNumber: pull.number,
+			prUrl: pull.html_url,
+			headBranch: pull.head.ref,
+			headSha: pull.head.sha,
+			baseBranch: pull.base.ref,
+			baseSha: pull.base.sha
+		});
+	}
+	return conflicted;
+}
+/** Add one label to a pull request. */
+async function addLabel(input) {
+	return parseLabels(await gitHubRequest(input, `/issues/${positiveInteger(input.pullRequestNumber, "pullRequestNumber")}/labels`, {
+		method: "POST",
+		body: JSON.stringify({ labels: [input.label] })
+	}));
+}
+/** Remove one label from a pull request. */
+async function removeLabel(input) {
+	return parseLabels(await gitHubRequest(input, `/issues/${positiveInteger(input.pullRequestNumber, "pullRequestNumber")}/labels/${encodeURIComponent(input.label)}`, { method: "DELETE" }));
+}
+async function gitHubRequest(input, path, init = {}) {
+	if (!repositorySlugPattern.test(input.repository)) throw new Error(`invalid GitHub repository slug: ${input.repository}`);
+	const response = await (input.fetch ?? globalThis.fetch)(`${gitHubApiUrl}/repos/${input.repository}${path}`, {
+		...init,
+		headers: {
+			Accept: "application/vnd.github+json",
+			Authorization: `Bearer ${input.token}`,
+			"Content-Type": "application/json",
+			"X-GitHub-Api-Version": "2022-11-28",
+			...init.headers
+		}
+	});
+	const body = await response.json();
+	if (!response.ok) {
+		const message = z.object({ message: z.string() }).safeParse(body);
+		throw new Error(`GitHub API request failed (${response.status}): ${message.success ? message.data.message : response.statusText}`);
+	}
+	return body;
+}
+function parseReviewComment(value) {
+	const comment = reviewCommentSchema.parse(value);
+	return {
+		id: comment.id,
+		body: comment.body,
+		url: comment.html_url,
+		author: comment.user.login,
+		inReplyToId: comment.in_reply_to_id ?? null
+	};
+}
+function parseLabels(value) {
+	return labelsSchema.parse(value).map(({ name }) => name);
+}
+async function assertReviewCommentAuthor(input, author) {
+	if (input.authorPolicy === "any") return;
+	const { permission } = collaboratorPermissionSchema.parse(await gitHubRequest(input, `/collaborators/${encodeURIComponent(author)}/permission`));
+	if (!writePermissions.has(permission)) throw new GitHubReviewCommentAuthorError(author);
+}
+function positiveInteger(value, name) {
+	if (!Number.isInteger(value) || value < 1) throw new Error(`${name} must be a positive integer`);
+	return value;
+}
+/**
+* Verify a GitHub webhook HMAC signature (the x-hub-signature-256 header)
+* against the raw request body. Returns false for missing or malformed
+* signatures instead of throwing.
+*/
+function verifyGitHubSignature(options) {
+	const { secret, payload, signature } = options;
+	if (signature === null || !signature.startsWith("sha256=")) return false;
+	const expected = createHmac("sha256", secret).update(payload).digest("hex");
+	const provided = signature.slice(7);
+	if (provided.length !== expected.length) return false;
+	return timingSafeEqual(Buffer.from(provided, "hex"), Buffer.from(expected, "hex"));
+}
+const pushEventSchema = z.looseObject({
+	ref: z.string().min(1),
+	repository: z.looseObject({
+		default_branch: z.string().min(1),
+		full_name: z.string().min(1)
+	})
+});
+/** Normalize a push to a repository's default branch for deterministic reconciliation. */
+function normalizeGitHubDefaultBranchPush(options) {
+	if (options.event !== "push") return null;
+	const parsed = pushEventSchema.safeParse(options.payload);
+	if (!parsed.success || parsed.data.ref !== `refs/heads/${parsed.data.repository.default_branch}`) return null;
+	return {
+		source: "github_default_branch_push",
+		deliveryId: options.deliveryId,
+		repositorySlug: parsed.data.repository.full_name.toLowerCase(),
+		defaultBranch: parsed.data.repository.default_branch
+	};
+}
+const issueEventSchema = z.looseObject({
+	action: z.string(),
+	issue: z.looseObject({
+		number: z.number().int().min(1),
+		title: z.string(),
+		body: z.string().nullable()
+	}),
+	repository: z.looseObject({ full_name: z.string().min(1) })
+});
+const failedWorkflowConclusions = /* @__PURE__ */ new Set([
+	"action_required",
+	"failure",
+	"stale",
+	"startup_failure",
+	"timed_out"
+]);
+const workflowRunEventSchema = z.looseObject({
+	action: z.string(),
+	repository: z.looseObject({
+		default_branch: z.string().min(1),
+		full_name: z.string().min(1)
+	}),
+	workflow_run: z.looseObject({
+		id: z.number().int().min(1),
+		name: z.string().min(1),
+		event: z.string().min(1),
+		head_branch: z.string().min(1).nullable(),
+		head_repository: z.looseObject({ full_name: z.string().min(1) }).nullable(),
+		head_sha: z.string().min(1),
+		html_url: z.url(),
+		conclusion: z.string().nullable(),
+		run_attempt: z.number().int().min(1)
+	})
+});
+/**
+* Normalize a GitHub issues webhook into the factory's signal shape. Returns
+* null for payloads that are not an opened issue. The caller supplies the
+* repository id; the payload stays untrusted data.
+*/
+function normalizeGitHubIssueOpened(options) {
+	if (options.event !== "issues") return null;
+	const parsed = issueEventSchema.safeParse(options.payload);
+	if (!parsed.success || parsed.data.action !== "opened") return null;
+	const slug = parsed.data.repository.full_name.toLowerCase();
+	const { number, title, body } = parsed.data.issue;
+	return {
+		source: "github_issue",
+		deliveryId: options.deliveryId,
+		repositorySlug: slug,
+		replyTo: {
+			channel: "github",
+			address: `${slug}#${number}`
+		},
+		issue: {
+			number,
+			title,
+			body
+		},
+		payload: options.payload
+	};
+}
+/** Normalize a completed, unsuccessful GitHub Actions run into a CI failure signal. */
+function normalizeGitHubWorkflowRunFailure(options) {
+	if (options.event !== "workflow_run") return null;
+	const parsed = workflowRunEventSchema.safeParse(options.payload);
+	if (!parsed.success || parsed.data.action !== "completed") return null;
+	const run = parsed.data.workflow_run;
+	const conclusion = run.conclusion;
+	if (conclusion === null || !failedWorkflowConclusions.has(conclusion)) return null;
+	const slug = parsed.data.repository.full_name.toLowerCase();
+	return {
+		source: "github_ci_failure",
+		deliveryId: options.deliveryId,
+		repositoryDefaultBranch: parsed.data.repository.default_branch,
+		repositorySlug: slug,
+		replyTo: {
+			channel: "github",
+			address: `${slug}/actions/runs/${run.id}`
+		},
+		workflowRun: {
+			id: run.id,
+			name: run.name,
+			trigger: run.event,
+			branch: run.head_branch,
+			headRepositorySlug: run.head_repository?.full_name.toLowerCase() ?? null,
+			headSha: run.head_sha,
+			url: run.html_url,
+			conclusion,
+			attempt: run.run_attempt
+		},
+		payload: options.payload
+	};
+}
+//#endregion
+export { GitHubReviewCommentAuthorError, addLabel, answerReviewComment, createPullRequest, listConflictedPullRequests, normalizeGitHubDefaultBranchPush, normalizeGitHubIssueOpened, normalizeGitHubWorkflowRunFailure, readReviewComment, removeLabel, verifyGitHubSignature };
+
+//# sourceMappingURL=github.mjs.map

package/dist/github.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.mjs","names":[],"sources":["../src/github.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { z } from \"zod\";\nimport type { NormalizedSignal, WebhookEvent } from \"./connectors/index\";\n\nconst gitHubApiUrl = \"https://api.github.com\";\nconst repositorySlugPattern = /^[^/\\s]+\\/[^/\\s]+$/;\n\nexport interface GitHubRepositoryRequest {\n  repository: string;\n  token: string;\n  fetch?: typeof globalThis.fetch;\n}\n\nexport interface CreatePullRequestInput extends GitHubRepositoryRequest {\n  title: string;\n  head: string;\n  base: string;\n  body?: string;\n  draft?: boolean;\n}\n\nexport interface CreatedPullRequest {\n  prNumber: number;\n  prUrl: string;\n}\n\nexport type ReviewCommentAuthorPolicy = \"write\" | \"any\";\n\ninterface ReviewCommentTrustInput {\n  /** Defaults to `write`. Use `any` only when untrusted review text is handled as data. */\n  authorPolicy?: ReviewCommentAuthorPolicy;\n}\n\nexport interface ReadReviewCommentInput extends GitHubRepositoryRequest, ReviewCommentTrustInput {\n  commentId: number;\n}\n\nexport interface GitHubReviewComment {\n  id: number;\n  body: string;\n  url: string;\n  author: string;\n  inReplyToId: number | null;\n}\n\nexport interface AnswerReviewCommentInput\n  extends GitHubRepositoryRequest,\n    ReviewCommentTrustInput {\n  pullRequestNumber: number;\n  commentId: number;\n  body: string;\n}\n\nexport interface PullRequestLabelInput extends GitHubRepositoryRequest {\n  pullRequestNumber: number;\n  label: string;\n}\n\nexport interface ConflictedPullRequest {\n  prNumber: number;\n  prUrl: string;\n  headBranch: string;\n  headSha: string;\n  baseBranch: string;\n  baseSha: string;\n}\n\nexport type ListConflictedPullRequestsInput = GitHubRepositoryRequest;\n\nconst pullRequestSchema = z.object({\n  number: z.number().int().positive(),\n  html_url: z.url(),\n});\n\nconst reviewCommentSchema = z.object({\n  id: z.number().int().positive(),\n  body: z.string(),\n  html_url: z.url(),\n  user: z.object({ login: z.string().min(1) }),\n  in_reply_to_id: z.number().int().positive().nullish(),\n});\n\nconst labelsSchema = z.array(z.object({ name: z.string().min(1) }));\nconst pullRequestCandidateSchema = z.object({\n  number: z.number().int().positive(),\n  user: z.object({ type: z.string().min(1) }),\n  head: z.object({ ref: z.string().min(1), repo: z.object({ full_name: z.string().min(1) }) }),\n});\nconst openPullRequestsSchema = z.array(pullRequestCandidateSchema);\nconst pullRequestDetailSchema = pullRequestCandidateSchema.extend({\n  html_url: z.url(),\n  mergeable: z.boolean().nullable(),\n  mergeable_state: z.string().min(1),\n  head: pullRequestCandidateSchema.shape.head.extend({ sha: z.string().min(1) }),\n  base: z.object({ ref: z.string().min(1), sha: z.string().min(1) }),\n});\nconst collaboratorPermissionSchema = z.object({\n  permission: z.enum([\"admin\", \"maintain\", \"write\", \"triage\", \"read\", \"none\"]),\n});\nconst writePermissions = new Set([\"admin\", \"maintain\", \"write\"]);\n\nexport class GitHubReviewCommentAuthorError extends Error {\n  readonly author: string;\n\n  constructor(author: string) {\n    super(`GitHub user ${author} does not have write access to the repository`);\n    this.name = \"GitHubReviewCommentAuthorError\";\n    this.author = author;\n  }\n}\n\n/** Create a pull request from an existing head branch. */\nexport async function createPullRequest(input: CreatePullRequestInput): Promise<CreatedPullRequest> {\n  const pull = pullRequestSchema.parse(\n    await gitHubRequest(input, \"/pulls\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        title: input.title,\n        head: input.head,\n        base: input.base,\n        ...(input.body === undefined ? {} : { body: input.body }),\n        ...(input.draft === undefined ? {} : { draft: input.draft }),\n      }),\n    }),\n  );\n  return { prNumber: pull.number, prUrl: pull.html_url };\n}\n\n/** Read one inline review comment after applying the author policy, which requires write access by default. */\nexport async function readReviewComment(\n  input: ReadReviewCommentInput,\n): Promise<GitHubReviewComment> {\n  const comment = parseReviewComment(\n    await gitHubRequest(input, `/pulls/comments/${positiveInteger(input.commentId, \"commentId\")}`),\n  );\n  await assertReviewCommentAuthor(input, comment.author);\n  return comment;\n}\n\n/** Reply to an inline review comment after applying the author policy, which requires write access by default. */\nexport async function answerReviewComment(\n  input: AnswerReviewCommentInput,\n): Promise<GitHubReviewComment> {\n  await readReviewComment(input);\n  return parseReviewComment(\n    await gitHubRequest(\n      input,\n      `/pulls/${positiveInteger(input.pullRequestNumber, \"pullRequestNumber\")}/comments/${positiveInteger(input.commentId, \"commentId\")}/replies`,\n      { method: \"POST\", body: JSON.stringify({ body: input.body }) },\n    ),\n  );\n}\n\n/** List open, same-repository pull requests by one author that GitHub reports as conflicting. */\nexport async function listConflictedPullRequests(\n  input: ListConflictedPullRequestsInput,\n): Promise<ConflictedPullRequest[]> {\n  const pulls = openPullRequestsSchema.parse(\n    await gitHubRequest(input, `/pulls?state=open&per_page=100`),\n  );\n  const candidates = pulls.filter(\n    (pull) =>\n      pull.user.type === \"Bot\" &&\n      pull.head.ref.startsWith(\"factory/\") &&\n      pull.head.repo.full_name.toLowerCase() === input.repository.toLowerCase(),\n  );\n  const conflicted: ConflictedPullRequest[] = [];\n  for (const candidate of candidates) {\n    const pull = pullRequestDetailSchema.parse(\n      await gitHubRequest(input, `/pulls/${candidate.number}`),\n    );\n    if (pull.mergeable === false || pull.mergeable_state === \"dirty\") {\n      conflicted.push({\n        prNumber: pull.number,\n        prUrl: pull.html_url,\n        headBranch: pull.head.ref,\n        headSha: pull.head.sha,\n        baseBranch: pull.base.ref,\n        baseSha: pull.base.sha,\n      });\n    }\n  }\n  return conflicted;\n}\n\n/** Add one label to a pull request. */\nexport async function addLabel(input: PullRequestLabelInput): Promise<string[]> {\n  return parseLabels(\n    await gitHubRequest(\n      input,\n      `/issues/${positiveInteger(input.pullRequestNumber, \"pullRequestNumber\")}/labels`,\n      { method: \"POST\", body: JSON.stringify({ labels: [input.label] }) },\n    ),\n  );\n}\n\n/** Remove one label from a pull request. */\nexport async function removeLabel(input: PullRequestLabelInput): Promise<string[]> {\n  return parseLabels(\n    await gitHubRequest(\n      input,\n      `/issues/${positiveInteger(input.pullRequestNumber, \"pullRequestNumber\")}/labels/${encodeURIComponent(input.label)}`,\n      { method: \"DELETE\" },\n    ),\n  );\n}\n\nasync function gitHubRequest(\n  input: GitHubRepositoryRequest,\n  path: string,\n  init: RequestInit = {},\n): Promise<unknown> {\n  if (!repositorySlugPattern.test(input.repository)) {\n    throw new Error(`invalid GitHub repository slug: ${input.repository}`);\n  }\n  const response = await (input.fetch ?? globalThis.fetch)(\n    `${gitHubApiUrl}/repos/${input.repository}${path}`,\n    {\n      ...init,\n      headers: {\n        Accept: \"application/vnd.github+json\",\n        Authorization: `Bearer ${input.token}`,\n        \"Content-Type\": \"application/json\",\n        \"X-GitHub-Api-Version\": \"2022-11-28\",\n        ...init.headers,\n      },\n    },\n  );\n  const body: unknown = await response.json();\n  if (!response.ok) {\n    const message = z.object({ message: z.string() }).safeParse(body);\n    throw new Error(\n      `GitHub API request failed (${response.status}): ${message.success ? message.data.message : response.statusText}`,\n    );\n  }\n  return body;\n}\n\nfunction parseReviewComment(value: unknown): GitHubReviewComment {\n  const comment = reviewCommentSchema.parse(value);\n  return {\n    id: comment.id,\n    body: comment.body,\n    url: comment.html_url,\n    author: comment.user.login,\n    inReplyToId: comment.in_reply_to_id ?? null,\n  };\n}\n\nfunction parseLabels(value: unknown): string[] {\n  return labelsSchema.parse(value).map(({ name }) => name);\n}\n\nasync function assertReviewCommentAuthor(\n  input: GitHubRepositoryRequest & ReviewCommentTrustInput,\n  author: string,\n): Promise<void> {\n  if (input.authorPolicy === \"any\") {\n    return;\n  }\n  const { permission } = collaboratorPermissionSchema.parse(\n    await gitHubRequest(input, `/collaborators/${encodeURIComponent(author)}/permission`),\n  );\n  if (!writePermissions.has(permission)) {\n    throw new GitHubReviewCommentAuthorError(author);\n  }\n}\n\nfunction positiveInteger(value: number, name: string): number {\n  if (!Number.isInteger(value) || value < 1) {\n    throw new Error(`${name} must be a positive integer`);\n  }\n  return value;\n}\n\n/**\n * Verify a GitHub webhook HMAC signature (the x-hub-signature-256 header)\n * against the raw request body. Returns false for missing or malformed\n * signatures instead of throwing.\n */\nexport function verifyGitHubSignature(options: {\n  secret: string;\n  payload: string;\n  signature: string | null;\n}): boolean {\n  const { secret, payload, signature } = options;\n  if (signature === null || !signature.startsWith(\"sha256=\")) {\n    return false;\n  }\n  const expected = createHmac(\"sha256\", secret).update(payload).digest(\"hex\");\n  const provided = signature.slice(\"sha256=\".length);\n  if (provided.length !== expected.length) {\n    return false;\n  }\n  return timingSafeEqual(Buffer.from(provided, \"hex\"), Buffer.from(expected, \"hex\"));\n}\n\nconst pushEventSchema = z.looseObject({\n  ref: z.string().min(1),\n  repository: z.looseObject({\n    default_branch: z.string().min(1),\n    full_name: z.string().min(1),\n  }),\n});\n\nexport interface GitHubDefaultBranchPush {\n  source: \"github_default_branch_push\";\n  deliveryId: string;\n  repositorySlug: string;\n  defaultBranch: string;\n}\n\n/** Normalize a push to a repository's default branch for deterministic reconciliation. */\nexport function normalizeGitHubDefaultBranchPush(options: {\n  deliveryId: string;\n  event: string;\n  payload: unknown;\n}): GitHubDefaultBranchPush | null {\n  if (options.event !== \"push\") return null;\n  const parsed = pushEventSchema.safeParse(options.payload);\n  if (!parsed.success || parsed.data.ref !== `refs/heads/${parsed.data.repository.default_branch}`) {\n    return null;\n  }\n  return {\n    source: \"github_default_branch_push\",\n    deliveryId: options.deliveryId,\n    repositorySlug: parsed.data.repository.full_name.toLowerCase(),\n    defaultBranch: parsed.data.repository.default_branch,\n  };\n}\n\nconst issueEventSchema = z.looseObject({\n  action: z.string(),\n  issue: z.looseObject({\n    number: z.number().int().min(1),\n    title: z.string(),\n    body: z.string().nullable(),\n  }),\n  repository: z.looseObject({\n    full_name: z.string().min(1),\n  }),\n});\n\nexport interface GitHubIssueSignal extends NormalizedSignal<\"github_issue\"> {\n  repositorySlug: string;\n  issue: { number: number; title: string; body: string | null };\n}\n\nconst failedWorkflowConclusions = new Set([\n  \"action_required\",\n  \"failure\",\n  \"stale\",\n  \"startup_failure\",\n  \"timed_out\",\n]);\n\nconst workflowRunEventSchema = z.looseObject({\n  action: z.string(),\n  repository: z.looseObject({\n    default_branch: z.string().min(1),\n    full_name: z.string().min(1),\n  }),\n  workflow_run: z.looseObject({\n    id: z.number().int().min(1),\n    name: z.string().min(1),\n    event: z.string().min(1),\n    head_branch: z.string().min(1).nullable(),\n    head_repository: z\n      .looseObject({\n        full_name: z.string().min(1),\n      })\n      .nullable(),\n    head_sha: z.string().min(1),\n    html_url: z.url(),\n    conclusion: z.string().nullable(),\n    run_attempt: z.number().int().min(1),\n  }),\n});\n\nexport interface GitHubCIFailureSignal extends NormalizedSignal<\"github_ci_failure\"> {\n  repositoryDefaultBranch: string;\n  repositorySlug: string;\n  workflowRun: {\n    id: number;\n    name: string;\n    trigger: string;\n    branch: string | null;\n    headRepositorySlug: string | null;\n    headSha: string;\n    url: string;\n    conclusion: string;\n    attempt: number;\n  };\n}\n\n/**\n * Normalize a GitHub issues webhook into the factory's signal shape. Returns\n * null for payloads that are not an opened issue. The caller supplies the\n * repository id; the payload stays untrusted data.\n */\nexport function normalizeGitHubIssueOpened(options: WebhookEvent): GitHubIssueSignal | null {\n  if (options.event !== \"issues\") {\n    return null;\n  }\n  const parsed = issueEventSchema.safeParse(options.payload);\n  if (!parsed.success || parsed.data.action !== \"opened\") {\n    return null;\n  }\n  const slug = parsed.data.repository.full_name.toLowerCase();\n  const { number, title, body } = parsed.data.issue;\n  return {\n    source: \"github_issue\",\n    deliveryId: options.deliveryId,\n    repositorySlug: slug,\n    replyTo: { channel: \"github\", address: `${slug}#${number}` },\n    issue: { number, title, body },\n    payload: options.payload,\n  };\n}\n\n/** Normalize a completed, unsuccessful GitHub Actions run into a CI failure signal. */\nexport function normalizeGitHubWorkflowRunFailure(\n  options: WebhookEvent,\n): GitHubCIFailureSignal | null {\n  if (options.event !== \"workflow_run\") {\n    return null;\n  }\n  const parsed = workflowRunEventSchema.safeParse(options.payload);\n  if (!parsed.success || parsed.data.action !== \"completed\") {\n    return null;\n  }\n\n  const run = parsed.data.workflow_run;\n  const conclusion = run.conclusion;\n  if (conclusion === null || !failedWorkflowConclusions.has(conclusion)) {\n    return null;\n  }\n  const slug = parsed.data.repository.full_name.toLowerCase();\n  return {\n    source: \"github_ci_failure\",\n    deliveryId: options.deliveryId,\n    repositoryDefaultBranch: parsed.data.repository.default_branch,\n    repositorySlug: slug,\n    replyTo: { channel: \"github\", address: `${slug}/actions/runs/${run.id}` },\n    workflowRun: {\n      id: run.id,\n      name: run.name,\n      trigger: run.event,\n      branch: run.head_branch,\n      headRepositorySlug: run.head_repository?.full_name.toLowerCase() ?? null,\n      headSha: run.head_sha,\n      url: run.html_url,\n      conclusion,\n      attempt: run.run_attempt,\n    },\n    payload: options.payload,\n  };\n}\n"],"mappings":";;;AAIA,MAAM,eAAe;AACrB,MAAM,wBAAwB;AAgE9B,MAAM,oBAAoB,EAAE,OAAO;CACjC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAClC,UAAU,EAAE,IAAI;AAClB,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;CACnC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAC9B,MAAM,EAAE,OAAO;CACf,UAAU,EAAE,IAAI;CAChB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;CAC3C,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ;AACtD,CAAC;AAED,MAAM,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClE,MAAM,6BAA6B,EAAE,OAAO;CAC1C,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAClC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;CAC1C,MAAM,EAAE,OAAO;EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAAG,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;CAAE,CAAC;AAC7F,CAAC;AACD,MAAM,yBAAyB,EAAE,MAAM,0BAA0B;AACjE,MAAM,0BAA0B,2BAA2B,OAAO;CAChE,UAAU,EAAE,IAAI;CAChB,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACjC,MAAM,2BAA2B,MAAM,KAAK,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;CAC7E,MAAM,EAAE,OAAO;EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAAG,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAAE,CAAC;AACnE,CAAC;AACD,MAAM,+BAA+B,EAAE,OAAO,EAC5C,YAAY,EAAE,KAAK;CAAC;CAAS;CAAY;CAAS;CAAU;CAAQ;AAAM,CAAC,EAC7E,CAAC;AACD,MAAM,mCAAmB,IAAI,IAAI;CAAC;CAAS;CAAY;AAAO,CAAC;AAE/D,IAAa,iCAAb,cAAoD,MAAM;CACxD;CAEA,YAAY,QAAgB;EAC1B,MAAM,eAAe,OAAO,8CAA8C;EAC1E,KAAK,OAAO;EACZ,KAAK,SAAS;CAChB;AACF;;AAGA,eAAsB,kBAAkB,OAA4D;CAClG,MAAM,OAAO,kBAAkB,MAC7B,MAAM,cAAc,OAAO,UAAU;EACnC,QAAQ;EACR,MAAM,KAAK,UAAU;GACnB,OAAO,MAAM;GACb,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;GACvD,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;EAC5D,CAAC;CACH,CAAC,CACH;CACA,OAAO;EAAE,UAAU,KAAK;EAAQ,OAAO,KAAK;CAAS;AACvD;;AAGA,eAAsB,kBACpB,OAC8B;CAC9B,MAAM,UAAU,mBACd,MAAM,cAAc,OAAO,mBAAmB,gBAAgB,MAAM,WAAW,WAAW,GAAG,CAC/F;CACA,MAAM,0BAA0B,OAAO,QAAQ,MAAM;CACrD,OAAO;AACT;;AAGA,eAAsB,oBACpB,OAC8B;CAC9B,MAAM,kBAAkB,KAAK;CAC7B,OAAO,mBACL,MAAM,cACJ,OACA,UAAU,gBAAgB,MAAM,mBAAmB,mBAAmB,EAAE,YAAY,gBAAgB,MAAM,WAAW,WAAW,EAAE,WAClI;EAAE,QAAQ;EAAQ,MAAM,KAAK,UAAU,EAAE,MAAM,MAAM,KAAK,CAAC;CAAE,CAC/D,CACF;AACF;;AAGA,eAAsB,2BACpB,OACkC;CAIlC,MAAM,aAHQ,uBAAuB,MACnC,MAAM,cAAc,OAAO,gCAAgC,CAEtC,CAAC,CAAC,QACtB,SACC,KAAK,KAAK,SAAS,SACnB,KAAK,KAAK,IAAI,WAAW,UAAU,KACnC,KAAK,KAAK,KAAK,UAAU,YAAY,MAAM,MAAM,WAAW,YAAY,CAC5E;CACA,MAAM,aAAsC,CAAC;CAC7C,KAAK,MAAM,aAAa,YAAY;EAClC,MAAM,OAAO,wBAAwB,MACnC,MAAM,cAAc,OAAO,UAAU,UAAU,QAAQ,CACzD;EACA,IAAI,KAAK,cAAc,SAAS,KAAK,oBAAoB,SACvD,WAAW,KAAK;GACd,UAAU,KAAK;GACf,OAAO,KAAK;GACZ,YAAY,KAAK,KAAK;GACtB,SAAS,KAAK,KAAK;GACnB,YAAY,KAAK,KAAK;GACtB,SAAS,KAAK,KAAK;EACrB,CAAC;CAEL;CACA,OAAO;AACT;;AAGA,eAAsB,SAAS,OAAiD;CAC9E,OAAO,YACL,MAAM,cACJ,OACA,WAAW,gBAAgB,MAAM,mBAAmB,mBAAmB,EAAE,UACzE;EAAE,QAAQ;EAAQ,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC,MAAM,KAAK,EAAE,CAAC;CAAE,CACpE,CACF;AACF;;AAGA,eAAsB,YAAY,OAAiD;CACjF,OAAO,YACL,MAAM,cACJ,OACA,WAAW,gBAAgB,MAAM,mBAAmB,mBAAmB,EAAE,UAAU,mBAAmB,MAAM,KAAK,KACjH,EAAE,QAAQ,SAAS,CACrB,CACF;AACF;AAEA,eAAe,cACb,OACA,MACA,OAAoB,CAAC,GACH;CAClB,IAAI,CAAC,sBAAsB,KAAK,MAAM,UAAU,GAC9C,MAAM,IAAI,MAAM,mCAAmC,MAAM,YAAY;CAEvE,MAAM,WAAW,OAAO,MAAM,SAAS,WAAW,MAAA,CAChD,GAAG,aAAa,SAAS,MAAM,aAAa,QAC5C;EACE,GAAG;EACH,SAAS;GACP,QAAQ;GACR,eAAe,UAAU,MAAM;GAC/B,gBAAgB;GAChB,wBAAwB;GACxB,GAAG,KAAK;EACV;CACF,CACF;CACA,MAAM,OAAgB,MAAM,SAAS,KAAK;CAC1C,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI;EAChE,MAAM,IAAI,MACR,8BAA8B,SAAS,OAAO,KAAK,QAAQ,UAAU,QAAQ,KAAK,UAAU,SAAS,YACvG;CACF;CACA,OAAO;AACT;AAEA,SAAS,mBAAmB,OAAqC;CAC/D,MAAM,UAAU,oBAAoB,MAAM,KAAK;CAC/C,OAAO;EACL,IAAI,QAAQ;EACZ,MAAM,QAAQ;EACd,KAAK,QAAQ;EACb,QAAQ,QAAQ,KAAK;EACrB,aAAa,QAAQ,kBAAkB;CACzC;AACF;AAEA,SAAS,YAAY,OAA0B;CAC7C,OAAO,aAAa,MAAM,KAAK,CAAC,CAAC,KAAK,EAAE,WAAW,IAAI;AACzD;AAEA,eAAe,0BACb,OACA,QACe;CACf,IAAI,MAAM,iBAAiB,OACzB;CAEF,MAAM,EAAE,eAAe,6BAA6B,MAClD,MAAM,cAAc,OAAO,kBAAkB,mBAAmB,MAAM,EAAE,YAAY,CACtF;CACA,IAAI,CAAC,iBAAiB,IAAI,UAAU,GAClC,MAAM,IAAI,+BAA+B,MAAM;AAEnD;AAEA,SAAS,gBAAgB,OAAe,MAAsB;CAC5D,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,GACtC,MAAM,IAAI,MAAM,GAAG,KAAK,4BAA4B;CAEtD,OAAO;AACT;;;;;;AAOA,SAAgB,sBAAsB,SAI1B;CACV,MAAM,EAAE,QAAQ,SAAS,cAAc;CACvC,IAAI,cAAc,QAAQ,CAAC,UAAU,WAAW,SAAS,GACvD,OAAO;CAET,MAAM,WAAW,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;CAC1E,MAAM,WAAW,UAAU,MAAM,CAAgB;CACjD,IAAI,SAAS,WAAW,SAAS,QAC/B,OAAO;CAET,OAAO,gBAAgB,OAAO,KAAK,UAAU,KAAK,GAAG,OAAO,KAAK,UAAU,KAAK,CAAC;AACnF;AAEA,MAAM,kBAAkB,EAAE,YAAY;CACpC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACrB,YAAY,EAAE,YAAY;EACxB,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAChC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC7B,CAAC;AACH,CAAC;;AAUD,SAAgB,iCAAiC,SAId;CACjC,IAAI,QAAQ,UAAU,QAAQ,OAAO;CACrC,MAAM,SAAS,gBAAgB,UAAU,QAAQ,OAAO;CACxD,IAAI,CAAC,OAAO,WAAW,OAAO,KAAK,QAAQ,cAAc,OAAO,KAAK,WAAW,kBAC9E,OAAO;CAET,OAAO;EACL,QAAQ;EACR,YAAY,QAAQ;EACpB,gBAAgB,OAAO,KAAK,WAAW,UAAU,YAAY;EAC7D,eAAe,OAAO,KAAK,WAAW;CACxC;AACF;AAEA,MAAM,mBAAmB,EAAE,YAAY;CACrC,QAAQ,EAAE,OAAO;CACjB,OAAO,EAAE,YAAY;EACnB,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;EAC9B,OAAO,EAAE,OAAO;EAChB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,CAAC;CACD,YAAY,EAAE,YAAY,EACxB,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAC7B,CAAC;AACH,CAAC;AAOD,MAAM,4CAA4B,IAAI,IAAI;CACxC;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,yBAAyB,EAAE,YAAY;CAC3C,QAAQ,EAAE,OAAO;CACjB,YAAY,EAAE,YAAY;EACxB,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAChC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC7B,CAAC;CACD,cAAc,EAAE,YAAY;EAC1B,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;EAC1B,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;EACxC,iBAAiB,EACd,YAAY,EACX,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAC7B,CAAC,CAAC,CACD,SAAS;EACZ,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAC1B,UAAU,EAAE,IAAI;EAChB,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;EAChC,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;CACrC,CAAC;AACH,CAAC;;;;;;AAuBD,SAAgB,2BAA2B,SAAiD;CAC1F,IAAI,QAAQ,UAAU,UACpB,OAAO;CAET,MAAM,SAAS,iBAAiB,UAAU,QAAQ,OAAO;CACzD,IAAI,CAAC,OAAO,WAAW,OAAO,KAAK,WAAW,UAC5C,OAAO;CAET,MAAM,OAAO,OAAO,KAAK,WAAW,UAAU,YAAY;CAC1D,MAAM,EAAE,QAAQ,OAAO,SAAS,OAAO,KAAK;CAC5C,OAAO;EACL,QAAQ;EACR,YAAY,QAAQ;EACpB,gBAAgB;EAChB,SAAS;GAAE,SAAS;GAAU,SAAS,GAAG,KAAK,GAAG;EAAS;EAC3D,OAAO;GAAE;GAAQ;GAAO;EAAK;EAC7B,SAAS,QAAQ;CACnB;AACF;;AAGA,SAAgB,kCACd,SAC8B;CAC9B,IAAI,QAAQ,UAAU,gBACpB,OAAO;CAET,MAAM,SAAS,uBAAuB,UAAU,QAAQ,OAAO;CAC/D,IAAI,CAAC,OAAO,WAAW,OAAO,KAAK,WAAW,aAC5C,OAAO;CAGT,MAAM,MAAM,OAAO,KAAK;CACxB,MAAM,aAAa,IAAI;CACvB,IAAI,eAAe,QAAQ,CAAC,0BAA0B,IAAI,UAAU,GAClE,OAAO;CAET,MAAM,OAAO,OAAO,KAAK,WAAW,UAAU,YAAY;CAC1D,OAAO;EACL,QAAQ;EACR,YAAY,QAAQ;EACpB,yBAAyB,OAAO,KAAK,WAAW;EAChD,gBAAgB;EAChB,SAAS;GAAE,SAAS;GAAU,SAAS,GAAG,KAAK,gBAAgB,IAAI;EAAK;EACxE,aAAa;GACX,IAAI,IAAI;GACR,MAAM,IAAI;GACV,SAAS,IAAI;GACb,QAAQ,IAAI;GACZ,oBAAoB,IAAI,iBAAiB,UAAU,YAAY,KAAK;GACpE,SAAS,IAAI;GACb,KAAK,IAAI;GACT;GACA,SAAS,IAAI;EACf;EACA,SAAS,QAAQ;CACnB;AACF"}