agentfootprint 9.7.0 → 9.9.0

package/dist/esm/adapters/observability/githubBugReporter.js

@@ -0,0 +1,457 @@
+/**
+ * githubBugReporter — file a bug report, with the run attached, into GitHub.
+ *
+ *   import { exportBugReport, githubBugReporter } from 'agentfootprint/observe';
+ *
+ *   const reporter = githubBugReporter({
+ *     issueRepo: 'acme/checkout-agent',      // where the ISSUE goes
+ *     evidenceRepo: 'acme/agent-evidence',   // where the ZIP goes (default: issueRepo)
+ *   });                                      // token: GITHUB_TOKEN, or `token`
+ *
+ *   const { issueUrl, zipUrl } = await reporter.file(report);
+ *
+ * Two HTTP calls and no SDK: `PUT /repos/{evidenceRepo}/contents/{path}` commits
+ * the zip, `POST /repos/{issueRepo}/issues` files the issue with a manifest
+ * table and a link to the committed bundle. Plain `fetch`, zero dependencies,
+ * `apiBase` for GitHub Enterprise Server — so this works unchanged on a network
+ * that never reaches github.com.
+ *
+ * ## TWIN TARGETS: the issue and the evidence may live in different repos
+ *
+ * The case this exists for: a field tester finds a bug in a LIBRARY. The issue
+ * belongs in the library's public repo, where the maintainers and the next
+ * person to hit it will find it. The evidence — a real run, with real prompts,
+ * real tool arguments and real retrieved documents — does not. So the zip goes
+ * into a PRIVATE repo the maintainers can read, and the issue links it and says
+ * plainly that the evidence is private.
+ *
+ * ```ts
+ * githubBugReporter({
+ *   issueRepo: 'footprintjs/agentfootprint',   // public — the conversation
+ *   evidenceRepo: 'acme/af-bug-evidence',      // private — the run
+ * });
+ * ```
+ *
+ * ## DEFAULT-TARGET DOCTRINE
+ *
+ * **File into the application's OWN repo.** That is the default (`evidenceRepo`
+ * defaults to `issueRepo`) and it is the right default: the run belongs to the
+ * organisation that produced it. Sending a run's evidence across an
+ * organisational boundary — to a vendor, to an upstream library, to anyone
+ * whose access your company did not grant — is a HUMAN act with consequences a
+ * library cannot weigh. This adapter will do it, because a field tester filing
+ * upstream is a real and valuable thing; it will not do it quietly. The
+ * consent manifest (`describeBugReport`) exists so a person sees exactly what
+ * would leave before it does, and this reporter refuses to commit evidence to a
+ * PUBLIC repo unless the caller says `acknowledgePublicEvidence: true` out loud.
+ *
+ * ## Provisioning the token: fine-grained, and scoped to two repos
+ *
+ * Use a **fine-grained personal access token** (GitHub → Settings → Developer
+ * settings → Fine-grained tokens), scoped to ONLY `issueRepo` and
+ * `evidenceRepo`, with exactly two permissions — **Contents: read and write**
+ * (to commit the zip) and **Issues: read and write** (to file the issue) — and
+ * an expiry date. Put it in the server's environment as `GITHUB_TOKEN`, or pass
+ * it as `token`.
+ *
+ * The contrast matters: a CLASSIC PAT's `repo` scope is coarse — it grants
+ * read/write across every repository the account can reach, so a leaked
+ * bug-report token is a leaked key to the whole account. With a fine-grained
+ * token scoped as above, the blast radius of a leak is filing bug reports and
+ * committing files to one evidence repo, and nothing else. GitHub App
+ * installation tokens (short-lived, org-installed, revocable centrally) are the
+ * next rung for an organisation that wants one; this adapter does not mint
+ * them — hand it the token your app already obtained.
+ *
+ * ## Secrecy (the two-clause law)
+ *
+ * The token appears in no message, no error and no log this adapter can
+ * produce, and neither does the bundle's content. A failed request is reported
+ * as **the status and GitHub's own `message` field** — never the request, never
+ * the headers, never the body that carried the token, never a byte of
+ * evidence. Transport failures are re-wrapped rather than rethrown, because a
+ * `fetch` implementation is free to put the request (headers included) into the
+ * error it throws. Nothing here writes to a console. Pinned by a suite that
+ * forces every failure path and greps the message, the stack and the JSON
+ * projection for the token.
+ *
+ * @example  A server route (the app's own repo, the default target)
+ * ```ts
+ * const reporter = githubBugReporter({ issueRepo: 'acme/checkout-agent' });
+ * app.post('/bug-report', async (req, res) => {
+ *   const report = exportBugReport(recordings.get(req.body.runId), req.body.fields);
+ *   res.json(await reporter.file(report));
+ * });
+ * ```
+ */
+import { formatBytes } from '../../lib/bug-report/build.js';
+/** GitHub's own ceiling for a file committed through the contents API is 100 MB,
+ *  but an issue attachment that large is not a bug report anybody opens. 24 MB
+ *  keeps a bundle inside every practical limit including the 25 MB the web UI
+ *  accepts for a drag-and-dropped file. */
+const DEFAULT_MAX_ZIP_BYTES = 24 * 1024 * 1024;
+const DEFAULT_API_BASE = 'https://api.github.com';
+const FINE_GRAINED_TOKEN_PAGE = 'Settings → Developer settings → Fine-grained tokens';
+export function githubBugReporter(options) {
+    const issueRepo = checkedRepo(options.issueRepo, 'issueRepo');
+    const evidenceRepo = options.evidenceRepo
+        ? checkedRepo(options.evidenceRepo, 'evidenceRepo')
+        : issueRepo;
+    const token = options.token ?? readEnv('GITHUB_TOKEN');
+    if (!token) {
+        throw new TypeError('githubBugReporter: no GitHub token. Pass `token`, or set the GITHUB_TOKEN environment ' +
+            'variable on the server (a token belongs in the environment, not in the option in a ' +
+            `committed config file). Make it a FINE-GRAINED token — ${FINE_GRAINED_TOKEN_PAGE} — ` +
+            `scoped to just ${evidenceRepo === issueRepo ? issueRepo : `${issueRepo} and ${evidenceRepo}`}, ` +
+            'with Contents: read/write and Issues: read/write, and an expiry date. A classic PAT ' +
+            "grants those permissions across every repo the account can reach; this token's " +
+            'blast radius should be filing bug reports and nothing else.');
+    }
+    const apiBase = (options.apiBase ?? DEFAULT_API_BASE).replace(/\/+$/, '');
+    const dir = (options.dir ?? 'bug-reports').replace(/^\/+|\/+$/g, '');
+    const maxZipBytes = options.maxZipBytes ?? DEFAULT_MAX_ZIP_BYTES;
+    const doFetch = options._fetch ?? ((...args) => fetch(...args));
+    return {
+        async file(report) {
+            if (!report || !(report.zip instanceof Uint8Array) || !report.manifest) {
+                throw new TypeError('githubBugReporter.file: expected the object exportBugReport() returns ' +
+                    '({ manifest, files, zip, filename }).');
+            }
+            // 1. SIZE, before a byte moves. Refusing after a 24 MB upload wastes the
+            //    reporter's time and GitHub's, and the manifest already computed the
+            //    way out.
+            if (report.zip.length > maxZipBytes) {
+                throw new Error(`githubBugReporter: refusing to upload a ${formatBytes(report.zip.length)} bundle — ` +
+                    `the ceiling is ${formatBytes(maxZipBytes)}. GitHub accepts far larger files through the ` +
+                    `contents API, but a bundle this size is not one a maintainer opens. Send fewer ` +
+                    `units: ${trimAdvice(report)}`);
+            }
+            // 2. VISIBILITY. The doctrine's teeth: evidence is a real run, and a
+            //    public repo publishes it permanently.
+            const visibility = await readVisibility({ apiBase, evidenceRepo, token, doFetch });
+            if (visibility.checked &&
+                visibility.isPrivate === false &&
+                !options.acknowledgePublicEvidence) {
+                throw new Error(`githubBugReporter: refusing to commit evidence to '${evidenceRepo}', which is a ` +
+                    `PUBLIC repository. A bug-report bundle carries a real run — prompts, tool ` +
+                    `arguments, retrieved documents — and committing it here publishes all of it ` +
+                    `permanently. Point \`evidenceRepo\` at a private repo the maintainers can read ` +
+                    `(the issue can still go to the public one), or pass ` +
+                    `\`acknowledgePublicEvidence: true\` if this is intended.`);
+            }
+            // 3. COMMIT the zip.
+            const uploaded = await uploadZip({
+                apiBase,
+                evidenceRepo,
+                dir,
+                token,
+                doFetch,
+                report,
+                ...(options.branch !== undefined && { branch: options.branch }),
+            });
+            // 4. FILE the issue, pointing at it.
+            const issueUrl = await createIssue({
+                apiBase,
+                issueRepo,
+                token,
+                doFetch,
+                report,
+                zipUrl: uploaded.zipUrl,
+                zipPath: uploaded.zipPath,
+                evidenceRepo,
+                crossRepo: evidenceRepo !== issueRepo,
+                evidencePrivate: visibility.checked ? visibility.isPrivate : undefined,
+                ...(options.labels !== undefined && { labels: options.labels }),
+            });
+            return {
+                issueUrl,
+                zipUrl: uploaded.zipUrl,
+                zipPath: uploaded.zipPath,
+                evidenceRepo,
+                checkedVisibility: visibility.checked,
+                ...(visibility.checked && { evidenceRepoPrivate: visibility.isPrivate }),
+            };
+        },
+    };
+}
+/**
+ * Read the evidence repo's visibility.
+ *
+ * Never blocks on a permissions quirk: a token with `contents: write` but no
+ * metadata read is a legitimate configuration, and a bug report that cannot be
+ * filed because a GUARD could not run has failed at its one job. The result
+ * carries `checked: false` so the caller learns the guard was skipped.
+ */
+async function readVisibility(args) {
+    try {
+        const res = await args.doFetch(`${args.apiBase}/repos/${args.evidenceRepo}`, {
+            method: 'GET',
+            headers: githubHeaders(args.token),
+        });
+        if (!res.ok)
+            return { checked: false, isPrivate: false };
+        const body = (await res.json());
+        if (typeof body?.private !== 'boolean')
+            return { checked: false, isPrivate: false };
+        return { checked: true, isPrivate: body.private };
+    }
+    catch {
+        // A transport failure here is not the report's problem, and the error is
+        // deliberately not propagated — it is the one place where a thrown fetch
+        // could carry request headers into a message.
+        return { checked: false, isPrivate: false };
+    }
+}
+/** Commit the zip, suffixing the name if that path is already taken. */
+async function uploadZip(args) {
+    const base = args.report.filename.replace(/\.zip$/, '');
+    const content = toBase64(args.report.zip);
+    const title = args.report.manifest.report?.title ?? 'bug report';
+    // A name collision is ordinary (two reports of the same bug on the same day),
+    // and GitHub answers a create-without-sha on an existing path with 409/422.
+    // Suffix and retry rather than overwrite: the earlier bundle is somebody
+    // else's evidence.
+    for (let attempt = 1; attempt <= 5; attempt++) {
+        const path = `${args.dir}/${base}-${shortId()}.zip`;
+        const res = await request({
+            ...args,
+            url: `${args.apiBase}/repos/${args.evidenceRepo}/contents/${encodePath(path)}`,
+            method: 'PUT',
+            body: {
+                message: `bug report: ${title}`,
+                content,
+                ...(args.branch !== undefined && { branch: args.branch }),
+            },
+            what: `commit the evidence bundle to '${args.evidenceRepo}'`,
+            allowStatuses: [409, 422],
+        });
+        if (res.ok) {
+            const body = res.body;
+            const htmlUrl = typeof body?.content?.html_url === 'string'
+                ? body.content.html_url
+                : `https://github.com/${args.evidenceRepo}/blob/HEAD/${path}`;
+            return { zipUrl: htmlUrl, zipPath: path };
+        }
+        if (attempt === 5) {
+            throw new Error(`githubBugReporter: could not commit the evidence bundle to '${args.evidenceRepo}' — ` +
+                `five names in '${args.dir}/' were already taken (GitHub answered ${res.status}: ` +
+                `${res.message}). Check that the token has Contents: read/write there, or set ` +
+                `\`dir\` to somewhere less crowded.`);
+        }
+    }
+    /* istanbul ignore next — the loop always returns or throws. */
+    throw new Error('githubBugReporter: unreachable');
+}
+async function createIssue(args) {
+    const res = await request({
+        ...args,
+        url: `${args.apiBase}/repos/${args.issueRepo}/issues`,
+        method: 'POST',
+        body: {
+            title: args.report.manifest.report?.title ?? 'Bug report',
+            body: issueBody(args),
+            ...(args.labels && args.labels.length > 0 && { labels: [...args.labels] }),
+        },
+        what: `file the issue on '${args.issueRepo}'`,
+        allowStatuses: [],
+    });
+    const body = res.body;
+    return typeof body?.html_url === 'string'
+        ? body.html_url
+        : `https://github.com/${args.issueRepo}/issues`;
+}
+/**
+ * One request.
+ *
+ * Everything about the secrecy law lives here: the token goes into a header and
+ * nowhere else; a thrown fetch is re-wrapped so no implementation can smuggle
+ * its request (headers included) into the text; a non-2xx names the status and
+ * GitHub's `message` field ONLY — never the request body, which for the upload
+ * is the base64 of the evidence and for every call travelled beside the token.
+ */
+async function request(args) {
+    let res;
+    try {
+        res = await args.doFetch(args.url, {
+            method: args.method,
+            headers: { ...githubHeaders(args.token), 'content-type': 'application/json' },
+            body: JSON.stringify(args.body),
+        });
+    }
+    catch (err) {
+        throw new Error(`githubBugReporter: could not reach GitHub to ${args.what} (${transportReason(err)}). ` +
+            `Check the network and \`apiBase\`.`);
+    }
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch {
+        body = undefined;
+    }
+    const message = githubMessage(body);
+    if (res.ok)
+        return { ok: true, status: res.status, message, body };
+    if (args.allowStatuses.includes(res.status)) {
+        return { ok: false, status: res.status, message, body };
+    }
+    throw new Error(`githubBugReporter: GitHub answered ${res.status} when asked to ${args.what}` +
+        `${message ? ` — "${message}"` : ''}.${statusHint(res.status)}`);
+}
+/** GitHub's error envelope is `{ message, documentation_url, errors }`. Only
+ *  `message` is ever surfaced: `errors[]` can quote the request. */
+function githubMessage(body) {
+    const message = body?.message;
+    return typeof message === 'string' ? message.slice(0, 200) : '';
+}
+function statusHint(status) {
+    if (status === 401) {
+        return (` The token is missing, expired or revoked — mint a new fine-grained one ` +
+            `(${FINE_GRAINED_TOKEN_PAGE}).`);
+    }
+    if (status === 403) {
+        return (` The token is valid but not permitted here. A fine-grained token needs Contents: ` +
+            `read/write on the evidence repo and Issues: read/write on the issue repo, and it must ` +
+            `list BOTH repositories in its repository access.`);
+    }
+    if (status === 404) {
+        return (` Either the repository does not exist under that name, or the token cannot see it — ` +
+            `GitHub answers 404 rather than 403 for a private repo a token has no access to.`);
+    }
+    if (status === 410)
+        return ' Issues are disabled on that repository.';
+    return '';
+}
+function githubHeaders(token) {
+    return {
+        authorization: `Bearer ${token}`,
+        accept: 'application/vnd.github+json',
+        'x-github-api-version': '2022-11-28',
+    };
+}
+/** A short, payload-free reason. Never the error's own message: a fetch may put
+ *  the request — headers included — in it. */
+function transportReason(err) {
+    if (err instanceof Error) {
+        if (err.name === 'TimeoutError' || err.name === 'AbortError')
+            return 'the request timed out';
+        return err.name || 'network error';
+    }
+    return 'network error';
+}
+// ─── Small pure helpers ──────────────────────────────────────────────
+function checkedRepo(repo, option) {
+    if (typeof repo !== 'string' || !/^[^/\s]+\/[^/\s]+$/.test(repo)) {
+        throw new TypeError(`githubBugReporter: \`${option}\` must be 'owner/name' (e.g. 'acme/checkout-agent'), ` +
+            `not '${String(repo)}'. \`issueRepo\` is where the ISSUE is filed; \`evidenceRepo\` ` +
+            `is where the evidence ZIP is committed, and defaults to \`issueRepo\`.`);
+    }
+    return repo;
+}
+function readEnv(name) {
+    const env = globalThis.process
+        ?.env;
+    const value = env?.[name];
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+/** Base64 for the contents API. Node-only, and it says so by name. */
+function toBase64(bytes) {
+    const buffer = globalThis.Buffer;
+    if (!buffer) {
+        throw new Error('githubBugReporter is a server-side reporter and needs Node (it base64-encodes the ' +
+            'bundle with Buffer). In a browser, build the bundle with exportBugReport() and POST ' +
+            'it to your own server, which files it — a browser holding a GitHub token is a token ' +
+            'anyone with the page can read.');
+    }
+    return buffer.from(bytes).toString('base64');
+}
+/** Six characters of collision resistance in a filename. */
+function shortId() {
+    const random = globalThis
+        .crypto;
+    if (random?.getRandomValues) {
+        const bytes = random.getRandomValues(new Uint8Array(4));
+        return [...bytes]
+            .map((byte) => byte.toString(16).padStart(2, '0'))
+            .join('')
+            .slice(0, 6);
+    }
+    return Math.random().toString(36).slice(2, 8);
+}
+const encodePath = (path) => path.split('/').map(encodeURIComponent).join('/');
+/** The manifest already worked out what to drop; repeat it rather than invent. */
+function trimAdvice(report) {
+    const hints = report.manifest.oversize?.trimHints;
+    if (hints && hints.length > 0)
+        return hints.join(' ');
+    const biggest = [...report.manifest.units]
+        .filter((unit) => unit.kind === 'conversation')
+        .sort((left, right) => right.bytes - left.bytes)
+        .slice(0, 3);
+    return biggest.length > 0
+        ? `pass \`include\` to exportBugReport() without ${biggest
+            .map((unit) => `${unit.id} (${formatBytes(unit.bytes)})`)
+            .join(' / ')}.`
+        : 'pass `include` to exportBugReport() with fewer units.';
+}
+// ─── The issue body ──────────────────────────────────────────────────
+function issueBody(args) {
+    const { manifest } = args.report;
+    const fields = manifest.report;
+    const lines = [];
+    if (fields) {
+        lines.push('### Steps to reproduce', '', fields.stepsToReproduce, '');
+        lines.push('### Expected', '', fields.expected, '');
+        lines.push('### Actual', '', fields.actual, '');
+    }
+    lines.push('### The run is attached', '');
+    lines.push(`[\`${args.zipPath}\`](${args.zipUrl}) — the recorded run itself.`);
+    if (args.crossRepo) {
+        lines.push('', args.evidencePrivate === false
+            ? `The evidence is committed to \`${args.evidenceRepo}\`, a separate PUBLIC repository.`
+            : `The evidence is committed to \`${args.evidenceRepo}\`, a private repository visible ` +
+                `to maintainers — this issue links it but does not contain it.`);
+    }
+    lines.push('', 'Open it with `observeRecording()` (agentfootprint-lens) or the trace tools — ' +
+        '`recording.json` is the canon `{ snapshot, events, structure }`.', '');
+    lines.push('### What is in the bundle', '');
+    lines.push('| file | bytes | events | turns |', '|---|---:|---:|---:|');
+    for (const file of manifest.files) {
+        lines.push(`| \`${file.name}\` | ${file.bytes} | ${file.eventCount ?? ''} | ${file.turnCount ?? ''} |`);
+    }
+    lines.push('', `${manifest.counts.conversations} conversation(s), ${manifest.counts.runs} run(s), ` +
+        `${manifest.counts.events} event(s), ${manifest.counts.turns} turn(s), ` +
+        `${manifest.totalBytes} bytes uncompressed.`, '');
+    if (manifest.excluded.conversations > 0 || manifest.excluded.files > 0) {
+        lines.push(`**The reporter chose a subset.** Left out: ${manifest.excluded.conversations} ` +
+            `conversation(s) (${manifest.excluded.events} events, ${manifest.excluded.turns} ` +
+            `turns) and ${manifest.excluded.files} file(s).`, '');
+    }
+    lines.push('### Redacted keys', '', manifest.redactedKeys.length > 0
+        ? `Scrubbed at commit time by the run's redaction policy, listed by name only: ` +
+            `${manifest.redactedKeys.map((key) => `\`${key}\``).join(', ')}.`
+        : 'None — this run had no redaction policy, so every value in the bundle is real.', '');
+    const env = manifest.environment;
+    lines.push('### Environment', '');
+    lines.push('```');
+    lines.push(`agentfootprint  ${env.agentfootprint}`);
+    lines.push(`footprintjs     ${env.footprintjs}`);
+    lines.push(`node            ${env.node}`);
+    lines.push(`platform        ${env.platform}/${env.arch}`);
+    if (env.appVersion)
+        lines.push(`app             ${env.appVersion}`);
+    lines.push('```');
+    if (manifest.warnings.length > 0) {
+        lines.push('', '### Warnings', '');
+        for (const warning of manifest.warnings)
+            lines.push(`- ${warning}`);
+    }
+    if (manifest.notes.length > 0) {
+        lines.push('', '<details><summary>Notes about this bundle</summary>', '');
+        for (const note of manifest.notes)
+            lines.push(`- ${note}`);
+        lines.push('', '</details>');
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=githubBugReporter.js.map

package/dist/esm/adapters/observability/githubBugReporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"githubBugReporter.js","sourceRoot":"","sources":["../../../../src/adapters/observability/githubBugReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAG5D;;;2CAG2C;AAC3C,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAClD,MAAM,uBAAuB,GAAG,qDAAqD,CAAC;AAuEtF,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY;QACvC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CACjB,wFAAwF;YACtF,qFAAqF;YACrF,0DAA0D,uBAAuB,KAAK;YACtF,kBACE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,QAAQ,YAAY,EAC3E,IAAI;YACJ,sFAAsF;YACtF,iFAAiF;YACjF,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAA8B,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAE1F,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAiB;YAC1B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACvE,MAAM,IAAI,SAAS,CACjB,wEAAwE;oBACtE,uCAAuC,CAC1C,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,yEAAyE;YACzE,cAAc;YACd,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,2CAA2C,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY;oBACnF,kBAAkB,WAAW,CAC3B,WAAW,CACZ,gDAAgD;oBACjD,iFAAiF;oBACjF,UAAU,UAAU,CAAC,MAAM,CAAC,EAAE,CACjC,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,2CAA2C;YAC3C,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACnF,IACE,UAAU,CAAC,OAAO;gBAClB,UAAU,CAAC,SAAS,KAAK,KAAK;gBAC9B,CAAC,OAAO,CAAC,yBAAyB,EAClC,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,sDAAsD,YAAY,gBAAgB;oBAChF,4EAA4E;oBAC5E,8EAA8E;oBAC9E,iFAAiF;oBACjF,sDAAsD;oBACtD,0DAA0D,CAC7D,CAAC;YACJ,CAAC;YAED,qBAAqB;YACrB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC;gBAC/B,OAAO;gBACP,YAAY;gBACZ,GAAG;gBACH,KAAK;gBACL,OAAO;gBACP,MAAM;gBACN,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aAChE,CAAC,CAAC;YAEH,qCAAqC;YACrC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC;gBACjC,OAAO;gBACP,SAAS;gBACT,KAAK;gBACL,OAAO;gBACP,MAAM;gBACN,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,YAAY;gBACZ,SAAS,EAAE,YAAY,KAAK,SAAS;gBACrC,eAAe,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBACtE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aAChE,CAAC,CAAC;YAEH,OAAO;gBACL,QAAQ;gBACR,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,YAAY;gBACZ,iBAAiB,EAAE,UAAU,CAAC,OAAO;gBACrC,GAAG,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,mBAAmB,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;aACzE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAkD;IAElD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,UAAU,IAAI,CAAC,YAAY,EAAE,EAAE;YAC3E,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,yEAAyE;QACzE,8CAA8C;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,SAAS,CACtB,IAKC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,YAAY,CAAC;IAEjE,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,mBAAmB;IACnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,EAAE,MAAM,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC;YACxB,GAAG,IAAI;YACP,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,IAAI,CAAC,YAAY,aAAa,UAAU,CAAC,IAAI,CAAC,EAAE;YAC9E,MAAM,EAAE,KAAK;YACb,IAAI,EAAE;gBACJ,OAAO,EAAE,eAAe,KAAK,EAAE;gBAC/B,OAAO;gBACP,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;aAC1D;YACD,IAAI,EAAE,kCAAkC,IAAI,CAAC,YAAY,GAAG;YAC5D,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;SAC1B,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,GAAG,CAAC,IAA4D,CAAC;YAC9E,MAAM,OAAO,GACX,OAAO,IAAI,EAAE,OAAO,EAAE,QAAQ,KAAK,QAAQ;gBACzC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ;gBACvB,CAAC,CAAC,sBAAsB,IAAI,CAAC,YAAY,cAAc,IAAI,EAAE,CAAC;YAClE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,+DAA+D,IAAI,CAAC,YAAY,MAAM;gBACpF,kBAAkB,IAAI,CAAC,GAAG,0CAA0C,GAAG,CAAC,MAAM,IAAI;gBAClF,GAAG,GAAG,CAAC,OAAO,iEAAiE;gBAC/E,oCAAoC,CACvC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,+DAA+D;IAC/D,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IASC;IAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC;QACxB,GAAG,IAAI;QACP,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,IAAI,CAAC,SAAS,SAAS;QACrD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE;YACJ,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,YAAY;YACzD,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;SAC3E;QACD,IAAI,EAAE,sBAAsB,IAAI,CAAC,SAAS,GAAG;QAC7C,aAAa,EAAE,EAAE;KAClB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,CAAC,IAA8B,CAAC;IAChD,OAAO,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ;QACvC,CAAC,CAAC,IAAI,CAAC,QAAQ;QACf,CAAC,CAAC,sBAAsB,IAAI,CAAC,SAAS,SAAS,CAAC;AACpD,CAAC;AAsBD;;;;;;;;GAQG;AACH,KAAK,UAAU,OAAO,CAAC,IAAiB;IACtC,IAAI,GAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC7E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,GAAG,CAAC,KAAK;YACrF,oCAAoC,CACvC,CAAC;IACJ,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEpC,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,KAAK,CACb,sCAAsC,GAAG,CAAC,MAAM,kBAAkB,IAAI,CAAC,IAAI,EAAE;QAC3E,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAClE,CAAC;AACJ,CAAC;AAED;oEACoE;AACpE,SAAS,aAAa,CAAC,IAAa;IAClC,MAAM,OAAO,GAAI,IAA0C,EAAE,OAAO,CAAC;IACrE,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,CACL,0EAA0E;YAC1E,IAAI,uBAAuB,IAAI,CAChC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,CACL,mFAAmF;YACnF,wFAAwF;YACxF,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,CACL,sFAAsF;YACtF,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,0CAA0C,CAAC;IACtE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO;QACL,aAAa,EAAE,UAAU,KAAK,EAAE;QAChC,MAAM,EAAE,6BAA6B;QACrC,sBAAsB,EAAE,YAAY;KACrC,CAAC;AACJ,CAAC;AAED;8CAC8C;AAC9C,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,uBAAuB,CAAC;QAC7F,OAAO,GAAG,CAAC,IAAI,IAAI,eAAe,CAAC;IACrC,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,wEAAwE;AAExE,SAAS,WAAW,CAAC,IAAY,EAAE,MAAoC;IACrE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,SAAS,CACjB,wBAAwB,MAAM,wDAAwD;YACpF,QAAQ,MAAM,CAAC,IAAI,CAAC,iEAAiE;YACrF,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,GAAG,GAAI,UAAyE,CAAC,OAAO;QAC5F,EAAE,GAAG,CAAC;IACR,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,sEAAsE;AACtE,SAAS,QAAQ,CAAC,KAAiB;IACjC,MAAM,MAAM,GACV,UACD,CAAC,MAAM,CAAC;IACT,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,oFAAoF;YAClF,sFAAsF;YACtF,sFAAsF;YACtF,gCAAgC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,4DAA4D;AAC5D,SAAS,OAAO;IACd,MAAM,MAAM,GAAI,UAA+E;SAC5F,MAAM,CAAC;IACV,IAAI,MAAM,EAAE,eAAe,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,KAAK,CAAC;aACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aACjD,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/F,kFAAkF;AAClF,SAAS,UAAU,CAAC,MAAiB;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAClD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;SACvC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC;SAC9C,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;SAC/C,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACf,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,iDAAiD,OAAO;aACrD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,KAAK,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;aACxD,IAAI,CAAC,KAAK,CAAC,GAAG;QACnB,CAAC,CAAC,uDAAuD,CAAC;AAC9D,CAAC;AAED,wEAAwE;AAExE,SAAS,SAAS,CAAC,IAOlB;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,OAAO,IAAI,CAAC,MAAM,8BAA8B,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CACR,EAAE,EACF,IAAI,CAAC,eAAe,KAAK,KAAK;YAC5B,CAAC,CAAC,kCAAkC,IAAI,CAAC,YAAY,mCAAmC;YACxF,CAAC,CAAC,kCAAkC,IAAI,CAAC,YAAY,mCAAmC;gBACpF,+DAA+D,CACtE,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,+EAA+E;QAC7E,kEAAkE,EACpE,EAAE,CACH,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;IAC5C,KAAK,CAAC,IAAI,CAAC,mCAAmC,EAAE,sBAAsB,CAAC,CAAC;IACxE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CACR,OAAO,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,UAAU,IAAI,EAAE,MAAM,IAAI,CAAC,SAAS,IAAI,EAAE,IAAI,CAC5F,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,qBAAqB,QAAQ,CAAC,MAAM,CAAC,IAAI,WAAW;QAClF,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,cAAc,QAAQ,CAAC,MAAM,CAAC,KAAK,YAAY;QACxE,GAAG,QAAQ,CAAC,UAAU,sBAAsB,EAC9C,EAAE,CACH,CAAC;IAEF,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACvE,KAAK,CAAC,IAAI,CACR,8CAA8C,QAAQ,CAAC,QAAQ,CAAC,aAAa,GAAG;YAC9E,oBAAoB,QAAQ,CAAC,QAAQ,CAAC,MAAM,YAAY,QAAQ,CAAC,QAAQ,CAAC,KAAK,GAAG;YAClF,cAAc,QAAQ,CAAC,QAAQ,CAAC,KAAK,WAAW,EAClD,EAAE,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CACR,mBAAmB,EACnB,EAAE,EACF,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAC9B,CAAC,CAAC,8EAA8E;YAC5E,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACrE,CAAC,CAAC,gFAAgF,EACpF,EAAE,CACH,CAAC;IAEF,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC;IACjC,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,GAAG,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAElB,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,qDAAqD,EAAE,EAAE,CAAC,CAAC;QAC1E,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/esm/adapters/observability/githubDeviceSignIn.d.ts

@@ -0,0 +1,131 @@
+/**
+ * githubDeviceSignIn — let the REPORTER sign in, so the issue is filed as them.
+ *
+ *   import { githubDeviceSignIn } from 'agentfootprint/observe';
+ *
+ *   const signIn = await githubDeviceSignIn({ clientId: 'Iv1.0123456789abcdef' });
+ *   show(`Go to ${signIn.verificationUri} and enter ${signIn.userCode}`);
+ *   const { token, login } = await signIn.completed;   // resolves on authorize
+ *
+ * GitHub's OAuth **device flow**, spoken as three plain `fetch` calls and
+ * nothing else: request a code, show it to the human, poll until they approve.
+ * Zero dependencies, and it runs in a browser as well as on a server — there is
+ * no client secret in this flow, which is exactly why it is the one that works
+ * from a page.
+ *
+ * ## Why this exists beside a server token
+ *
+ * A server-side PAT files every report as the application. That is right for an
+ * automated "Report a problem" button: the app owns the repo, the app owns the
+ * token. It is wrong when the value is ATTRIBUTION — a field tester filing
+ * upstream should appear as themselves, so a maintainer can ask them a
+ * follow-up question and so their report counts as theirs.
+ *
+ * | | server PAT | device sign-in |
+ * |---|---|---|
+ * | Who the issue is from | the application | the reporter |
+ * | Where the token lives | server environment | the reporter's session, in memory |
+ * | Human steps | none | one: enter a code, approve |
+ * | Right for | in-app "report a problem" | field testers filing upstream |
+ *
+ * The token this returns is handed to {@link githubBugReporter} as `token`,
+ * with no special-casing anywhere: a token is a token.
+ *
+ * ## Keep it in memory, for the session only
+ *
+ * **Never `localStorage`, never a cookie, never a log line.** A device-flow
+ * token is a live credential for the account that approved it; persisting it in
+ * a browser turns one XSS into a lasting account compromise. Hold it in a
+ * variable, use it, drop it when the tab closes.
+ *
+ * ## Scopes are coarse here, and that is GitHub's design
+ *
+ * The device flow issues a CLASSIC OAuth token, and classic scopes are coarse:
+ * `public_repo` (the default here) grants write across every public repository
+ * the account can reach, and `repo` grants it across private ones too. There is
+ * no fine-grained equivalent in this flow. That trade buys attribution — the
+ * issue is really from that person — and it is the reason the default stops at
+ * `public_repo`: filing an issue needs no more, and the token disappears with
+ * the session. Where least privilege matters more than attribution, use a
+ * fine-grained PAT on a server instead (see {@link githubBugReporter}).
+ *
+ * ## The collaborator caveat, stated rather than discovered
+ *
+ * A reporter who signs in as themselves can file an issue on a public repo, and
+ * can commit evidence ONLY to a repository they can write to. Pointing
+ * `evidenceRepo` at a private repo the reporter is not a collaborator on will
+ * fail with a 404 (GitHub hides private repos from tokens that cannot see
+ * them). Either add the reporter as a collaborator, or let them attach the zip
+ * to the issue by hand — `exportBugReport` gives them the file either way.
+ *
+ * ## Secrecy
+ *
+ * The token appears in no message this module can produce. The three failure
+ * shapes of the flow — the human denied it, the code expired, the poll was
+ * aborted — are named plainly, with GitHub's `error_description` only, never a
+ * response body or a request.
+ */
+export interface GithubDeviceSignInOptions {
+    /**
+     * The OAuth App's client id. **Public by design** — the device flow has no
+     * client secret, so this belongs in your front-end code. Create the app once
+     * under the organisation, tick "Enable Device Flow", and copy the id.
+     */
+    readonly clientId: string;
+    /**
+     * Classic OAuth scopes. Default `['public_repo']` — enough to file an issue
+     * and commit to a public evidence repo, and no more. `['repo']` is what a
+     * private evidence repo needs, and it is a much larger grant; ask for it only
+     * when the flow really commits there.
+     */
+    readonly scopes?: readonly string[];
+    /** Cancel the polling (a closed dialog, an unmounted component). */
+    readonly signal?: AbortSignal;
+    /** GitHub's web origin. GHES: `https://github.your-company.com`. */
+    readonly authBase?: string;
+    /** GitHub's API root. GHES: `https://github.your-company.com/api/v3`. */
+    readonly apiBase?: string;
+    /** Test seam — inject `fetch`. Bypasses the network entirely. */
+    readonly _fetch?: typeof fetch;
+    /** Test seam — inject the wait between polls. */
+    readonly _sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+}
+/** Who signed in, and with what. */
+export interface GithubDeviceIdentity {
+    /** The access token. Memory-only; see the module docs. */
+    readonly token: string;
+    /** Usually `bearer`. */
+    readonly tokenType: string;
+    /** The scopes GitHub actually granted — not necessarily the ones asked for. */
+    readonly scopes: readonly string[];
+    /** The GitHub login the issue will be filed as. `undefined` if `/user` refused. */
+    readonly login?: string;
+}
+/** The code to show a human, and the promise that resolves when they approve. */
+export interface GithubDeviceSignIn {
+    /** The code the human types — show it verbatim, it is case-sensitive. */
+    readonly userCode: string;
+    /** The page they type it into. */
+    readonly verificationUri: string;
+    /** Seconds until `userCode` stops working. */
+    readonly expiresIn: number;
+    /** Seconds GitHub asked us to wait between polls. */
+    readonly interval: number;
+    /**
+     * Resolves when the human approves, rejects when they deny it, when the code
+     * expires, or when `signal` aborts. Polling starts immediately — awaiting
+     * this later does not miss an approval.
+     */
+    readonly completed: Promise<GithubDeviceIdentity>;
+}
+/**
+ * Start a device-flow sign-in.
+ *
+ * Resolves as soon as GitHub hands back a code — that is the point, because
+ * the human cannot approve a code they have not been shown. The waiting happens
+ * on the returned `completed` promise.
+ *
+ * @throws TypeError when `clientId` is missing (naming where it comes from).
+ * @throws Error naming the status when GitHub refuses to issue a code.
+ */
+export declare function githubDeviceSignIn(options: GithubDeviceSignInOptions): Promise<GithubDeviceSignIn>;