agor-live 0.22.0 → 0.23.2

package/dist/git/index.d.ts

@@ -0,0 +1,533 @@
+/**
+ * Operational Git Utilities for Agor
+ *
+ * Provides Git operations for repo management and branch isolation shared by daemon compatibility paths and executor commands.
+ * Supports SSH keys, user environment variables (GITHUB_TOKEN), and system credential helpers.
+ *
+ * When branch RBAC is enabled, git operations run via `sudo su -` to ensure
+ * fresh Unix group memberships (groups are cached at login time).
+ */
+import { simpleGit } from 'simple-git';
+export type RepoCloneErrorCategory = 'auth_failed' | 'not_found' | 'network' | 'unknown';
+/**
+ * Validate a user-supplied git ref (branch name, tag) before it is passed to
+ * git subcommands.
+ *
+ * A ref that starts with `-` (e.g. `--upload-pack=/tmp/payload`) would be
+ * interpreted as an option by git, giving an attacker code execution. Even
+ * with `--` separators as defence-in-depth, callers must validate the ref
+ * itself too.
+ *
+ * Rules:
+ *  - Must be a non-empty string.
+ *  - Must NOT start with `-` (option injection).
+ *  - Must NOT contain whitespace, newlines, or NUL bytes.
+ *  - Must pass `git check-ref-format --branch <ref>`.
+ *
+ * Callers must await this and bail out on rejection.
+ */
+export declare function validateGitRef(ref: unknown): Promise<void>;
+/**
+ * Build the argv for `git worktree add`, always inserting a `--` separator
+ * before positional arguments.
+ *
+ * Even when {@link validateGitRef} has rejected option-shaped refs, we keep
+ * the `--` separator as defence-in-depth — any value that slips through (e.g.
+ * a future regression in validation, or a sourceBranch path) is still forced
+ * into positional-argument semantics.
+ *
+ * Named for the underlying `git worktree add` CLI primitive rather than the
+ * Agor "branch" entity it materialises — the carve-out keeps `worktree` in
+ * names that wrap the git CLI directly, so a reader of this module isn't
+ * misled into thinking "branch" here means a git branch.
+ *
+ * Exported so tests can assert the argv shape without spawning a real git.
+ */
+export declare function buildWorktreeAddArgs(params: {
+    branchPath: string;
+    ref: string;
+    createBranch: boolean;
+    sourceBranch?: string;
+    refType?: 'branch' | 'tag';
+    fetchSucceeded: boolean;
+}): string[];
+export interface GitRemoteCredentialFinding {
+    configPath: string;
+    remote: string;
+    key: 'url' | 'pushurl';
+    redactedUrl: string;
+    sanitizedUrl: string;
+}
+export interface GitRemoteCredentialScanResult {
+    repoPath: string;
+    configPaths: string[];
+    findings: GitRemoteCredentialFinding[];
+}
+export interface GitRemoteCredentialScrubResult extends GitRemoteCredentialScanResult {
+    changed: boolean;
+}
+/**
+ * Scan a repo or worktree for credential-bearing remote URLs in its git config
+ * without invoking git. For worktree pointer files, this checks both the
+ * per-worktree gitdir and the shared common `.git/config`.
+ */
+export declare function scanGitConfigRemoteCredentials(repoPath: string): Promise<GitRemoteCredentialScanResult>;
+/**
+ * Repair credential-bearing remote URL entries in `.git/config` by replacing
+ * each `remote.<name>.url` / `pushurl` value with the same URL minus userinfo.
+ * Findings contain only redacted/sanitized values.
+ */
+export declare function scrubGitConfigRemoteCredentials(repoPath: string): Promise<GitRemoteCredentialScrubResult>;
+/**
+ * Bucket a git error message into a coarse category so callers (UI, MCP) can
+ * suggest the right next step.
+ *
+ * Returns the canonical `RepoCloneErrorCategory` union from `@agor/core/types`
+ * so callers can persist it onto `Repo.clone_error.category` without redeclaring
+ * the values. The matching is intentionally loose — git's stderr varies across
+ * versions and remotes, and a false-positive `auth_failed` is cheaper than
+ * `unknown` for the user trying to recover. `'auth_failed'` is the bucket whose
+ * copy points users at Settings → API Keys (the most common reason private
+ * clones silently failed pre-#1126).
+ */
+export declare function categorizeGitError(stderr: string): RepoCloneErrorCategory;
+/**
+ * Mask `GIT_CONFIG_VALUE_<n>` entries carrying an `Authorization:` header.
+ * Use before serialising env into logs / error reports. The match is loose
+ * on purpose — a false-positive redaction is cheaper than a leaked token.
+ */
+export declare function redactGitEnv(env: Record<string, string | undefined>): Record<string, string>;
+/**
+ * Create a configured simple-git instance.
+ *
+ * Unix-user impersonation is handled upstream when spawning the executor;
+ * per-user credentials reach this function via `env` (e.g. from
+ * `users.getGitEnvironment`).
+ *
+ * When `env.GITHUB_TOKEN` / `env.GH_TOKEN` is set, the token is fed to git as
+ * `http.https://<authHost>/.extraheader` via the `GIT_CONFIG_COUNT/KEY/VALUE`
+ * env trio — keeping it off argv (where simple-git's `config: [...]` would
+ * put it, exposed via `ps`, audit logs, error reports). Per-host scoping
+ * prevents a GitHub Enterprise token from reaching github.com (or vice versa).
+ *
+ * `GIT_CONFIG_GLOBAL=/dev/null` blocks inheritance from the daemon user's
+ * `~/.gitconfig` (which may carry an ambient `credential.helper` from
+ * `gh auth login` that would silently leak the daemon's identity). Git ops
+ * run as the daemon user (see `git-impersonation.ts`), so HOME is the
+ * daemon's; if that ever changes to a true uid switch this must be removed.
+ * `/etc/gitconfig` is intentionally NOT killed — admin policy territory
+ * (CA bundles, proxies, safe.directory).
+ *
+ * **env isolation**: `GIT_CONFIG_GLOBAL=/dev/null` and `GIT_TERMINAL_PROMPT=0` are
+ * only set when `env` is provided (or an auth token is found in it). Callers
+ * that omit `env` (e.g. `createGit(branchPath)`) intentionally inherit the
+ * daemon process environment so they can read `/etc/gitconfig`, `safe.directory`,
+ * and other admin-policy config. They still get the `unsafe.*` scanner opt-ins.
+ *
+ * @param authHost - Host to scope the auth header to. When omitted, falls back
+ *                   to github.com; callers should derive this via
+ *                   {@link parseHostFromGitUrl} or {@link resolveAuthHost}.
+ */
+export declare function createGit(baseDir?: string, env?: Record<string, string>, authHost?: string): {
+    git: ReturnType<typeof simpleGit>;
+};
+/**
+ * Build a git client pre-scoped for talking to `remoteUrl`. Centralises the
+ * "derive the auth-header host from the URL, then call createGit" two-step
+ * that every remote-talking helper needs (cloneRepo, createBranchAsClone, …).
+ * Keep call sites focused on their domain logic instead of repeating the
+ * auth-host derivation.
+ */
+export declare function createGitForRemote(remoteUrl: string, env?: Record<string, string>): {
+    git: ReturnType<typeof simpleGit>;
+};
+/**
+ * Register `path` as a git `safe.directory` in the daemon user's global
+ * gitconfig. Multi-user setups (branches owned by one uid, accessed by
+ * another) trip "dubious ownership" otherwise. Non-fatal: logs a warning
+ * and returns on failure, since the branch itself is already on disk.
+ *
+ * IMPORTANT: never pass user env here. `createGit(_, env)` activates the
+ * impersonation isolation block (`GIT_CONFIG_GLOBAL=/dev/null`), and
+ * `addConfig(..., 'global')` writes to whatever `GIT_CONFIG_GLOBAL` points
+ * at — git would try to lock `/dev/null` and fail with permission denied.
+ * The safe.directory entry belongs in the daemon user's real `~/.gitconfig`
+ * so daemon-side git ops (which do not load /dev/null) can find it.
+ */
+export declare function addSafeDirectoryBestEffort(path: string, logPrefix?: string): Promise<void>;
+export interface CloneOptions {
+    url: string;
+    targetDir?: string;
+    bare?: boolean;
+    /**
+     * Pin the working tree to a specific branch instead of the remote's HEAD.
+     * Forwarded as `git clone --branch <name>`. Used when the operator wants
+     * the repo's effective base to be a non-default branch — e.g. so `.agor.yml`
+     * on a feature branch is what the daemon reads at clone time.
+     */
+    branch?: string;
+    onProgress?: (progress: CloneProgress) => void;
+    env?: Record<string, string>;
+}
+export interface CloneProgress {
+    method: string;
+    stage: string;
+    progress: number;
+    processed?: number;
+    total?: number;
+}
+export interface CloneResult {
+    path: string;
+    repoName: string;
+    defaultBranch: string;
+}
+export { buildAuthHeaderEnv, buildGitConfigEnv, buildGitConfigParameters, extractRepoName, getBranchesDir, getBranchPath, getReposDir, gitUrlHasUserinfo, isLikelyGitToken, parseHostFromGitUrl, redactGitUrlCredentials, stripGitUrlCredentials, } from './pure';
+/**
+ * Clone a Git repository to ~/.agor/repos/<name>
+ */
+export declare function cloneRepo(options: CloneOptions): Promise<CloneResult>;
+/**
+ * Check if a directory is a Git repository
+ */
+/**
+ * Validate that a path points to a git repository
+ *
+ * This checks both filesystem existence and git metadata.
+ */
+export declare function isValidGitRepo(path: string): Promise<boolean>;
+/**
+ * @deprecated Use `isValidGitRepo` instead.
+ *
+ * Kept for backwards compatibility.
+ */
+export declare function isGitRepo(path: string): Promise<boolean>;
+/**
+ * Get current branch name
+ */
+export declare function getCurrentBranch(repoPath: string): Promise<string>;
+/**
+ * Get repository's default branch
+ *
+ * This is the branch that the remote HEAD points to (e.g., 'main', 'master', 'develop').
+ * Uses git symbolic-ref to determine the default branch accurately.
+ *
+ * @param repoPath - Path to repository
+ * @param remote - Remote name (default: 'origin')
+ * @returns Default branch name (e.g., 'main')
+ */
+export declare function getDefaultBranch(repoPath: string, remote?: string): Promise<string>;
+/**
+ * Get current commit SHA
+ */
+export declare function getCurrentSha(repoPath: string): Promise<string>;
+/**
+ * Check if working directory is clean (no uncommitted changes)
+ */
+export declare function isClean(repoPath: string): Promise<boolean>;
+/**
+ * Get remote URL
+ */
+export declare function getRemoteUrl(repoPath: string, remote?: string): Promise<string | null>;
+/**
+ * `previousUrl` is newline-joined when the prior state was multi-valued (git
+ * config legally allows that). Callers logging this MUST redact — values can
+ * carry credentials.
+ */
+export interface EnsureRemoteUrlResult {
+    changed: boolean;
+    previousUrl: string | undefined;
+}
+/**
+ * Realign `remote.<name>.url` to `expectedUrl`, leaving other remotes alone.
+ * No-op when already matching; deliberately does NOT create the remote when
+ * absent. Caller must trust `expectedUrl` (no validation here).
+ *
+ * Uses raw `git config --get-all` / `--replace-all` to handle the multi-value
+ * case (`--add` semantics) — `simple-git.getRemotes()` surfaces only one
+ * value, and `git remote set-url` errors when the key is multi-valued.
+ */
+export declare function ensureGitRemoteUrl(repoPath: string, remoteName: string, expectedUrl: string, env?: Record<string, string>): Promise<EnsureRemoteUrlResult>;
+/**
+ * Parsed entry from `git worktree list --porcelain` output. Describes a
+ * git-worktree primitive — not the Agor Branch entity (which carries env
+ * config, board placement, owners, etc. on top of this).
+ */
+export interface GitWorktreeInfo {
+    name: string;
+    path: string;
+    ref: string;
+    sha: string;
+    detached: boolean;
+}
+/**
+ * Create a git branch
+ */
+export declare function createBranch(repoPath: string, branchPath: string, ref: string, createBranch?: boolean, pullLatest?: boolean, sourceBranch?: string, env?: Record<string, string>, refType?: 'branch' | 'tag'): Promise<void>;
+/**
+ * Options for {@link createBranchAsClone} — the self-standing-clone
+ * counterpart to {@link createBranch}.
+ *
+ * Branch storage mode = 'clone' produces a working directory whose `.git/`
+ * is a real directory (not a `gitdir:` pointer file), with its own
+ * `.git/config`, refs, and credentials surface. Closes the cross-branch
+ * leak vectors that the Layer A defenses exist to mitigate. See
+ * `context/explorations/clone-redesign.md` §1.
+ */
+export interface CreateBranchAsCloneOptions {
+    /** Remote URL to clone from (https://, ssh://, git@host:path, file://, or local path). */
+    remoteUrl: string;
+    /** Absolute path where the new clone should land. Must not already exist. */
+    targetPath: string;
+    /**
+     * Branch to clone. Forwarded as `git clone --branch <ref>`. The remote
+     * must already have this ref. When {@link newBranchName} is also set,
+     * this is the *base* ref the new branch is created off (the typical
+     * "feature off main" flow).
+     */
+    ref: string;
+    /**
+     * Optional new branch to create after the clone, via
+     * `git checkout -b <newBranchName>` against the cloned tip of {@link ref}.
+     * Use this when the caller wants `createBranch=true` semantics in
+     * clone-mode: the remote doesn't have the new branch yet, so we clone
+     * the source and fork locally. Omit to just check out `ref` directly.
+     */
+    newBranchName?: string;
+    /**
+     * Optional shallow-clone depth. Positive integer → `--depth N`. Omit (or
+     * pass `undefined`) for a full clone with complete history.
+     */
+    depth?: number;
+    /**
+     * `--single-branch`. Defaults to `true` — we only need the one branch we
+     * just asked for, and skipping the rest is cheaper. Pass `false` for the
+     * rare case where you want every remote ref locally.
+     */
+    singleBranch?: boolean;
+    /**
+     * Optional `git clone --reference <path>` object-cache borrow.
+     *
+     * When set AND the path exists on the calling process's filesystem at
+     * runtime, this turns the per-branch `.git/objects/` into an `alternates`
+     * pointer at `<path>/.git/objects/` — disk drops from "full pack copy"
+     * (hundreds of MB for big repos) to "a few MB of refs/config". The
+     * config/credentials isolation that clone mode buys is preserved: only
+     * the immutable object store is shared with the daemon-owned base clone.
+     *
+     * When set but the path does NOT exist (executor running in a different
+     * mount, base clone not yet seeded, etc.), the `--reference` flag is
+     * silently dropped and a regular clone runs — at higher disk cost but
+     * still correct. This lets the daemon hand the executor a "use this if
+     * you have it" hint without coupling the two filesystems.
+     *
+     * NEVER paired with `--dissociate`: dissociate copies all reachable
+     * objects out of the reference into the new clone (~equivalent to a
+     * naïve clone), defeating the purpose. See design doc §5.
+     *
+     * Operational caveat: `git gc --prune=now` against the reference can
+     * orphan objects that branches' alternates pointers still depend on.
+     * Daemon-side base-cache management must avoid `--prune=now` (a future
+     * `branch_storage.base_cache_gc_prune` config knob will enforce this).
+     */
+    referencePath?: string;
+    /** Per-user environment variables (GITHUB_TOKEN, GH_TOKEN, …). */
+    env?: Record<string, string>;
+}
+/**
+ * Result of {@link createBranchAsClone}. Shape mirrors what the executor
+ * handler wants out of {@link createBranch} so the call sites can stay
+ * uniform across storage modes.
+ */
+export interface CreateBranchAsCloneResult {
+    /** Absolute path of the created clone (echoes back `targetPath`). */
+    path: string;
+    /**
+     * Branch the working tree is actually on after the call. Equal to
+     * `newBranchName` when set (post-checkout); otherwise equal to `ref`.
+     */
+    ref: string;
+}
+export interface AssertRemoteRefVisibleForCloneOptions {
+    /** Remote URL/path that clone-mode will pass to `git clone`. */
+    remoteUrl: string;
+    /** Branch/tag name that clone-mode will pass to `git clone --branch`. */
+    ref: string;
+    /** Which namespace to check. Defaults to branch refs. */
+    refType?: 'branch' | 'tag';
+    /** Per-user environment variables (GITHUB_TOKEN, GH_TOKEN, …). */
+    env?: Record<string, string>;
+}
+/**
+ * Preflight a clone-mode base ref before Agor persists any branch/session
+ * records. Clone mode can only materialise refs visible from the clone remote
+ * (typically `origin`); a local-only branch in the daemon's base clone is not
+ * cloneable via `git clone --branch`.
+ */
+export declare function assertRemoteRefVisibleForClone(options: AssertRemoteRefVisibleForCloneOptions): Promise<void>;
+/**
+ * Create a self-standing clone of a remote at `targetPath` and check out a
+ * branch. Sibling to {@link createBranch}; chosen at branch-create time
+ * by the `storage_mode = 'clone'` opt-in.
+ *
+ * Two flows:
+ *  - Without `newBranchName`: clone `ref` directly. Equivalent to
+ *    `git clone --branch <ref> [--depth N] --single-branch <remoteUrl> <targetPath>`.
+ *  - With `newBranchName`: clone `ref` as the base, then
+ *    `git checkout -b <newBranchName>`. This is the typical "feature off
+ *    main" flow that the create-time UI emits; the new branch doesn't
+ *    exist on the remote yet, so we can't `git clone --branch <new>`.
+ *
+ * Unlike {@link createBranch}, this issues a real `git clone` and does
+ * not touch the per-repo base clone at `~/.agor/repos/<slug>/`. The
+ * resulting working directory has its own `.git/` directory — `.git/config`,
+ * remotes, credentials, hooks, and refs are all branch-local.
+ *
+ * Implemented via `simple-git`; no `execSync`/`spawn`. Credentials are
+ * delivered via `http.<host>.extraheader` env vars exactly like
+ * {@link cloneRepo}, never on argv.
+ *
+ * @throws if `targetPath` already exists, either ref is invalid, the
+ *         underlying clone fails (network, auth, missing base ref, …), or
+ *         the post-clone `checkout -b` fails.
+ */
+export declare function createBranchAsClone(options: CreateBranchAsCloneOptions): Promise<CreateBranchAsCloneResult>;
+/**
+ * Result of a branch restoration attempt
+ */
+export interface RestoreBranchResult {
+    success: boolean;
+    /** Which strategy was used: 'checkout' (existing branch) or 'create' (new branch from base) */
+    strategy: 'checkout' | 'create';
+    /** Error message if restoration failed */
+    error?: string;
+}
+/**
+ * Restore a branch directory by checking out the branch or creating it from a base ref.
+ *
+ * Shared logic used by both:
+ * - `sync-unix` CLI command (restore action for failed branches)
+ * - `unarchive()` daemon method (via executor's git.branch.add command)
+ *
+ * Strategy:
+ * 1. Fetch from remote to ensure we have latest refs
+ * 2. Check if the branch exists on the remote via `ls-remote`
+ * 3. If YES: `createBranch(repoPath, path, ref, false)` — checkout existing branch
+ * 4. If NO: `createBranch(repoPath, path, ref, true, true, baseRef)` — create new branch from base
+ *
+ * This is safe because we only create a new branch when `ls-remote` confirms it
+ * doesn't exist on the remote, avoiding the orphan cleanup force-delete risk
+ * in `createBranch()`.
+ *
+ * @param repoPath - Absolute path to the base repository
+ * @param branchPath - Absolute path where the branch should be created
+ * @param ref - Branch name to restore
+ * @param baseRef - Fallback base branch (e.g., 'main') if ref doesn't exist on remote
+ * @param env - Optional environment variables for git operations (GITHUB_TOKEN, etc.)
+ */
+export declare function restoreBranchFilesystem(repoPath: string, branchPath: string, ref: string, baseRef: string, env?: Record<string, string>): Promise<RestoreBranchResult>;
+/**
+ * List git-worktree entries registered with a repository (parsed
+ * `git worktree list --porcelain` output).
+ *
+ * Wraps the git-CLI primitive, so the name reflects what git sees ("worktrees"
+ * with a real `.git/worktrees/<name>/` entry in the base repo). Agor "branches"
+ * in clone storage mode are not git worktrees of the base repo and won't appear
+ * here — that's intentional; callers wanting the canonical list of Agor
+ * branches should use `BranchRepository`.
+ */
+export declare function listGitWorktrees(repoPath: string): Promise<GitWorktreeInfo[]>;
+/**
+ * Remove a git-worktree entry from the base repo (`git worktree remove --force`).
+ *
+ * Wraps the git CLI directly — the name reflects the primitive, not the
+ * Agor "Branch" entity. Branches in clone storage mode aren't registered as
+ * git worktrees of the base repo and shouldn't go through this path.
+ */
+export declare function removeGitWorktree(repoPath: string, branchName: string): Promise<void>;
+/**
+ * Clean a git branch (remove untracked files and build artifacts)
+ *
+ * Runs git clean -fdx which removes:
+ * - Untracked files and directories (-f -d)
+ * - Ignored files (node_modules, build artifacts, etc.) (-x)
+ *
+ * Preserves:
+ * - .git directory
+ * - Tracked files
+ * - Git state (commits, branches)
+ *
+ * In multi-user branches, files may be owned by different users (e.g., build artifacts
+ * created by different user sessions). This function attempts to fix ownership before
+ * cleaning to ensure all files can be removed.
+ *
+ * @param branchPath - Absolute path to the branch directory
+ * @param fixOwnership - Whether to attempt ownership fix via sudo (default: true)
+ * @returns Disk space freed in bytes (approximate based on removed file count)
+ */
+export declare function cleanBranch(branchPath: string, fixOwnership?: boolean): Promise<{
+    filesRemoved: number;
+}>;
+/**
+ * Prune stale git-worktree metadata (`git worktree prune`).
+ *
+ * Wraps the git CLI directly — used after manual filesystem removal to
+ * tell git to drop the stale `.git/worktrees/<name>/` administrative entry.
+ */
+export declare function pruneGitWorktrees(repoPath: string): Promise<void>;
+/**
+ * Check if a remote branch exists
+ */
+export declare function hasRemoteBranch(repoPath: string, branchName: string, remote?: string): Promise<boolean>;
+/**
+ * Get list of remote branches
+ */
+export declare function getRemoteBranches(repoPath: string, remote?: string): Promise<string[]>;
+/**
+ * Get git state for a repository (SHA + dirty status)
+ *
+ * Returns the current commit SHA with "-dirty" suffix if working directory has uncommitted changes.
+ * If not in a git repo or SHA cannot be determined, returns "unknown".
+ *
+ * Examples:
+ * - "abc123def456" (clean working directory)
+ * - "abc123def456-dirty" (uncommitted changes)
+ * - "unknown" (not a git repo or error)
+ */
+export declare function getGitState(repoPath: string): Promise<string>;
+/**
+ * Delete a repository directory from filesystem
+ *
+ * Removes the repository directory and all its contents from ~/.agor/repos/.
+ * This is typically used when deleting a remote repository that was cloned by Agor.
+ *
+ * @param repoPath - Absolute path to the repository directory
+ * @throws Error if the path is not inside ~/.agor/repos/ (safety check)
+ */
+export declare function deleteRepoDirectory(repoPath: string): Promise<void>;
+/**
+ * Delete a branch directory from filesystem
+ *
+ * Removes the branch directory and all its contents from the branches directory.
+ *
+ * @param branchPath - Absolute path to the branch directory
+ * @throws Error if the path is not inside the configured branches directory (safety check)
+ */
+export declare function deleteBranchDirectory(branchPath: string): Promise<void>;
+/**
+ * Delete a local git branch
+ *
+ * Uses -D (force delete) to handle branches that haven't been merged.
+ * Silently succeeds if the branch doesn't exist.
+ *
+ * @param repoPath - Path to the repository
+ * @param branchName - Branch name to delete
+ * @returns true if branch was deleted, false if it didn't exist
+ */
+export declare function deleteBranch(repoPath: string, branchName: string): Promise<boolean>;
+/**
+ * Re-export for test helpers only.
+ * Production service code must use createGit() to get the unsafe-ops flags,
+ * env hardening, and consistent git binary selection.
+ */
+export { simpleGit };
+//# sourceMappingURL=index.d.ts.map

package/dist/git/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAavC,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEzF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhE;AAmED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,MAAM,EAAE,CAqBX;AAUD,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,KAAK,GAAG,SAAS,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,0BAA0B,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,8BAA+B,SAAQ,6BAA6B;IACnF,OAAO,EAAE,OAAO,CAAC;CAClB;AAuGD;;;;GAIG;AACH,wBAAsB,8BAA8B,CAClD,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,6BAA6B,CAAC,CAUxC;AAED;;;;GAIG;AACH,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,8BAA8B,CAAC,CAgBzC;AAyBD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,sBAAsB,CAiCzE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS5F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,SAAS,CACvB,OAAO,CAAC,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,QAAQ,CAAC,EAAE,MAAM,GAChB;IAAE,GAAG,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAA;CAAE,CAwEvC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B;IAAE,GAAG,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAA;CAAE,CAEvC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhG;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAGD,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,cAAc,EACd,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,QAAQ,CAAC;AAEhB;;GAEG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAmI3E;AAED;;GAEG;AACH;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAanE;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE9D;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIxE;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAiB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIrE;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIhE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAiB,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASxB;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CA0BhC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,YAAY,GAAE,OAAe,EAC7B,UAAU,GAAE,OAAc,EAC1B,YAAY,CAAC,EAAE,MAAM,EACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,CAAC,EAAE,QAAQ,GAAG,KAAK,GACzB,OAAO,CAAC,IAAI,CAAC,CAwJf;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,0BAA0B;IACzC,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,qCAAqC;IACpD,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,OAAO,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC3B,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CAyFpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,EAAE,UAAU,GAAG,QAAQ,CAAC;IAChC,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CAkE9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAoCnF;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG3F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,YAAY,GAAE,OAAc,GAC3B,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAgFnC;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvE;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,MAAiB,GACxB,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAiB,GACxB,OAAO,CAAC,MAAM,EAAE,CAAC,CAMnB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4CnE;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BzE;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC7E;AAED;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAezF;AAED;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,CAAC"}