canary-test-cli 5.15.0 → 6.0.0

package/dist/engine/guardian/delta-emitter.js

@@ -0,0 +1,46 @@
+/**
+ * Emit the machine-readable api-delta.json v1 artifact.
+ *
+ * Faithful TypeScript port of `agent/guardian/delta_emitter.py`. Serializes an
+ * `ApiDiff` into the frozen contract (docs/specs/api-delta-contract.md) that
+ * downstream tooling consumes to trigger library-stub regeneration. Generic and
+ * company-neutral — the shape carries only HTTP method/path/change categories.
+ *
+ * The builder is pure (the caller supplies `generated`) so it stays testable.
+ */
+import { writeFileSync } from 'node:fs';
+import { classifyChanges } from './diff-extractor.js';
+/** Python: `build_api_delta`. Build the api-delta.json v1 object from a diff. */
+export function buildApiDelta(diff, sha, suite, generated) {
+    return {
+        schema_version: 1,
+        sut: { sha, suite },
+        generated,
+        summary: {
+            added: diff.added.length,
+            removed: diff.removed.length,
+            changed: diff.changed.length,
+            total: diff.added.length + diff.removed.length + diff.changed.length,
+        },
+        endpoints: {
+            added: diff.added.map((ec) => ({
+                method: ec.method.toUpperCase(),
+                path: ec.path,
+            })),
+            removed: diff.removed.map((ec) => ({
+                method: ec.method.toUpperCase(),
+                path: ec.path,
+            })),
+            changed: diff.changed.map((ec) => ({
+                method: ec.method.toUpperCase(),
+                path: ec.path,
+                changes: classifyChanges(ec.before, ec.after),
+            })),
+        },
+    };
+}
+/** Python: `write_api_delta`. Write the delta to `path` as indented JSON. */
+export function writeApiDelta(delta, path) {
+    writeFileSync(path, `${JSON.stringify(delta, null, 2)}\n`, 'utf-8');
+}
+//# sourceMappingURL=delta-emitter.js.map

package/dist/engine/guardian/diff-extractor.js

@@ -0,0 +1,257 @@
+/**
+ * OpenAPI spec diff extractor.
+ *
+ * Faithful TypeScript port of `agent/guardian/diff_extractor.py`. Compares two
+ * OpenAPI specs (before/after a commit) and produces a structured list of
+ * added, removed, and changed endpoints.
+ *
+ * Input: parsed objects (from JSON.parse or a YAML loader).
+ * Output: an `ApiDiff` with three lists of `EndpointChange`.
+ */
+/** Python: `ChangeType(str, Enum)`. */
+export var ChangeType;
+(function (ChangeType) {
+    ChangeType["ADDED"] = "added";
+    ChangeType["REMOVED"] = "removed";
+    ChangeType["CHANGED"] = "changed";
+})(ChangeType || (ChangeType = {}));
+/**
+ * Python: `EndpointChange` dataclass. A class (rather than a bare interface) so
+ * the constructor supplies the same field defaults the dataclass does
+ * (`operation_id`/`summary` -> "", `before`/`after` -> {}).
+ */
+export class EndpointChange {
+    path;
+    method;
+    change_type;
+    // `string | null`: mirrors Python `dict.get("operationId", "")` — a MISSING
+    // key defaults to "", but a present-null value passes through as `null`.
+    operation_id;
+    summary;
+    before;
+    after;
+    constructor(init) {
+        this.path = init.path;
+        this.method = init.method;
+        this.change_type = init.change_type;
+        // Default only on undefined (missing key), never on a present null.
+        this.operation_id =
+            init.operation_id === undefined ? '' : init.operation_id;
+        this.summary = init.summary === undefined ? '' : init.summary;
+        this.before = init.before === undefined ? {} : init.before;
+        this.after = init.after === undefined ? {} : init.after;
+    }
+}
+/** Python: `ApiDiff` dataclass. */
+export class ApiDiff {
+    added;
+    removed;
+    changed;
+    constructor(added, removed, changed) {
+        this.added = added;
+        this.removed = removed;
+        this.changed = changed;
+    }
+    /** Python: `is_empty` property. */
+    get isEmpty() {
+        return !(this.added.length || this.removed.length || this.changed.length);
+    }
+}
+const HTTP_METHODS = [
+    'get',
+    'post',
+    'put',
+    'patch',
+    'delete',
+    'head',
+    'options',
+];
+// Frozen vocabulary for a changed endpoint (see
+// docs/specs/api-delta-contract.md).
+export const VALID_CHANGES = [
+    'params',
+    'request-body',
+    'response',
+    'auth',
+    'status-codes',
+];
+/** Collision-free composite key for a (path, method) pair (Python tuple key). */
+function opKey(path, method) {
+    return JSON.stringify([path, method]);
+}
+/**
+ * Python-truthiness for JSON-shaped values: `None`/`undefined`, `false`, `0`,
+ * `""`, empty array, and empty object are all falsy (mirrors `if op:`).
+ */
+function pyTruthy(value) {
+    if (value === null || value === undefined || value === false)
+        return false;
+    if (value === 0 || value === '')
+        return false;
+    if (Array.isArray(value))
+        return value.length > 0;
+    if (typeof value === 'object')
+        return Object.keys(value).length > 0;
+    return Boolean(value);
+}
+/** Python `a or b`: the fallback wins only when `a` is falsy. */
+function pyOr(value, fallback) {
+    return pyTruthy(value) ? value : fallback;
+}
+/** Python `dict.get(key, default)`: default only on a missing key. */
+function pyGet(obj, key, fallback) {
+    return Object.prototype.hasOwnProperty.call(obj, key) ? obj[key] : fallback;
+}
+/**
+ * Deep equality mirroring Python `==` on JSON-shaped data: arrays compare
+ * order-sensitively, objects compare by key set (order-insensitive), and
+ * `None`/`undefined` are interchangeable.
+ */
+function pyEqual(a, b) {
+    if (a === b)
+        return true;
+    if (a === null || a === undefined)
+        return b === null || b === undefined;
+    if (b === null || b === undefined)
+        return false;
+    const aArr = Array.isArray(a);
+    const bArr = Array.isArray(b);
+    if (aArr || bArr) {
+        if (!aArr || !bArr || a.length !== b.length)
+            return false;
+        for (let i = 0; i < a.length; i++) {
+            if (!pyEqual(a[i], b[i]))
+                return false;
+        }
+        return true;
+    }
+    if (typeof a === 'object' && typeof b === 'object') {
+        const ao = a;
+        const bo = b;
+        const aKeys = Object.keys(ao);
+        const bKeys = Object.keys(bo);
+        if (aKeys.length !== bKeys.length)
+            return false;
+        for (const key of aKeys) {
+            if (!Object.prototype.hasOwnProperty.call(bo, key))
+                return false;
+            if (!pyEqual(ao[key], bo[key]))
+                return false;
+        }
+        return true;
+    }
+    return false;
+}
+function setEqual(a, b) {
+    if (a.size !== b.size)
+        return false;
+    for (const x of a) {
+        if (!b.has(x))
+            return false;
+    }
+    return true;
+}
+/**
+ * Python: `classify_changes`. Classify a changed OpenAPI operation into the
+ * frozen change vocabulary. Returns every applicable category ordered by
+ * `VALID_CHANGES`; a change confined to non-contract fields returns [].
+ */
+export function classifyChanges(before, after) {
+    const found = new Set();
+    if (!pyEqual(pyOr(before['parameters'], []), pyOr(after['parameters'], []))) {
+        found.add('params');
+    }
+    if (!pyEqual(before['requestBody'], after['requestBody'])) {
+        found.add('request-body');
+    }
+    if (!pyEqual(before['security'], after['security'])) {
+        found.add('auth');
+    }
+    const beforeResp = pyOr(before['responses'], {});
+    const afterResp = pyOr(after['responses'], {});
+    const beforeKeys = new Set(Object.keys(beforeResp));
+    const afterKeys = new Set(Object.keys(afterResp));
+    if (!setEqual(beforeKeys, afterKeys)) {
+        found.add('status-codes');
+    }
+    for (const code of beforeKeys) {
+        if (afterKeys.has(code) && !pyEqual(beforeResp[code], afterResp[code])) {
+            found.add('response');
+            break;
+        }
+    }
+    return VALID_CHANGES.filter((c) => found.has(c));
+}
+/**
+ * Python: `_iter_operations`. Insertion-ordered to match Python's dict
+ * iteration order.
+ */
+function iterOperations(spec) {
+    const result = new Map();
+    const paths = pyOr(spec['paths'], {});
+    for (const [path, pathItemRaw] of Object.entries(paths)) {
+        const pathItem = pathItemRaw;
+        for (const method of HTTP_METHODS) {
+            const op = pathItem[method];
+            if (pyTruthy(op)) {
+                result.set(opKey(path, method), {
+                    path,
+                    method,
+                    op: op,
+                });
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Python: `extract_api_diff`. Compare two OpenAPI spec objects and return the
+ * diff.
+ */
+export function extractApiDiff(before, after) {
+    const beforeOps = iterOperations(before);
+    const afterOps = iterOperations(after);
+    const added = [];
+    const removed = [];
+    const changed = [];
+    for (const [key, { path, method, op }] of afterOps) {
+        if (!beforeOps.has(key)) {
+            added.push(new EndpointChange({
+                path,
+                method,
+                change_type: ChangeType.ADDED,
+                operation_id: pyGet(op, 'operationId', ''),
+                summary: pyGet(op, 'summary', ''),
+                after: op,
+            }));
+        }
+        else {
+            const beforeOp = beforeOps.get(key).op;
+            if (!pyEqual(op, beforeOp)) {
+                changed.push(new EndpointChange({
+                    path,
+                    method,
+                    change_type: ChangeType.CHANGED,
+                    operation_id: pyGet(op, 'operationId', pyGet(beforeOp, 'operationId', '')),
+                    summary: pyGet(op, 'summary', ''),
+                    before: beforeOp,
+                    after: op,
+                }));
+            }
+        }
+    }
+    for (const [key, { path, method, op }] of beforeOps) {
+        if (!afterOps.has(key)) {
+            removed.push(new EndpointChange({
+                path,
+                method,
+                change_type: ChangeType.REMOVED,
+                operation_id: pyGet(op, 'operationId', ''),
+                summary: pyGet(op, 'summary', ''),
+                before: op,
+            }));
+        }
+    }
+    return new ApiDiff(added, removed, changed);
+}
+//# sourceMappingURL=diff-extractor.js.map

package/dist/engine/guardian/hard-gate.js

@@ -0,0 +1,373 @@
+/**
+ * Promote the guardian gate from soft to hard by registering its status check
+ * as a **required** check in branch protection — the one admin step the
+ * operator guide says the guardian can't do for you.
+ *
+ * Faithful TypeScript port of `agent/guardian/hard_gate.py`.
+ *
+ * Structure mirrors {@link ./pr-comment}: a {@link BranchProtection} interface,
+ * an in-memory fake for network-free tests, and a thin `fetch` REST client. The
+ * decision logic ({@link planHardGate}) is pure. Any barrier — no admin scope, a
+ * plan without branch protection, a bad token, a network error — surfaces as
+ * {@link HardGateBlocked} carrying a manual playbook, never a silent no-op and
+ * never a crash (the #294/#295 fail-loud contract).
+ *
+ * Two hazards this module is built to avoid:
+ *
+ * - **Clobbering existing protection.** `GET .../required_status_checks` returns
+ *   404 both for an unprotected branch AND a protected branch that simply has no
+ *   required-checks section. Treating the latter as "unprotected" and PUT-ing a
+ *   fresh ruleset would wipe review/admin/restriction protections. We
+ *   disambiguate via the parent `.../protection` endpoint and only ever
+ *   PUT-create when the branch is *genuinely* unprotected; otherwise we PATCH
+ *   the checks sub-resource, which leaves every other protection untouched.
+ * - **Registering a phantom check.** A required context that no workflow reports
+ *   stays "Expected" forever and blocks *every* merge — worse than not
+ *   promoting. So before registering we verify the context against the checks a
+ *   recent commit actually reported, and refuse (listing the real ones) unless
+ *   `force`.
+ *
+ * Python→TS nuances:
+ *   - **async**: the seam is `Promise`-returning (Node `fetch` is async), so
+ *     {@link applyHardGate} is async and the fakes are `async`. The pure
+ *     {@link planHardGate} and {@link renderPlaybook} stay synchronous.
+ *   - **error mapping**: `fetch` resolves on a non-2xx status. The real client
+ *     maps 401/403→{@link GitHubPermissionError} off `resp.status`, and throws a
+ *     status-bearing {@link HttpError} for other codes so the 404 disambiguation
+ *     can inspect the status (the analog of urllib's `HTTPError.code`). Python's
+ *     `OSError` (URLError / timeout / non-403 HTTPError) maps to any non-permission
+ *     error caught in {@link applyHardGate}.
+ */
+import { GitHubPermissionError } from './pr-comment.js';
+/**
+ * A barrier stopped the required-check registration.
+ *
+ * Carries a human-readable `reason` and a `playbook` of manual steps, so a
+ * permission/plan/network barrier degrades to actionable guidance rather than a
+ * crash or a silent skip.
+ */
+export class HardGateBlocked extends Error {
+    reason;
+    playbook;
+    constructor(reason, playbook) {
+        super(reason);
+        this.name = 'HardGateBlocked';
+        this.reason = reason;
+        this.playbook = playbook;
+    }
+}
+/**
+ * Decide the change without touching the network (PURE).
+ *
+ * `existingContexts` is the branch's current required-check contexts, an empty
+ * list if the branch is protected but requires no checks yet, or `null`
+ * **only** if the branch has no protection at all. That three-way distinction
+ * is load-bearing: `null` is the only value that permits the
+ * protection-creating path.
+ */
+export function planHardGate(existingContexts, checkContext, branch) {
+    const creates = existingContexts === null;
+    const current = [...(existingContexts ?? [])];
+    const already = current.includes(checkContext);
+    const resulting = already ? current : [...current, checkContext];
+    return {
+        check_context: checkContext,
+        branch,
+        already_required: already,
+        creates_protection: creates,
+        resulting_contexts: [...new Set(resulting)].sort(),
+    };
+}
+/**
+ * In-memory {@link BranchProtection} for tests — no network.
+ *
+ * State model: `contexts` is the required-check list; `null` means no checks
+ * section. `protected` says whether the branch has protection at all (implied
+ * true when `contexts` is a list). So `contexts=null, protected=true` models the
+ * dangerous protected-without-checks state, and `contexts=null,
+ * protected=false` a genuinely unprotected branch. `admin=false` →
+ * reads/writes reject (no scope); `plan_supported=false` → writes reject.
+ * `read_error` injects an arbitrary read failure.
+ */
+export class FakeBranchProtectionClient {
+    contexts;
+    protected;
+    admin;
+    plan_supported;
+    observed;
+    read_error;
+    write_count;
+    last_create;
+    store;
+    constructor(init = {}) {
+        this.contexts = init.contexts ?? null;
+        this.protected = init.protected ?? false;
+        this.admin = init.admin ?? true;
+        this.plan_supported = init.plan_supported ?? true;
+        this.observed = init.observed ?? [];
+        this.read_error = init.read_error ?? null;
+        this.write_count = 0;
+        this.last_create = null;
+        this.store = new Map();
+        // Mirrors the Python dataclass `__post_init__`: a seeded contexts list
+        // implies the branch is protected, and is always stored under "main".
+        if (this.contexts !== null) {
+            this.store.set('main', [...this.contexts]);
+            this.protected = true;
+        }
+    }
+    contextsFor(branch) {
+        return this.store.get(branch) ?? null;
+    }
+    async requiredCheckContexts(branch) {
+        if (this.read_error !== null) {
+            throw this.read_error;
+        }
+        if (!this.admin) {
+            throw new GitHubPermissionError('token lacks admin scope for branch protection');
+        }
+        const stored = this.store.get(branch);
+        if (stored !== undefined) {
+            return stored;
+        }
+        return this.protected ? [] : null;
+    }
+    async observedCheckContexts(branch) {
+        void branch;
+        return [...this.observed];
+    }
+    async setRequiredChecks(branch, contexts, create) {
+        if (!this.admin) {
+            throw new GitHubPermissionError('token lacks admin scope');
+        }
+        if (!this.plan_supported) {
+            throw new GitHubPermissionError('Upgrade your plan to use branch protection on this repository');
+        }
+        this.write_count += 1;
+        this.last_create = create;
+        this.store.set(branch, [...contexts]);
+    }
+}
+/**
+ * Manual steps to require the guardian check — the fallback when canary can't
+ * do it (no admin, unsupported plan, bad token, network error).
+ */
+export function renderPlaybook(repo, branch, checkContext) {
+    return (`Manual steps to require the '${checkContext}' check on ` +
+        `${repo}@${branch}:\n` +
+        `  1. Open https://github.com/${repo}/settings/branches\n` +
+        `  2. Add or edit a branch protection rule for '${branch}'.\n` +
+        `  3. Enable 'Require status checks to pass before merging' and add ` +
+        `'${checkContext}' to the required checks.\n` +
+        `Or, with an admin token, run:\n` +
+        `  gh api -X PATCH ` +
+        `repos/${repo}/branches/${branch}/protection/required_status_checks ` +
+        `-f 'checks[][context]=${checkContext}'\n` +
+        `Confirm '${checkContext}' is the exact context a recent PR reported ` +
+        `(a wrong name registers a gate that never fires — and can block every ` +
+        `merge).`);
+}
+/**
+ * Register `checkContext` as required on `branch`.
+ *
+ * Verifies the context is one a recent commit actually reported (unless
+ * `force`) so we never register a phantom check that would block every merge.
+ * Returns the plan on success (including the idempotent already-required
+ * no-op). Rejects with {@link HardGateBlocked} carrying a playbook on any
+ * barrier.
+ */
+export async function applyHardGate(client, repo, branch, checkContext, force = false) {
+    const playbook = renderPlaybook(repo, branch, checkContext);
+    const blocked = (reason) => new HardGateBlocked(reason, playbook);
+    // --- verify the context is real, before we touch protection ---
+    if (!force) {
+        let observed;
+        try {
+            observed = await client.observedCheckContexts(branch);
+        }
+        catch {
+            // Python catches (GitHubPermissionError, OSError) → best-effort empty.
+            observed = [];
+        }
+        if (observed.length === 0) {
+            throw blocked(`could not confirm any check has reported on ${repo}@${branch}, ` +
+                `so cannot verify '${checkContext}' is a real context; ` +
+                'requiring an unreported check would block every merge. ' +
+                'Open a PR so the guardian check runs at least once, or pass ' +
+                '--force to register it anyway.');
+        }
+        if (!observed.includes(checkContext)) {
+            const sorted = [...observed].sort();
+            throw blocked(`'${checkContext}' is not among the checks recently reported on ` +
+                `${repo}@${branch}: ${reprList(sorted)}. Requiring it would block ` +
+                'every merge. Re-run --check with one of those, or --force to ' +
+                'override.');
+        }
+    }
+    // --- read state (disambiguating unprotected vs protected-without-checks) ---
+    let existing;
+    try {
+        existing = await client.requiredCheckContexts(branch);
+    }
+    catch (err) {
+        if (err instanceof GitHubPermissionError) {
+            throw blocked(`cannot read branch protection for ${repo}@${branch}: ${err.message}`);
+        }
+        // OSError analog: URLError / timeout / non-403 HTTPError.
+        throw blocked(`failed reading branch protection for ${repo}@${branch}: ${errText(err)}`);
+    }
+    const plan = planHardGate(existing, checkContext, branch);
+    if (plan.already_required) {
+        return plan;
+    }
+    try {
+        await client.setRequiredChecks(branch, plan.resulting_contexts, plan.creates_protection);
+    }
+    catch (err) {
+        if (err instanceof GitHubPermissionError) {
+            throw blocked(`cannot update branch protection for ${repo}@${branch}: ${err.message}`);
+        }
+        throw blocked(`failed updating branch protection for ${repo}@${branch}: ${errText(err)}`);
+    }
+    return plan;
+}
+/** Render a string list the way Python's `repr(list)` reads: `['a', 'b']`. */
+function reprList(items) {
+    return `[${items.map((s) => `'${s}'`).join(', ')}]`;
+}
+function errText(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * A GitHub REST HTTP error carrying its status, the analog of urllib's
+ * `HTTPError.code`. Thrown by {@link RestBranchProtectionClient} for non-2xx
+ * responses other than 401/403 so the 404 disambiguation can inspect the code.
+ */
+export class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.name = 'HttpError';
+        this.status = status;
+    }
+}
+/** Thin real {@link BranchProtection} over the GitHub REST API (`fetch`). */
+export class RestBranchProtectionClient {
+    repo;
+    token;
+    static API = 'https://api.github.com';
+    constructor(repo, token) {
+        this.repo = repo;
+        this.token = token;
+    }
+    async request(method, path, body) {
+        const url = `${RestBranchProtectionClient.API}/repos/${this.repo}/${path}`;
+        const headers = {
+            Authorization: `Bearer ${this.token}`,
+            Accept: 'application/vnd.github+json',
+        };
+        const init = { method, headers };
+        if (body !== undefined) {
+            headers['Content-Type'] = 'application/json';
+            init.body = JSON.stringify(body);
+        }
+        const resp = await fetch(url, init);
+        if (!resp.ok) {
+            // 401 (bad/expired token) and 403 (no admin scope / rate limit) both mean
+            // "we can't proceed here" → permission error → playbook.
+            if (resp.status === 401 || resp.status === 403) {
+                throw new GitHubPermissionError(`HTTP ${resp.status}: ${resp.statusText || 'forbidden'}`);
+            }
+            // Other codes propagate as a status-bearing error → fail-loud, and the
+            // 404 disambiguation reads `.status`.
+            throw new HttpError(resp.status, `HTTP ${resp.status}: ${resp.statusText || ''}`);
+        }
+        const raw = (await resp.text()) || '{}';
+        return JSON.parse(raw);
+    }
+    async branchIsUnprotected(branch) {
+        // True only if the branch has NO protection object at all (parent 404). A
+        // protected branch without a checks section returns 200 here.
+        try {
+            await this.request('GET', `branches/${branch}/protection`);
+            return false;
+        }
+        catch (err) {
+            if (err instanceof HttpError && err.status === 404) {
+                return true;
+            }
+            throw err;
+        }
+    }
+    async requiredCheckContexts(branch) {
+        let data;
+        try {
+            data = await this.request('GET', `branches/${branch}/protection/required_status_checks`);
+        }
+        catch (err) {
+            if (err instanceof HttpError && err.status === 404) {
+                // Ambiguous 404: genuinely unprotected, OR protected without a checks
+                // section. Only the former may take the create path.
+                return (await this.branchIsUnprotected(branch)) ? null : [];
+            }
+            throw err;
+        }
+        const checks = data['checks'];
+        if (Array.isArray(checks)) {
+            return checks
+                .map((c) => (isRecord(c) ? String(c['context'] ?? '') : ''))
+                .filter((context) => context !== '');
+        }
+        const contexts = data['contexts'];
+        return Array.isArray(contexts) ? contexts : []; // legacy shape
+    }
+    async observedCheckContexts(branch) {
+        let data;
+        try {
+            data = await this.request('GET', `commits/${branch}/check-runs`);
+        }
+        catch (err) {
+            // URLError / GitHubPermissionError → best-effort empty. (An HttpError for
+            // another status also degrades to empty here, matching the Python
+            // best-effort intent for observed checks.)
+            void err;
+            return [];
+        }
+        const runs = data['check_runs'];
+        if (!Array.isArray(runs)) {
+            return [];
+        }
+        const names = new Set();
+        for (const r of runs) {
+            if (isRecord(r)) {
+                const name = String(r['name'] ?? '');
+                if (name !== '')
+                    names.add(name);
+            }
+        }
+        return [...names].sort();
+    }
+    async setRequiredChecks(branch, contexts, create) {
+        const checks = contexts.map((c) => ({ context: c }));
+        if (create) {
+            // Genuinely unprotected — PUT a minimal ruleset requiring only the checks;
+            // other protections stay unset.
+            await this.request('PUT', `branches/${branch}/protection`, {
+                required_status_checks: { strict: false, checks },
+                enforce_admins: null,
+                required_pull_request_reviews: null,
+                restrictions: null,
+            });
+        }
+        else {
+            // Protected already — PATCH the sub-resource (a partial update that
+            // touches ONLY required status checks, preserving reviews / restrictions /
+            // enforce_admins / the existing `strict` flag).
+            await this.request('PATCH', `branches/${branch}/protection/required_status_checks`, { checks });
+        }
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=hard-gate.js.map