create-hq 10.1.0 → 10.7.0

package/dist/admin-onboarding.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Admin onboarding flow — for users creating a brand new HQ team.
+ *
+ * Steps:
+ *   1. List user's GitHub orgs (only those where they can create repos)
+ *   2. Let user pick an existing org or create a new one (browser hand-off)
+ *   3. Verify the HQ App is installed on the chosen org (browser hand-off if not)
+ *   4. Prompt for team name (default = org display name)
+ *   5. Create the {org}/hq private repo
+ *   6. Seed the repo locally with the company template + push
+ *   7. Clone the repo into companies/{slug}/ as a nested git
+ *   8. Return team metadata for the orientation summary
+ */
+import { type GitHubAuth } from "./auth.js";
+import { type TeamMetadata } from "./company-template.js";
+export interface AdminOnboardingResult {
+    team: TeamMetadata;
+    /** Local path where the team repo was cloned. */
+    companyDir: string;
+    /** GitHub HTML URL for the new team repo. */
+    repoHtmlUrl: string;
+}
+export declare function slugify(input: string): string;
+/**
+ * Run the admin onboarding flow.
+ *
+ * @param auth          - Authenticated GitHub user
+ * @param hqRoot        - Local HQ root directory (where companies/ lives)
+ * @param hqVersion     - HQ template version (for team metadata)
+ */
+export declare function runAdminOnboarding(auth: GitHubAuth, hqRoot: string, hqVersion: string): Promise<AdminOnboardingResult | null>;
+/**
+ * Interactive invite generation for a single member. Prompts for email,
+ * sends org invite, generates token, and prints instructions.
+ */
+export declare function generateInviteInteractive(auth: GitHubAuth, meta: TeamMetadata, cloneUrl: string): Promise<void>;
+/**
+ * Invite loop — asks "Invite a team member?" and repeats until the admin
+ * says no. Used after team creation and from the standalone invite command.
+ */
+export declare function inviteLoop(auth: GitHubAuth, meta: TeamMetadata, cloneUrl: string): Promise<void>;
+//# sourceMappingURL=admin-onboarding.d.ts.map

package/dist/admin-onboarding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-onboarding.d.ts","sourceRoot":"","sources":["../src/admin-onboarding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,OAAO,EACL,KAAK,UAAU,EAIhB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAgDhF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,YAAY,CAAC;IACnB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AA+KD,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM7C;AAID;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CA+PvC;AAID;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAwCf;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/dist/admin-onboarding.js

@@ -0,0 +1,445 @@
+/**
+ * Admin onboarding flow — for users creating a brand new HQ team.
+ *
+ * Steps:
+ *   1. List user's GitHub orgs (only those where they can create repos)
+ *   2. Let user pick an existing org or create a new one (browser hand-off)
+ *   3. Verify the HQ App is installed on the chosen org (browser hand-off if not)
+ *   4. Prompt for team name (default = org display name)
+ *   5. Create the {org}/hq private repo
+ *   6. Seed the repo locally with the company template + push
+ *   7. Clone the repo into companies/{slug}/ as a nested git
+ *   8. Return team metadata for the orientation summary
+ */
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import * as crypto from "crypto";
+import { execSync } from "child_process";
+import { createInterface } from "readline";
+import chalk from "chalk";
+import { HQ_GITHUB_APP_SLUG, githubApi, openBrowser, } from "./auth.js";
+import { writeCompanyTemplate } from "./company-template.js";
+import { stepStatus, success, warn, info } from "./ui.js";
+import { encodeInviteToken, printInviteSummary, openInviteEmail, formatInviteMessage, copyToClipboard, } from "./invite.js";
+// ─── Prompt helpers ─────────────────────────────────────────────────────────
+function prompt(question, defaultVal) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const suffix = defaultVal ? ` (${defaultVal})` : "";
+    return new Promise((resolve) => {
+        rl.question(`  ? ${question}${suffix} `, (answer) => {
+            rl.close();
+            resolve(answer.trim() || defaultVal || "");
+        });
+    });
+}
+function pause(message) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(`  ${message} `, () => {
+            rl.close();
+            resolve();
+        });
+    });
+}
+// ─── GitHub helpers ─────────────────────────────────────────────────────────
+/**
+ * Fetch the orgs the user is an active admin of. Uses
+ * /user/memberships/orgs which (unlike /user/orgs) tells us our role.
+ *
+ * Requires the App's "Organization > Members: Read" permission. If the App
+ * isn't permitted, this returns an empty array (and we tell the user to
+ * check their App permissions).
+ */
+async function fetchAdminOrgs(auth) {
+    try {
+        const memberships = await githubApi("/user/memberships/orgs?state=active&per_page=100", auth);
+        return memberships
+            .filter((m) => m.role === "admin")
+            .map((m) => ({
+            login: m.organization.login,
+            id: m.organization.id,
+        }));
+    }
+    catch (err) {
+        // Permission errors come back as 403/404 — surface as empty list, the
+        // caller will guide the user to fix App permissions or create an org.
+        return [];
+    }
+}
+async function fetchInstallations(auth) {
+    const data = await githubApi("/user/installations?per_page=100", auth);
+    return data.installations ?? [];
+}
+function findHqInstallation(installations, orgLogin) {
+    return (installations.find((i) => i.app_slug === HQ_GITHUB_APP_SLUG &&
+        i.account?.login?.toLowerCase() === orgLogin.toLowerCase()) ?? null);
+}
+async function createOrgRepo(auth, orgLogin, repoName, description) {
+    return githubApi(`/orgs/${orgLogin}/repos`, auth, {
+        method: "POST",
+        body: JSON.stringify({
+            name: repoName,
+            private: true,
+            description,
+            auto_init: false,
+            has_issues: true,
+            has_projects: false,
+            has_wiki: false,
+        }),
+    });
+}
+async function getExistingRepo(auth, orgLogin, repoName) {
+    try {
+        return await githubApi(`/repos/${orgLogin}/${repoName}`, auth);
+    }
+    catch {
+        return null;
+    }
+}
+// ─── Git helpers ────────────────────────────────────────────────────────────
+/**
+ * Run a git command, embedding the user's GitHub token via a one-shot
+ * credential helper so the token never appears in argv or remote URLs.
+ *
+ * The token is passed via an environment variable to a tiny inline askpass
+ * script written to a temp file, which git invokes via GIT_ASKPASS.
+ */
+function runGitWithToken(args, cwd, auth, inputEnv = {}) {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "create-hq-git-"));
+    const isWindows = process.platform === "win32";
+    const askpassPath = path.join(tmpDir, isWindows ? "askpass.cmd" : "askpass.sh");
+    try {
+        if (isWindows) {
+            // Windows batch script: stdout the token (for Password) or username
+            fs.writeFileSync(askpassPath, `@echo off\nif "%~1"=="" (echo %GIT_TOKEN%) else (echo %GIT_TOKEN%)\n`, "utf-8");
+        }
+        else {
+            fs.writeFileSync(askpassPath, `#!/bin/sh\necho "$GIT_TOKEN"\n`, "utf-8");
+            fs.chmodSync(askpassPath, 0o700);
+        }
+        execSync(`git ${args.join(" ")}`, {
+            cwd,
+            stdio: "pipe",
+            env: {
+                ...process.env,
+                ...inputEnv,
+                GIT_TOKEN: auth.access_token,
+                GIT_ASKPASS: askpassPath,
+                GIT_TERMINAL_PROMPT: "0",
+                // Prevent any system credential helper from caching the token
+                GCM_INTERACTIVE: "never",
+            },
+        });
+    }
+    finally {
+        try {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+        catch {
+            // ignore
+        }
+    }
+}
+/**
+ * Build an HTTPS URL with the username embedded so git's askpass only
+ * needs to provide the password (the token). We use "x-access-token" as
+ * the username — GitHub's recommended convention for token auth.
+ */
+function tokenAuthUrl(cloneUrl) {
+    const u = new URL(cloneUrl);
+    u.username = "x-access-token";
+    // Don't put the token in the URL — askpass handles it
+    return u.toString();
+}
+// ─── Slug helper ────────────────────────────────────────────────────────────
+export function slugify(input) {
+    return input
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 50) || "team";
+}
+// ─── Main flow ──────────────────────────────────────────────────────────────
+/**
+ * Run the admin onboarding flow.
+ *
+ * @param auth          - Authenticated GitHub user
+ * @param hqRoot        - Local HQ root directory (where companies/ lives)
+ * @param hqVersion     - HQ template version (for team metadata)
+ */
+export async function runAdminOnboarding(auth, hqRoot, hqVersion) {
+    console.log();
+    console.log(chalk.bold("  Create a new HQ team"));
+    console.log();
+    // 1. Fetch admin orgs
+    const orgsLabel = "Looking up your GitHub organizations";
+    stepStatus(orgsLabel, "running");
+    let orgs = await fetchAdminOrgs(auth);
+    stepStatus(orgsLabel, "done");
+    // 2. Pick or create org
+    let chosenOrg = null;
+    while (!chosenOrg) {
+        if (orgs.length === 0) {
+            console.log();
+            info("You aren't an admin of any GitHub organization yet.");
+            info("HQ Teams need a GitHub org to host the shared workspace repo.");
+            console.log();
+            const create = await prompt("Open browser to create one now? (Y/n)", "y");
+            if (!create.toLowerCase().startsWith("y")) {
+                warn("Skipping team creation — you can run create-hq again after creating an org.");
+                return null;
+            }
+            openBrowser("https://github.com/organizations/new");
+            await pause("Press Enter when you have finished creating the org...");
+            stepStatus("Re-checking organizations", "running");
+            orgs = await fetchAdminOrgs(auth);
+            stepStatus("Re-checking organizations", "done");
+            continue;
+        }
+        console.log();
+        console.log(chalk.bold("  Choose an organization:"));
+        for (let i = 0; i < orgs.length; i++) {
+            console.log(chalk.cyan(`  [${i + 1}] `) + chalk.white(orgs[i].login));
+        }
+        console.log(chalk.cyan(`  [${orgs.length + 1}] `) + chalk.dim("Create a new GitHub organization"));
+        console.log();
+        const answer = await prompt(`Select (1-${orgs.length + 1})`, "1");
+        const idx = parseInt(answer, 10) - 1;
+        if (idx === orgs.length) {
+            // Create new org
+            openBrowser("https://github.com/organizations/new");
+            await pause("Press Enter when you have finished creating the org...");
+            stepStatus("Re-checking organizations", "running");
+            orgs = await fetchAdminOrgs(auth);
+            stepStatus("Re-checking organizations", "done");
+            continue;
+        }
+        if (idx < 0 || idx >= orgs.length) {
+            warn("Invalid selection. Try again.");
+            continue;
+        }
+        chosenOrg = orgs[idx];
+    }
+    // 3. Verify HQ App is installed on the org
+    let installation = null;
+    while (!installation) {
+        const installLabel = `Checking HQ App on ${chosenOrg.login}`;
+        stepStatus(installLabel, "running");
+        const installations = await fetchInstallations(auth);
+        installation = findHqInstallation(installations, chosenOrg.login);
+        if (installation) {
+            stepStatus(installLabel, "done");
+            break;
+        }
+        stepStatus(installLabel, "failed");
+        console.log();
+        info(`The HQ GitHub App isn't installed on ${chalk.cyan(chosenOrg.login)} yet.`);
+        info("Installing it gives HQ permission to manage the team workspace repo.");
+        console.log();
+        const installUrl = `https://github.com/apps/${HQ_GITHUB_APP_SLUG}/installations/new/permissions?target_id=${chosenOrg.id}`;
+        const proceed = await prompt("Open the install page in your browser? (Y/n)", "y");
+        if (!proceed.toLowerCase().startsWith("y")) {
+            warn("HQ App is required to create a team. Aborting team creation.");
+            return null;
+        }
+        openBrowser(installUrl);
+        await pause("Press Enter when the App has been installed...");
+    }
+    // 4. Prompt for team name
+    console.log();
+    const defaultName = chosenOrg.login;
+    const teamName = (await prompt("Team name", defaultName)) || defaultName;
+    const teamSlug = slugify(teamName);
+    const teamId = crypto.randomUUID();
+    const meta = {
+        team_id: teamId,
+        team_name: teamName,
+        team_slug: teamSlug,
+        org_login: chosenOrg.login,
+        org_id: chosenOrg.id,
+        created_by: auth.login,
+        created_at: new Date().toISOString(),
+        hq_version: hqVersion,
+    };
+    // 5. Create the {org}/hq-{teamSlug} repo
+    const repoName = `hq-${teamSlug}`;
+    const repoLabel = `Creating ${chosenOrg.login}/${repoName} private repo`;
+    stepStatus(repoLabel, "running");
+    let repo = null;
+    try {
+        repo = await createOrgRepo(auth, chosenOrg.login, repoName, `HQ Teams workspace for ${teamName}`);
+        stepStatus(repoLabel, "done");
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes("422") && /already exists/i.test(message)) {
+            // Repo already exists — could be from a prior run. Confirm before reusing.
+            stepStatus(repoLabel, "done");
+            console.log();
+            info(`${chosenOrg.login}/${repoName} already exists.`);
+            const reuse = await prompt("Reuse this repo? (Y/n)", "y");
+            if (!reuse.toLowerCase().startsWith("y")) {
+                warn("Aborting — choose a different team name next time to avoid the conflict.");
+                return null;
+            }
+            repo = await getExistingRepo(auth, chosenOrg.login, repoName);
+            if (!repo) {
+                stepStatus(repoLabel, "failed");
+                warn(`Could not load existing ${chosenOrg.login}/${repoName}: ${message}`);
+                return null;
+            }
+        }
+        else {
+            stepStatus(repoLabel, "failed");
+            warn(`Could not create repo: ${message}`);
+            return null;
+        }
+    }
+    // 6. Seed locally and push
+    const seedLabel = "Seeding team workspace";
+    stepStatus(seedLabel, "running");
+    const seedDir = fs.mkdtempSync(path.join(os.tmpdir(), "create-hq-seed-"));
+    try {
+        // git init in seed dir
+        execSync(`git init -b main`, { cwd: seedDir, stdio: "pipe" });
+        execSync(`git config user.email "${auth.email || `${auth.login}@users.noreply.github.com`}"`, {
+            cwd: seedDir,
+            stdio: "pipe",
+        });
+        execSync(`git config user.name "${auth.name || auth.login}"`, {
+            cwd: seedDir,
+            stdio: "pipe",
+        });
+        writeCompanyTemplate(seedDir, meta);
+        execSync(`git add -A`, { cwd: seedDir, stdio: "pipe" });
+        execSync(`git commit -m "chore: bootstrap HQ team workspace"`, { cwd: seedDir, stdio: "pipe" });
+        const remoteUrl = tokenAuthUrl(repo.clone_url);
+        execSync(`git remote add origin "${remoteUrl}"`, { cwd: seedDir, stdio: "pipe" });
+        runGitWithToken(["push", "-u", "origin", "main"], seedDir, auth);
+        stepStatus(seedLabel, "done");
+    }
+    catch (err) {
+        stepStatus(seedLabel, "failed");
+        const message = err instanceof Error ? err.message : String(err);
+        warn(`Failed to seed team repo: ${message}`);
+        return null;
+    }
+    finally {
+        try {
+            fs.rmSync(seedDir, { recursive: true, force: true });
+        }
+        catch {
+            // ignore
+        }
+    }
+    // 7. Clone into companies/{slug}/
+    const companiesDir = path.join(hqRoot, "companies");
+    if (!fs.existsSync(companiesDir)) {
+        fs.mkdirSync(companiesDir, { recursive: true });
+    }
+    const companyDir = path.join(companiesDir, teamSlug);
+    if (fs.existsSync(companyDir) && fs.readdirSync(companyDir).length > 0) {
+        warn(`companies/${teamSlug}/ already exists and is not empty — skipping clone.`);
+    }
+    else {
+        const cloneLabel = `Cloning into companies/${teamSlug}`;
+        stepStatus(cloneLabel, "running");
+        try {
+            const remoteUrl = tokenAuthUrl(repo.clone_url);
+            runGitWithToken(["clone", `"${remoteUrl}"`, `"${companyDir}"`], companiesDir, auth);
+            // Strip token from the stored remote URL
+            execSync(`git remote set-url origin "${repo.clone_url}"`, {
+                cwd: companyDir,
+                stdio: "pipe",
+            });
+            stepStatus(cloneLabel, "done");
+        }
+        catch (err) {
+            stepStatus(cloneLabel, "failed");
+            const message = err instanceof Error ? err.message : String(err);
+            warn(`Could not clone into companies/${teamSlug}/: ${message}`);
+            // Team repo was created on GitHub — still return success so the user
+            // gets the admin orientation (with repo URL) instead of generic next steps.
+            // They can clone manually later.
+            console.log();
+            success(`Team "${teamName}" created at ${repo.html_url}`);
+            info("Local clone failed — clone manually with:");
+            info(`  git clone ${repo.clone_url} companies/${teamSlug}`);
+            // Still offer invite generation
+            await inviteLoop(auth, meta, repo.clone_url);
+            return {
+                team: meta,
+                companyDir,
+                repoHtmlUrl: repo.html_url,
+            };
+        }
+    }
+    console.log();
+    success(`Team "${teamName}" created — ${repo.html_url}`);
+    // 8. Offer to generate member invites
+    await inviteLoop(auth, meta, repo.clone_url);
+    return {
+        team: meta,
+        companyDir,
+        repoHtmlUrl: repo.html_url,
+    };
+}
+// ─── Invite generation (used by admin onboarding + standalone) ──────────────
+/**
+ * Interactive invite generation for a single member. Prompts for email,
+ * sends org invite, generates token, and prints instructions.
+ */
+export async function generateInviteInteractive(auth, meta, cloneUrl) {
+    const payload = {
+        org: meta.org_login,
+        repo: `hq-${meta.team_slug}`,
+        slug: meta.team_slug,
+        teamName: meta.team_name,
+        cloneUrl,
+        invitedBy: auth.login,
+    };
+    const token = encodeInviteToken(payload);
+    // Ask for email — used for the mailto invite, not for API calls
+    const email = await prompt("New member's email (or press Enter to skip)");
+    printInviteSummary(payload, token, false, email || undefined);
+    // Copy invite message to clipboard
+    const msg = formatInviteMessage(payload, token, email || undefined);
+    const copied = copyToClipboard(msg);
+    // Try to open mailto: with pre-populated email (works well on macOS/first use)
+    if (email) {
+        openInviteEmail(payload, token, email);
+    }
+    // Always show clipboard status — mailto: is unreliable on Windows after first use
+    if (copied) {
+        success("Invite message copied to clipboard — if your email client didn't open, just paste into a new email and send.");
+    }
+    else if (!email) {
+        info("No email provided — share the invite message above via email, Slack, or text.");
+    }
+    // Remind admin to send the GitHub org invite
+    console.log();
+    info(`Send them a GitHub org invite (required for access):`);
+    info(`  https://github.com/orgs/${meta.org_login}/people`);
+    info(`  Click "Invite member" and enter${email ? ": " + email : " their email or GitHub username"}`);
+}
+/**
+ * Invite loop — asks "Invite a team member?" and repeats until the admin
+ * says no. Used after team creation and from the standalone invite command.
+ */
+export async function inviteLoop(auth, meta, cloneUrl) {
+    let first = true;
+    while (true) {
+        console.log();
+        const question = first
+            ? "Invite a team member now? (Y/n)"
+            : "Invite another team member? (y/N)";
+        const defaultAnswer = first ? "y" : "n";
+        const answer = await prompt(question, defaultAnswer);
+        if (!answer.toLowerCase().startsWith("y"))
+            break;
+        await generateInviteInteractive(auth, meta, cloneUrl);
+        first = false;
+    }
+}
+//# sourceMappingURL=admin-onboarding.js.map

package/dist/admin-onboarding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-onboarding.js","sourceRoot":"","sources":["../src/admin-onboarding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAEL,kBAAkB,EAClB,SAAS,EACT,WAAW,GACZ,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAqB,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,eAAe,GAEhB,MAAM,aAAa,CAAC;AA+CrB,+EAA+E;AAE/E,SAAS,MAAM,CAAC,QAAgB,EAAE,UAAmB;IACnD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,OAAO,QAAQ,GAAG,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE;YAClD,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,UAAU,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,KAAK,OAAO,GAAG,EAAE,GAAG,EAAE;YAChC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAE/E;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,IAAgB;IAC5C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,SAAS,CACjC,kDAAkD,EAClD,IAAI,CACL,CAAC;QACF,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK;YAC3B,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE;SACtB,CAAC,CAAC,CAAC;IACR,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,sEAAsE;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAgB;IAChD,MAAM,IAAI,GAAG,MAAM,SAAS,CAC1B,kCAAkC,EAClC,IAAI,CACL,CAAC;IACF,OAAO,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,kBAAkB,CACzB,aAAmC,EACnC,QAAgB;IAEhB,OAAO,CACL,aAAa,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,kBAAkB;QACjC,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAC7D,IAAI,IAAI,CACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAgB,EAChB,QAAgB,EAChB,QAAgB,EAChB,WAAmB;IAEnB,OAAO,SAAS,CAAqB,SAAS,QAAQ,QAAQ,EAAE,IAAI,EAAE;QACpE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,IAAI;YACb,WAAW;YACX,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,KAAK;YACnB,QAAQ,EAAE,KAAK;SAChB,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAgB,EAChB,QAAgB,EAChB,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAqB,UAAU,QAAQ,IAAI,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAS,eAAe,CACtB,IAAc,EACd,GAAW,EACX,IAAgB,EAChB,WAA8B,EAAE;IAEhC,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAEhF,IAAI,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,oEAAoE;YACpE,EAAE,CAAC,aAAa,CACd,WAAW,EACX,sEAAsE,EACtE,OAAO,CACR,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,gCAAgC,EAAE,OAAO,CAAC,CAAC;YACzE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QAED,QAAQ,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;YAChC,GAAG;YACH,KAAK,EAAE,MAAM;YACb,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,GAAG,QAAQ;gBACX,SAAS,EAAE,IAAI,CAAC,YAAY;gBAC5B,WAAW,EAAE,WAAW;gBACxB,mBAAmB,EAAE,GAAG;gBACxB,8DAA8D;gBAC9D,eAAe,EAAE,OAAO;aACzB;SACF,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC,CAAC,QAAQ,GAAG,gBAAgB,CAAC;IAC9B,sDAAsD;IACtD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;AAC5B,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAgB,EAChB,MAAc,EACd,SAAiB;IAEjB,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,sBAAsB;IACtB,MAAM,SAAS,GAAG,sCAAsC,CAAC;IACzD,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACjC,IAAI,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAE9B,wBAAwB;IACxB,IAAI,SAAS,GAAqB,IAAI,CAAC;IACvC,OAAO,CAAC,SAAS,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,qDAAqD,CAAC,CAAC;YAC5D,IAAI,CAAC,+DAA+D,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YAC1E,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,6EAA6E,CAAC,CAAC;gBACpF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,WAAW,CAAC,sCAAsC,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAEtE,UAAU,CAAC,2BAA2B,EAAE,SAAS,CAAC,CAAC;YACnD,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;YAClC,UAAU,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,EAAE,CAAC;QAEd,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,aAAa,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,EAC/B,GAAG,CACJ,CAAC;QACF,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACxB,iBAAiB;YACjB,WAAW,CAAC,sCAAsC,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;YACtE,UAAU,CAAC,2BAA2B,EAAE,SAAS,CAAC,CAAC;YACnD,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;YAClC,UAAU,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QAED,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,2CAA2C;IAC3C,IAAI,YAAY,GAA8B,IAAI,CAAC;IACnD,OAAO,CAAC,YAAY,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,sBAAsB,SAAS,CAAC,KAAK,EAAE,CAAC;QAC7D,UAAU,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACrD,YAAY,GAAG,kBAAkB,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAElE,IAAI,YAAY,EAAE,CAAC;YACjB,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACjC,MAAM;QACR,CAAC;QAED,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,wCAAwC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjF,IAAI,CAAC,sEAAsE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,EAAE,CAAC;QAEd,MAAM,UAAU,GAAG,2BAA2B,kBAAkB,4CAA4C,SAAS,CAAC,EAAE,EAAE,CAAC;QAC3H,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;QAClF,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,8DAA8D,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,WAAW,CAAC,UAAU,CAAC,CAAC;QACxB,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAChE,CAAC;IAED,0BAA0B;IAC1B,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC;IACpC,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEnC,MAAM,IAAI,GAAiB;QACzB,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,SAAS,CAAC,KAAK;QAC1B,MAAM,EAAE,SAAS,CAAC,EAAE;QACpB,UAAU,EAAE,IAAI,CAAC,KAAK;QACtB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,UAAU,EAAE,SAAS;KACtB,CAAC;IAEF,yCAAyC;IACzC,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,YAAY,SAAS,CAAC,KAAK,IAAI,QAAQ,eAAe,CAAC;IACzE,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAEjC,IAAI,IAAI,GAA8B,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CACxB,IAAI,EACJ,SAAS,CAAC,KAAK,EACf,QAAQ,EACR,0BAA0B,QAAQ,EAAE,CACrC,CAAC;QACF,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,2EAA2E;YAC3E,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,IAAI,QAAQ,kBAAkB,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;YAC1D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,0EAA0E,CAAC,CAAC;gBACjF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAChC,IAAI,CAAC,2BAA2B,SAAS,CAAC,KAAK,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAChC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,SAAS,GAAG,wBAAwB,CAAC;IAC3C,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAEjC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,uBAAuB;QACvB,QAAQ,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9D,QAAQ,CAAC,0BAA0B,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,CAAC,KAAK,2BAA2B,GAAG,EAAE;YAC5F,GAAG,EAAE,OAAO;YACZ,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,QAAQ,CAAC,yBAAyB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,GAAG,EAAE;YAC5D,GAAG,EAAE,OAAO;YACZ,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QAEH,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAEpC,QAAQ,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,QAAQ,CACN,oDAAoD,EACpD,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAChC,CAAC;QAEF,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,QAAQ,CAAC,0BAA0B,SAAS,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,eAAe,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAEjE,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAErD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,aAAa,QAAQ,qDAAqD,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,0BAA0B,QAAQ,EAAE,CAAC;QACxD,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC/C,eAAe,CACb,CAAC,OAAO,EAAE,IAAI,SAAS,GAAG,EAAE,IAAI,UAAU,GAAG,CAAC,EAC9C,YAAY,EACZ,IAAI,CACL,CAAC;YACF,yCAAyC;YACzC,QAAQ,CAAC,8BAA8B,IAAI,CAAC,SAAS,GAAG,EAAE;gBACxD,GAAG,EAAE,UAAU;gBACf,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;YACH,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,IAAI,CAAC,kCAAkC,QAAQ,MAAM,OAAO,EAAE,CAAC,CAAC;YAChE,qEAAqE;YACrE,4EAA4E;YAC5E,iCAAiC;YACjC,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,SAAS,QAAQ,gBAAgB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAClD,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,cAAc,QAAQ,EAAE,CAAC,CAAC;YAE5D,gCAAgC;YAChC,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAE7C,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,UAAU;gBACV,WAAW,EAAE,IAAI,CAAC,QAAQ;aAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,SAAS,QAAQ,eAAe,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEzD,sCAAsC;IACtC,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAE7C,OAAO;QACL,IAAI,EAAE,IAAI;QACV,UAAU;QACV,WAAW,EAAE,IAAI,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAgB,EAChB,IAAkB,EAClB,QAAgB;IAEhB,MAAM,OAAO,GAAkB;QAC7B,GAAG,EAAE,IAAI,CAAC,SAAS;QACnB,IAAI,EAAE,MAAM,IAAI,CAAC,SAAS,EAAE;QAC5B,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,KAAK;KACtB,CAAC;IAEF,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAEzC,gEAAgE;IAChE,MAAM,KAAK,GAAG,MAAM,MAAM,CACxB,6CAA6C,CAC9C,CAAC;IAEF,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;IAE9D,mCAAmC;IACnC,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAEpC,+EAA+E;IAC/E,IAAI,KAAK,EAAE,CAAC;QACV,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,kFAAkF;IAClF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,8GAA8G,CAAC,CAAC;IAC1H,CAAC;SAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACxF,CAAC;IAED,6CAA6C;IAC7C,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAC7D,IAAI,CAAC,6BAA6B,IAAI,CAAC,SAAS,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,oCAAoC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,iCAAiC,EAAE,CAAC,CAAC;AACvG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAgB,EAChB,IAAkB,EAClB,QAAgB;IAEhB,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,OAAO,IAAI,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,KAAK;YACpB,CAAC,CAAC,iCAAiC;YACnC,CAAC,CAAC,mCAAmC,CAAC;QACxC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM;QACjD,MAAM,yBAAyB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtD,KAAK,GAAG,KAAK,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/auth.d.ts

@@ -1,32 +1,69 @@
 /**
- * Auth utilities for create-hq — OAuth PKCE flow for Clerk (US-008)
+ * GitHub App device flow auth for create-hq.
  *
- * Reuses the same patterns as hq-cli/src/utils/auth.ts and
- * hq-cli/src/utils/token-store.ts but bundled inline so create-hq
- * has no dependency on @indigoai-us/hq-cli.
+ * Talks directly to github.com — no backend involved.
+ *
+ * Flow:
+ *   1. POST github.com/login/device/code with our App's client_id
+ *   2. Display user_code, open verification_uri in browser
+ *   3. Poll github.com/login/oauth/access_token at the GitHub-specified interval
+ *   4. On success: GET api.github.com/user → store { access_token, login, id, name, email }
+ *
+ * Token is stored at ~/.hq/credentials.json (mode 0600). Tokens are
+ * GitHub App user-to-server tokens (ghu_…), so they ignore OAuth scopes —
+ * permissions are configured on the App settings page.
  *
  * Token values are NEVER written to stdout or logs.
  */
-export interface AuthToken {
-    clerk_session_token: string;
-    user_id: string;
-    email: string;
-    expires_at: string;
+/** hq-team-sync GitHub App client ID (public — safe to commit). */
+export declare const HQ_GITHUB_APP_CLIENT_ID = "Iv23liSdkCBQYhrNcRmI";
+export declare const HQ_GITHUB_APP_SLUG = "hq-team-sync";
+/** Stored credentials for the authenticated GitHub user. */
+export interface GitHubAuth {
+    /** ghu_ user-to-server token from GitHub App device flow. */
+    access_token: string;
+    /** GitHub login (username). */
+    login: string;
+    /** GitHub numeric user ID. */
+    id: number;
+    /** Display name (may be null on GitHub, fall back to login). */
+    name: string | null;
+    /** Public email (may be null if user has it private). */
+    email: string | null;
+    /** ISO timestamp the token was issued. */
+    issued_at: string;
 }
-/** Save auth token to ~/.hq/auth.json with 0600 permissions. */
-export declare function saveToken(token: AuthToken): void;
-/** Load auth token from ~/.hq/auth.json. Returns null if missing/invalid. */
-export declare function loadToken(): AuthToken | null;
-/** Check if a token is expired or within 5 minutes of expiry. */
-export declare function isTokenExpired(token: AuthToken): boolean;
 /**
- * Start the OAuth PKCE auth flow:
- * 1. Generate PKCE code_verifier + code_challenge
- * 2. Start local HTTP server on a random port for the callback
- * 3. Open browser to Clerk auth URL
- * 4. Wait for callback with auth code
- * 5. Exchange code for token via registry /auth/token endpoint
- * 6. Save token and return AuthToken
+ * Backwards-compat alias used by older modules. Will be removed once all
+ * callers have migrated. New code should use GitHubAuth.
+ */
+export type AuthToken = GitHubAuth;
+/** Save credentials to ~/.hq/credentials.json with 0600 perms. */
+export declare function saveGitHubAuth(auth: GitHubAuth): void;
+/** Load credentials, or null if missing/invalid. */
+export declare function loadGitHubAuth(): GitHubAuth | null;
+/** Remove stored credentials. */
+export declare function clearGitHubAuth(): void;
+/**
+ * Quick liveness probe — does the stored token still work?
+ * Calls api.github.com/user with the token; returns true on 200.
+ */
+export declare function isGitHubAuthValid(auth: GitHubAuth): Promise<boolean>;
+/** Open a URL in the user's default browser. Best-effort, never throws. */
+export declare function openBrowser(url: string): void;
+/**
+ * Run the GitHub App device authorization flow.
+ *
+ * Throws on:
+ *   - Network errors talking to github.com
+ *   - User-denied authorization (access_denied)
+ *   - Device code expiration
+ *   - Failure to fetch the user profile
+ */
+export declare function startGitHubDeviceFlow(): Promise<GitHubAuth>;
+/**
+ * Authenticated fetch against api.github.com. Throws on non-2xx with
+ * the response body included for diagnostics.
  */
-export declare function startAuthFlow(registryUrl: string): Promise<AuthToken>;
+export declare function githubApi<T>(pathname: string, auth: GitHubAuth, init?: RequestInit): Promise<T>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH,MAAM,WAAW,SAAS;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAaD,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAIhD;AAED,6EAA6E;AAC7E,wBAAgB,SAAS,IAAI,SAAS,GAAG,IAAI,CAqB5C;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAIxD;AA0BD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAkG3E"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH,mEAAmE;AACnE,eAAO,MAAM,uBAAuB,yBAAyB,CAAC;AAC9D,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AAWjD,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,6DAA6D;IAC7D,YAAY,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,gEAAgE;IAChE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,yDAAyD;IACzD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC;AAkCnC,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAKrD;AAED,oDAAoD;AACpD,wBAAgB,cAAc,IAAI,UAAU,GAAG,IAAI,CAelD;AAED,iCAAiC;AACjC,wBAAgB,eAAe,IAAI,IAAI,CAQtC;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAc1E;AAID,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAkB7C;AAQD;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,UAAU,CAAC,CAyHjE;AAID;;;GAGG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,CAAC,CAAC,CAwBZ"}