dorfl 0.0.0 → 0.1.0

package/dist/harness.js

@@ -0,0 +1,157 @@
+import { spawnSync } from 'node:child_process';
+/** The `{model}` placeholder the null/shell adapter substitutes in `agentCmd`. */
+export const MODEL_PLACEHOLDER = '{model}';
+/**
+ * Inject the model ROUTING intent (ADR §13) into a shell `command` for the
+ * null/shell adapter, with three degradation rules so model routing is OFFERED,
+ * never FORCED:
+ *
+ *  1. `{model}` present + `model` set ⇒ substitute every occurrence.
+ *  2. `{model}` present + `model` unset ⇒ a clear config error (we never emit a
+ *     literal `{model}` to the shell — that would silently misroute).
+ *  3. `{model}` absent ⇒ return `command` as-is (a user who bakes the model into
+ *     `agentCmd`, or relies on the harness's own default, is untouched).
+ *
+ * dorfl only moves the model INTENT; auth/keys stay the harness's job.
+ */
+export function substituteModel(command, model) {
+    if (!command.includes(MODEL_PLACEHOLDER)) {
+        return command; // rule 3: no placeholder ⇒ run as-is.
+    }
+    if (model === undefined || model === '') {
+        throw new Error(`agentCmd contains a ${MODEL_PLACEHOLDER} placeholder but no model is ` +
+            `configured. Set a model (--model, DORFL_MODEL, per-repo, or ` +
+            `global config) or remove ${MODEL_PLACEHOLDER} from agentCmd.`);
+    }
+    return command.split(MODEL_PLACEHOLDER).join(model); // rule 1: substitute.
+}
+/**
+ * Is this `spawnSync.error` a BENIGN failure of the prompt write, safe to
+ * ignore? The null/shell adapter feeds `input.prompt` to the child on stdin
+ * (`spawnSync('bash', …, {input})`). When the prompt is EMPTY — the autonomous
+ * review/arbiter launches that just shell out and capture stdout — a child that
+ * closes its stdin before the parent's (zero-byte) write surfaces as `EPIPE`
+ * under concurrent test load. That write failing is harmless: there was nothing
+ * to deliver, and the child's stdout/exit status are still captured normally.
+ * So we treat ONLY `EPIPE` as benign and let every OTHER spawn error (`ENOENT`,
+ * `EACCES`, buffer overflow, …) throw — those are real launch failures.
+ */
+export function isBenignPromptWriteError(error) {
+    return error.code === 'EPIPE';
+}
+/**
+ * The **null adapter**: runs the configured command synchronously to completion
+ * in the job dir, recording the PID. Liveness is `process.kill(pid, 0)` against
+ * the recorded PID (the OS process table) — explicitly NOT a file mtime. Because
+ * it runs synchronously, the process has already exited by the time `launch`
+ * returns, so a finished job reads as not-alive (which is correct).
+ */
+export class NullHarness {
+    adapter = 'null';
+    launch(input) {
+        // BACKSTOP (config error, NOT a spawn failure): an empty/whitespace command
+        // resolves the null adapter to `bash -c ''`, which exits 0 with no output — a
+        // "successful" build that ran NOTHING. The `do`/`run`/`--remote` CLI sites
+        // already refuse this up-front (doNeedsAgentCmd), but THIS seam can be reached
+        // by other callers (tests, embeddings, future paths), so it must refuse too.
+        // Distinct from the `result.error` spawn-failure throw below: this names the
+        // config cause + the fix, in the voice of `launchInteractive`/`substituteModel`.
+        if (input.command.trim() === '') {
+            throw new Error('no command to run: the null/shell adapter was launched with an empty ' +
+                'agentCmd — nothing would run. Set `agentCmd` (--agent-cmd, per-repo, or ' +
+                'global config) or configure `harness: pi`.');
+        }
+        // Inject the model routing intent into the shell command via the `{model}`
+        // placeholder (ADR §13) — offered, never forced (see substituteModel).
+        const command = substituteModel(input.command, input.model);
+        const result = spawnSync('bash', ['-c', command], {
+            cwd: input.dir,
+            encoding: 'utf8',
+            input: input.prompt,
+            env: input.env ?? process.env,
+            maxBuffer: 64 * 1024 * 1024,
+        });
+        if (result.error && !isBenignPromptWriteError(result.error)) {
+            throw new Error(`failed to spawn harness command: ${result.error.message}`);
+        }
+        // Record the CHILD's PID (the liveness anchor) — not the runner's. The null
+        // adapter runs synchronously, so by the time we return the child has
+        // exited, and `isAlive` correctly reads it as not-alive (from the PID
+        // table, NOT a file mtime).
+        const record = {
+            adapter: this.adapter,
+            pid: result.pid,
+            command,
+        };
+        const status = result.status ?? -1;
+        // The null/shell adapter's OUTPUT is its captured stdout (trimmed): a
+        // synchronous spawn, so there is no stream-fragility caveat — the command's
+        // stdout IS its answer. `undefined` when empty (no answer to surface).
+        const stdout = (result.stdout ?? '').trim();
+        return {
+            ok: status === 0,
+            record,
+            detail: status === 0 ? undefined : (result.stderr ?? '').trim(),
+            output: stdout === '' ? undefined : stdout,
+        };
+    }
+    /**
+     * Interactive launch is NOT supported by the null/shell adapter (decision #2):
+     * its `agentCmd` is shaped for the captured, prompt-fed AUTONOMOUS path, so
+     * "interactive" has no clean meaning here. Throw a CLEAR pi-only error
+     * (mirroring `do --watch`'s fail-on-null decision) rather than silently
+     * shelling out the wrong way.
+     */
+    launchInteractive(_input) {
+        throw new Error('interactive launch requires the pi harness; configure `harness: pi` ' +
+            '(the null/shell adapter only supports the captured autonomous launch).');
+    }
+    isAlive(record) {
+        return pidAlive(record.pid);
+    }
+}
+/**
+ * Resolve the harness adapter that OWNS a given job record, keyed off the
+ * record's `adapter` field. The core (`status`, `watch`, `gc`) reads liveness
+ * for a heterogeneous set of jobs (some null, some pi) from their persisted
+ * records, so it must ask the RIGHT adapter per job — a pi job's liveness is the
+ * pi adapter's responsibility (PID + session pointer), not the null adapter's.
+ *
+ * Adapters register here lazily via {@link registerHarness}; an unknown adapter
+ * falls back to the null adapter (PID-only liveness — never mtime), which is a
+ * safe superset for any PID-anchored record.
+ */
+export function resolveHarness(record) {
+    return HARNESS_REGISTRY.get(record.adapter) ?? FALLBACK_HARNESS;
+}
+/**
+ * Register a harness adapter under its `adapter` name so {@link resolveHarness}
+ * can dispatch liveness to it. Idempotent (last registration wins). The pi
+ * adapter registers itself on import; tests may register stubs.
+ */
+export function registerHarness(harness) {
+    HARNESS_REGISTRY.set(harness.adapter, harness);
+}
+const FALLBACK_HARNESS = new NullHarness();
+const HARNESS_REGISTRY = new Map([
+    [FALLBACK_HARNESS.adapter, FALLBACK_HARNESS],
+]);
+/**
+ * Is `pid` a live process? Uses signal 0 (`process.kill(pid, 0)`), which checks
+ * for existence/permission WITHOUT delivering a signal — the OS process table,
+ * never a filesystem mtime. Unknown/undefined PID ⇒ not alive.
+ */
+export function pidAlive(pid) {
+    if (pid === undefined || pid <= 0) {
+        return false;
+    }
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        // EPERM means the process exists but we may not signal it ⇒ still alive.
+        return err.code === 'EPERM';
+    }
+}
+//# sourceMappingURL=harness.js.map

package/dist/harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.js","sourceRoot":"","sources":["../src/harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,SAAS,EAAC,MAAM,oBAAoB,CAAC;AAoI7C,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC9B,OAAe,EACf,KAAyB;IAEzB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1C,OAAO,OAAO,CAAC,CAAC,sCAAsC;IACvD,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACd,uBAAuB,iBAAiB,+BAA+B;YACtE,8DAA8D;YAC9D,4BAA4B,iBAAiB,iBAAiB,CAC/D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB;AAC5E,CAAC;AAkDD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAY;IACpD,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACd,OAAO,GAAG,MAAM,CAAC;IAE1B,MAAM,CAAC,KAAkB;QACxB,4EAA4E;QAC5E,8EAA8E;QAC9E,2EAA2E;QAC3E,+EAA+E;QAC/E,6EAA6E;QAC7E,6EAA6E;QAC7E,iFAAiF;QACjF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACd,uEAAuE;gBACtE,0EAA0E;gBAC1E,4CAA4C,CAC7C,CAAC;QACH,CAAC;QACD,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;YACjD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;YAC7B,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC3B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACd,oCAAoC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC1D,CAAC;QACH,CAAC;QACD,4EAA4E;QAC5E,qEAAqE;QACrE,sEAAsE;QACtE,4BAA4B;QAC5B,MAAM,MAAM,GAAkB;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,OAAO;SACP,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACnC,sEAAsE;QACtE,4EAA4E;QAC5E,uEAAuE;QACvE,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,OAAO;YACN,EAAE,EAAE,MAAM,KAAK,CAAC;YAChB,MAAM;YACN,MAAM,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAC/D,MAAM,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;SAC1C,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,MAA8B;QAC/C,MAAM,IAAI,KAAK,CACd,sEAAsE;YACrE,wEAAwE,CACzE,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAqB;QAC5B,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;CACD;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB;IACnD,OAAO,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC/C,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,WAAW,EAAE,CAAC;AAC3C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAkB;IACjD,CAAC,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,CAAC;CAC5C,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAuB;IAC/C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,yEAAyE;QACzE,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;IACxD,CAAC;AACF,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,167 @@
+/**
+ * The **identity** feature: run the runner's git + provider operations as a
+ * configured entity (a bot), without mutating the user's global git/`gh` config.
+ *
+ * The mechanism is process-scoped environment overrides on the child processes
+ * the runner spawns (`git`, `gh`) — never a global mutation. So if the runner
+ * crashes mid-run the user's machine is untouched, and an absent identity is
+ * byte-for-byte today's ambient behaviour.
+ *
+ * # The three axes (keep these distinct — they are different concerns)
+ *
+ *   1. **commit label** (`name` / `email`) — the git author/committer strings
+ *      stamped into the commit object. These are NOT authenticated: git never
+ *      checks them against anything. Driven by `GIT_CONFIG_PARAMETERS`.
+ *   2. **git transport auth** (`auth`) — WHO pushes. Per-transport policy: an
+ *      SSH key (or ambient ssh) drives `GIT_SSH_COMMAND`; HTTPS uses the ambient
+ *      credential. This is the substrate concern — meaningful with NO provider.
+ *   3. **provider API auth** (`providers.github`) — WHO opens the PR / posts the
+ *      comment, via `GH_TOKEN`. NEVER used as a git credential (git is SSH-first;
+ *      GitHub is an additive layer). Optional: absent ⇒ `gh` degrades.
+ *
+ * The three axes SHOULD point at the same entity for a coherent bot (the token's
+ * GitHub account should be the account the SSH key is registered to), but nothing
+ * can verify that automatically — it is a documented coherence note, not a check.
+ *
+ * # Why `auth` is mandatory-explicit (no silent omission)
+ *
+ * `auth.ssh` and `auth.https` are BOTH required, each an explicit small union, so
+ * the dangerous "I set a bot provider token but left git auth ambient — and my
+ * remote is HTTPS, so I silently push as the human" misconfig is UNSPELLABLE by
+ * accident: pushing over ambient HTTPS requires literally writing
+ * `https: "ambient"`. A bot setup naturally writes `https: "never"`, which makes
+ * the leak a hard push-time failure instead of a silent wrong-account push.
+ */
+/** The conventional `agents.alt` TLD never resolves to a real account (deliberate). */
+export declare const DEFAULT_IDENTITY_NAME = "dorfl";
+export declare const DEFAULT_IDENTITY_EMAIL = "dorfl@agents.alt";
+/**
+ * Per-transport git-auth policy for SSH. A filesystem path PINS that key
+ * (`GIT_SSH_COMMAND -i <path>`); `"ambient"` lets ssh-agent / `~/.ssh/config`
+ * resolve the key; `"never"` FORBIDS the SSH transport (a hard push-time failure
+ * if the arbiter is an SSH remote). A `union of more` later (e.g. host options).
+ */
+export type SshAuth = string | 'ambient' | 'never';
+/**
+ * Per-transport git-auth policy for HTTPS. `"ambient"` uses whatever HTTPS
+ * credential the environment supplies (credential helper / cached PAT — e.g. the
+ * CI `actions/checkout` token); `"never"` FORBIDS the HTTPS transport (a hard
+ * push-time failure if the arbiter is an HTTPS remote). A token-pin member (the
+ * explicit HTTPS-push credential, distinct from the provider token) is a planned
+ * future addition — keep this a union so it grows without churn.
+ */
+export type HttpsAuth = 'ambient' | 'never';
+/** Git TRANSPORT auth — both transports stated, no silent-omission state. */
+export interface GitAuth {
+    /** Policy for SSH pushes: a key path, `"ambient"`, or `"never"`. */
+    ssh: SshAuth;
+    /** Policy for HTTPS pushes: `"ambient"` or `"never"`. */
+    https: HttpsAuth;
+}
+/** Provider API auth — the `gh` token, by literal value OR an env-var name. */
+export type GitHubProviderAuth = {
+    token: string;
+} | {
+    tokenEnv: string;
+};
+/** The optional, pluggable review-request providers (matches `ProviderName`). */
+export interface IdentityProviders {
+    /** GitHub provider API auth (`gh`). Absent ⇒ `gh` runs unauthenticated. */
+    github?: GitHubProviderAuth;
+}
+/**
+ * A configured runner identity (a bot). The WHOLE block is optional — absent ⇒
+ * fully ambient (today's behaviour, byte-for-byte). When present, `auth` is
+ * MANDATORY (both transports stated); `name`/`email` default in; `providers` is
+ * optional. HOST-ONLY: rejected in a per-repo `.dorfl.json` (it carries
+ * secrets and is per-machine), so it lives only in the global config.
+ */
+export interface Identity {
+    /** Commit author/committer LABEL. Default {@link DEFAULT_IDENTITY_NAME}. */
+    name?: string;
+    /** Commit author/committer LABEL. Default {@link DEFAULT_IDENTITY_EMAIL}. */
+    email?: string;
+    /** Git transport auth (mandatory when identity present). */
+    auth: GitAuth;
+    /** Optional pluggable providers (GitHub today). */
+    providers?: IdentityProviders;
+}
+/** Which transport an arbiter remote URL pushes over. */
+export type ArbiterTransport = 'ssh' | 'https' | 'local';
+/**
+ * Classify the git transport an arbiter remote URL uses — the fact that selects
+ * WHICH `auth` policy (`ssh` vs `https`) applies at push time. Mirrors the four
+ * URL shapes `repo-mirror`/`github` already handle:
+ *
+ *  - scp-like ssh (`git@host:org/repo.git`) and `ssh://` ⇒ `ssh`
+ *  - `https://` / `http://` ⇒ `https`
+ *  - `file://` / a plain local path ⇒ `local` (no transport auth applies)
+ */
+export declare function arbiterTransport(url: string): ArbiterTransport;
+/** A validation failure naming the offending field (load-time config error). */
+export declare class IdentityConfigError extends Error {
+}
+/** A push-time transport-coherence failure (forbidden transport for the arbiter). */
+export declare class IdentityTransportError extends Error {
+}
+/**
+ * Validate a present `identity` block at config-LOAD time (dumb — does NOT
+ * resolve any arbiter URL; the transport-coherence check is push-time). Throws
+ * an {@link IdentityConfigError} naming the offending field. The structural
+ * "auth mandatory / ssh+https stated" guarantee mostly rides on the type, but a
+ * JSON file is untyped, so we re-check it here for a human-facing message.
+ */
+export declare function validateIdentity(identity: Identity): void;
+/**
+ * Resolve the `gh` token for the GitHub provider from the identity, or
+ * `undefined` when no GitHub provider auth is configured. A `tokenEnv` is read
+ * from `env` at USE-time (so a missing env var surfaces here with a clear
+ * message), `token` is the literal value. `env` defaults to `process.env`.
+ */
+export declare function resolveGitHubToken(identity: Identity | undefined, env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Build the process-scoped environment overrides for `identity`, merged over
+ * `base` (default `process.env`). Returns `base` UNCHANGED (same reference) when
+ * `identity` is `undefined` — the absent-identity path is byte-for-byte today's
+ * behaviour, so callers can pass the result straight through.
+ *
+ * When present it sets, on a COPY of `base`:
+ *   - `GIT_CONFIG_PARAMETERS` — quoted `'user.name=…' 'user.email=…'` (defaults
+ *     applied). Properly single-quoted (with `'\''` escaping) so a name/email
+ *     containing a space or quote cannot break the parse.
+ *   - `GIT_AUTHOR_NAME`/`GIT_AUTHOR_EMAIL`/`GIT_COMMITTER_NAME`/
+ *     `GIT_COMMITTER_EMAIL` — set to the SAME bot name/email. This is
+ *     LOAD-BEARING: the per-commit `GIT_AUTHOR_*`/`GIT_COMMITTER_*` env vars take
+ *     PRECEDENCE over `user.name`/`user.email` (and thus over
+ *     `GIT_CONFIG_PARAMETERS`). If the AMBIENT env already has them (some CI /
+ *     tooling sets them), `GIT_CONFIG_PARAMETERS` alone would be SILENTLY ignored
+ *     and the commit would be authored by the ambient identity — exactly the
+ *     silent-fallback this feature exists to prevent. So we pin all four to the
+ *     identity, making it win UNCONDITIONALLY over any ambient git identity.
+ *   - `GIT_SSH_COMMAND` — `ssh -i <path> -o IdentitiesOnly=yes -o
+ *     IdentityAgent=none` ONLY when `auth.ssh` is a key path. `"ambient"`/`"never"`
+ *     set nothing (ambient ssh resolution; `"never"` is enforced by the push-time
+ *     transport guard).
+ *
+ *     `IdentityAgent=none` is LOAD-BEARING, NOT decoration: `IdentitiesOnly=yes`
+ *     ALONE does NOT stop a running ssh-agent from offering its OWN keys — it only
+ *     restricts which keys are tried to those whose public file is named, and an
+ *     agent key matching a discoverable `~/.ssh/*.pub` is still offered FIRST. So
+ *     with a personal key in the agent, the push could silently authenticate as
+ *     the HUMAN (the wrong account) despite `-i <bot key>` — the exact silent-
+ *     wrong-account failure mode this feature exists to prevent (the SSH-axis twin
+ *     of the `GIT_AUTHOR_*` pinning below). `IdentityAgent=none` detaches the
+ *     agent entirely, so ONLY the pinned key is offered — it wins unconditionally.
+ *   - `GH_TOKEN` — ONLY when a GitHub provider token is configured (resolved at
+ *     use-time). NEVER fed to git (the token is provider-API only).
+ */
+export declare function identityEnv(identity: Identity | undefined, base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * Enforce the push-time transport-coherence rule: the `auth` policy for the
+ * arbiter's actual transport must not be `"never"`. Throws an
+ * {@link IdentityTransportError} with an actionable message (use a matching
+ * remote, or unset `identity`) when the transport is forbidden. A `local`
+ * arbiter (or an absent identity) has nothing to enforce.
+ */
+export declare function assertTransportAllowed(identity: Identity | undefined, arbiterUrl: string): void;
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,uFAAuF;AACvF,eAAO,MAAM,qBAAqB,UAAU,CAAC;AAC7C,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAE5C,6EAA6E;AAC7E,MAAM,WAAW,OAAO;IACvB,oEAAoE;IACpE,GAAG,EAAE,OAAO,CAAC;IACb,yDAAyD;IACzD,KAAK,EAAE,SAAS,CAAC;CACjB;AAED,+EAA+E;AAC/E,MAAM,MAAM,kBAAkB,GAAG;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAAC;AAEtE,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IACjC,2EAA2E;IAC3E,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACxB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,IAAI,EAAE,OAAO,CAAC;IACd,mDAAmD;IACnD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC9B;AAED,yDAAyD;AACzD,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC;AAEzD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAkB9D;AAED,gFAAgF;AAChF,qBAAa,mBAAoB,SAAQ,KAAK;CAAG;AAEjD,qFAAqF;AACrF,qBAAa,sBAAuB,SAAQ,KAAK;CAAG;AAEpD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAkCzD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CACjC,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,MAAM,GAAG,SAAS,CAmBpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,WAAW,CAC1B,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,IAAI,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAAC,UAAU,CAuCnB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,UAAU,EAAE,MAAM,GAChB,IAAI,CAmBN"}

package/dist/identity.js

@@ -0,0 +1,231 @@
+/**
+ * The **identity** feature: run the runner's git + provider operations as a
+ * configured entity (a bot), without mutating the user's global git/`gh` config.
+ *
+ * The mechanism is process-scoped environment overrides on the child processes
+ * the runner spawns (`git`, `gh`) — never a global mutation. So if the runner
+ * crashes mid-run the user's machine is untouched, and an absent identity is
+ * byte-for-byte today's ambient behaviour.
+ *
+ * # The three axes (keep these distinct — they are different concerns)
+ *
+ *   1. **commit label** (`name` / `email`) — the git author/committer strings
+ *      stamped into the commit object. These are NOT authenticated: git never
+ *      checks them against anything. Driven by `GIT_CONFIG_PARAMETERS`.
+ *   2. **git transport auth** (`auth`) — WHO pushes. Per-transport policy: an
+ *      SSH key (or ambient ssh) drives `GIT_SSH_COMMAND`; HTTPS uses the ambient
+ *      credential. This is the substrate concern — meaningful with NO provider.
+ *   3. **provider API auth** (`providers.github`) — WHO opens the PR / posts the
+ *      comment, via `GH_TOKEN`. NEVER used as a git credential (git is SSH-first;
+ *      GitHub is an additive layer). Optional: absent ⇒ `gh` degrades.
+ *
+ * The three axes SHOULD point at the same entity for a coherent bot (the token's
+ * GitHub account should be the account the SSH key is registered to), but nothing
+ * can verify that automatically — it is a documented coherence note, not a check.
+ *
+ * # Why `auth` is mandatory-explicit (no silent omission)
+ *
+ * `auth.ssh` and `auth.https` are BOTH required, each an explicit small union, so
+ * the dangerous "I set a bot provider token but left git auth ambient — and my
+ * remote is HTTPS, so I silently push as the human" misconfig is UNSPELLABLE by
+ * accident: pushing over ambient HTTPS requires literally writing
+ * `https: "ambient"`. A bot setup naturally writes `https: "never"`, which makes
+ * the leak a hard push-time failure instead of a silent wrong-account push.
+ */
+/** The conventional `agents.alt` TLD never resolves to a real account (deliberate). */
+export const DEFAULT_IDENTITY_NAME = 'dorfl';
+export const DEFAULT_IDENTITY_EMAIL = 'dorfl@agents.alt';
+/**
+ * Classify the git transport an arbiter remote URL uses — the fact that selects
+ * WHICH `auth` policy (`ssh` vs `https`) applies at push time. Mirrors the four
+ * URL shapes `repo-mirror`/`github` already handle:
+ *
+ *  - scp-like ssh (`git@host:org/repo.git`) and `ssh://` ⇒ `ssh`
+ *  - `https://` / `http://` ⇒ `https`
+ *  - `file://` / a plain local path ⇒ `local` (no transport auth applies)
+ */
+export function arbiterTransport(url) {
+    const trimmed = url.trim();
+    if (!trimmed.includes('://')) {
+        // scp-like ssh: [user@]host:path (a `:` before the path, NOT a local path).
+        const scp = /^(?:[^@/]+@)?([^/:]+):(.+)$/;
+        if (scp.test(trimmed) && !trimmed.startsWith('/')) {
+            return 'ssh';
+        }
+        return 'local'; // a plain absolute path has no transport
+    }
+    const scheme = trimmed.slice(0, trimmed.indexOf('://')).toLowerCase();
+    if (scheme === 'ssh') {
+        return 'ssh';
+    }
+    if (scheme === 'https' || scheme === 'http') {
+        return 'https';
+    }
+    return 'local'; // file:// (or anything else) — no transport auth
+}
+/** A validation failure naming the offending field (load-time config error). */
+export class IdentityConfigError extends Error {
+}
+/** A push-time transport-coherence failure (forbidden transport for the arbiter). */
+export class IdentityTransportError extends Error {
+}
+/**
+ * Validate a present `identity` block at config-LOAD time (dumb — does NOT
+ * resolve any arbiter URL; the transport-coherence check is push-time). Throws
+ * an {@link IdentityConfigError} naming the offending field. The structural
+ * "auth mandatory / ssh+https stated" guarantee mostly rides on the type, but a
+ * JSON file is untyped, so we re-check it here for a human-facing message.
+ */
+export function validateIdentity(identity) {
+    if (identity.auth === undefined || identity.auth === null) {
+        throw new IdentityConfigError('identity.auth is required when an identity is configured ' +
+            '(state both `ssh` and `https`).');
+    }
+    const { ssh, https } = identity.auth;
+    if (ssh === undefined || ssh === null || ssh === '') {
+        throw new IdentityConfigError('identity.auth.ssh is required (a key path, "ambient", or "never").');
+    }
+    if (https !== 'ambient' && https !== 'never') {
+        throw new IdentityConfigError('identity.auth.https must be "ambient" or "never".');
+    }
+    const github = identity.providers?.github;
+    if (github !== undefined) {
+        const hasToken = 'token' in github && github.token !== undefined;
+        const hasEnv = 'tokenEnv' in github && github.tokenEnv !== undefined;
+        if (hasToken && hasEnv) {
+            throw new IdentityConfigError('identity.providers.github must set exactly one of `token` or ' +
+                '`tokenEnv`, not both.');
+        }
+        if (!hasToken && !hasEnv) {
+            throw new IdentityConfigError('identity.providers.github must set `token` or `tokenEnv`.');
+        }
+    }
+}
+/**
+ * Resolve the `gh` token for the GitHub provider from the identity, or
+ * `undefined` when no GitHub provider auth is configured. A `tokenEnv` is read
+ * from `env` at USE-time (so a missing env var surfaces here with a clear
+ * message), `token` is the literal value. `env` defaults to `process.env`.
+ */
+export function resolveGitHubToken(identity, env = process.env) {
+    const github = identity?.providers?.github;
+    if (github === undefined) {
+        return undefined;
+    }
+    if ('token' in github && github.token !== undefined) {
+        return github.token;
+    }
+    if ('tokenEnv' in github && github.tokenEnv !== undefined) {
+        const value = env[github.tokenEnv];
+        if (value === undefined || value === '') {
+            throw new IdentityConfigError(`identity.providers.github.tokenEnv names env var ` +
+                `"${github.tokenEnv}", which is unset or empty.`);
+        }
+        return value;
+    }
+    return undefined;
+}
+/**
+ * Build the process-scoped environment overrides for `identity`, merged over
+ * `base` (default `process.env`). Returns `base` UNCHANGED (same reference) when
+ * `identity` is `undefined` — the absent-identity path is byte-for-byte today's
+ * behaviour, so callers can pass the result straight through.
+ *
+ * When present it sets, on a COPY of `base`:
+ *   - `GIT_CONFIG_PARAMETERS` — quoted `'user.name=…' 'user.email=…'` (defaults
+ *     applied). Properly single-quoted (with `'\''` escaping) so a name/email
+ *     containing a space or quote cannot break the parse.
+ *   - `GIT_AUTHOR_NAME`/`GIT_AUTHOR_EMAIL`/`GIT_COMMITTER_NAME`/
+ *     `GIT_COMMITTER_EMAIL` — set to the SAME bot name/email. This is
+ *     LOAD-BEARING: the per-commit `GIT_AUTHOR_*`/`GIT_COMMITTER_*` env vars take
+ *     PRECEDENCE over `user.name`/`user.email` (and thus over
+ *     `GIT_CONFIG_PARAMETERS`). If the AMBIENT env already has them (some CI /
+ *     tooling sets them), `GIT_CONFIG_PARAMETERS` alone would be SILENTLY ignored
+ *     and the commit would be authored by the ambient identity — exactly the
+ *     silent-fallback this feature exists to prevent. So we pin all four to the
+ *     identity, making it win UNCONDITIONALLY over any ambient git identity.
+ *   - `GIT_SSH_COMMAND` — `ssh -i <path> -o IdentitiesOnly=yes -o
+ *     IdentityAgent=none` ONLY when `auth.ssh` is a key path. `"ambient"`/`"never"`
+ *     set nothing (ambient ssh resolution; `"never"` is enforced by the push-time
+ *     transport guard).
+ *
+ *     `IdentityAgent=none` is LOAD-BEARING, NOT decoration: `IdentitiesOnly=yes`
+ *     ALONE does NOT stop a running ssh-agent from offering its OWN keys — it only
+ *     restricts which keys are tried to those whose public file is named, and an
+ *     agent key matching a discoverable `~/.ssh/*.pub` is still offered FIRST. So
+ *     with a personal key in the agent, the push could silently authenticate as
+ *     the HUMAN (the wrong account) despite `-i <bot key>` — the exact silent-
+ *     wrong-account failure mode this feature exists to prevent (the SSH-axis twin
+ *     of the `GIT_AUTHOR_*` pinning below). `IdentityAgent=none` detaches the
+ *     agent entirely, so ONLY the pinned key is offered — it wins unconditionally.
+ *   - `GH_TOKEN` — ONLY when a GitHub provider token is configured (resolved at
+ *     use-time). NEVER fed to git (the token is provider-API only).
+ */
+export function identityEnv(identity, base = process.env) {
+    if (identity === undefined) {
+        return base;
+    }
+    const name = identity.name ?? DEFAULT_IDENTITY_NAME;
+    const email = identity.email ?? DEFAULT_IDENTITY_EMAIL;
+    const env = { ...base };
+    // Commit LABEL (always set when an identity is present). GIT_CONFIG_PARAMETERS
+    // is a space-separated list of shell-quoted `key=value` pairs.
+    env.GIT_CONFIG_PARAMETERS = [
+        shellQuote(`user.name=${name}`),
+        shellQuote(`user.email=${email}`),
+    ].join(' ');
+    // Pin the per-commit author/committer env too — these OUTRANK `user.name`/
+    // `user.email`, so without them an ambient `GIT_AUTHOR_*`/`GIT_COMMITTER_*`
+    // would silently beat the identity (the silent-fallback failure mode). Setting
+    // them makes the identity win unconditionally.
+    env.GIT_AUTHOR_NAME = name;
+    env.GIT_AUTHOR_EMAIL = email;
+    env.GIT_COMMITTER_NAME = name;
+    env.GIT_COMMITTER_EMAIL = email;
+    // Git TRANSPORT auth — only a PINNED ssh key sets GIT_SSH_COMMAND.
+    // `IdentityAgent=none` is REQUIRED for the pin to actually hold: without it a
+    // running ssh-agent (e.g. with the human's personal key) can offer its own keys
+    // FIRST and silently push as the wrong account, despite `-i <bot key>`.
+    const ssh = identity.auth.ssh;
+    if (ssh !== 'ambient' && ssh !== 'never') {
+        env.GIT_SSH_COMMAND = `ssh -i ${shellQuote(ssh)} -o IdentitiesOnly=yes -o IdentityAgent=none`;
+    }
+    // Provider API auth — the gh token, NEVER a git credential.
+    const token = resolveGitHubToken(identity, base);
+    if (token !== undefined) {
+        env.GH_TOKEN = token;
+    }
+    return env;
+}
+/**
+ * Enforce the push-time transport-coherence rule: the `auth` policy for the
+ * arbiter's actual transport must not be `"never"`. Throws an
+ * {@link IdentityTransportError} with an actionable message (use a matching
+ * remote, or unset `identity`) when the transport is forbidden. A `local`
+ * arbiter (or an absent identity) has nothing to enforce.
+ */
+export function assertTransportAllowed(identity, arbiterUrl) {
+    if (identity === undefined) {
+        return;
+    }
+    const transport = arbiterTransport(arbiterUrl);
+    if (transport === 'ssh' && identity.auth.ssh === 'never') {
+        throw new IdentityTransportError(`identity forbids SSH (auth.ssh: "never") but arbiter ` +
+            `"${arbiterUrl}" is an SSH remote. Use an HTTPS remote, set ` +
+            `auth.ssh to a key path or "ambient", or unset identity.`);
+    }
+    if (transport === 'https' && identity.auth.https === 'never') {
+        throw new IdentityTransportError(`identity forbids HTTPS (auth.https: "never") but arbiter ` +
+            `"${arbiterUrl}" is an HTTPS remote. Use an SSH remote, set ` +
+            `auth.https to "ambient", or unset identity.`);
+    }
+}
+/**
+ * Single-quote a string for safe inclusion in a `GIT_CONFIG_PARAMETERS` /
+ * `GIT_SSH_COMMAND` value: wrap in single quotes and escape any embedded single
+ * quote as `'\''` (close-quote, escaped-quote, re-open-quote — the POSIX idiom).
+ */
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,uFAAuF;AACvF,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AA0DzD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,4EAA4E;QAC5E,MAAM,GAAG,GAAG,6BAA6B,CAAC;QAC1C,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,OAAO,CAAC,CAAC,yCAAyC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACtE,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC;IAChB,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,iDAAiD;AAClE,CAAC;AAED,gFAAgF;AAChF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;CAAG;AAEjD,qFAAqF;AACrF,MAAM,OAAO,sBAAuB,SAAQ,KAAK;CAAG;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkB;IAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3D,MAAM,IAAI,mBAAmB,CAC5B,2DAA2D;YAC1D,iCAAiC,CAClC,CAAC;IACH,CAAC;IACD,MAAM,EAAC,GAAG,EAAE,KAAK,EAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,mBAAmB,CAC5B,oEAAoE,CACpE,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAC9C,MAAM,IAAI,mBAAmB,CAC5B,mDAAmD,CACnD,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,OAAO,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC;QACjE,MAAM,MAAM,GAAG,UAAU,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC;QACrE,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAmB,CAC5B,+DAA+D;gBAC9D,uBAAuB,CACxB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,mBAAmB,CAC5B,2DAA2D,CAC3D,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,QAA8B,EAC9B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,IAAI,UAAU,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,mBAAmB,CAC5B,mDAAmD;gBAClD,IAAI,MAAM,CAAC,QAAQ,6BAA6B,CACjD,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,WAAW,CAC1B,QAA8B,EAC9B,OAA0B,OAAO,CAAC,GAAG;IAErC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,qBAAqB,CAAC;IACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,sBAAsB,CAAC;IACvD,MAAM,GAAG,GAAsB,EAAC,GAAG,IAAI,EAAC,CAAC;IAEzC,+EAA+E;IAC/E,+DAA+D;IAC/D,GAAG,CAAC,qBAAqB,GAAG;QAC3B,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC;QAC/B,UAAU,CAAC,cAAc,KAAK,EAAE,CAAC;KACjC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,2EAA2E;IAC3E,4EAA4E;IAC5E,+EAA+E;IAC/E,+CAA+C;IAC/C,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC;IAC3B,GAAG,CAAC,gBAAgB,GAAG,KAAK,CAAC;IAC7B,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAC9B,GAAG,CAAC,mBAAmB,GAAG,KAAK,CAAC;IAEhC,mEAAmE;IACnE,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC1C,GAAG,CAAC,eAAe,GAAG,UAAU,UAAU,CAAC,GAAG,CAAC,8CAA8C,CAAC;IAC/F,CAAC;IAED,4DAA4D;IAC5D,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACrC,QAA8B,EAC9B,UAAkB;IAElB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;IACR,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,sBAAsB,CAC/B,uDAAuD;YACtD,IAAI,UAAU,+CAA+C;YAC7D,yDAAyD,CAC1D,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC9D,MAAM,IAAI,sBAAsB,CAC/B,2DAA2D;YAC1D,IAAI,UAAU,+CAA+C;YAC7D,6CAA6C,CAC9C,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAa;IAChC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC5C,CAAC"}