gcb-client 0.0.0-stage → 0.0.1

package/lib/commands/remotes.js

@@ -0,0 +1,157 @@
+/**
+ * Let a branch name say *which* repository it is on, by naming a configured remote.
+ *
+ * `--head feat/x` is a branch in the repository `--repo` names. For a pull request from your fork into an
+ * upstream, one of the two has to name the other repository, and the honest way to say it is the remote
+ * name you already push to: `--head origin:feat/x --base upstream:main`. A hand-typed `owner/name` is a
+ * string that can be wrong in a way that looks right; a remote name is one git already knows, and a typo
+ * gets you the list of the ones that exist.
+ *
+ * Resolved here rather than on the host, because this process runs in the checkout: the wire carries the
+ * answer, so the host side needs no git and no repository.
+ */
+import { execFileSync } from 'node:child_process';
+/**
+ * Run a git command in a directory, and answer with everything it said.
+ *
+ * Everything, not the first line: `git remote get-url` answers with one, and `git remote` with all of
+ * them, and a helper that quietly dropped the rest would report one remote for a checkout with two.
+ *
+ * @param args - the arguments, without `git`.
+ * @param cwd - where to run it.
+ * @returns the output, or undefined when git refused.
+ */
+function git(args, cwd) {
+    try {
+        const out = execFileSync('git', [...args], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+        const trimmed = out.replace(/\s+$/, '');
+        return trimmed === '' ? undefined : trimmed;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The remotes this checkout knows, in the order git lists them.
+ *
+ * @param cwd - the directory to ask.
+ * @returns the names, possibly empty.
+ */
+export function listRemotes(cwd) {
+    return (git(['remote'], cwd) ?? '')
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line !== '');
+}
+/**
+ * What repository a remote points at.
+ *
+ * HTTPS and SSH spell the same thing differently, and both end in `owner/repo`, optionally with a `.git`.
+ *
+ * @param name - the remote name.
+ * @param cwd - the directory to ask.
+ * @returns the owner, repository and host, or undefined when there is no such remote or the URL is not one.
+ */
+export function remoteRepo(name, cwd, push = false) {
+    // `--push` for a head: git lets a remote fetch from one place and push to another, and the branch a
+    // pull request comes from lives where it was pushed. The base asks the other question.
+    const url = git(['remote', 'get-url', ...(push ? ['--push'] : []), name], cwd);
+    if (url === undefined)
+        return undefined;
+    // A URL has an authority and then a path; the scp form has a host and then one. Anything else — a local
+    // path, a `file:` URL, a host with no dot — is refused rather than read as an owner that happens to be a
+    // port number or a directory name.
+    let path;
+    let host;
+    const scheme = /^([a-z+]+):\/\//i.exec(url)?.[1]?.toLowerCase();
+    if (scheme !== undefined) {
+        const rest = url.replace(/^[a-z+]+:\/\//i, '').replace(/^[^@/]*@/, '');
+        const slash = rest.indexOf('/');
+        const authority = slash < 0 ? '' : rest.slice(0, slash);
+        const hostname = authority.split(':')[0] ?? '';
+        if (slash >= 0 && hostname.includes('.')) {
+            // An HTTP(S) port is part of the host key the broker matches; an SSH or git port is not.
+            host = scheme === 'http' || scheme === 'https' ? authority : hostname;
+            path = rest.slice(slash + 1);
+        }
+    }
+    else {
+        const scp = /^(?:[^@/]+@)?([^/:]+\.[^/:]+):(.+)$/.exec(url);
+        if (scp !== null && scp[1] !== undefined && scp[2] !== undefined) {
+            host = scp[1];
+            path = scp[2];
+        }
+    }
+    if (path === undefined || host === undefined)
+        return undefined;
+    const cleaned = path.replace(/^\/+/, '').replace(/\/+$/, '').replace(/\.git$/i, '');
+    const [owner, repo, ...rest] = cleaned.split('/').filter((part) => part !== '');
+    if (owner === undefined || repo === undefined || rest.length > 0)
+        return undefined;
+    return { owner, repo, host: host.toLowerCase() };
+}
+/**
+ * The URL a remote points at, for saying what was wrong with it.
+ *
+ * @param name - the remote name.
+ * @param cwd - the directory to ask.
+ * @returns the URL, or undefined when there is no such remote.
+ */
+export function remoteUrl(name, cwd) {
+    return git(['remote', 'get-url', name], cwd);
+}
+/**
+ * Turn `remote:branch` into `owner:branch`, and leave a plain branch alone.
+ *
+ * @param value - what the operator wrote.
+ * @param cwd - the directory to resolve remotes in.
+ * @returns the value to send.
+ * @throws {Error} when the prefix is not a remote this checkout knows, naming the ones it does.
+ */
+export function qualifiedBranch(value, cwd) {
+    const colon = value.indexOf(':');
+    if (colon < 0)
+        return value;
+    const name = value.slice(0, colon);
+    const branch = value.slice(colon + 1);
+    const found = remoteRepo(name, cwd, true);
+    if (found === undefined) {
+        const known = listRemotes(cwd);
+        const url = remoteUrl(name, cwd);
+        if (url !== undefined) {
+            throw new Error(`remote ${JSON.stringify(name)} points at ${url}, which does not name an owner and a repository`);
+        }
+        throw new Error(`no remote named ${JSON.stringify(name)} here, so ${JSON.stringify(value)} cannot be resolved` +
+            (known.length > 0 ? `; this checkout has: ${known.join(', ')}` : '; this checkout has no remotes'));
+    }
+    return `${found.owner}:${branch}`;
+}
+/**
+ * The branch a `--base` means, given the repository the pull request lands in.
+ *
+ * `--base upstream:main` names the remote for the check and the branch for the wire: a base is a branch of
+ * `--repo`, and `owner:branch` is not a branch name anywhere. A remote pointing at a different repository
+ * is a mistake worth catching here rather than letting GitHub answer confusingly.
+ *
+ * @param raw - what the operator wrote.
+ * @param repo - the repository `--repo` names, as `owner/name`.
+ * @param cwd - the directory to resolve remotes in.
+ * @returns the branch to send.
+ * @throws {Error} when the remote points at a repository other than `repo`.
+ */
+export function baseBranchFor(raw, repo, cwd) {
+    const colon = raw.indexOf(':');
+    if (colon < 0)
+        return raw;
+    const name = raw.slice(0, colon);
+    const found = remoteRepo(name, cwd);
+    if (found === undefined) {
+        // Says what is wrong with the remote rather than pretending the base is the problem.
+        throw new Error(`--base names ${JSON.stringify(name)}, which is not a remote this checkout can read`);
+    }
+    if (`${found.owner}/${found.repo}`.toLowerCase() !== repo.toLowerCase()) {
+        throw new Error(`--base names a remote pointing at ${found.owner}/${found.repo}, but --repo is ${repo}: the base is a branch of the repository the pull request lands in`);
+    }
+    return raw.slice(colon + 1);
+}
+//# sourceMappingURL=remotes.js.map

package/lib/commands/remotes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remotes.js","sourceRoot":"","sources":["../../src/commands/remotes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAUlD;;;;;;;;;GASG;AACH,SAAS,GAAG,CAAC,IAAuB,EAAE,GAAW;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3G,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;SAChC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,GAAW,EAAE,IAAI,GAAG,KAAK;IAChE,oGAAoG;IACpG,uFAAuF;IACvF,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAExC,wGAAwG;IACxG,yGAAyG;IACzG,mCAAmC;IACnC,IAAI,IAAwB,CAAC;IAC7B,IAAI,IAAwB,CAAC;IAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAChE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,KAAK,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,yFAAyF;YACzF,IAAI,GAAG,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;YACtE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5D,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACjE,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACd,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IAChF,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACnF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,GAAW;IACjD,OAAO,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,GAAW;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,GAAG,iDAAiD,CACjG,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,qBAAqB;YAC5F,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,wBAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,gCAAgC,CAAC,CACrG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAY,EAAE,GAAW;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,qFAAqF;QACrF,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,mBAAmB,IAAI,oEAAoE,CAC1J,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAC9B,CAAC"}

package/lib/commands/setup.d.ts

@@ -0,0 +1,58 @@
+import { parseArgs } from 'gcb-core';
+/** Everything `setup` needs, resolved. */
+export interface SetupInput {
+    /** Credential helper command to record. A bare name is resolved by git through PATH. */
+    readonly helper: string;
+    /** Socket path in this environment. */
+    readonly socket: string;
+    /** Git config file to write. */
+    readonly gitconfig: string;
+    /** Shell snippet recording the environment for interactive shells. */
+    readonly envFile: string;
+    /** Durable socket-path file, read by the helper when the environment carries nothing. */
+    readonly socketFile: string;
+    /** Where to write a CA bundle when the image has none. */
+    readonly caBundlePath: string;
+    /** Host whose ssh remotes are rewritten to https, or null to leave remotes alone. */
+    readonly rewriteSshHost: string | null;
+    /** Report what would happen without writing anything. */
+    readonly dryRun: boolean;
+    /** Home whose mounts the config must not be written into; defaults to the real home. */
+    readonly home?: string;
+    /** The directories the container shares, when the caller already has them. */
+    readonly mounts?: readonly string[];
+}
+/** What `setup` did. */
+export interface SetupResult {
+    readonly gitconfig: string;
+    readonly entries: readonly string[];
+    readonly caBundle: string | null;
+    readonly socketFile: string;
+    readonly envFile: string;
+    readonly warnings: readonly string[];
+}
+/**
+ * Apply the configuration.
+ *
+ * @param input - the resolved options.
+ * @returns what was done.
+ * @throws {Error} when the target config is a symlink, or inside a directory the container shares.
+ */
+export declare function performSetup(input: SetupInput): Promise<SetupResult>;
+/** Usage text for `setup`. */
+export declare const SETUP_USAGE = "Usage: gcb setup [options]\n\nConfigure this environment's git to obtain credentials from the broker.\n\n  --helper <cmd>       Credential helper to record (default: !gcb, resolved through PATH)\n  --socket <path>      Broker socket path (default: $GIT_BROKER_SOCKET, else /run/git-cred-broker/broker.sock)\n  --gitconfig <path>   Git config to write (default: $HOME/.gitconfig)\n  --rewrite-ssh <host> Rewrite git@<host>: remotes to https (default: github.com)\n  --no-rewrite-ssh     Leave remote URLs alone\n  --env-file <path>    Where to record the environment (default: $HOME/.git-broker.env)\n  --socket-file <path> Durable socket-path file (default: $HOME/.config/git-credential-broker/socket)\n  --ca-bundle <path>   Where to write a CA bundle if the image has none\n  --dry-run            Print what would change, write nothing\n  -h, --help           Show this help\n";
+/**
+ * Run the `setup` command.
+ *
+ * @param argv - arguments after the command name.
+ * @returns the process exit code.
+ */
+export declare function runSetup(argv: readonly string[]): Promise<number>;
+/**
+ * Collect the repeatable `--allow` flag; exported so `init` and tests share one implementation.
+ *
+ * @param args - the parsed arguments.
+ * @returns the entries.
+ */
+export declare function allowList(args: ReturnType<typeof parseArgs>): string[];
+//# sourceMappingURL=setup.d.ts.map

package/lib/commands/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/commands/setup.ts"],"names":[],"mappings":"AAqBA,OAAO,EAQL,SAAS,EAKV,MAAM,UAAU,CAAC;AAElB,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gCAAgC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qFAAqF;IACrF,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,wFAAwF;IACxF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,wBAAwB;AACxB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA6F1E;AAED,8BAA8B;AAC9B,eAAO,MAAM,WAAW,m3BAcvB,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAqCvE;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,GAAG,MAAM,EAAE,CAEtE"}

package/lib/commands/setup.js

@@ -0,0 +1,178 @@
+/**
+ * `setup` — configure the git in *this* environment to use the broker.
+ *
+ * This is the container-side half, and it replaces the old `container-setup.sh`. It is written
+ * to a git config that belongs to the running user, never to a shared repository or to the
+ * host's own configuration.
+ *
+ * It does four things, each for a reason that was measured rather than assumed:
+ *  - points `credential.helper` at the installed helper and turns on `credential.useHttpPath`,
+ *    without which git sends no repository path and the broker can only authorize host-wide;
+ *  - rewrites the ssh remote to https *in this environment only*, because an App installation
+ *    token cannot be used over ssh and this container has no ssh key at all;
+ *  - supplies a CA bundle when the image has none, because git then cannot verify any TLS
+ *    certificate while Node still can — a pair of symptoms that looks like an application bug;
+ *  - records the socket path in a file as well as in the environment, because git is often
+ *    spawned from a non-login shell that never sources a profile.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fail, findSystemCaBundle, gitConfigList, gitConfigSet, insideMountedPath, listFlag, mountedPaths, parseArgs, say, warn, writeNodeCaBundle, writeSecretFile, } from 'gcb-core';
+/**
+ * Apply the configuration.
+ *
+ * @param input - the resolved options.
+ * @returns what was done.
+ * @throws {Error} when the target config is a symlink, or inside a directory the container shares.
+ */
+export async function performSetup(input) {
+    // Writing through a symlink would edit whatever it points at, and a config that lives in a directory
+    // the container shares is one the container can rewrite.
+    if (fs.existsSync(input.gitconfig) && fs.lstatSync(input.gitconfig).isSymbolicLink()) {
+        const target = fs.realpathSync(input.gitconfig);
+        throw new Error(`${input.gitconfig} is a symlink to ${target}; refusing to write through it`);
+    }
+    // The config must not be written into any directory the container can rewrite. Canonical, so the
+    // host's spelling of a shared directory and the container's spelling of the same one are one place.
+    // `setup` runs in the container by definition, so the mount table it is standing on is the
+    // authority. Reading it directly means a container that leaves no marker for `isInsideContainer`
+    // (plain containerd, a Kubernetes pod) still gets the right answer instead of hunting for a runtime
+    // it does not have.
+    const mounts = input.mounts ?? mountedPaths(input.home, { container: true });
+    const mounted = insideMountedPath(input.gitconfig, input.home, mounts);
+    if (mounted) {
+        throw new Error(`${input.gitconfig} is inside ${mounted}, which is mounted into the container; refusing to write ` +
+            "this environment's git config where the container can rewrite it");
+    }
+    const warnings = [];
+    if (input.dryRun) {
+        return {
+            gitconfig: input.gitconfig,
+            entries: [
+                `credential.helper=${input.helper}`,
+                'credential.useHttpPath=true',
+                ...(input.rewriteSshHost ? [`url.https://${input.rewriteSshHost}/.insteadOf=git@${input.rewriteSshHost}:`] : []),
+            ],
+            caBundle: findSystemCaBundle() ? null : input.caBundlePath,
+            socketFile: input.socketFile,
+            envFile: input.envFile,
+            warnings,
+        };
+    }
+    fs.mkdirSync(path.dirname(input.gitconfig), { recursive: true });
+    gitConfigSet(input.gitconfig, 'credential.helper', input.helper);
+    gitConfigSet(input.gitconfig, 'credential.useHttpPath', 'true');
+    if (input.rewriteSshHost) {
+        gitConfigSet(input.gitconfig, `url.https://${input.rewriteSshHost}/.insteadOf`, `git@${input.rewriteSshHost}:`);
+    }
+    // TLS trust. The image may install git with --no-install-recommends and no ca-certificates,
+    // in which case every https operation fails with "CAfile: none" while Node keeps working.
+    let caBundle = null;
+    const systemBundle = findSystemCaBundle();
+    if (systemBundle) {
+        say(`TLS            : using the system CA bundle (${systemBundle})`);
+    }
+    else {
+        const written = await writeNodeCaBundle(input.caBundlePath);
+        gitConfigSet(input.gitconfig, 'http.sslCAInfo', input.caBundlePath);
+        caBundle = input.caBundlePath;
+        say(`TLS            : no system CA bundle; wrote ${written} roots from Node's store`);
+        say(`                 ${input.caBundlePath} (adding ca-certificates to the image would be better)`);
+    }
+    fs.chmodSync(input.gitconfig, 0o600);
+    writeSecretFile(input.socketFile, `${input.socket}\n`);
+    writeSecretFile(input.envFile, [
+        '# Generated by gcb setup',
+        `export GIT_BROKER_SOCKET='${input.socket}'`,
+        '# Fail closed: if the socket variable ever goes missing, refuse rather than silently',
+        '# falling back to whatever other credential the environment happens to offer.',
+        'export GIT_BROKER_REQUIRE=1',
+        '',
+    ].join('\n'));
+    if (!fs.existsSync(input.socket)) {
+        warnings.push(`no broker socket at ${input.socket} yet; pushes will fail closed until the broker runs`);
+    }
+    return {
+        gitconfig: input.gitconfig,
+        entries: gitConfigList(input.gitconfig),
+        caBundle,
+        socketFile: input.socketFile,
+        envFile: input.envFile,
+        warnings,
+    };
+}
+/** Usage text for `setup`. */
+export const SETUP_USAGE = `Usage: gcb setup [options]
+
+Configure this environment's git to obtain credentials from the broker.
+
+  --helper <cmd>       Credential helper to record (default: !gcb, resolved through PATH)
+  --socket <path>      Broker socket path (default: $GIT_BROKER_SOCKET, else /run/git-cred-broker/broker.sock)
+  --gitconfig <path>   Git config to write (default: $HOME/.gitconfig)
+  --rewrite-ssh <host> Rewrite git@<host>: remotes to https (default: github.com)
+  --no-rewrite-ssh     Leave remote URLs alone
+  --env-file <path>    Where to record the environment (default: $HOME/.git-broker.env)
+  --socket-file <path> Durable socket-path file (default: $HOME/.config/git-credential-broker/socket)
+  --ca-bundle <path>   Where to write a CA bundle if the image has none
+  --dry-run            Print what would change, write nothing
+  -h, --help           Show this help
+`;
+/**
+ * Run the `setup` command.
+ *
+ * @param argv - arguments after the command name.
+ * @returns the process exit code.
+ */
+export async function runSetup(argv) {
+    const args = parseArgs(argv, { booleans: ['no-rewrite-ssh', 'dry-run', 'help'] });
+    if (args.has('help') || args.has('h')) {
+        say(SETUP_USAGE);
+        return 0;
+    }
+    const home = os.homedir();
+    const socket = args.value('socket') ?? process.env['GIT_BROKER_SOCKET'] ?? '/run/git-cred-broker/broker.sock';
+    try {
+        const result = await performSetup({
+            // !gcb is a shell command, so the git process that later runs the helper resolves it
+            // through its own PATH. setup cannot know that future environment; this is why the
+            // README says the installed gcb must be on the PATH of the processes that call git.
+            helper: args.value('helper') ?? '!gcb',
+            socket,
+            gitconfig: args.value('gitconfig') ?? path.join(home, '.gitconfig'),
+            envFile: args.value('env-file') ?? path.join(home, '.git-broker.env'),
+            socketFile: args.value('socket-file') ?? path.join(home, '.config', 'git-credential-broker', 'socket'),
+            caBundlePath: args.value('ca-bundle') ?? path.join(home, '.config', 'git-credential-broker', 'ca-bundle.pem'),
+            rewriteSshHost: args.has('no-rewrite-ssh') ? null : (args.value('rewrite-ssh') ?? 'github.com'),
+            dryRun: args.has('dry-run'),
+            home,
+        });
+        say(`git config     : ${result.gitconfig}${args.has('dry-run') ? ' (dry run)' : ''}`);
+        for (const entry of result.entries)
+            say(`  ${entry}`);
+        if (result.caBundle)
+            say(`CA bundle      : ${result.caBundle}`);
+        say(`socket file    : ${result.socketFile}`);
+        say(`env file       : ${result.envFile}`);
+        for (const warning of result.warnings)
+            warn(`warning: ${warning}`);
+        if (args.has('dry-run'))
+            say('dry run: nothing was written');
+        else
+            say('\nnext: start the broker (gcb daemon) and verify with `gcb probe`.');
+        return 0;
+    }
+    catch (error) {
+        fail(error.message);
+    }
+}
+/**
+ * Collect the repeatable `--allow` flag; exported so `init` and tests share one implementation.
+ *
+ * @param args - the parsed arguments.
+ * @returns the entries.
+ */
+export function allowList(args) {
+    return listFlag(args, 'allow');
+}
+//# sourceMappingURL=setup.js.map

package/lib/commands/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/commands/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,IAAI,EACJ,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,GAAG,EACH,IAAI,EACJ,iBAAiB,EACjB,eAAe,GAChB,MAAM,UAAU,CAAC;AAoClB;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAiB;IAClD,qGAAqG;IACrG,yDAAyD;IACzD,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QACrF,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,SAAS,oBAAoB,MAAM,gCAAgC,CAAC,CAAC;IAChG,CAAC;IACD,iGAAiG;IACjG,oGAAoG;IACpG,2FAA2F;IAC3F,iGAAiG;IACjG,oGAAoG;IACpG,oBAAoB;IACpB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvE,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,SAAS,cAAc,OAAO,2DAA2D;YAChG,kEAAkE,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE;gBACP,qBAAqB,KAAK,CAAC,MAAM,EAAE;gBACnC,6BAA6B;gBAC7B,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,cAAc,mBAAmB,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACjH;YACD,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY;YAC1D,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,wBAAwB,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,YAAY,CACV,KAAK,CAAC,SAAS,EACf,eAAe,KAAK,CAAC,cAAc,aAAa,EAChD,OAAO,KAAK,CAAC,cAAc,GAAG,CAC/B,CAAC;IACJ,CAAC;IAED,4FAA4F;IAC5F,0FAA0F;IAC1F,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,IAAI,YAAY,EAAE,CAAC;QACjB,GAAG,CAAC,gDAAgD,YAAY,GAAG,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5D,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACpE,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC;QAC9B,GAAG,CAAC,+CAA+C,OAAO,0BAA0B,CAAC,CAAC;QACtF,GAAG,CAAC,oBAAoB,KAAK,CAAC,YAAY,wDAAwD,CAAC,CAAC;IACtG,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAErC,eAAe,CACb,KAAK,CAAC,UAAU,EAChB,GAAG,KAAK,CAAC,MAAM,IAAI,CACpB,CAAC;IACF,eAAe,CACb,KAAK,CAAC,OAAO,EACb;QACE,0BAA0B;QAC1B,6BAA6B,KAAK,CAAC,MAAM,GAAG;QAC5C,sFAAsF;QACtF,+EAA+E;QAC/E,6BAA6B;QAC7B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IAEF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,MAAM,qDAAqD,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;QACvC,QAAQ;QACR,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,8BAA8B;AAC9B,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;CAc1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAuB;IACpD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,gBAAgB,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,kCAAkC,CAAC;IAC9G,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,qFAAqF;YACrF,mFAAmF;YACnF,oFAAoF;YACpF,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM;YACtC,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YACnE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC;YACrE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,uBAAuB,EAAE,QAAQ,CAAC;YACtG,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,uBAAuB,EAAE,eAAe,CAAC;YAC7G,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,YAAY,CAAC;YAC/F,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAC3B,IAAI;SACL,CAAC,CAAC;QAEH,GAAG,CAAC,oBAAoB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO;YAAE,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,QAAQ;YAAE,GAAG,CAAC,oBAAoB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,oBAAoB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC7C,GAAG,CAAC,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;YAAE,IAAI,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,GAAG,CAAC,8BAA8B,CAAC,CAAC;;YACxD,GAAG,CAAC,oEAAoE,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,IAAkC;IAC1D,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC"}

package/lib/helper.d.ts

@@ -0,0 +1,77 @@
+import type { Readable, Writable } from 'node:stream';
+import type { WireResponse } from 'gcb-core';
+/** Injectable streams and environment, for tests. */
+export interface HelperIO {
+    readonly stdin?: Readable;
+    readonly stdout?: Writable;
+    readonly stderr?: Writable;
+    readonly env?: NodeJS.ProcessEnv;
+}
+/** The helper's parsed command line. */
+export interface HelperArgs {
+    readonly operation: string;
+    readonly socketPath: string | undefined;
+    readonly strict: boolean;
+}
+/**
+ * Parse git's credential description.
+ *
+ * @param text - the raw stdin contents.
+ * @returns the key/value pairs.
+ */
+export declare function parseCredentialInput(text: string): Record<string, string>;
+/**
+ * Read a stream to the end, with a size ceiling.
+ *
+ * Chunks are normalized to `Buffer` rather than assumed: `process.stdin` yields buffers, but
+ * any stream in string or object mode yields strings, and `Buffer.concat` rejects those.
+ *
+ * @param stream - the stream to drain.
+ * @param maxBytes - ceiling; exceeding it rejects.
+ * @returns the decoded contents.
+ */
+export declare function readAll(stream: Readable, maxBytes?: number): Promise<string>;
+/**
+ * Send one request to the broker over its unix socket and await one response.
+ *
+ * @param socketPath - the broker socket path.
+ * @param request - the request payload.
+ * @param timeoutMs - how long to wait for an answer.
+ * @returns the parsed response.
+ */
+export declare function requestOverSocket(socketPath: string, request: Record<string, unknown>, timeoutMs?: number): Promise<WireResponse>;
+/**
+ * Decide where the broker lives, in precedence order:
+ *
+ *   1. `--socket <path>` on the command line;
+ *   2. `GIT_BROKER_SOCKET`;
+ *   3. the contents of `GIT_BROKER_SOCKET_FILE`, defaulting to
+ *      `$HOME/.config/git-credential-broker/socket`.
+ *
+ * An empty or missing result means "not configured in this environment", which the caller
+ * treats as "behave as if not installed".
+ *
+ * @param explicitSocket - the `--socket` argument, if any.
+ * @param env - the environment to read.
+ * @returns the resolved socket path, or undefined when nothing is configured.
+ */
+export declare function resolveSocketPath(explicitSocket: string | undefined, env: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Parse the helper's own command line.
+ *
+ * @param argv - arguments after the script name.
+ * @returns the parsed arguments.
+ */
+export declare function parseArgs(argv: readonly string[]): HelperArgs;
+/**
+ * Run the helper.
+ *
+ * Always resolves with an exit code; refusals still exit 0 on purpose (see the module
+ * comment) so that git stops instead of falling through to another helper.
+ *
+ * @param argv - arguments after the script name.
+ * @param io - injectable streams and environment.
+ * @returns the process exit code.
+ */
+export declare function runHelper(argv: readonly string[], io?: HelperIO): Promise<number>;
+//# sourceMappingURL=helper.d.ts.map

package/lib/helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAiB7C,qDAAqD;AACrD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC;AAED,wCAAwC;AACxC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAE,MAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB7F;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,SAAS,GAAE,MAA0B,GACpC,OAAO,CAAC,YAAY,CAAC,CAoCvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,MAAM,GAAG,SAAS,CAcpB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAqB7D;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAyF3F"}