gcb-host 0.0.0 → 0.0.1

package/lib/commands/diagnose.js

@@ -0,0 +1,213 @@
+/**
+ * `diagnose` — explain why the broker could not mint a token.
+ *
+ * The broker deliberately answers the pushing side with a generic message, because provider
+ * errors can embed API responses. This asks GitHub directly and prints what the app can
+ * actually see, which is what separates the two causes of
+ *
+ *   422 "There is at least one repository that does not exist or is not accessible to the
+ *   parent installation"
+ *
+ * — the repository was never created, or the installation was granted "only select
+ * repositories" and this one is not on that list. The message is identical for both.
+ *
+ * It never prints a key or a token.
+ */
+import { readFileSync } from 'node:fs';
+import { assertKeysReadable, loadConfig, resolveConfigPath } from '../config.js';
+import { nextLink, signAppJwt } from '../providers/github-app.js';
+import { fetcherFor, parseProxy } from '../http.js';
+import { fail, parseArgs, say, warn } from 'gcb-core';
+/** Usage text for `diagnose`. */
+export const DIAGNOSE_USAGE = `Usage: gcb diagnose [options]
+
+Ask GitHub what this app can actually see: identity, permissions, installations and the
+repositories each installation can reach. Never prints a key or a token.
+
+  --config <path>  The broker configuration to inspect (default: $GIT_BROKER_CONFIG, else ./broker.config.yml)
+  --host <host>    Which host block to inspect (default: the first github-app one)
+  --proxy <url>    Use this proxy for this command
+  --no-proxy       Reach GitHub directly for this command
+  -h, --help       Show this help
+`;
+/**
+ * Run the `diagnose` command.
+ *
+ * @param argv - arguments after the command name.
+ * @returns the process exit code: 0 everything reachable, 1 something is not.
+ */
+import { assertProxyEnabled } from '../proxy.js';
+export async function runDiagnose(argv) {
+    const args = parseArgs(argv, { booleans: ['help', 'no-proxy'] });
+    if (args.has('no-proxy') && args.value('proxy') !== undefined)
+        fail('--proxy and --no-proxy are mutually exclusive');
+    if (args.has('proxy') && args.value('proxy') === undefined)
+        fail('--proxy needs a value');
+    const proxy = args.has('no-proxy') ? null : args.value('proxy');
+    if (proxy !== undefined && parseProxy(proxy) === false)
+        fail('--proxy must be an http(s) URL');
+    if (proxy === undefined)
+        assertProxyEnabled();
+    if (args.has('help') || args.has('h')) {
+        say(DIAGNOSE_USAGE);
+        return 0;
+    }
+    const configPath = resolveConfigPath(args.value('config'));
+    const config = loadConfig(configPath);
+    // Before reading the key: a configuration written for the sidecar records a path that exists only
+    // inside that container, and running this on the host then fails with a bare ENOENT about a path
+    // that looks like a mistake in the key rather than in where the command was run.
+    assertKeysReadable(config);
+    const wanted = args.value('host');
+    const entry = Object.entries(config.hosts).find(([host, block]) => block.provider === 'github-app' && (wanted ? host === wanted : true));
+    if (!entry)
+        fail(`no github-app host${wanted ? ` named ${wanted}` : ''} in ${configPath}`);
+    const [host, block] = entry;
+    if (!block.privateKeyPath) {
+        fail('this host uses privateKeyPem; point the command at a config that references a key file');
+    }
+    const pem = readFileSync(block.privateKeyPath, 'utf8');
+    const issuer = block.clientId ?? block.appId;
+    if (issuer === undefined)
+        fail('the host block has neither clientId nor appId');
+    const api = block.apiBaseUrl ?? 'https://api.github.com';
+    const apiVersion = block.apiVersion ?? '2022-11-28';
+    const fetcher = fetcherFor(proxy);
+    /**
+     * Call the API authenticated as the app.
+     *
+     * @param path - path below the API root.
+     * @returns the parsed body and the Link header.
+     */
+    async function asApp(path) {
+        const jwt = signAppJwt({ privateKeyPem: pem, iss: issuer, nowMs: Date.now() });
+        const response = await fetcher(`${api}${path}`, {
+            method: 'GET',
+            headers: {
+                accept: 'application/vnd.github+json',
+                authorization: `Bearer ${jwt}`,
+                'x-github-api-version': apiVersion,
+                'user-agent': 'gcb-diagnose',
+            },
+        });
+        const text = await response.text();
+        let json = null;
+        try {
+            json = JSON.parse(text);
+        }
+        catch {
+            json = null;
+        }
+        if (!response.ok) {
+            const message = json !== null && typeof json === 'object' && 'message' in json
+                ? String(json.message)
+                : text.slice(0, 200);
+            throw new Error(`${path} -> ${response.status}: ${message}`);
+        }
+        return { json, link: response.headers.get('link') };
+    }
+    /**
+     * Call the API authenticated as one installation.
+     *
+     * @param installationId - the installation to act as.
+     * @param path - path below the API root.
+     * @returns the parsed body.
+     */
+    async function asInstallation(installationId, path) {
+        const jwt = signAppJwt({ privateKeyPem: pem, iss: issuer, nowMs: Date.now() });
+        const minted = await fetcher(`${api}/app/installations/${installationId}/access_tokens`, {
+            method: 'POST',
+            headers: {
+                accept: 'application/vnd.github+json',
+                authorization: `Bearer ${jwt}`,
+                'x-github-api-version': apiVersion,
+                'user-agent': 'gcb-diagnose',
+            },
+        });
+        const mintedText = await minted.text();
+        if (!minted.ok) {
+            throw new Error(`token request for installation ${installationId} -> ${minted.status}: ${mintedText.slice(0, 200)}`);
+        }
+        const token = JSON.parse(mintedText).token;
+        if (!token)
+            throw new Error(`installation ${installationId} returned no token`);
+        const response = await fetcher(`${api}${path}`, {
+            method: 'GET',
+            headers: {
+                accept: 'application/vnd.github+json',
+                authorization: `Bearer ${token}`,
+                'x-github-api-version': apiVersion,
+                'user-agent': 'gcb-diagnose',
+            },
+        });
+        const text = await response.text();
+        if (!response.ok)
+            throw new Error(`${path} -> ${response.status}: ${text.slice(0, 200)}`);
+        return JSON.parse(text);
+    }
+    const app = (await asApp('/app')).json;
+    say(`app            : ${app.slug ?? '?'} (id ${app.id ?? '?'})`);
+    say(`app permissions: ${JSON.stringify(app.permissions ?? {})}`);
+    say(`config host    : ${host}, allow ${JSON.stringify(block.allow)}`);
+    say('');
+    const installations = [];
+    let page = '/app/installations?per_page=100';
+    for (let index = 0; index < 10 && page; index += 1) {
+        const result = await asApp(page);
+        if (Array.isArray(result.json))
+            installations.push(...result.json);
+        page = nextLink(result.link);
+    }
+    if (installations.length === 0) {
+        say('installations  : none');
+        say('');
+        say('The app is not installed anywhere. Install it on the account that owns the repositories.');
+        return 1;
+    }
+    /** Repositories each installation can reach. */
+    const reachable = new Map();
+    for (const installation of installations) {
+        say(`installation ${installation.id}`);
+        say(`  account            : ${installation.account?.login ?? '?'} (${installation.account?.type ?? '?'})`);
+        say(`  repository access  : ${installation.repository_selection ?? '?'}`);
+        say(`  permissions        : ${JSON.stringify(installation.permissions ?? {})}`);
+        // Enumerate even when the selection is "all". "All" means every repository that *exists*;
+        // naming one that does not exist still fails with the same 422, so without this list a
+        // repository that was never created looks exactly like one that is merely not selected.
+        const listed = (await asInstallation(installation.id, '/installation/repositories?per_page=100'));
+        const names = (listed.repositories ?? []).map((repo) => repo.full_name ?? '?');
+        reachable.set(installation.id, names);
+        const shown = names.slice(0, 20).join(', ');
+        say(`  repositories (${names.length}${names.length >= 100 ? '+' : ''}): ${shown || '(none)'}${names.length > 20 ? ', …' : ''}`);
+    }
+    say('');
+    say('verdict:');
+    let problems = 0;
+    for (const allowEntry of block.allow) {
+        const [owner, repoPattern] = allowEntry.split('/');
+        const matching = installations.filter((installation) => installation.account?.login?.toLowerCase() === owner?.toLowerCase());
+        if (matching.length === 0) {
+            say(`  ${allowEntry}: no installation on account "${owner}"`);
+            problems += 1;
+            continue;
+        }
+        const visible = matching.some((installation) => {
+            const known = reachable.get(installation.id) ?? [];
+            if (repoPattern === '*') {
+                return known.some((name) => name.toLowerCase().startsWith(`${owner?.toLowerCase()}/`));
+            }
+            return known.some((name) => name.toLowerCase() === `${owner?.toLowerCase()}/${repoPattern?.toLowerCase()}`);
+        });
+        say(`  ${allowEntry}: ${visible ? 'reachable' : 'NOT in the repositories this installation can see'}`);
+        if (!visible)
+            problems += 1;
+    }
+    if (problems > 0) {
+        warn('');
+        warn('A repository that is not listed above either does not exist yet, or the installation was');
+        warn('granted "Only select repositories" and this one is not on that list — GitHub returns the');
+        warn('same 422 for both. To grant access: organisation settings -> GitHub Apps -> Configure.');
+    }
+    return problems > 0 ? 1 : 0;
+}
+//# sourceMappingURL=diagnose.js.map

package/lib/commands/diagnose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnose.js","sourceRoot":"","sources":["../../src/commands/diagnose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEpD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAgBtD,iCAAiC;AACjC,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;CAU7B,CAAC;AAEF;;;;;GAKG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAuB;IACvD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,IAAI,CAAC,+CAA+C,CAAC,CAAC;IACrH,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC/F,IAAI,KAAK,KAAK,SAAS;QAAE,kBAAkB,EAAE,CAAC;IAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE3D,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,kGAAkG;IAClG,iGAAiG;IACjG,iFAAiF;IACjF,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAC7C,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CACxF,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,qBAAqB,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,UAAU,EAAE,CAAC,CAAC;IAC3F,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,KAAsC,CAAC;IAE7D,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAChF,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,wBAAwB,CAAC;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,YAAY,CAAC;IACpD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAElC;;;;;OAKG;IACH,KAAK,UAAU,KAAK,CAAC,IAAY;QAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,MAAyB,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,EAAE;YAC9C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,6BAA6B;gBACrC,aAAa,EAAE,UAAU,GAAG,EAAE;gBAC9B,sBAAsB,EAAE,UAAU;gBAClC,YAAY,EAAE,cAAc;aAC7B;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,OAAO,GACX,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI;gBAC5D,CAAC,CAAC,MAAM,CAAE,IAA6B,CAAC,OAAO,CAAC;gBAChD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,cAAc,CAAC,cAAsB,EAAE,IAAY;QAChE,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,MAAyB,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,sBAAsB,cAAc,gBAAgB,EAAE;YACvF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,6BAA6B;gBACrC,aAAa,EAAE,UAAU,GAAG,EAAE;gBAC9B,sBAAsB,EAAE,UAAU;gBAClC,YAAY,EAAE,cAAc;aAC7B;SACF,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,kCAAkC,cAAc,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;QACD,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAwB,CAAC,KAAK,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,cAAc,oBAAoB,CAAC,CAAC;QAEhF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,EAAE;YAC9C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,6BAA6B;gBACrC,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,sBAAsB,EAAE,UAAU;gBAClC,YAAY,EAAE,cAAc;aAC7B;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAA4E,CAAC;IAC/G,GAAG,CAAC,oBAAoB,GAAG,CAAC,IAAI,IAAI,GAAG,QAAQ,GAAG,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACjE,GAAG,CAAC,oBAAoB,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtE,GAAG,CAAC,EAAE,CAAC,CAAC;IAER,MAAM,aAAa,GAAmB,EAAE,CAAC;IACzC,IAAI,IAAI,GAAkB,iCAAiC,CAAC;IAC5D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,GAAI,MAAM,CAAC,IAAuB,CAAC,CAAC;QACvF,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC7B,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,0FAA0F,CAAC,CAAC;QAChG,OAAO,CAAC,CAAC;IACX,CAAC;IAED,gDAAgD;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE9C,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,GAAG,CAAC,gBAAgB,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,GAAG,CAAC,0BAA0B,YAAY,CAAC,OAAO,EAAE,KAAK,IAAI,GAAG,KAAK,YAAY,CAAC,OAAO,EAAE,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC;QAC3G,GAAG,CAAC,0BAA0B,YAAY,CAAC,oBAAoB,IAAI,GAAG,EAAE,CAAC,CAAC;QAC1E,GAAG,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAEhF,0FAA0F;QAC1F,uFAAuF;QACvF,wFAAwF;QACxF,MAAM,MAAM,GAAG,CAAC,MAAM,cAAc,CAAC,YAAY,CAAC,EAAE,EAAE,yCAAyC,CAAC,CAE/F,CAAC;QACF,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;QAC/E,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,GAAG,CACD,mBAAmB,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3H,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,UAAU,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CACnC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,KAAK,EAAE,WAAW,EAAE,CACtF,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,UAAU,iCAAiC,KAAK,GAAG,CAAC,CAAC;YAC9D,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE;YAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;YACzF,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,EAAE,WAAW,EAAE,IAAI,WAAW,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,mDAAmD,EAAE,CAAC,CAAC;QACvG,IAAI,CAAC,OAAO;YAAE,QAAQ,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,IAAI,CAAC,EAAE,CAAC,CAAC;QACT,IAAI,CAAC,0FAA0F,CAAC,CAAC;QACjG,IAAI,CAAC,0FAA0F,CAAC,CAAC;QACjG,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC"}

package/lib/commands/host-opener.d.ts

@@ -0,0 +1,23 @@
+/** Usage text for `host-opener`. */
+export declare const HOST_OPENER_USAGE = "Usage: gcb host-opener [options]\n\nRun on the host, once, beside the trees the container also sees. It finds the checkouts under the\nroots it is given \u2014 ones created later included \u2014 and fulfils their requests to open a pull request\nwith the credentials of whoever runs it, so the pull request is authored by a person rather than by\nthe app's bot. It does nothing else: it cannot push, merge or close anything.\n\n  --root <dir>          A tree to serve, repeatable (default: $HOME)\n  --depth <n>           How far below a root to look for checkouts (default: 4)\n  --repo <path>         Serve this one checkout instead of discovering any\n  --command <path>      The program that creates a pull request\n                        (default: $GIT_BROKER_PR_COMMAND, else gh)\n  --arg <token>         An extra argument for that program, before the subcommand (repeatable)\n  --interval <seconds>  How often to look for requests (default: 5)\n  --once                Fulfil what is waiting, then exit\n  -h, --help            Show this help\n\nThe container asks for this by passing --via-host to `pr`. Requests are files under\n<git dir>/gcb/pr-requests, which is shared with the container and untracked by git\n\u2014 so the paths on the two sides never have to match: each writes and reads its own view of the same\ndirectory, and only the roots this process scans are host-side paths.\n";
+/**
+ * Read a pull request's number and URL out of a program's output.
+ *
+ * `gh pr create` prints the URL, and so does anything that behaves like it. Nothing else is trusted:
+ * without a URL in the output the opener reports a failure rather than guessing.
+ *
+ * @param output - the program's standard output.
+ * @returns the number and URL, or `undefined`.
+ */
+export declare function pullRequestUrl(output: string): {
+    number: number;
+    url: string;
+} | undefined;
+/**
+ * Run the `host-opener` command.
+ *
+ * @param argv - arguments after the command name.
+ * @returns the process exit code.
+ */
+export declare function runHostOpener(argv: readonly string[]): Promise<number>;
+//# sourceMappingURL=host-opener.d.ts.map

package/lib/commands/host-opener.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-opener.d.ts","sourceRoot":"","sources":["../../src/commands/host-opener.ts"],"names":[],"mappings":"AAwCA,oCAAoC;AACpC,eAAO,MAAM,iBAAiB,63CAqB7B,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAK1F;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuE5E"}

package/lib/commands/host-opener.js

@@ -0,0 +1,244 @@
+/**
+ * `host-opener` — fulfil the container's requests to open pull requests, as the person running it.
+ *
+ * This runs on the host, beside the checkout the container also sees, and it does exactly one thing:
+ * it turns a request file into a pull request, using the credentials of whoever started it. That is
+ * the whole point — a pull request authored by a person is one that automated reviewers will actually
+ * review, and the app cannot be that person.
+ *
+ * It has no other power. It cannot push, merge, close or read anything, and it never runs a shell: the
+ * program it calls is configuration, and it is called with an argument list built here.
+ */
+import { execFile } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { promisify } from 'node:util';
+import { channelDir, clearOpener, discoverCheckouts, findGitDir, listRequests, readOpener, claimRequest, removeRequest, requestProblems, writeOpener, writeResult, } from 'gcb-core';
+import { fail, listFlag, parseArgs, say, warn } from 'gcb-core';
+import { applyProxyChoice, parseProxy } from '../http.js';
+const run = promisify(execFile);
+/** How long one `pr create` may take. */
+const CREATE_TIMEOUT_MS = 120_000;
+/** Usage text for `host-opener`. */
+export const HOST_OPENER_USAGE = `Usage: gcb host-opener [options]
+
+Run on the host, once, beside the trees the container also sees. It finds the checkouts under the
+roots it is given — ones created later included — and fulfils their requests to open a pull request
+with the credentials of whoever runs it, so the pull request is authored by a person rather than by
+the app's bot. It does nothing else: it cannot push, merge or close anything.
+
+  --root <dir>          A tree to serve, repeatable (default: $HOME)
+  --depth <n>           How far below a root to look for checkouts (default: 4)
+  --repo <path>         Serve this one checkout instead of discovering any
+  --command <path>      The program that creates a pull request
+                        (default: $GIT_BROKER_PR_COMMAND, else gh)
+  --arg <token>         An extra argument for that program, before the subcommand (repeatable)
+  --interval <seconds>  How often to look for requests (default: 5)
+  --once                Fulfil what is waiting, then exit
+  -h, --help            Show this help
+
+The container asks for this by passing --via-host to \`pr\`. Requests are files under
+<git dir>/gcb/pr-requests, which is shared with the container and untracked by git
+— so the paths on the two sides never have to match: each writes and reads its own view of the same
+directory, and only the roots this process scans are host-side paths.
+`;
+/**
+ * Read a pull request's number and URL out of a program's output.
+ *
+ * `gh pr create` prints the URL, and so does anything that behaves like it. Nothing else is trusted:
+ * without a URL in the output the opener reports a failure rather than guessing.
+ *
+ * @param output - the program's standard output.
+ * @returns the number and URL, or `undefined`.
+ */
+export function pullRequestUrl(output) {
+    const match = /https:\/\/[^\s]+\/pull\/(\d+)/.exec(output);
+    const digits = match?.[1];
+    if (!match || digits === undefined)
+        return undefined;
+    return { number: Number(digits), url: match[0] };
+}
+/**
+ * Run the `host-opener` command.
+ *
+ * @param argv - arguments after the command name.
+ * @returns the process exit code.
+ */
+export async function runHostOpener(argv) {
+    const args = parseArgs(argv, { booleans: ['help', 'once'] });
+    if (args.has('help') || args.has('h')) {
+        say(HOST_OPENER_USAGE);
+        return 0;
+    }
+    const explicit = args.value('repo');
+    const single = explicit === undefined ? undefined : resolve(explicit);
+    const roots = listFlag(args, 'root');
+    const scanned = roots.length > 0 ? roots.map((root) => resolve(root)) : [homedir()];
+    const depth = Number(args.value('depth') ?? '4');
+    const command = args.value('command') ?? process.env['GIT_BROKER_PR_COMMAND'] ?? 'gh';
+    const extra = listFlag(args, 'arg');
+    const interval = Number(args.value('interval') ?? '5');
+    if (!Number.isFinite(interval) || interval < 1) {
+        fail(`--interval must be at least one second, got ${JSON.stringify(args.value('interval'))}`);
+    }
+    if (!Number.isInteger(depth) || depth < 0) {
+        fail(`--depth must be a whole number of levels, got ${JSON.stringify(args.value('depth'))}`);
+    }
+    /** The checkouts to serve: one named checkout, or everything under the roots. */
+    const targets = () => {
+        if (single === undefined)
+            return scanned.flatMap((root) => discoverCheckouts(root, depth));
+        const gitDir = findGitDir(single);
+        if (gitDir === undefined)
+            fail(`no git repository at or above ${single}`);
+        return [{ repo: single, dir: channelDir(gitDir) }];
+    };
+    const advertised = new Set();
+    /** Advertise a channel, without rewriting the marker on every sweep. */
+    const advertise = (dir) => {
+        advertised.add(dir);
+        if (readOpener(dir)?.pid !== process.pid) {
+            writeOpener(dir, { pid: process.pid, command, startedAt: new Date().toISOString() });
+        }
+    };
+    // However this process ends — a signal, --once, an exception — its markers go with it. A stale
+    // marker would tell the container an opener is there and make it wait for an answer that is not
+    // coming.
+    process.on('exit', () => {
+        for (const dir of advertised) {
+            try {
+                if (readOpener(dir)?.pid === process.pid)
+                    clearOpener(dir);
+            }
+            catch {
+                // Nothing useful is left to do while exiting.
+            }
+        }
+    });
+    const stop = () => process.exit(0);
+    process.on('SIGINT', stop);
+    process.on('SIGTERM', stop);
+    say(single === undefined ? `serving the checkouts under ${scanned.join(', ')}` : `serving ${single}`);
+    say(`creating pull requests with ${command}${extra.length > 0 ? ` ${extra.join(' ')}` : ''}, as ${process.env['USER'] ?? 'this user'}`);
+    for (;;) {
+        for (const { repo, dir } of targets()) {
+            // One checkout the container has made hostile — its channel directory replaced by a file, say —
+            // must not stop the opener serving every other root, under Restart=always least of all.
+            try {
+                advertise(dir);
+                await sweep(dir, repo, command, extra);
+            }
+            catch (error) {
+                warn(`could not serve ${repo}: ${error.message}`);
+            }
+        }
+        if (args.has('once'))
+            return 0;
+        await new Promise((done) => setTimeout(done, Math.max(interval, 0) * 1000));
+    }
+}
+/**
+ * Answer everything waiting in the channel.
+ *
+ * @param dir - the channel directory.
+ * @param repo - the checkout to create pull requests in.
+ * @param command - the program to call.
+ * @param extra - arguments to pass before the subcommand.
+ * @returns how many requests were answered.
+ */
+async function sweep(dir, repo, command, extra) {
+    let answered = 0;
+    for (const id of listRequests(dir)) {
+        // Claimed, not read: two openers — a service and a hand-run --once — would otherwise both act on the
+        // same request and each create the pull request, under the person's name.
+        const request = claimRequest(dir, id);
+        if (!request) {
+            // Either unreadable or already claimed, and the two are not worth telling apart here: removing
+            // anything now would delete another opener's claim, which is the claim's whole purpose.
+            warn(`skipped ${id}: unreadable, or another opener has it`);
+            continue;
+        }
+        const problems = requestProblems(request);
+        if (problems.length > 0) {
+            writeResult(dir, id, { error: problems.join('; ') });
+            removeRequest(dir, id);
+            warn(`refused ${id}: ${problems.join('; ')}`);
+            answered += 1;
+            continue;
+        }
+        const proxy = parseProxy(request.proxy);
+        if (proxy === false) {
+            writeResult(dir, id, { error: 'invalid proxy in the request' });
+            removeRequest(dir, id);
+            warn(`refused ${id}: invalid proxy`);
+            answered += 1;
+            continue;
+        }
+        const result = await openOne(repo, command, extra, { ...request, proxy });
+        writeResult(dir, id, result);
+        removeRequest(dir, id);
+        if (result.error !== undefined) {
+            warn(`failed to open ${request.head}: ${result.error}`);
+        }
+        else {
+            say(`opened #${result.number}: ${result.url}`);
+        }
+        answered += 1;
+    }
+    return answered;
+}
+/**
+ * Create one pull request.
+ *
+ * @param repo - the checkout to create it in.
+ * @param command - the program to call.
+ * @param extra - arguments to pass before the subcommand.
+ * @param request - what to create.
+ * @returns the number and URL, or the reason it did not work.
+ */
+function openerEnv(proxy) {
+    const env = { ...process.env };
+    applyProxyChoice(env, proxy);
+    return env;
+}
+async function openOne(repo, command, extra, request) {
+    // The body goes to a private temp file: the program is given a path, never a string to interpret.
+    const scratch = mkdtempSync(join(tmpdir(), 'gcb-'));
+    const bodyFile = join(scratch, 'body.md');
+    writeFileSync(bodyFile, request.body, 'utf8');
+    try {
+        const { stdout, stderr } = await run(command, [
+            ...extra,
+            'pr',
+            'create',
+            // No `--repo`: gh resolves the repository from the checkout it runs in, which is the checkout the
+            // request was written in. That is a mechanism, not a boundary — the container can edit that checkout,
+            // its remote included. What a deployment controls is which roots are served and which program runs;
+            // what this reaches is whatever the person running it can reach.
+            ...(request.draft === true ? ['--draft'] : []),
+            '--base',
+            request.base,
+            '--head',
+            request.head,
+            '--title',
+            request.title,
+            '--body-file',
+            bodyFile,
+        ], { cwd: repo, timeout: CREATE_TIMEOUT_MS, maxBuffer: 1 << 20, env: openerEnv(request.proxy) });
+        const found = pullRequestUrl(stdout);
+        if (!found) {
+            return { error: `no pull request URL in the output: ${(stdout.trim() || stderr.trim()).slice(0, 300)}` };
+        }
+        return found;
+    }
+    catch (error) {
+        const failure = error;
+        const reason = (failure.stderr ?? failure.message ?? 'the command failed').trim();
+        return { error: reason.slice(0, 300) || 'the command failed' };
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=host-opener.js.map

package/lib/commands/host-opener.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-opener.js","sourceRoot":"","sources":["../../src/commands/host-opener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EACL,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,aAAa,EACb,eAAe,EACf,WAAW,EACX,WAAW,GAGZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAoB,MAAM,YAAY,CAAC;AAE5E,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC,yCAAyC;AACzC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC,oCAAoC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBhC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuB;IACzD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC;IACtF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,+CAA+C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,iDAAiD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,iFAAiF;IACjF,MAAM,OAAO,GAAG,GAAoC,EAAE;QACpD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,wEAAwE;IACxE,MAAM,SAAS,GAAG,CAAC,GAAW,EAAQ,EAAE;QACtC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YACzC,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC,CAAC;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,UAAU;IACV,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG;oBAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IACtG,GAAG,CAAC,+BAA+B,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC;IAExI,SAAS,CAAC;QACR,KAAK,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC;YACtC,gGAAgG;YAChG,wFAAwF;YACxF,IAAI,CAAC;gBACH,SAAS,CAAC,GAAG,CAAC,CAAC;gBACf,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,mBAAmB,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,CAAC;QAC/B,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,IAAY,EAAE,OAAe,EAAE,KAAwB;IACvF,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,EAAE,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,qGAAqG;QACrG,0EAA0E;QAC1E,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,+FAA+F;YAC7F,wFAAwF;YACxF,IAAI,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrD,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9C,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAChE,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;YACrC,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7B,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,kBAAkB,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,QAAQ,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,KAAkB;IACnC,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,IAAY,EACZ,OAAe,EACf,KAAwB,EACxB,OAAwB;IAExB,kGAAkG;IAClG,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1C,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAClC,OAAO,EACP;YACE,GAAG,KAAK;YACR,IAAI;YACJ,QAAQ;YACR,kGAAkG;YAClG,sGAAsG;YACtG,oGAAoG;YACpG,iEAAiE;YACjE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,QAAQ;YACR,OAAO,CAAC,IAAI;YACZ,QAAQ;YACR,OAAO,CAAC,IAAI;YACZ,SAAS;YACT,OAAO,CAAC,KAAK;YACb,aAAa;YACb,QAAQ;SACT,EACD,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACF,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,sCAAsC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QAC3G,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAA8C,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAAC,CAAC,IAAI,EAAE,CAAC;QAClF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,oBAAoB,EAAE,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}