lastlight-shared 0.1.6 → 0.2.0

package/dist/repo-config-schema.js

@@ -0,0 +1,592 @@
+/**
+ * The PURE half of the per-repository config layer (issue #180) — the schema,
+ * the operator bounds, and the validators/merger that enforce them.
+ *
+ * A managed repo may commit a `.lastlight/` directory that overrides a BOUNDED
+ * subset of Last Light's config for runs against that repo. The directory
+ * mirrors a deployment overlay's on-disk shape exactly:
+ *
+ *   .lastlight/
+ *     lastlight.yml                  # the config override
+ *     workflows/prompts/*.md         # prompt overrides
+ *     skills/<name>/SKILL.md         # skill overrides
+ *     agent-context/*.md             # persona/rules additions
+ *
+ * ── Why this lives in `lastlight-shared` ──────────────────────────────────
+ * Two consumers need exactly the same answers about a `.lastlight/` tree:
+ *   - `lastlight-core` at runtime, after fetching the layer from GitHub
+ *     (`apps/server/src/config/repo-config.ts`, which owns the impure half —
+ *     the fetch, the TTL cache, the on-disk unpack — and re-exports everything
+ *     here so its import surface is unchanged); and
+ *   - the `lastlight` CLI, offline, inside a user's own code repo
+ *     (`lastlight repo config validate`).
+ * The CLI must never gain a dependency edge to core, so the bounds logic sits
+ * here — the one package both already depend on. Nothing in this file touches
+ * the filesystem, the network, or runtime config: it is a function of its
+ * arguments, which is also what makes it directly unit-testable.
+ *
+ * ── The trust rule ────────────────────────────────────────────────────────
+ * The layer is ALWAYS read from the repo's **default branch**. Never a PR head.
+ * Never the sandbox checkout. That rule is enforced by the fetcher in core;
+ * this module only describes what may appear in the layer once it arrives.
+ *
+ * ── The failure rule ──────────────────────────────────────────────────────
+ * Warn, drop the bad bits, run anyway. A repo's config file must never fail a
+ * run. Invalid YAML drops the whole file; an unknown or out-of-bounds key drops
+ * just that key. Every rejection becomes a structured {@link RepoConfigWarning}
+ * so the dashboard/CLI can report it back to the repo's owners.
+ */
+import { join, resolve, sep } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { providerByPrefix, oauthProviderByModelPrefix } from "./providers.js";
+// ---------------------------------------------------------------------------
+// Bounds
+// ---------------------------------------------------------------------------
+/** Hard cap on the unpacked `.lastlight/` layer, in bytes. */
+export const REPO_CONFIG_MAX_BYTES = 2 * 1024 * 1024;
+/** Hard cap on the number of files in the unpacked layer. */
+export const REPO_CONFIG_MAX_FILES = 200;
+/** The config file inside `.lastlight/`. Exactly this name — no `.yaml` variant. */
+export const REPO_CONFIG_FILE = "lastlight.yml";
+/** Git filemode for a symlink blob. Rejected on sight — see {@link sanitizeRepoFiles}. */
+const GIT_MODE_SYMLINK = "120000";
+/**
+ * The allow-list a deployment gets when it says nothing. Kept as a constant so
+ * the normaliser, the docs, `config/default.yaml` and the CLI's offline
+ * validator can't drift apart.
+ *
+ * It MUST stay identical to `repoConfig.allowKeys` in
+ * `apps/server/config/default.yaml`: this list is what a deployment falls back
+ * to when config isn't in reach (`repoConfigPolicy()`'s no-config path, and the
+ * CLI's offline `lastlight repo config validate`), so a divergence tells repo
+ * owners their file is out of bounds when it isn't. Pinned by the
+ * `default allow-list` block in `apps/server/tests/config/repo-config-shared.test.ts`
+ * — the two drifted apart once already, silently.
+ */
+export const DEFAULT_REPO_CONFIG_ALLOW_KEYS = [
+    "models",
+    "variants",
+    "crons",
+    "disabled.workflows",
+    "disabled.crons",
+    "approval",
+];
+/**
+ * The bounds to assume when no deployment config is in reach — the shipped
+ * defaults. The offline CLI validator (`lastlight repo config validate`) uses
+ * this: it can't know the operator's narrowing, so it validates against the
+ * widest shipped policy and says so.
+ */
+export function defaultRepoConfigPolicy() {
+    return {
+        enabled: true,
+        allowKeys: [...DEFAULT_REPO_CONFIG_ALLOW_KEYS],
+        allowedModels: null,
+        allowAssets: true,
+    };
+}
+/**
+ * Classify a path relative to `.lastlight/`, or `null` when it is not part of
+ * the layer at all.
+ *
+ * `null` is a routine answer, not an error: `.lastlight/` is shared real
+ * estate. With `buildAssets.location: repo` the build workflow commits its
+ * handoff docs to `.lastlight/<issueKey>/*.md`, and repos are free to keep
+ * other things there. Those are simply outside the layer — the warning path is
+ * reserved for files that LOOK like layer assets but have the wrong shape
+ * (see {@link sanitizeRepoFiles}).
+ */
+export function repoLayerPathKind(path) {
+    if (path === REPO_CONFIG_FILE)
+        return "config";
+    if (/^workflows\/prompts\/(?:[^/]+\/)*[^/]+\.md$/.test(path))
+        return "prompt";
+    if (/^skills\/[^/]+\/(?:[^/]+\/)*[^/]+$/.test(path))
+        return "skill";
+    if (/^agent-context\/[^/]+\.md$/.test(path))
+        return "agent-context";
+    return null;
+}
+/** True when a path is a workflow DEFINITION — the one thing a repo may never contribute. */
+export function isRepoWorkflowPath(path) {
+    return /^workflows\/[^/]+\.ya?ml$/.test(path);
+}
+/** Top-level directories inside `.lastlight/` that the layer claims. */
+const LAYER_DIRS = ["workflows/", "skills/", "agent-context/"];
+// ---------------------------------------------------------------------------
+// File-level guards
+// ---------------------------------------------------------------------------
+/**
+ * Reject a relative path that can't be safely joined onto a root. Modelled on
+ * `assertSafeRelative` in `./workflow-loader.ts`, but returning a reason
+ * instead of throwing — a hostile repo must not be able to abort a run by
+ * committing a bad filename.
+ */
+function unsafeRelativeReason(path) {
+    if (!path)
+        return "path is empty";
+    if (path.startsWith("/") || /^[A-Za-z]:/.test(path))
+        return "path is absolute";
+    if (path.includes("\0"))
+        return "path contains a NUL byte";
+    if (path.includes("\\"))
+        return "path contains a backslash";
+    const segments = path.split("/");
+    if (segments.some((s) => s === "" || s === "." || s === ".."))
+        return "path contains a traversal segment";
+    return null;
+}
+/** True when `filePath` resolves inside `root`. Same check as the workflow loader's `isInside`. */
+function isInside(filePath, root) {
+    const r = resolve(root);
+    const f = resolve(filePath);
+    return f === r || f.startsWith(r + sep);
+}
+/**
+ * Apply every file-level bound to a `.lastlight/` subtree.
+ *
+ * Pure — takes the blobs, returns the ones that may be written to disk plus a
+ * warning per rejection. The caps are enforced here as well as at fetch time
+ * (the client stops downloading at its own limits) because this function is the
+ * last gate before anything touches the filesystem, and defence in depth is
+ * cheap.
+ *
+ * Generic in the file type so a caller carrying a richer blob shape (core's
+ * `RepoConfigFile`) gets its own type back rather than a widened one.
+ */
+export function sanitizeRepoFiles(files, policy, repo) {
+    const warnings = [];
+    const accepted = [];
+    const warn = (code, path, message) => warnings.push({ code, repo, path, message });
+    let bytes = 0;
+    let unrecognised = 0;
+    let assetsDropped = 0;
+    for (const file of files) {
+        const path = file.path;
+        const unsafe = unsafeRelativeReason(path);
+        if (unsafe) {
+            warn("path-escape", path, `Ignored .lastlight/${path}: ${unsafe}.`);
+            continue;
+        }
+        // Second, independent check: even a segment-clean path must land under the
+        // layer root once joined. Cheap, and catches anything the string checks miss.
+        if (!isInside(join("/layer-root", path), "/layer-root")) {
+            warn("path-escape", path, `Ignored .lastlight/${path}: it escapes the layer directory.`);
+            continue;
+        }
+        // Symlinks are the classic unpack escape — a `skills/x/SKILL.md` symlink
+        // pointing at /etc/passwd or at the harness's own secrets would otherwise be
+        // read as layer content. Only regular files are ever materialized.
+        if (file.mode === GIT_MODE_SYMLINK) {
+            warn("symlink", path, `Ignored .lastlight/${path}: symlinks are not allowed in a repo config layer.`);
+            continue;
+        }
+        if (file.mode !== "100644" && file.mode !== "100755") {
+            warn("symlink", path, `Ignored .lastlight/${path}: only regular files are allowed (mode ${file.mode}).`);
+            continue;
+        }
+        // Repos may contribute PROMPTS, never workflows: a workflow YAML defines
+        // phases, skills and permission profiles, which is the operator's call.
+        if (isRepoWorkflowPath(path)) {
+            warn("workflow-not-allowed", path, `Ignored .lastlight/${path}: a repo may override prompts (workflows/prompts/*.md), not workflow definitions.`);
+            continue;
+        }
+        const kind = repoLayerPathKind(path);
+        if (!kind) {
+            // Inside a layer directory but the wrong shape → the repo probably meant
+            // it as an asset. Counted and reported once, so a big stray directory
+            // can't flood the warning list.
+            if (LAYER_DIRS.some((d) => path.startsWith(d)))
+                unrecognised++;
+            continue;
+        }
+        if (kind !== "config" && !policy.allowAssets) {
+            assetsDropped++;
+            continue;
+        }
+        if (accepted.length >= REPO_CONFIG_MAX_FILES) {
+            warn("file-count-cap", path, `Ignored .lastlight/${path}: the repo config layer is capped at ${REPO_CONFIG_MAX_FILES} files.`);
+            continue;
+        }
+        if (bytes + file.content.length > REPO_CONFIG_MAX_BYTES) {
+            warn("size-cap", path, `Ignored .lastlight/${path}: the repo config layer is capped at ${REPO_CONFIG_MAX_BYTES} bytes.`);
+            continue;
+        }
+        bytes += file.content.length;
+        accepted.push(file);
+    }
+    if (unrecognised > 0) {
+        warn("unrecognised-asset", ".lastlight", `Ignored ${unrecognised} file(s) under .lastlight/: a repo layer may contain ${REPO_CONFIG_FILE}, ` +
+            `workflows/prompts/*.md, skills/<name>/SKILL.md and agent-context/*.md.`);
+    }
+    if (assetsDropped > 0) {
+        warn("assets-not-allowed", ".lastlight", `Ignored ${assetsDropped} asset file(s) under .lastlight/: this deployment sets repoConfig.allowAssets: false.`);
+    }
+    return { accepted, warnings };
+}
+// ---------------------------------------------------------------------------
+// Config-level bounds
+// ---------------------------------------------------------------------------
+/**
+ * Parse a repo's `lastlight.yml`. Malformed YAML, or YAML that isn't a mapping,
+ * drops the WHOLE file — a half-understood config file is more dangerous than
+ * none, and the repo gets a warning either way.
+ */
+export function parseRepoConfigYaml(raw, repo) {
+    let parsed;
+    try {
+        parsed = parseYaml(raw);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            warnings: [
+                {
+                    code: "invalid-yaml",
+                    repo,
+                    path: REPO_CONFIG_FILE,
+                    message: `Ignored .lastlight/${REPO_CONFIG_FILE}: it is not valid YAML (${message}).`,
+                },
+            ],
+        };
+    }
+    // An empty file parses to null — legal, just carries nothing.
+    if (parsed === null || parsed === undefined)
+        return { warnings: [] };
+    if (!isPlainObject(parsed)) {
+        return {
+            warnings: [
+                {
+                    code: "not-a-mapping",
+                    repo,
+                    path: REPO_CONFIG_FILE,
+                    message: `Ignored .lastlight/${REPO_CONFIG_FILE}: the top level must be a mapping.`,
+                },
+            ],
+        };
+    }
+    return { config: parsed, warnings: [] };
+}
+/**
+ * True when `path` (a dotted config path) is admitted by the allow-list. An
+ * entry admits itself and everything beneath it — `models` admits
+ * `models.architect`; `disabled.workflows` does NOT admit `disabled.prompts`.
+ */
+function isAllowedKey(path, allowKeys) {
+    return allowKeys.some((allowed) => path === allowed || path.startsWith(`${allowed}.`));
+}
+/**
+ * True when a dotted path is a PREFIX of some allow-list entry — i.e. the repo
+ * must be allowed to descend into it even though the container itself isn't
+ * directly settable (`disabled` for `disabled.workflows`).
+ */
+function isAllowedPrefix(path, allowKeys) {
+    return allowKeys.some((allowed) => allowed.startsWith(`${path}.`));
+}
+/**
+ * Reduce a repo's raw `lastlight.yml` to the sub-tree it is actually allowed to
+ * contribute. Pure. Everything dropped produces a warning.
+ *
+ * `base` supplies the operator's current values, which the `approval` add-only
+ * rule needs: a repo may raise a gate, never lower one.
+ */
+export function sanitizeRepoConfigLayer(raw, policy, base, repo) {
+    const warnings = [];
+    const layer = {};
+    if (!raw)
+        return { layer, warnings };
+    const warn = (code, path, message) => warnings.push({ code, repo, path, message });
+    for (const [key, value] of Object.entries(raw)) {
+        const allowed = isAllowedKey(key, policy.allowKeys);
+        const descendable = isAllowedPrefix(key, policy.allowKeys);
+        if (!allowed && !descendable) {
+            warn("key-not-allowed", key, `Ignored "${key}" in .lastlight/${REPO_CONFIG_FILE}: a repo may not set this key.`);
+            continue;
+        }
+        switch (key) {
+            case "models":
+                assignIfAny(layer, "models", sanitizeModels(value, policy, warn));
+                break;
+            case "variants":
+                assignIfAny(layer, "variants", sanitizeStringMap(value, "variants", policy, warn));
+                break;
+            case "crons":
+                // Accepted and deliberately NOT merged. Cron participation
+                // (`crons: {enable, disable}`) is read straight off the RAW layer by
+                // the scheduler at tick time — `repoCronPrefs` in
+                // `apps/server/src/cron/repo-crons.ts` — because it decides WHICH repos
+                // a cron fans out over, which happens before any run (and therefore
+                // before any merged per-run config) exists. So it is not part of
+                // {@link RepoMergedConfig} and has no merged-shape validator here; the
+                // `case` exists only to stop the `default:` branch reporting a
+                // "no repo-layer validator" warning for a block that is fully
+                // supported. Do NOT "fix" this by adding `crons` to the merged shape:
+                // that would give one block two owners with two bounds checks.
+                break;
+            case "disabled":
+                assignIfAny(layer, "disabled", sanitizeDisabled(value, policy, warn));
+                break;
+            case "approval":
+                assignIfAny(layer, "approval", sanitizeApproval(value, policy, base, warn));
+                break;
+            default:
+                // Allow-listed by the operator but not a key this module knows how to
+                // bound. Refusing is the safe direction: an unbounded pass-through
+                // would let an operator widen the layer past what's been reviewed.
+                warn("key-not-allowed", key, `Ignored "${key}" in .lastlight/${REPO_CONFIG_FILE}: it has no repo-layer validator.`);
+        }
+    }
+    return { layer, warnings };
+}
+/** Drop empty sub-trees so the merge never records a `repo` provenance for nothing. */
+function assignIfAny(target, key, value) {
+    if (value && Object.keys(value).length > 0)
+        target[key] = value;
+}
+function sanitizeModels(raw, policy, warn) {
+    if (!isPlainObject(raw)) {
+        warn("invalid-value", "models", `Ignored "models" in .lastlight/${REPO_CONFIG_FILE}: it must be a mapping.`);
+        return undefined;
+    }
+    const out = {};
+    for (const [task, spec] of Object.entries(raw)) {
+        const path = `models.${task}`;
+        // Re-checked per leaf, not just on the `models` container: an operator can
+        // narrow the allow-list to a single task (`models.triage`), and the leaf is
+        // the only place that distinction exists.
+        if (!isAllowedKey(path, policy.allowKeys)) {
+            warn("key-not-allowed", path, `Ignored "${path}": a repo may not set this key.`);
+            continue;
+        }
+        if (typeof spec !== "string" || !spec.trim()) {
+            warn("invalid-value", path, `Ignored "${path}": a model must be a non-empty "provider/model" string.`);
+            continue;
+        }
+        const model = spec.trim();
+        const prefix = model.split("/")[0] ?? "";
+        if (!prefix || !model.includes("/") || (!providerByPrefix(prefix) && !oauthProviderByModelPrefix(prefix))) {
+            warn("unknown-provider", path, `Ignored "${path}": "${model}" is not a "provider/model" spec Last Light can wire.`);
+            continue;
+        }
+        // A non-null allowedModels is the operator saying "exactly these" — an
+        // exact-match list, never a prefix rule, so it can't be widened by a repo
+        // appending to a model id.
+        if (policy.allowedModels !== null && !policy.allowedModels.includes(model)) {
+            warn("model-not-allowed", path, `Ignored "${path}": "${model}" is not in this deployment's repoConfig.allowedModels.`);
+            continue;
+        }
+        out[task] = model;
+    }
+    return out;
+}
+function sanitizeStringMap(raw, path, policy, warn) {
+    if (!isPlainObject(raw)) {
+        warn("invalid-value", path, `Ignored "${path}" in .lastlight/${REPO_CONFIG_FILE}: it must be a mapping.`);
+        return undefined;
+    }
+    const out = {};
+    for (const [key, value] of Object.entries(raw)) {
+        const leaf = `${path}.${key}`;
+        if (!isAllowedKey(leaf, policy.allowKeys)) {
+            warn("key-not-allowed", leaf, `Ignored "${leaf}": a repo may not set this key.`);
+            continue;
+        }
+        if (typeof value !== "string" || !value.trim()) {
+            warn("invalid-value", leaf, `Ignored "${leaf}": it must be a non-empty string.`);
+            continue;
+        }
+        out[key] = value.trim();
+    }
+    return out;
+}
+function sanitizeDisabled(raw, policy, warn) {
+    if (!isPlainObject(raw)) {
+        warn("invalid-value", "disabled", `Ignored "disabled" in .lastlight/${REPO_CONFIG_FILE}: it must be a mapping.`);
+        return undefined;
+    }
+    const out = {};
+    for (const [key, value] of Object.entries(raw)) {
+        const path = `disabled.${key}`;
+        if (!isAllowedKey(path, policy.allowKeys)) {
+            warn("key-not-allowed", path, `Ignored "${path}": a repo may not set this key.`);
+            continue;
+        }
+        if (!Array.isArray(value) || value.some((v) => typeof v !== "string" || !v.trim())) {
+            warn("invalid-value", path, `Ignored "${path}": it must be an array of non-empty strings.`);
+            continue;
+        }
+        // Same unsafe-name check `validateAssets` applies to the operator's own
+        // disabled lists — a name is a logical workflow/cron name, never a path.
+        const names = value.map((v) => v.trim());
+        const bad = names.find((n) => n.includes("/") || n.includes(".."));
+        if (bad) {
+            warn("invalid-value", path, `Ignored "${path}": "${bad}" is not a valid workflow/cron name.`);
+            continue;
+        }
+        out[key] = names;
+    }
+    return out;
+}
+function sanitizeApproval(raw, policy, base, warn) {
+    if (!isPlainObject(raw)) {
+        warn("invalid-value", "approval", `Ignored "approval" in .lastlight/${REPO_CONFIG_FILE}: it must be a mapping.`);
+        return undefined;
+    }
+    const baseApproval = isPlainObject(base.value.approval) ? base.value.approval : {};
+    const out = {};
+    for (const [gate, value] of Object.entries(raw)) {
+        const path = `approval.${gate}`;
+        if (!isAllowedKey(path, policy.allowKeys)) {
+            warn("key-not-allowed", path, `Ignored "${path}": a repo may not set this key.`);
+            continue;
+        }
+        if (typeof value !== "boolean") {
+            warn("invalid-value", path, `Ignored "${path}": an approval gate must be true or false.`);
+            continue;
+        }
+        // ADD-ONLY. A repo may demand more human oversight of runs against itself;
+        // it may never remove oversight the operator asked for. Clearing a gate the
+        // operator never set is a no-op, so every `false` is simply dropped — with a
+        // warning, so the repo learns why nothing happened.
+        if (value === false) {
+            const code = baseApproval[gate] === true ? "approval-downgrade" : "invalid-value";
+            warn(code, path, `Ignored "${path}: false": the repo approval layer is add-only — a repo can raise an approval gate, never clear one.`);
+            continue;
+        }
+        out[gate] = true;
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Resolution
+// ---------------------------------------------------------------------------
+/**
+ * Apply a repo's layer on top of the boot config and report what happened.
+ *
+ * PURE — no fs, no network, no runtime-config reads. Plain objects deep-merge
+ * key-by-key while arrays and scalars replace wholesale — byte-for-byte the
+ * semantics of the boot layers (see {@link mergeLayer}), so the repo layer can
+ * never acquire semantics the operator's layers don't have.
+ *
+ * Note on `disabled.*`: those are arrays, so a repo's list REPLACES the
+ * operator's rather than adding to it (locked precedence). Operators who don't
+ * want that remove `disabled.workflows` / `disabled.crons` from
+ * `repoConfig.allowKeys`.
+ *
+ * Passing `undefined` for `repoLayer` (no `.lastlight/`, fetch failed, feature
+ * disabled) returns the base unchanged with no warnings — the inert path.
+ */
+export function resolveRepoConfig(base, policy, repoLayer) {
+    const warnings = repoLayer ? [...repoLayer.warnings] : [];
+    let layer = {};
+    if (repoLayer && policy.enabled) {
+        const sanitized = sanitizeRepoConfigLayer(repoLayer.config, policy, base, repoLayer.repo);
+        layer = sanitized.layer;
+        warnings.push(...sanitized.warnings);
+    }
+    const value = structuredClone(base.value);
+    const sources = structuredClone(base.sources);
+    mergeLayer(value, sources, layer, "repo");
+    return {
+        merged: shapeMerged(value),
+        sources: shapeSources(sources),
+        warnings,
+    };
+}
+/**
+ * Merge one layer INTO `value`/`sources` in place, tagging every leaf it
+ * supplies with `source`.
+ *
+ * THE single definition of Last Light's config-merge semantics: plain objects
+ * deep-merge key-by-key so each leaf resolves (and is attributed) on its own;
+ * arrays and scalars replace wholesale. Core's boot-layer resolver
+ * (`apps/server/src/config/config-resolve.ts`) re-exports this rather than
+ * carrying its own — the repo layer must merge exactly the way default/overlay/
+ * env do, or a repo could acquire precedence the operator's own layers don't
+ * have, and two implementations is exactly how that drift starts.
+ *
+ * It lives HERE, in the leaf package, because the direction of the dependency
+ * edge only permits it here: `lastlight-shared` may never depend on core.
+ */
+export function mergeLayer(value, sources, layer, source) {
+    for (const [key, incoming] of Object.entries(layer)) {
+        if (isPlainObject(incoming)) {
+            const childValue = isPlainObject(value[key]) ? value[key] : {};
+            const childSources = isPlainObject(sources[key]) ? sources[key] : {};
+            mergeLayer(childValue, childSources, incoming, source);
+            value[key] = childValue;
+            sources[key] = childSources;
+        }
+        else {
+            value[key] = incoming;
+            sources[key] = source;
+        }
+    }
+}
+function shapeMerged(value) {
+    const disabled = isPlainObject(value.disabled) ? value.disabled : {};
+    return {
+        models: stringMap(value.models),
+        variants: stringMap(value.variants),
+        disabled: {
+            workflows: stringList(disabled.workflows),
+            crons: stringList(disabled.crons),
+            prompts: stringList(disabled.prompts),
+            skills: stringList(disabled.skills),
+            agentContext: stringList(disabled.agentContext),
+        },
+        approval: boolMap(value.approval),
+    };
+}
+function shapeSources(sources) {
+    const disabled = isPlainObject(sources.disabled) ? sources.disabled : {};
+    const pick = (key) => (isConfigSource(disabled[key]) ? disabled[key] : "default");
+    return {
+        models: sourceMap(sources.models),
+        variants: sourceMap(sources.variants),
+        disabled: {
+            workflows: pick("workflows"),
+            crons: pick("crons"),
+            prompts: pick("prompts"),
+            skills: pick("skills"),
+            agentContext: pick("agentContext"),
+        },
+        approval: sourceMap(sources.approval),
+    };
+}
+/** Narrow an unknown provenance leaf to a {@link ConfigSource}. */
+export function isConfigSource(value) {
+    return value === "default" || value === "overlay" || value === "env" || value === "repo";
+}
+function stringMap(raw) {
+    const out = {};
+    if (isPlainObject(raw))
+        for (const [k, v] of Object.entries(raw))
+            if (typeof v === "string")
+                out[k] = v;
+    return out;
+}
+function boolMap(raw) {
+    const out = {};
+    if (isPlainObject(raw))
+        for (const [k, v] of Object.entries(raw))
+            out[k] = v === true;
+    return out;
+}
+function sourceMap(raw) {
+    const out = {};
+    if (isConfigSource(raw))
+        return out;
+    if (isPlainObject(raw))
+        for (const [k, v] of Object.entries(raw))
+            if (isConfigSource(v))
+                out[k] = v;
+    return out;
+}
+function stringList(raw) {
+    return Array.isArray(raw) ? raw.filter((v) => typeof v === "string") : [];
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=repo-config-schema.js.map

package/dist/repo-config-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-config-schema.js","sourceRoot":"","sources":["../src/repo-config-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAG9E,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAEzC,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD,0FAA0F;AAC1F,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAyClC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB;IAC/D,QAAQ;IACR,UAAU;IACV,OAAO;IACP,oBAAoB;IACpB,gBAAgB;IAChB,UAAU;CACX,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,CAAC,GAAG,8BAA8B,CAAC;QAC9C,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC;AA+ID;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9E,IAAI,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IACpE,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;AAE/D,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,eAAe,CAAC;IAClC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAC/E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,0BAA0B,CAAC;IAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,2BAA2B,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,mCAAmC,CAAC;IAC1G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mGAAmG;AACnG,SAAS,QAAQ,CAAC,QAAgB,EAAE,IAAY;IAC9C,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAmB,EACnB,MAAwB,EACxB,IAAa;IAEb,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAQ,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,IAA2B,EAAE,IAAY,EAAE,OAAe,EAAE,EAAE,CAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAE/C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,sBAAsB,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,8EAA8E;QAC9E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,sBAAsB,IAAI,mCAAmC,CAAC,CAAC;YACzF,SAAS;QACX,CAAC;QACD,yEAAyE;QACzE,6EAA6E;QAC7E,mEAAmE;QACnE,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACnC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,sBAAsB,IAAI,oDAAoD,CAAC,CAAC;YACtG,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,sBAAsB,IAAI,0CAA0C,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACzG,SAAS;QACX,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,IAAI,CACF,sBAAsB,EACtB,IAAI,EACJ,sBAAsB,IAAI,mFAAmF,CAC9G,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,yEAAyE;YACzE,sEAAsE;YACtE,gCAAgC;YAChC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAAE,YAAY,EAAE,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7C,aAAa,EAAE,CAAC;YAChB,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAC7C,IAAI,CACF,gBAAgB,EAChB,IAAI,EACJ,sBAAsB,IAAI,wCAAwC,qBAAqB,SAAS,CACjG,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACxD,IAAI,CACF,UAAU,EACV,IAAI,EACJ,sBAAsB,IAAI,wCAAwC,qBAAqB,SAAS,CACjG,CAAC;YACF,SAAS;QACX,CAAC;QAED,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,CACF,oBAAoB,EACpB,YAAY,EACZ,WAAW,YAAY,wDAAwD,gBAAgB,IAAI;YACjG,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,IAAI,CACF,oBAAoB,EACpB,YAAY,EACZ,WAAW,aAAa,uFAAuF,CAChH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,IAAa;IAEb,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,cAAc;oBACpB,IAAI;oBACJ,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,sBAAsB,gBAAgB,2BAA2B,OAAO,IAAI;iBACtF;aACF;SACF,CAAC;IACJ,CAAC;IACD,8DAA8D;IAC9D,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACrE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI;oBACJ,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,sBAAsB,gBAAgB,oCAAoC;iBACpF;aACF;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,SAA4B;IAC9D,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,SAA4B;IACjE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAwC,EACxC,MAAwB,EACxB,IAAoB,EACpB,IAAa;IAEb,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,IAA2B,EAAE,IAAY,EAAE,OAAe,EAAE,EAAE,CAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAE/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE,YAAY,GAAG,mBAAmB,gBAAgB,gCAAgC,CAAC,CAAC;YACjH,SAAS;QACX,CAAC;QACD,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,QAAQ;gBACX,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;gBAClE,MAAM;YACR,KAAK,UAAU;gBACb,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;gBACnF,MAAM;YACR,KAAK,OAAO;gBACV,2DAA2D;gBAC3D,qEAAqE;gBACrE,kDAAkD;gBAClD,wEAAwE;gBACxE,oEAAoE;gBACpE,iEAAiE;gBACjE,uEAAuE;gBACvE,+DAA+D;gBAC/D,8DAA8D;gBAC9D,sEAAsE;gBACtE,+DAA+D;gBAC/D,MAAM;YACR,KAAK,UAAU;gBACb,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;gBACtE,MAAM;YACR,KAAK,UAAU;gBACb,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC5E,MAAM;YACR;gBACE,sEAAsE;gBACtE,mEAAmE;gBACnE,mEAAmE;gBACnE,IAAI,CACF,iBAAiB,EACjB,GAAG,EACH,YAAY,GAAG,mBAAmB,gBAAgB,mCAAmC,CACtF,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAID,uFAAuF;AACvF,SAAS,WAAW,CAAC,MAA+B,EAAE,GAAW,EAAE,KAA0C;IAC3G,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAClE,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,MAAwB,EAAE,IAAU;IACxE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,eAAe,EAAE,QAAQ,EAAE,kCAAkC,gBAAgB,yBAAyB,CAAC,CAAC;QAC7G,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,IAAI,EAAE,CAAC;QAC9B,2EAA2E;QAC3E,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,YAAY,IAAI,iCAAiC,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,YAAY,IAAI,yDAAyD,CAAC,CAAC;YACvG,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC1G,IAAI,CAAC,kBAAkB,EAAE,IAAI,EAAE,YAAY,IAAI,OAAO,KAAK,uDAAuD,CAAC,CAAC;YACpH,SAAS;QACX,CAAC;QACD,uEAAuE;QACvE,0EAA0E;QAC1E,2BAA2B;QAC3B,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3E,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,YAAY,IAAI,OAAO,KAAK,yDAAyD,CAAC,CAAC;YACvH,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAY,EACZ,IAAY,EACZ,MAAwB,EACxB,IAAU;IAEV,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,YAAY,IAAI,mBAAmB,gBAAgB,yBAAyB,CAAC,CAAC;QAC1G,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,YAAY,IAAI,iCAAiC,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,YAAY,IAAI,mCAAmC,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,MAAwB,EAAE,IAAU;IAC1E,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,eAAe,EAAE,UAAU,EAAE,oCAAoC,gBAAgB,yBAAyB,CAAC,CAAC;QACjH,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,YAAY,GAAG,EAAE,CAAC;QAC/B,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,YAAY,IAAI,iCAAiC,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACnF,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,YAAY,IAAI,8CAA8C,CAAC,CAAC;YAC5F,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,KAAK,GAAI,KAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,YAAY,IAAI,OAAO,GAAG,sCAAsC,CAAC,CAAC;YAC9F,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAY,EACZ,MAAwB,EACxB,IAAoB,EACpB,IAAU;IAEV,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,eAAe,EAAE,UAAU,EAAE,oCAAoC,gBAAgB,yBAAyB,CAAC,CAAC;QACjH,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,YAAY,IAAI,iCAAiC,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,YAAY,IAAI,4CAA4C,CAAC,CAAC;YAC1F,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,oDAAoD;QACpD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC;YAClF,IAAI,CACF,IAAI,EACJ,IAAI,EACJ,YAAY,IAAI,qGAAqG,CACtH,CAAC;YACF,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAoB,EACpB,MAAwB,EACxB,SAAqB;IAErB,MAAM,QAAQ,GAAwB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/E,IAAI,KAAK,GAA4B,EAAE,CAAC;IACxC,IAAI,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,uBAAuB,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1F,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC;QAC1B,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;QAC9B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CACxB,KAA8B,EAC9B,OAAgC,EAChC,KAA8B,EAC9B,MAAoB;IAEpB,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,GAAG,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,GAAG,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,UAAU,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvD,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B;IACjD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/B,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;QACnC,QAAQ,EAAE;YACR,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;YACzC,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;YACrC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;YACnC,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;SAChD;QACD,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAgC;IACpD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAgB,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxG,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;QACjC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrC,QAAQ,EAAE;YACR,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC;YAC5B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;YACpB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;YACxB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;YACtB,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC;SACnC;QACD,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC;AAC3F,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,aAAa,CAAC,GAAG,CAAC;QAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,aAAa,CAAC,GAAG,CAAC;QAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;IACtF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,GAAG,GAAiC,EAAE,CAAC;IAC7C,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACpC,IAAI,aAAa,CAAC,GAAG,CAAC;QAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,IAAI,cAAc,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}