looply-cli 0.5.8 → 0.5.10

package/dist/delivery-rules.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALWAYS_PROTECTED = exports.DELIVERY_REMOTE = void 0;
+exports.isDeployRemoteUrl = isDeployRemoteUrl;
+exports.githubRepoOf = githubRepoOf;
+exports.redactUrl = redactUrl;
+exports.shortBranch = shortBranch;
+exports.pushRefusal = pushRefusal;
+exports.deployPushArgv = deployPushArgv;
+exports.unsafeDeployPushArgv = unsafeDeployPushArgv;
+exports.deliveryPushArgv = deliveryPushArgv;
+exports.unsafePushArgv = unsafePushArgv;
+const integrator_1 = require("./integrator");
+/**
+ * THE HARD RULES FOR EVERY PUSH LOOPLY MAKES OF A FINISHED BRANCH.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * Not settings. Nothing in config.yaml, nothing from the server and nothing a
+ * goal says can loosen any of them:
+ *
+ *   1. ONLY `origin`. Several of the owner's repositories have remotes that
+ *      DEPLOY ON PUSH (`heroku`, `heroku-qa`); a push to one of them is a
+ *      release, not a review. And an `origin` that itself points at Heroku is
+ *      refused for the same reason.
+ *   2. ONLY a `looply/run-*` branch — the goal's own work. Never the base
+ *      branch, never `main`/`master`, never a branch the project or GitHub
+ *      marks protected.
+ *   3. NEVER FORCED. The argv is built here and checked here again just before
+ *      it runs: no `--force` in any spelling, no `+` refspec, no deletes, no
+ *      `--mirror`/`--all`/`--tags`. A branch origin already has at a commit
+ *      this one does not contain is reported, not overwritten.
+ *
+ * Merging into the base branch (`deliver: merge`) is a GitHub merge of a pull
+ * request whose checks are green — never a push — and lives in
+ * `branch-delivery.ts`.
+ */
+/** The one remote Looply pushes to. */
+exports.DELIVERY_REMOTE = 'origin';
+/** Branches never pushed whatever else is configured. */
+exports.ALWAYS_PROTECTED = ['main', 'master'];
+/** A remote URL whose push deploys an app: a push there is a release. */
+function isDeployRemoteUrl(url) {
+    let host;
+    try {
+        host = new URL(asUrl(url.trim())).hostname.toLowerCase();
+    }
+    catch {
+        // Unreadable: refuse anything that even mentions heroku rather than guess.
+        return /heroku/i.test(url);
+    }
+    return host === 'heroku.com' || host.endsWith('.heroku.com') || host.endsWith('.herokuapp.com');
+}
+function asUrl(url) {
+    // scp-like `git@host:owner/repo.git` → ssh://git@host/owner/repo.git, so URL can read the host.
+    const scp = /^([^@/]+@)?([^:/]+):(.+)$/.exec(url);
+    if (scp && !/^[a-z]+:\/\//i.test(url))
+        return `ssh://${scp[1] ?? ''}${scp[2]}/${scp[3]}`;
+    return url;
+}
+/** `owner/repo` for a github.com remote, else null (another host gets a push but no pull request). */
+function githubRepoOf(url) {
+    let u;
+    try {
+        u = new URL(asUrl(url.trim()));
+    }
+    catch {
+        return null;
+    }
+    if (u.hostname.toLowerCase() !== 'github.com')
+        return null;
+    const parts = u.pathname.replace(/^\/+/, '').replace(/\.git$/i, '').replace(/\/+$/, '').split('/');
+    if (parts.length !== 2 || !parts[0] || !parts[1])
+        return null;
+    if (!/^[A-Za-z0-9_.-]+$/.test(parts[0]) || !/^[A-Za-z0-9_.-]+$/.test(parts[1]))
+        return null;
+    return { owner: parts[0], repo: parts[1] };
+}
+/** A remote URL with any embedded credentials removed, for a sentence a person reads. */
+function redactUrl(url) {
+    return url.replace(/(\b[a-z][a-z0-9+.-]*:\/\/)[^@/\s]+@/gi, '$1');
+}
+/** The branch name without a leading `origin/` or `refs/heads/`. */
+function shortBranch(ref) {
+    return ref.replace(/^refs\/heads\//, '').replace(/^refs\/remotes\/[^/]+\//, '').replace(/^origin\//, '');
+}
+/** Why this push may not happen, or null when every rule allows it. */
+function pushRefusal(input) {
+    if (input.remote !== exports.DELIVERY_REMOTE) {
+        return `Looply pushes only to ${exports.DELIVERY_REMOTE}, never to "${input.remote}" (a remote like heroku deploys on push)`;
+    }
+    if (input.remoteUrl === null || input.remoteUrl.trim() === '') {
+        return `this repository has no ${exports.DELIVERY_REMOTE} remote to push to`;
+    }
+    if (isDeployRemoteUrl(input.remoteUrl)) {
+        return `${exports.DELIVERY_REMOTE} points at ${redactUrl(input.remoteUrl)}, where a push deploys; Looply does not push there`;
+    }
+    const b = input.branch;
+    if (!b.startsWith(integrator_1.RUN_BRANCH_PREFIX) || b.length <= integrator_1.RUN_BRANCH_PREFIX.length) {
+        return `only a goal's own ${integrator_1.RUN_BRANCH_PREFIX}* branch is pushed, and "${b}" is not one`;
+    }
+    if (!/^[A-Za-z0-9._/-]+$/.test(b) || b.includes('..') || b.endsWith('/') || b.endsWith('.lock') || b.includes('//')) {
+        return `"${b}" is not a branch name Looply will push`;
+    }
+    const lower = b.toLowerCase();
+    if (exports.ALWAYS_PROTECTED.includes(lower))
+        return `"${b}" is protected; Looply never pushes it`;
+    if (input.base !== null && lower === shortBranch(input.base).toLowerCase()) {
+        return `"${b}" is the project's base branch; Looply never pushes it`;
+    }
+    if (input.protectedBranches.some((p) => shortBranch(p).toLowerCase() === lower)) {
+        return `"${b}" is a protected branch; Looply never pushes it`;
+    }
+    return null;
+}
+/**
+ * THE ONE EXCEPTION TO "ORIGIN ONLY": a `push` deploy step, which the project
+ * configured explicitly (remote + branch). Exactly `push --porcelain <remote>
+ * <merged sha>:refs/heads/<branch>` — the configured remote and branch and
+ * nothing else, never forced, never a delete.
+ */
+function deployPushArgv(remote, branch, sha) {
+    return ['push', '--porcelain', remote, `${sha}:refs/heads/${branch}`];
+}
+function unsafeDeployPushArgv(argv, allowed) {
+    if (argv[0] !== 'push')
+        return 'not a push';
+    const rest = argv.slice(1);
+    const flags = rest.filter((a) => a.startsWith('-'));
+    if (flags.some((f) => f !== '--porcelain'))
+        return `only --porcelain is allowed, not ${flags.join(' ')}`;
+    const positional = rest.filter((a) => !a.startsWith('-'));
+    if (positional.length !== 2)
+        return 'a deploy push names exactly one remote and one refspec';
+    const [remote, spec] = positional;
+    if (remote !== allowed.remote)
+        return `the deploy remote is ${allowed.remote}, not "${remote}"`;
+    if (spec.startsWith('+'))
+        return 'a forced refspec (+) is never used';
+    const m = /^([0-9a-f]{40}):refs\/heads\/(.+)$/.exec(spec);
+    if (m === null)
+        return 'the refspec must be <full sha>:refs/heads/<branch>';
+    if (m[2] !== allowed.branch)
+        return `the deploy branch is ${allowed.branch}, not "${m[2]}"`;
+    return null;
+}
+/** The exact argv of a delivery push: `<sha>:refs/heads/<branch>` to origin, nothing else. */
+function deliveryPushArgv(branch, sha) {
+    return ['push', '--porcelain', exports.DELIVERY_REMOTE, `${sha}:refs/heads/${branch}`];
+}
+const FORBIDDEN_PUSH_FLAGS = /^(-f|--force.*|--mirror|--all|--tags|--follow-tags|--delete|-d|--prune|--set-upstream|-u|--receive-pack.*|--exec.*|--repo.*|-o|--push-option.*|--no-verify)$/;
+/**
+ * THE LAST LOOK BEFORE GIT RUNS. Refuses any argv that is not exactly a
+ * non-forced push of one sha to one `refs/heads/looply/run-*` on origin — so a
+ * future caller that builds its own argv cannot reach a force, a delete, a
+ * second remote or a protected branch through this module.
+ */
+function unsafePushArgv(argv) {
+    if (argv[0] !== 'push')
+        return 'not a push';
+    const rest = argv.slice(1);
+    for (const a of rest) {
+        if (FORBIDDEN_PUSH_FLAGS.test(a) || /^-[a-z]*f[a-z]*$/i.test(a) && !a.startsWith('--'))
+            return `"${a}" is not allowed in a delivery push`;
+    }
+    const positional = rest.filter((a) => !a.startsWith('-'));
+    const flags = rest.filter((a) => a.startsWith('-'));
+    if (flags.some((f) => f !== '--porcelain'))
+        return `only --porcelain is allowed, not ${flags.join(' ')}`;
+    if (positional.length !== 2)
+        return 'a delivery push names exactly one remote and one refspec';
+    const [remote, spec] = positional;
+    if (remote !== exports.DELIVERY_REMOTE)
+        return `the remote must be ${exports.DELIVERY_REMOTE}, not "${remote}"`;
+    if (spec.startsWith('+'))
+        return 'a forced refspec (+) is never used';
+    const m = /^([0-9a-f]{40}):refs\/heads\/(.+)$/.exec(spec);
+    if (m === null)
+        return 'the refspec must be <full sha>:refs/heads/<branch>';
+    const branch = m[2];
+    if (!branch.startsWith(integrator_1.RUN_BRANCH_PREFIX))
+        return `only ${integrator_1.RUN_BRANCH_PREFIX}* is pushed, not "${branch}"`;
+    if (exports.ALWAYS_PROTECTED.includes(branch.toLowerCase()))
+        return `"${branch}" is protected`;
+    return null;
+}
+//# sourceMappingURL=delivery-rules.js.map

package/dist/delivery-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-rules.js","sourceRoot":"","sources":["../src/delivery-rules.ts"],"names":[],"mappings":";;;AAiCA,8CASC;AAUD,oCAYC;AAGD,8BAEC;AAGD,kCAEC;AAcD,kCA0BC;AAQD,wCAEC;AAED,oDAcC;AAGD,4CAEC;AAUD,wCAmBC;AA9KD,6CAAiD;AAEjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,uCAAuC;AAC1B,QAAA,eAAe,GAAG,QAAQ,CAAC;AAExC,yDAAyD;AAC5C,QAAA,gBAAgB,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAU,CAAC;AAE5D,yEAAyE;AACzE,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,gGAAgG;IAChG,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sGAAsG;AACtG,SAAgB,YAAY,CAAC,GAAW;IACtC,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,yFAAyF;AACzF,SAAgB,SAAS,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,uCAAuC,EAAE,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,oEAAoE;AACpE,SAAgB,WAAW,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAC3G,CAAC;AAaD,uEAAuE;AACvE,SAAgB,WAAW,CAAC,KAAqB;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,uBAAe,EAAE,CAAC;QACrC,OAAO,yBAAyB,uBAAe,eAAe,KAAK,CAAC,MAAM,0CAA0C,CAAC;IACvH,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,OAAO,0BAA0B,uBAAe,oBAAoB,CAAC;IACvE,CAAC;IACD,IAAI,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,GAAG,uBAAe,cAAc,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,oDAAoD,CAAC;IACxH,CAAC;IACD,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,8BAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,8BAAiB,CAAC,MAAM,EAAE,CAAC;QAC7E,OAAO,qBAAqB,8BAAiB,4BAA4B,CAAC,cAAc,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpH,OAAO,IAAI,CAAC,yCAAyC,CAAC;IACxD,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9B,IAAK,wBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,wCAAwC,CAAC;IAClH,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC,wDAAwD,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC,iDAAiD,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,MAAc,EAAE,MAAc,EAAE,GAAW;IACxE,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,GAAG,eAAe,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAgB,oBAAoB,CAAC,IAAuB,EAAE,OAA2C;IACvG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC;QAAE,OAAO,oCAAoC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACzG,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,wDAAwD,CAAC;IAC7F,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,UAA8B,CAAC;IACtD,IAAI,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,wBAAwB,OAAO,CAAC,MAAM,UAAU,MAAM,GAAG,CAAC;IAChG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,oCAAoC,CAAC;IACtE,MAAM,CAAC,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,oDAAoD,CAAC;IAC5E,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,wBAAwB,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8FAA8F;AAC9F,SAAgB,gBAAgB,CAAC,MAAc,EAAE,GAAW;IAC1D,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,uBAAe,EAAE,GAAG,GAAG,eAAe,MAAM,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,oBAAoB,GAAG,8JAA8J,CAAC;AAE5L;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,IAAuB;IACpD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,qCAAqC,CAAC;IAC5I,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC;QAAE,OAAO,oCAAoC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACzG,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,0DAA0D,CAAC;IAC/F,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,UAA8B,CAAC;IACtD,IAAI,MAAM,KAAK,uBAAe;QAAE,OAAO,sBAAsB,uBAAe,UAAU,MAAM,GAAG,CAAC;IAChG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,oCAAoC,CAAC;IACtE,MAAM,CAAC,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,oDAAoD,CAAC;IAC5E,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAW,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,8BAAiB,CAAC;QAAE,OAAO,QAAQ,8BAAiB,qBAAqB,MAAM,GAAG,CAAC;IAC1G,IAAK,wBAAsC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,IAAI,MAAM,gBAAgB,CAAC;IAC9G,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/delivery-settings-cache.d.ts

@@ -0,0 +1,35 @@
+import { type DeliverMode, type DeployConfig } from '@looply/core';
+/**
+ * THE PROJECT'S REMOTE DELIVERY CHOICE, AS THIS MACHINE LAST HEARD IT.
+ *
+ * Set in AutoRyn's software-execution settings or the Looply console; pulled by
+ * the daemon with the model settings (every five minutes) and written here. A
+ * failed pull keeps the last answer, so an offline machine keeps doing what it
+ * was last told — never silently switches to merging or back.
+ *
+ * Precedence: config.yaml `deliver.mode` → this cache → `pr`.
+ */
+export declare const DELIVERY_SETTINGS_FILE = "delivery-settings.json";
+export interface DeliverySettingsCache {
+    deliver: DeliverMode | null;
+    /** The project's deploy step as set remotely; null when none. */
+    deploy: DeployConfig | null;
+    updatedAt: string | null;
+    fetchedAt: string;
+}
+export declare function readDeliverySettingsCache(stateDir: string): DeliverySettingsCache | null;
+/** The mode in force, and where it came from. */
+export declare function resolveDeliverMode(local: DeliverMode | undefined, stateDir: string): {
+    mode: DeliverMode;
+    from: 'config.yaml' | 'remote' | 'default';
+};
+/** The deploy step in force: config.yaml `deliver.deploy` → the remote setting → none (null). */
+export declare function resolveDeploy(local: DeployConfig | undefined, stateDir: string): DeployConfig | null;
+/** One pull: ask the server, write the cache when the answer changed. Never throws. */
+export declare function makeDeliverySettingsPull(deps: {
+    fetch(): Promise<unknown>;
+    stateDir: string;
+    log(line: string): void;
+    now(): number;
+}): () => Promise<'updated' | 'unchanged' | 'failed'>;
+//# sourceMappingURL=delivery-settings-cache.d.ts.map

package/dist/delivery-settings-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-settings-cache.d.ts","sourceRoot":"","sources":["../src/delivery-settings-cache.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkD,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAGnH;;;;;;;;;GASG;AAEH,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,iEAAiE;IACjE,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAoBxF;AAUD,iDAAiD;AACjD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,GAAG,SAAS,EAC9B,QAAQ,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAA;CAAE,CAKnE;AAED,iGAAiG;AACjG,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAGpG;AAED,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,GAAG,IAAI,MAAM,CAAC;CACf,GAAG,MAAM,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC,CA4CpD"}

package/dist/delivery-settings-cache.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DELIVERY_SETTINGS_FILE = void 0;
+exports.readDeliverySettingsCache = readDeliverySettingsCache;
+exports.resolveDeliverMode = resolveDeliverMode;
+exports.resolveDeploy = resolveDeploy;
+exports.makeDeliverySettingsPull = makeDeliverySettingsPull;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const core_1 = require("@looply/core");
+const server_client_1 = require("./server-client");
+/**
+ * THE PROJECT'S REMOTE DELIVERY CHOICE, AS THIS MACHINE LAST HEARD IT.
+ *
+ * Set in AutoRyn's software-execution settings or the Looply console; pulled by
+ * the daemon with the model settings (every five minutes) and written here. A
+ * failed pull keeps the last answer, so an offline machine keeps doing what it
+ * was last told — never silently switches to merging or back.
+ *
+ * Precedence: config.yaml `deliver.mode` → this cache → `pr`.
+ */
+exports.DELIVERY_SETTINGS_FILE = 'delivery-settings.json';
+function readDeliverySettingsCache(stateDir) {
+    try {
+        const raw = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(stateDir, exports.DELIVERY_SETTINGS_FILE), 'utf8'));
+        let deliver = null;
+        let deploy = null;
+        if (raw['deliver'] !== null && raw['deliver'] !== undefined) {
+            const v = (0, core_1.validateDeliverySettings)({ deliver: raw['deliver'], ...(raw['deploy'] ? { deploy: raw['deploy'] } : {}) });
+            if (!v.ok)
+                return null;
+            deliver = v.settings.deliver;
+            deploy = v.settings.deploy ?? null;
+        }
+        return {
+            deliver,
+            deploy,
+            updatedAt: typeof raw['updatedAt'] === 'string' ? raw['updatedAt'] : null,
+            fetchedAt: typeof raw['fetchedAt'] === 'string' ? raw['fetchedAt'] : '',
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writeCache(stateDir, value) {
+    (0, node_fs_1.mkdirSync)(stateDir, { recursive: true });
+    const target = (0, node_path_1.join)(stateDir, exports.DELIVERY_SETTINGS_FILE);
+    const tmp = `${target}.${process.pid}.tmp`;
+    (0, node_fs_1.writeFileSync)(tmp, JSON.stringify(value, null, 2) + '\n', 'utf8');
+    (0, node_fs_1.renameSync)(tmp, target);
+}
+/** The mode in force, and where it came from. */
+function resolveDeliverMode(local, stateDir) {
+    if (local !== undefined)
+        return { mode: local, from: 'config.yaml' };
+    const remote = readDeliverySettingsCache(stateDir)?.deliver ?? null;
+    if (remote !== null)
+        return { mode: remote, from: 'remote' };
+    return { mode: core_1.DEFAULT_DELIVER_MODE, from: 'default' };
+}
+/** The deploy step in force: config.yaml `deliver.deploy` → the remote setting → none (null). */
+function resolveDeploy(local, stateDir) {
+    if (local !== undefined)
+        return local;
+    return readDeliverySettingsCache(stateDir)?.deploy ?? null;
+}
+/** One pull: ask the server, write the cache when the answer changed. Never throws. */
+function makeDeliverySettingsPull(deps) {
+    let failureReported = false;
+    const reportOnce = (why) => {
+        if (failureReported)
+            return;
+        failureReported = true;
+        deps.log(`deliver : could not refresh the project's delivery setting — ${why}`);
+    };
+    return async () => {
+        let body;
+        try {
+            body = await deps.fetch();
+        }
+        catch (e) {
+            if (!(e instanceof server_client_1.ServerError && (e.isOffline || e.isAuth)))
+                reportOnce(e.message);
+            return 'failed';
+        }
+        const b = body;
+        if (typeof b !== 'object' || b === null || !('settings' in b)) {
+            reportOnce('the server answered with something that is not a settings envelope');
+            return 'failed';
+        }
+        let deliver = null;
+        let deploy = null;
+        if (b.settings !== null) {
+            const v = (0, core_1.validateDeliverySettings)(b.settings);
+            if (!v.ok) {
+                reportOnce(`the server sent a setting this build refuses (${v.key}: ${v.because})`);
+                return 'failed';
+            }
+            deliver = v.settings.deliver;
+            deploy = v.settings.deploy ?? null;
+        }
+        failureReported = false;
+        const updatedAt = typeof b.updatedAt === 'string' ? b.updatedAt : null;
+        const before = readDeliverySettingsCache(deps.stateDir);
+        if (before !== null && before.deliver === deliver && JSON.stringify(before.deploy) === JSON.stringify(deploy) && before.updatedAt === updatedAt)
+            return 'unchanged';
+        try {
+            writeCache(deps.stateDir, { deliver, deploy, updatedAt, fetchedAt: new Date(deps.now()).toISOString() });
+        }
+        catch (e) {
+            deps.log(`deliver : could not write the delivery setting cache (${e.message})`);
+            return 'failed';
+        }
+        deps.log(`deliver : project delivery setting is ${deliver ?? `the default (${core_1.DEFAULT_DELIVER_MODE})`}`);
+        return 'updated';
+    };
+}
+//# sourceMappingURL=delivery-settings-cache.js.map

package/dist/delivery-settings-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-settings-cache.js","sourceRoot":"","sources":["../src/delivery-settings-cache.ts"],"names":[],"mappings":";;;AA0BA,8DAoBC;AAWD,gDAQC;AAGD,sCAGC;AAGD,4DAiDC;AA3HD,qCAA6E;AAC7E,yCAAiC;AACjC,uCAAmH;AACnH,mDAA8C;AAE9C;;;;;;;;;GASG;AAEU,QAAA,sBAAsB,GAAG,wBAAwB,CAAC;AAU/D,SAAgB,yBAAyB,CAAC,QAAgB;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,QAAQ,EAAE,8BAAsB,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;QAChH,IAAI,OAAO,GAAuB,IAAI,CAAC;QACvC,IAAI,MAAM,GAAwB,IAAI,CAAC;QACvC,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,IAAA,+BAAwB,EAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACrH,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC7B,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC;QACrC,CAAC;QACD,OAAO;YACL,OAAO;YACP,MAAM;YACN,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;YACzE,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;SACxE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB,EAAE,KAA4B;IAChE,IAAA,mBAAS,EAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,QAAQ,EAAE,8BAAsB,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC3C,IAAA,uBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAClE,IAAA,oBAAU,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,iDAAiD;AACjD,SAAgB,kBAAkB,CAChC,KAA8B,EAC9B,QAAgB;IAEhB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;IACpE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7D,OAAO,EAAE,IAAI,EAAE,2BAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAgB,aAAa,CAAC,KAA+B,EAAE,QAAgB;IAC7E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AAC7D,CAAC;AAED,uFAAuF;AACvF,SAAgB,wBAAwB,CAAC,IAKxC;IACC,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,UAAU,GAAG,CAAC,GAAW,EAAQ,EAAE;QACvC,IAAI,eAAe;YAAE,OAAO;QAC5B,eAAe,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,gEAAgE,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC;IACF,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,YAAY,2BAAW,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;gBAAE,UAAU,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;YAC/F,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,GAAG,IAA0D,CAAC;QACrE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9D,UAAU,CAAC,oEAAoE,CAAC,CAAC;YACjF,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,GAAuB,IAAI,CAAC;QACvC,IAAI,MAAM,GAAwB,IAAI,CAAC;QACvC,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,IAAA,+BAAwB,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,UAAU,CAAC,iDAAiD,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;gBACpF,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC7B,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC;QACrC,CAAC;QACD,eAAe,GAAG,KAAK,CAAC;QACxB,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC;QACpK,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC3G,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,yDAA0D,CAAW,CAAC,OAAO,GAAG,CAAC,CAAC;YAC3F,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,yCAAyC,OAAO,IAAI,gBAAgB,2BAAoB,GAAG,EAAE,CAAC,CAAC;QACxG,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC"}

package/dist/github-api.d.ts

@@ -0,0 +1,99 @@
+/**
+ * THE SLICE OF GITHUB A FINISHED BRANCH NEEDS: find or open its pull request,
+ * ask whether a branch is protected, read its checks, and merge it.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * 🔴 THE MACHINE'S OWN CREDENTIALS, AND NOTHING NEW. The token is whatever this
+ * machine already pushes with: `gh auth token` when the GitHub CLI is installed
+ * and signed in, else git's own credential helper (`git credential fill` for
+ * github.com — Git Credential Manager on Windows). Nothing is stored, printed or
+ * sent anywhere but api.github.com. Neither may prompt: a daemon has nobody to
+ * answer, so `GIT_TERMINAL_PROMPT=0` and `GCM_INTERACTIVE=never` are set, and
+ * every child is hidden (`windowsHide`).
+ *
+ * When neither yields a token the answer is null, and the caller says so
+ * plainly: "pushed, but no pull request could be opened because …".
+ */
+export interface PullInfo {
+    readonly number: number;
+    /** The address a person opens. */
+    readonly url: string;
+    readonly state: 'open' | 'closed';
+    readonly merged: boolean;
+    /** The branch it targets. */
+    readonly base: string;
+    readonly headSha: string;
+}
+export type CheckState = 'success' | 'failure' | 'pending';
+export interface CheckResult {
+    readonly name: string;
+    readonly state: CheckState;
+}
+export interface GitHubApi {
+    /** The pull request whose head is `branch`, in any state, newest first; null when none. */
+    findPull(branch: string): Promise<PullInfo | null>;
+    getPull(n: number): Promise<PullInfo>;
+    createPull(input: {
+        title: string;
+        head: string;
+        base: string;
+        body: string;
+    }): Promise<PullInfo>;
+    /** True/false from GitHub; null when it would not say (no rights to read it). */
+    branchProtected(branch: string): Promise<boolean | null>;
+    /** True when origin has the branch. */
+    branchExists(branch: string): Promise<boolean>;
+    /** The required status-check names for `base`; null when unknown (unprotected, or not readable). */
+    requiredChecks(base: string): Promise<string[] | null>;
+    /** Every check run and commit status on `sha`, by name (newest wins). */
+    checksFor(sha: string): Promise<CheckResult[]>;
+    /** Merge, only if the head is still `sha`. Never a squash of somebody else's commits behind their back. */
+    merge(n: number, sha: string, title: string): Promise<{
+        merged: boolean;
+        message: string;
+        sha?: string;
+    }>;
+    setBase(n: number, base: string): Promise<void>;
+    /** Close a pull request a fix-up replaced, with a comment saying by what. */
+    closePull(n: number, comment: string): Promise<void>;
+}
+export declare class GitHubError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+type Fetch = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+}) => Promise<{
+    status: number;
+    text(): Promise<string>;
+}>;
+/** A client for one repository, with a token already in hand. */
+export declare function makeGitHubApi(deps: {
+    owner: string;
+    repo: string;
+    token: string;
+    fetch?: Fetch;
+}): GitHubApi;
+export type RunText = (bin: string, args: readonly string[], stdin: string, cwd: string) => Promise<{
+    code: number;
+    stdout: string;
+}>;
+/** `gh` on PATH, as an absolute path (never resolved from the cwd), or null. */
+export declare function ghBinary(env?: NodeJS.ProcessEnv): string | null;
+/**
+ * A token for github.com, and where it came from; null when this machine has
+ * none Looply can use. Order: `gh auth token`, then git's credential helper.
+ */
+export declare function githubToken(deps?: {
+    run?: RunText;
+    gh?: string | null;
+    git?: string | null;
+    cwd?: string;
+}): Promise<{
+    token: string;
+    from: 'gh' | 'git-credential';
+} | null>;
+export {};
+//# sourceMappingURL=github-api.d.ts.map

package/dist/github-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-api.d.ts","sourceRoot":"","sources":["../src/github-api.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE3D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACnD,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,UAAU,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClG,iFAAiF;IACjF,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACzD,uCAAuC;IACvC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,oGAAoG;IACpG,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,yEAAyE;IACzE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,2GAA2G;IAC3G,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1G,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,6EAA6E;IAC7E,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AASD,qBAAa,WAAY,SAAQ,KAAK;aAGlB,MAAM,EAAE,MAAM;gBAD9B,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM;CAKjC;AAED,KAAK,KAAK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC;IAC9G,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,GAAG,SAAS,CA2H5G;AAID,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA8BtI,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAW5E;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAClF,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,GAAG,gBAAgB,CAAA;CAAE,GAAG,IAAI,CAAC,CAsBlE"}