pm-github 2026.10.13 → 2026.10.15

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 2026.10.15 - 2026-10-15
+
+### Added
+
+- Close pm items delivered by merged pull requests with verifiable GitHub evidence ([pm-github-t4i2](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-t4i2.toon))
+- Regenerate caller changelogs and dispatch required CI for gated sync PRs ([pm-github-wrmt](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-wrmt.toon))
+
+## 2026.10.14 - 2026-10-14
+
+### Added
+
+- Select GitHub issue imports and cap list volume ([pm-github-6srd](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-6srd.toon))
+- Revalidate blocked items against the live state of their GitHub blockers ([pm-github-fmrf](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-fmrf.toon))
+
 ## 2026.10.8 - 2026-10-08
 
 ### Added

package/README.md

@@ -17,13 +17,156 @@ pm install npm:pm-github --global
 > `github.com/unbraind/pm-github` source cannot work either — pm copies a GitHub
 > source as-is without building it, and this repository does not commit `dist/`.
 
+## Close items delivered by merged pull requests
+
+Agents can use `pm github closeout` to replace manual post-merge tracker cleanup.
+It resolves `--repo` or `PM_GITHUB_REPO` through the existing
+repository resolver, and uses the normal `GITHUB_TOKEN` / `GH_TOKEN` / `gh auth`
+token resolution. Use repeatable `--pr` numbers **or** `--since` with an ISO date
+or timestamp including a timezone. `--since` selects merge times inclusively,
+drains the closed-PR listing, and verifies each selected PR individually.
+
+```sh
+# Agent: inspect the plan first. No tracker writes happen by default.
+pm github closeout --repo owner/repo --pr 42 --pr 43 --skip pm-deferred --json
+# Apply the reviewed selection; repeatable --skip always excludes those ids.
+pm github closeout --repo owner/repo --pr 42 --pr 43 --skip pm-deferred --apply
+# Incremental sweep, including merges exactly at the cutoff.
+PM_GITHUB_REPO=owner/repo pm github closeout --since 2026-10-01T00:00:00Z --json
+```
+
+Only `https://github.com/owner/repo/blob/main/.agents/pm/<folder>/<id>.toon`
+links in PR bodies are recognized. Percent-encoded names and nested SDK tracker
+folders are supported; malformed encodings and traversal segments are ignored. Repository comparisons ignore case. Links to
+other repositories, unknown ids, closed/canceled items and `--skip` ids produce
+explicit skip rows. Bare ids and `pm:` trailers are not supported. If several
+selected PRs reference one item, the lowest PR number supplies its evidence and
+later references are skipped.
+
+**A mention is not delivery.** PR bodies routinely link follow-ups, epics and
+related work for context, so a link alone never closes an item. An item is
+closed only when:
+
+- it is `in_progress` (claimed work), **or** its link is preceded on the same
+  line by a GitHub-style closing keyword: `Closes`, `Fixes`, `Resolves` or
+  `Delivers` (and their tense forms), for example `- Closes [pm-x](…/pm-x.toon)`;
+- it is not an `Epic`; epics close when their children are done;
+- it has no non-terminal child items.
+
+Each refused item gets a skip row naming the rule, so the plan shows why
+deferred follow-ups stay open. `--skip` still excludes any id unconditionally. Items are read through a certified complete SDK
+corpus, including terminal items.
+
+A PR must be merged and have complete merge facts. Required head checks from
+classic branch protection and active branch rulesets must conclude **success**;
+missing, pending, neutral, skipped, failed or app-mismatched required checks
+prevent closure. Required legacy commit-status contexts must succeed too, using their
+latest status. Check-run, status and ruleset pages are fully read. Rulesets are
+read through GitHub's [effective branch rules API](https://docs.github.com/en/rest/repos/rules#get-rules-for-a-branch).
+The check policy reflects the rules readable at invocation time.
+
+When a protection source is unreadable (HTTP 403/404), or no required contexts
+are configured, the report labels the **fallback** rule. Every readable required
+context still must conclude success, including its app binding. The fallback
+additionally requires at least one head check run, every run completed with
+`success`, `neutral` or `skipped`, and successful latest legacy head statuses.
+It never discards a known requirement because another source is unreadable.
+Missing, malformed or incomplete head evidence, malformed metadata and other
+metadata errors fail closed. The plan reports which rule was used.
+
+TOON is the compact default; global `--json` returns the stable shape
+`{command, repo, dry_run, plan, checks, closed, failed}`. Each plan row is exactly
+`{item, pr, action: "close" | "skip", reason}`. `checks` reports each PR's rule,
+verdict, explanation and successful check names. Dry-run rows describe intended
+closes; `closed` counts writes only with `--apply`. `--dry-run` overrides
+`--apply`. All API planning finishes before the first SDK close. Individual SDK
+refusals become skip rows containing a diagnostic code (or a generic failure
+class), without raw error prose, paths or lock-owner identities. Remaining
+closes continue; `failed` counts refused writes and `closed` counts successful
+writes. After processing everything, any failed close produces a `CommandError`
+with exit code 1 and the complete JSON report in its message. Eligibility skips
+alone do not fail the command. Inspect the report before retrying.
+
+The SDK close reason is a JSON string containing **only** verified facts:
+`{pr, url, merge_commit_sha, head_sha, merged_at, checks}`. `checks` contains the
+sorted unique names that actually succeeded at that head; neutral/skipped runs
+are not described as passed. PR body, title and comments are never persisted.
+For both default and strict close validation, the SDK always receives the three
+structured close fields it supports, without overriding tracker policy:
+
+- `resolution`: `Delivered by <PR URL> (merge <sha12>, head <sha12>)`.
+- `expected_result`: the item's own acceptance criteria verbatim when present;
+  otherwise `Delivered by the linked pull request, merged after its head check gate passed.`
+- `actual_result`: `Merged at <time>; required checks satisfied; successful head checks:
+  <names>` when branch protection or rulesets name required checks (the list holds every
+  successful head check, optional ones included). Under the fallback rule (no readable
+  required contexts) it reads `Merged at <time>; no readable required checks, so every
+  completed head check run had to succeed, be neutral or be skipped; successful checks:
+  <names>`, or `…; no check reported success` when only neutral or skipped runs exist.
+  Only the verified merge time, the applied check policy and sorted successful check
+  names are used; no platform, coverage or test-execution claims are made.
+
+Item titles never supply any of these fields. Existing tracker acceptance
+criteria remain the only prose source; PR body and comments supply no field text.
+Completion time is the GitHub merge time. Repeating a completed selection skips
+terminal items and performs zero additional tracker writes. The command edits
+only the tracker; commit it with its history and regenerate the caller's
+changelog in a closeout PR. Reusable bot-branch automation is tracked separately
+in [pm-github-0x3y](https://github.com/unbraind/pm-github/blob/main/.agents/pm/tasks/pm-github-0x3y.toon).
+
+## Revalidate GitHub blockers
+
+**Compatibility:** pm-github now requires PM CLI 2026.10.5 or newer for complete
+SDK reads and structured command exit statuses. Older hosts refuse installation
+or activation through the matching peer dependency and manifest floor.
+
+`pm github blockers` reads a certified complete tracker and checks every blocked
+item, plus non-terminal items with an external GitHub `blocked_by` dependency.
+It scans dependency targets, `blocked_reason`, description, and stored comments
+(including the latest) for `owner/repo#N`, issue/PR URLs, `#N`, and `GH-N`.
+Bare references use the item's `gh:owner/repo#N` provenance repo, then `--repo`.
+The extra short form `repo#N` resolves only against a matching repo hint.
+References are deduplicated across items and queried in GraphQL batches of 25,
+using the existing token resolution and rate-limit handling.
+
+```sh
+pm github blockers --repo unbraind/pm-cli
+pm github blockers --repo unbraind/pm-cli --json
+pm --pm-path fleet/pm-rl/.agents/pm github blockers --repo unbraind/pm-cli --json
+pm github blockers --ids pm-123,pm-456 --repo unbraind/pm-cli
+# Preview/write annotations only on a scratch tracker:
+pm --pm-path scratch/.agents/pm github blockers --repo unbraind/pm-cli --comment --dry-run
+pm --pm-path scratch/.agents/pm github blockers --repo unbraind/pm-cli --comment
+```
+
+Reports use the host renderer (TOON by default; global `--json`) and include item
+id/status, each reference's state, close reason and closed/merged timestamp.
+Verdicts are `cleared` (all references closed or merged), `partially_cleared`
+(some cleared), `still_blocked` (open blockers, none cleared), and `unresolvable`
+(no references or only unknown states). GitHub hides nonexistent and inaccessible
+private references alike: both can appear as `not_found`. Explicit permission
+errors remain `error` and cannot clear a blocker.
+
+Exit **0** means nothing cleared, **4** means at least one item has a cleared or
+partially cleared blocker, **1** means a query/comment failure (takes precedence
+over 4), **2** means invalid options or missing authentication, and **3** means
+an unknown `--ids` item. Structured reports remain available for query failures.
+No run auto-unblocks. `--comment` adds one comment per fully cleared item,
+listing newly cleared references as “Blocker X closed on D; revalidate.” Each
+reference/state/timestamp carries an idempotency marker; repeats add nothing,
+and a subsequent close with a different timestamp gets a fresh annotation.
+`--dry-run` previews the annotation counts without appending comments.
+The reusable scheduled sync runs this command report-only and emits an Actions
+warning for code 4; it stops on other non-zero codes. Callers must pin a release
+containing this command before adopting the updated workflow.
+
 ## Capabilities
 
 | SDK capability | What it provides |
 |---|---|
 | `importers` | `pm github import <owner/repo>` — idempotent native import pipeline |
 | `importers` (exporter) | `pm github export` — pm items → GitHub issues (dry-run by default; upsert) |
-| `commands` | `pm gh-issues import` (legacy import alias), `pm github sync` (push status), `pm github gate` (fail-closed pre-push privacy gate), `pm github validate` (diagnostics), `pm github project list\|fields\|import\|sync` (Projects v2) |
+| `commands` | `pm gh-issues import` (legacy import alias), `pm github sync` (push status), `pm github gate` (fail-closed pre-push privacy gate), `pm github validate` (diagnostics), `pm github closeout` (verified merged-PR delivery), `pm github project list\|fields\|import\|sync` (Projects v2) |
 | `schema` | declares `github_url`, `github_number`, `github_state`, `github_author`, `github_created_at`, `github_updated_at` item fields |
 | `hooks` | `afterCommand` — opt-in sync reminder (`PM_GITHUB_SYNC`) for linked items |
 | `preflight` | early warning when a mutating github command lacks a token |
@@ -64,6 +207,9 @@ checks.
 
 ```bash
 pm github import unbraind/pm-cli
+pm github import owner/repo --issue 189
+pm github import owner/repo --issue '189,#190,owner/repo#191'
+pm github import owner/repo --limit 10
 pm github import owner/repo --state all
 pm github import owner/repo --labels bug,enhancement
 pm github import owner/repo --since 2026-01-01T00:00:00Z   # incremental sync
@@ -79,6 +225,8 @@ pm github import owner/repo --dry-run
 
 | Flag | Type | Description |
 |---|---|---|
+| `--issue <N[,N...]>` | string | Fetch only selected issue endpoints; accepts numbers, `#N`, and same-repo `owner/repo#N` references. Conflicts with `--state`, `--all`, `--labels`, `--since`, `--assignee`, `--milestone`, and `--limit`. |
+| `--limit <n>` | positive integer | Cap list-mode imports, newest-updated first. Returns `limit` and `truncated` (true when more matching issues exist). Invalid with `--issue`. |
 | `--all` | boolean | Include closed issues (shorthand for `--state all`) |
 | `--state <state>` | string | `open` \| `closed` \| `all` (default: open) |
 | `--labels <labels>` | string | Comma-separated label filter |
@@ -97,6 +245,10 @@ pm github import owner/repo --dry-run
 
 Each imported item records GitHub provenance: the `gh:owner/repo#N` idempotency tag, a `github_author:<login>` tag, and an enriched description (`author @<login> · state reason <reason> · created <iso> · updated <iso>`). GitHub issues closed as `not_planned` import as pm `canceled` instead of `closed`, preserving the difference between completed work and deliberately dropped work. The integration declares the `github_url`, `github_number`, `github_state`, `github_author`, `github_created_at`, and `github_updated_at` schema fields.
 
+`--issue` deduplicates references and fetches each selected issue directly, including closed issues, without listing the repository. Every selected number is fetched and checked before any tracker write. A missing number fails the whole import; `--dry-run` instead reports `missingIssues` and previews the available selection. Pull request numbers require `--include-prs`. Selection combines with comment modes, dependency linking, atomic imports, gates, dry runs, and custom item types, preserving provenance-based re-import idempotency.
+
+`--limit` bounds the matching list after PR, draft, and milestone filters. Pagination stops once one extra matching issue establishes truncation, so at most `n + 1` eligible issues are retained; GitHub pages may also contain excluded entries. Without a limit, existing list ordering is unchanged.
+
 `--atomic` derives its durable transaction identity from the repository, complete rendered issue state, and exact ordered mutation plan (including target item ids), and derives each create id from the stable `owner/repo#number` external key rather than fetch position. Retrying the same response in a different order therefore resumes without duplicates; changed content, workspace prefixes, or resolved targets create a fresh compatible transaction. Native comment annotations run only after the item transaction commits and retain their cross-process deduplication lock.
 
 ### Native comment sync (`--comments-mode`)
@@ -294,7 +446,23 @@ The `gate` receipt reports the verdict, scanned file count, findings, and allowl
 
 ## Automated sync workflow
 
-Fleet repos sync their issues into pm through ONE audited implementation: the reusable `workflow_call` workflow at [`.github/workflows/pm-github-sync.yml`](.github/workflows/pm-github-sync.yml) in this repository. It runs the gated pipeline in fail-closed order — checkout → install the **pinned** extension → `pm github validate` → dry-run plan → **gated import** → verify the repeat import is a no-op → `pm health --strict-exit` → and only then commit, push the sync branch, and open/update a review PR whose body links every changed item as `https://github.com/<repo>/blob/main/.agents/pm/<folder>/<id>.toon`. Because `--gate` exits non-zero on any finding, the job can never reach the push step with a leak in the change. Actions are pinned by commit SHA; permissions are least-privilege (`contents: write`, `pull-requests: write`, `issues: read`).
+Fleet repos sync their issues into pm through ONE audited implementation: the reusable `workflow_call` workflow at [`.github/workflows/pm-github-sync.yml`](.github/workflows/pm-github-sync.yml). Its safety order is validate → dry-run plan → **gated import** → verify the repeat import is a no-op → caller post-import script → **full changed-path scope check and privacy gate** → strict health → repeat scope check and scan immediately before commit/push/review PR → caller CI dispatch. The default `post-import-script` is `changelog:full`, invoked with `npm run --if-present`: it runs the caller's own generator when present, so imported closed issues and their changelog entries land in the same commit. Actions are pinned by commit SHA. The job requests `contents: write`, `pull-requests: write`, `issues: read`, and `actions: write` for dispatch.
+
+When the tracker has no changes, regenerated `CHANGELOG.md` drift is discarded and the run emits a notice that the caller's own `changelog:check` owns that drift. The sync closes any owned open review PR and exits successfully without pushing or dispatching CI. Changelog changes are published only together with tracker changes.
+
+The explicit allowed scope for changed paths is:
+
+- Files beneath the SDK-resolved repository-local pm tracker, excluding its `extensions/`, `locks/`, and `checkpoints/` runtime directories. The extension setup files `settings.json` and `history/_workspace.jsonl` are permitted during setup, then restored before publication and excluded from both the scan and commit.
+- The repository-root `CHANGELOG.md`.
+
+After the caller script and again immediately before committing, `git status --porcelain=v1 -z --untracked-files=all` enumerates staged, unstaged, and untracked changes, including both sides of renames. Every path outside this list produces an error and prevents publication. Allowed changes are staged and the privacy gate scans the exact NUL-delimited path list passed to `git commit --only --pathspec-from-file` with literal pathspecs. The final scan is regenerated from current content; any finding, unreadable input, or script failure prevents publication. The restricted commit also excludes unrelated staged content if a scope check is bypassed.
+
+Optional inputs:
+
+| Input | Default | Behavior |
+| --- | --- | --- |
+| `post-import-script` | `changelog:full` | Caller npm script name invoked with `npm run --if-present` after import and before the final scan. Override for a different package script, or set `""` to disable. Missing scripts are skipped. Raw shell commands are not accepted. Generated `CHANGELOG.md` is staged with the tracker. Changing any file outside the documented scope fails the run, whether staged, unstaged, or untracked. |
+| `ci-workflows` | `ci.yml` | Whitespace-separated filenames in the caller's `.github/workflows`, for example `ci.yml codeql.yml`. Missing files emit a notice and are skipped; set `""` to disable dispatch. Existing workflows must enable `workflow_dispatch`; dispatch errors fail the sync job. |
 
 A fleet repo owns the schedule and calls it with the pinned versions (see [`docs/sync-workflow-caller.yml`](docs/sync-workflow-caller.yml)):
 
@@ -309,6 +477,7 @@ permissions:
   contents: write
   pull-requests: write
   issues: read
+  actions: write
 
 jobs:
   gated-sync:
@@ -317,7 +486,9 @@ jobs:
       pm-github-version: "RELEASE_VERSION"     # required: exact published version
 ```
 
-Replace the two release placeholders after the gated extension is published; the current published version does not contain this feature. The calling repo needs `@unbrained/pm-cli` as a devDependency (the workflow's `npm ci` provides the CLI) and its pm tracker at `.agents/pm` committed on `main`. Under **Settings → Actions → General → Workflow permissions** it must also allow read and write token permissions and enable **Allow GitHub Actions to create and approve pull requests** (an organization can disable this), or the run pushes the sync branch and then fails to open the review PR. A PR that `GITHUB_TOKEN` opens or edits does not trigger `pull_request` workflows, so the sync PR gets no CI checks until a maintainer re-runs them (for example by closing and reopening the PR); the reusable workflow always uses the job's `GITHUB_TOKEN`.
+Replace the two release placeholders with the release commit and package version containing this change; existing callers must repin both. The calling repo needs `@unbrained/pm-cli` as a devDependency (the workflow's `npm ci` provides the CLI) and its pm tracker at `.agents/pm` committed on `main`. Under **Settings → Actions → General → Workflow permissions** it must allow read and write token permissions and enable **Allow GitHub Actions to create and approve pull requests** (an organization can disable this), or the run pushes the sync branch and then fails to open the review PR. The caller must grant `actions: write`; a reusable workflow cannot elevate its caller's permissions.
+
+Bot-created review PRs may have missing required checks or `pull_request` runs parked in `action_required`. After a successful push and PR creation/update, the reusable workflow uses the job's `GITHUB_TOKEN` to run `gh workflow run <file> --ref "$SYNC_BRANCH"` for each configured caller CI workflow. Explicit `workflow_dispatch` creates runs on the sync head, so callers must enable that trigger and ensure those runs produce their required check names (and do not restrict the required jobs to the `pull_request` event). It also lists `action_required` runs for the exact pushed SHA and prints their URLs as notices without failing because approval is needed. Missing workflows, disabled dispatch, or approval notices do not establish that required CI passed; inspect the dispatched checks. A no-change sync closes its stale own review PR and dispatches nothing. See GitHub's [GITHUB_TOKEN event rules](https://docs.github.com/en/actions/concepts/security/github_token) and [dispatch trigger and permission requirements](https://docs.github.com/en/rest/actions/workflows#create-a-workflow-dispatch-event).
 
 ### Installed CLI timeout acceptance
 

package/dist/closeout.d.ts

@@ -0,0 +1,83 @@
+/** Existing GitHub REST transport, supplied by the extension entry point. */
+export interface CloseoutApi {
+    base: string;
+    get(url: string): Promise<{
+        body: string;
+        linkHeader?: string;
+    }>;
+    next(link?: string): string | undefined;
+}
+/** Stable machine-readable decision; reasons never quote pull-request prose. */
+export interface CloseoutRow {
+    item: string;
+    pr: number;
+    action: "close" | "skip";
+    reason: string;
+}
+/** Which head-check policy was evaluated for one selected pull request. */
+interface CheckGate {
+    pr: number;
+    rule: "required" | "fallback" | "unavailable";
+    reason: string;
+    passed: string[];
+    ok: boolean;
+}
+/** Fields retained from a pull request; its body is used only for extraction. */
+interface PullRequest {
+    number: number;
+    body: string | null;
+    merged: boolean;
+    merged_at: string | null;
+    merge_commit_sha: string | null;
+    html_url: string;
+    head: {
+        sha: string;
+    };
+    base: {
+        ref: string;
+        repo: {
+            full_name: string;
+        };
+    };
+}
+/** Verify required checks or the explicitly reported conservative fallback at the PR head. */
+export declare function checkCloseoutHead(api: CloseoutApi, repo: string, pr: PullRequest): Promise<CheckGate>;
+/**
+ * Whether a closing keyword directly precedes a link, given the line text before the link.
+ *
+ * Only earlier links (markdown or bare), commas and "and" may sit between the keyword and the link, so
+ * `Delivers [a](…) and [b](…)` declares both while `Not fixed here; see <link>` declares nothing.
+ * Scans backwards with plain string operations; no backtracking pattern touches PR text.
+ */
+export declare function declaresDelivery(prefix: string): boolean;
+/** Extract only canonical tracker links, retaining foreign references solely for skip rows. */
+export declare function extractCloseoutItems(body: string): {
+    item: string;
+    repo: string;
+    declared: boolean;
+}[];
+/** Report SDK refusal codes without exposing paths, identities or arbitrary error prose. */
+export declare function closeoutFailureReason(error: unknown): string;
+/** Invalid selectors or repository input: the caller must change the command, so the host maps it to a usage exit. */
+export declare class CloseoutUsageError extends Error {
+}
+/**
+ * Describe the verified check evidence for a passed gate without overstating it.
+ *
+ * The required rule states that the required checks were satisfied and lists every successful head check (optional
+ * ones included). The fallback rule (no readable required contexts)
+ * may pass on neutral or skipped runs alone, so it states that policy and lists successful checks only when any exist.
+ */
+export declare function checkEvidence(gate: CheckGate): string;
+/** Plan all selected PRs before closing eligible items through the real SDK. */
+export declare function runCloseout(pmRoot: string, repo: string | undefined, options: Record<string, unknown>, api: CloseoutApi): Promise<{
+    command: string;
+    repo: string;
+    dry_run: boolean;
+    plan: CloseoutRow[];
+    checks: CheckGate[];
+    closed: number;
+    failed: number;
+}>;
+export {};
+//# sourceMappingURL=closeout.d.ts.map

package/dist/closeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"closeout.d.ts","sourceRoot":"","sources":["../closeout.ts"],"names":[],"mappings":"AAGA,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACzC;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,2EAA2E;AAC3E,UAAU,SAAS;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,EAAE,EAAE,OAAO,CAAC;CACb;AAED,iFAAiF;AACjF,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CACpD;AA8ID,8FAA8F;AAC9F,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CA6C3G;AAQD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAuBxD;AAED,+FAA+F;AAC/F,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,EAAE,CAuBtG;AAQD,4FAA4F;AAC5F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAO5D;AAED,sHAAsH;AACtH,qBAAa,kBAAmB,SAAQ,KAAK;CAAG;AAOhD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAKrD;AAED,gFAAgF;AAChF,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,WAAW;;;;;;;;GAuF7H"}