pm-github 2026.10.4 → 2026.10.8

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 2026.10.8 - 2026-10-08
+
+### Added
+
+- Fail-closed privacy gate for automated GitHub issue imports and one reusable sync workflow ([pm-github-f1at](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-f1at.toon))
+
+### Fixed
+
+- Bound native Bun CLI repeats of a completed public atomic import ([pm-github-hptv](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-hptv.toon))
+- Root CI runs skip the read-only-directory comment-sync fixtures visibly instead of failing them ([pm-github-rap0](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-rap0.toon))
+
+### Other
+
+- Reach exact all-source coverage and include every operational script ([pm-github-9cjx](https://github.com/unbraind/pm-github/blob/main/.agents/pm/tasks/pm-github-9cjx.toon))
+- Auto-merge green Dependabot updates and group the pm toolchain into one daily PR ([pm-github-u9df](https://github.com/unbraind/pm-github/blob/main/.agents/pm/tasks/pm-github-u9df.toon))
+
 ## 2026.9.26 - 2026-09-26
 
 ### Other

package/README.md

@@ -23,7 +23,7 @@ pm install npm:pm-github --global
 |---|---|
 | `importers` | `pm github import <owner/repo>` — idempotent native import pipeline |
 | `importers` (exporter) | `pm github export` — pm items → GitHub issues (dry-run by default; upsert) |
-| `commands` | `pm gh-issues import` (legacy import alias), `pm github sync` (push status), `pm github validate` (diagnostics), `pm github project list\|fields\|import\|sync` (Projects v2) |
+| `commands` | `pm gh-issues import` (legacy import alias), `pm github sync` (push status), `pm github gate` (fail-closed pre-push privacy gate), `pm github validate` (diagnostics), `pm github project list\|fields\|import\|sync` (Projects v2) |
 | `schema` | declares `github_url`, `github_number`, `github_state`, `github_author`, `github_created_at`, `github_updated_at` item fields |
 | `hooks` | `afterCommand` — opt-in sync reminder (`PM_GITHUB_SYNC`) for linked items |
 | `preflight` | early warning when a mutating github command lacks a token |
@@ -91,6 +91,7 @@ pm github import owner/repo --dry-run
 | `--comments-mode <mode>` | `body`\|`annotations`\|`both` | How fetched GitHub comments are persisted (default `body`). `annotations` syncs comments into the pm item's native comments collection via the SDK; `both` writes the body section AND native comments. `annotations`/`both` are idempotent on re-import (dedupe by GitHub comment id) |
 | `--atomic` | boolean | Commit every create, update, close, and reopen in one workspace-writer-locked, crash-resumable transaction (requires pm CLI/SDK >=2026.7.20). Normal failure compensation restores updated/closed items and deletes newly created items; an incomplete compensation is reported explicitly for retry or repair. |
 | `--link-deps` | boolean | After import, map dependency references in issue **bodies** (`Blocked by #N`, `Depends on owner/repo#N`, `Blocks #N`) to pm dependency edges between the linked items. Idempotent, best-effort, and re-runnable; see [Dependency linking](#dependency-linking---link-deps) below. |
+| `--gate` | boolean | Fail-closed privacy gate: verify plan completeness (every fetched issue accounted for exactly once) and provenance idempotency (every re-import lands on exactly one `gh:owner/repo#N`-tagged item) BEFORE the write, then scan the proposed tracker change with [`pm github gate`](#pm-github-gate) AFTER it. Any finding — or any unreadable scan input — exits non-zero so an automated pipeline can never commit or push the change. Embeds `gate` receipts in the result. |
 | `--dry-run` | boolean | Preview without writing |
 | `--type <type>` | string | Override pm item type (default: Issue) |
 
@@ -248,6 +249,95 @@ pm search "uppercase dashes" --semantic        # hits = imported items whose ups
 
 Enable it by setting `search.provider` to `"github"` in `.agents/pm/settings.json` and pointing it at a repo via the `PM_GITHUB_REPO` env var.
 
+## Privacy gate
+
+### `pm github gate`
+
+GitHub issue text is untrusted: anyone who can open an issue can put a credential, a personal email, or a host path in it. An automated import writes that text into the pm tracker, and a sync pipeline then pushes the tracker to a public branch — publishing the leak with it. `pm github gate` is the fail-closed step between the write and any push:
+
+```bash
+pm github gate                       # scan the proposed tracker change in the working tree
+pm github gate --json               # machine-readable report (also via the global --json)
+pm github gate --diff sync.patch     # scan an explicit unified diff file instead
+pm github gate --allowlist .pm-github-gate-allowlist.json
+```
+
+It scans **only the proposed change** — the added lines and their filenames in the staged/working/untracked diff under the resolved pm tracker path (never a hardcoded `.agents/pm`; the SDK-resolved path wins), or an explicit `--diff` file — so pre-existing reviewed content is not re-litigated on every run, and removed content (which cannot publish anything new) is never scanned. A finding in a filename uses `field: "file_path"` and redacts a sensitive item id. It fails closed (non-zero, machine-readable report with `item_id` + `field` + `rule` + the sha256 `hash` of the matched content, **never the matched content itself**) on:
+
+- **credentials** — GitHub (`ghp_/gho_/ghu_/ghs_/ghr_` and fine-grained `github_pat_`), npm, AWS access key ids, Slack (including app and cookie credentials), OpenAI, Anthropic tokens, generic `Authorization: Bearer` values, `-----BEGIN … PRIVATE KEY-----` blocks, and high-entropy assignments to secret-named identifiers (`token = "…"`, `api_key: …`, `accessToken: …`) whose value has high measured entropy. UUID-shaped credential values and values containing dates receive the same checks;
+- **personal data** — email addresses other than no-reply identities (`@users.noreply.github.com`, `noreply@…`, `@noreply.…`), phone numbers in international (`+…`) or North-American (`(555) 123-4567`, `555-123-4567`) notation, and unformatted numbers under phone/tel/mobile contact labels;
+- **host paths** — absolute local filesystem paths (POSIX home/system directories and Windows drive paths with either separator), and named home-directory references.
+
+Unreadable input, malformed or truncated diffs, binary input, invalid UTF-8, Git failures, malformed allowlists, and scanner errors fail the gate. Untracked operational state in the tracker root (`locks/`, `extensions/`, `checkpoints/`) is excluded. Explicitly staged operational files remain in scope. Staged and unstaged changes are scanned separately, including staged content that the working copy subsequently removed.
+
+**False positives** are allowlisted by *content hash*, not by pattern: put the sha256 from the finding into `.pm-github-gate-allowlist.json` at the repository root (or pass `--allowlist <file>`) with a written justification. An entry suppresses exactly the reviewed content, can never widen to a pattern, and a missing justification fails the gate:
+
+```json
+{
+  "<sha256 of the reviewed finding content>": { "reason": "Reviewed: public support address in the import docs item." }
+}
+```
+
+### `pm github import --gate`
+
+`--gate` composes the gate into the import pipeline, in the order a sync workflow needs:
+
+1. **dry-run plan** — every fetched issue is prepared up front;
+2. **completeness check** — every fetched issue is accounted for exactly once (planned or explicitly skipped), nothing outside the fetch appears, counts reconcile — all before any mutation;
+3. **idempotency check** — no duplicate `gh:owner/repo#N` provenance tags in the existing corpus, every new entry born with its tag, no two plan entries resolving to the same item — so a second run reuses the existing item;
+4. **write** — the ordinary (atomic or per-item) import;
+5. **gate** — the proposed tracker change is scanned; a finding exits non-zero, so the caller never commits or pushes.
+
+Rendered values are also scanned in memory before mutation, so a known finding cannot be written to disk. After mutation, the importer verifies that every planned provenance tag exists exactly once, then scans the tracker diff. A completed SDK journal cannot substitute for missing item files.
+
+The `gate` receipt reports the verdict, scanned file count, findings, and allowlisted count. With `--json`, successful reports go to stdout; failures use the host CLI's JSON error envelope on stderr, with the redacted gate report serialized in `detail` (`jq ' .detail | fromjson ' gate-error.json`). Unreadable inputs produce a nonzero JSON refusal.
+
+## Automated sync workflow
+
+Fleet repos sync their issues into pm through ONE audited implementation: the reusable `workflow_call` workflow at [`.github/workflows/pm-github-sync.yml`](.github/workflows/pm-github-sync.yml) in this repository. It runs the gated pipeline in fail-closed order — checkout → install the **pinned** extension → `pm github validate` → dry-run plan → **gated import** → verify the repeat import is a no-op → `pm health --strict-exit` → and only then commit, push the sync branch, and open/update a review PR whose body links every changed item as `https://github.com/<repo>/blob/main/.agents/pm/<folder>/<id>.toon`. Because `--gate` exits non-zero on any finding, the job can never reach the push step with a leak in the change. Actions are pinned by commit SHA; permissions are least-privilege (`contents: write`, `pull-requests: write`, `issues: read`).
+
+A fleet repo owns the schedule and calls it with the pinned versions (see [`docs/sync-workflow-caller.yml`](docs/sync-workflow-caller.yml)):
+
+```yaml
+name: Sync GitHub issues into pm
+on:
+  schedule:
+    - cron: "17 2 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: read
+
+jobs:
+  gated-sync:
+    uses: unbraind/pm-github/.github/workflows/pm-github-sync.yml@RELEASE_COMMIT_SHA
+    with:
+      pm-github-version: "RELEASE_VERSION"     # required: exact published version
+```
+
+Replace the two release placeholders after the gated extension is published; the current published version does not contain this feature. The calling repo needs `@unbrained/pm-cli` as a devDependency (the workflow's `npm ci` provides the CLI) and its pm tracker at `.agents/pm` committed on `main`. Under **Settings → Actions → General → Workflow permissions** it must also allow read and write token permissions and enable **Allow GitHub Actions to create and approve pull requests** (an organization can disable this), or the run pushes the sync branch and then fails to open the review PR. A PR that `GITHUB_TOKEN` opens or edits does not trigger `pull_request` workflows, so the sync PR gets no CI checks until a maintainer re-runs them (for example by closing and reopening the PR); the reusable workflow always uses the job's `GITHUB_TOKEN`.
+
+### Installed CLI timeout acceptance
+
+`node test/helpers/public-acceptance.ts` packs the candidate, installs it beside
+its pinned host CLI in a disposable Git project, retrieves a paginated public
+issue/comment snapshot, and replays the unchanged responses through the installed
+HTTP client. It verifies a nonempty gated Node import, byte-identical Node and
+three native Bun repeats, and strict health. No remote is configured.
+
+Each import retains the original 45-second execution deadline. The acceptance
+watchdog sends SIGTERM to the process group, then SIGKILL after a five-second
+cleanup window; any timeout fails acceptance even if the child later exits zero.
+A real spinning-child negative control verifies forced cleanup and unchanged
+fixture bytes. The HTTP client also enforces a 30-second wall-clock deadline through redirect
+and response-body completion, even when native socket timeouts do not fire.
+The comment-lock retry honors its existing wait budget when
+an exclusive-create collision cannot be statted, including a dangling symlink.
+This reproduced lock defect is separate from the intermittent historical Bun
+repeat: recent packed repeats pass, but its original cause is not established.
+
 ## Validate / diagnostics
 
 ### `pm github validate`
@@ -266,7 +356,9 @@ MIT
 
 ## Release Automation
 
-This package is release-ready for GitHub, npm, and Bun-compatible installs. CI runs type checking, build, production dependency audit, package packing, Bun install verification, and pm-changelog validation. The daily release workflow publishes only when commits exist after the latest release tag and uses pm-changelog to generate CHANGELOG.md and GitHub release notes.
+Release checks require type checking, docstrings, ESLint, zero source duplication, exact 100/100/100/100 coverage across authored TypeScript and JavaScript modules including operational scripts, production dependency audit, package packing, Bun behavior, strict PM health, and pm-changelog validation. Unloaded modules count at zero; no source ignores or lowered thresholds are accepted. Coverage shortfalls block release. The shell changelog-date verifier is exercised separately and is outside the V8 percentage denominator. The daily release workflow publishes only when commits exist after the latest release tag and uses pm-changelog to generate CHANGELOG.md and GitHub release notes.
+
+`npm run changelog:full` reads the complete tracker through the SDK and feeds pm-changelog. Closed work supplies release history; the explicit `changelog-unreleased` tag includes a pending candidate without closing its PM item. Other open work stays excluded.
 
 ## Multi-agent merge safety
 

package/dist/gate.d.ts

@@ -0,0 +1,269 @@
+/**
+ * One fail-closed finding produced by the gate.
+ *
+ * Deliberately carries no matched text: the report is machine-readable and may
+ * be echoed into CI logs, so it identifies WHAT fired (rule), WHERE (item id and
+ * the item field that would publish it), and the content-addressed allowlist
+ * key (hash) — nothing more.
+ */
+export interface GateFinding {
+    /** Stable rule identifier, safe to print (never contains matched content). */
+    readonly rule: string;
+    /** The pm item whose change carries the finding, or `""` when unattributable. */
+    readonly item_id: string;
+    /** The item field the offending added line belongs to, or `""` when unknown. */
+    readonly field: string;
+    /** sha256 hex digest of the matched content — the allowlist key. */
+    readonly hash: string;
+}
+/** Verdict of one gate run: `fail` whenever any non-allowlisted finding exists. */
+export type GateVerdict = "pass" | "fail";
+/** Machine-readable result of one gate run over a proposed tracker change. */
+export interface GateReport {
+    /** `fail` when any finding survived the allowlist; `pass` otherwise. */
+    readonly verdict: GateVerdict;
+    /** Where the scanned change came from: `git` (working tree) or `diff` (explicit file). */
+    readonly source: "git" | "diff";
+    /** Number of changed tracker files whose added lines were scanned. */
+    readonly scanned_files: number;
+    /** Number of added lines scanned. */
+    readonly added_lines: number;
+    /** Findings that survived the allowlist, ordered file/line/ruleset. */
+    readonly findings: readonly GateFinding[];
+    /** Findings suppressed because their content hash was allowlisted. */
+    readonly allowlisted: number;
+    /** Path of the allowlist consulted (or `""` when none was resolved). */
+    readonly allowlist_path: string;
+}
+/**
+ * Input failure the gate treats as fail-closed: unreadable diff file, not a Git
+ * work tree, a Git command that failed, a malformed allowlist, or a scanner
+ * error. Callers translate this into a non-zero exit; it must never surface as a
+ * clean pass.
+ */
+export declare class GateInputError extends Error {
+    constructor(message: string);
+}
+/** One added line of a proposed tracker change, with its attributed item field. */
+interface AddedLine {
+    /** The added text with the leading diff `+` already stripped. */
+    readonly text: string;
+    /** Best-effort item field the line belongs to (top-level toon key, or `""`). */
+    readonly field: string;
+}
+/** The proposed change to one tracker file: its repo-relative path plus added lines. */
+interface ChangeFile {
+    /** Repo-relative or diff-relative path of the changed file. */
+    readonly filePath: string;
+    /** Best-effort pm item id for the file (`.toon` basename, embedded jsonl id, …). */
+    readonly itemId: string;
+    /** The added lines of the proposed change for this file. */
+    readonly addedLines: readonly AddedLine[];
+}
+/** Subprocess contract for running Git, injectable so tests can force failures. */
+export type RunGit = (cwd: string, args: readonly string[]) => {
+    ok: boolean;
+    stdout: string;
+    stderr: string;
+};
+/**
+ * Collaborators a gate run depends on, injectable for tests.
+ *
+ * The production object shells out to Git and reads the filesystem; a test can
+ * substitute either to exercise the fail-closed paths deterministically (a Git
+ * failure, an unreadable file) without depending on machine state.
+ */
+export interface GateRunDependencies {
+    /** Git runner used to resolve the work tree and collect the change. */
+    readonly runGit?: RunGit;
+    /** File reader used for the explicit diff file and untracked tracker files. */
+    readonly readFileSync?: (filePath: string) => string;
+}
+/** Resolved input for one gate run: what to scan and which allowlist to consult. */
+export interface TrackerGateInput {
+    /** pm root as the extension host supplies it (workspace root or data dir). */
+    readonly pmRoot: string;
+    /** Explicit unified diff file to scan instead of the working tree. */
+    readonly diffFile?: string;
+    /** Explicit allowlist file; missing explicit files fail closed. */
+    readonly allowlistFile?: string;
+    /** Injectable collaborators; production defaults shell out to Git and `fs`. */
+    readonly dependencies?: GateRunDependencies;
+    /** Rendered import values scanned in memory before persistence or diagnostics. */
+    readonly plannedItems?: readonly {
+        readonly itemId: string;
+        readonly fields: Readonly<Record<string, unknown>>;
+    }[];
+}
+/**
+ * Resolve the pm data dir from the `pmRoot` a command handler receives.
+ *
+ * The host may hand either the workspace root (the dir containing `.agents/pm`)
+ * or the data dir itself — the pm CLI accepts both for `--path`. This returns
+ * the dir that actually holds `settings.json` and `locks/`, defaulting to
+ * `pmRoot` unchanged when no nested `.agents/pm` exists.
+ *
+ * @param pmRoot - The path supplied by the extension host.
+ * @returns The resolved pm data directory.
+ */
+export declare function resolvePmDataDir(pmRoot: string): string;
+/**
+ * Shannon entropy per character of a value.
+ *
+ * Uniform random base62 has an expected ~5.5 bits/char, random hex ~4.0; natural
+ * language and dates sit far lower (~3–3.4). The assignment rule uses the gap:
+ * a long value over a secret-bearing identifier is only a finding when its
+ * per-character entropy is indistinguishable from random.
+ *
+ * @param value - The string to measure.
+ * @returns Bits per character (0 for the empty string).
+ */
+export declare function shannonEntropyPerChar(value: string): number;
+/**
+ * Whether an `identifier = "value"` assignment looks like a hardcoded secret.
+ *
+ * Fires only when the identifier names a credential (token/secret/password/
+ * credential/api_key/access_key/private_key segment) AND the value is long
+ * (≥20 chars), high-entropy (≥3.9 bits/char — above dates, timestamps, prose),
+ * and the identifier names a credential. Both halves are required: identifier-only would
+ * flag every `token: "the token above"` prose reference, entropy-only would
+ * flag every generated id.
+ *
+ * @param identifier - The assignment target, e.g. `AWS_SECRET_ACCESS_KEY`.
+ * @param value - The assigned value text.
+ * @returns Whether the pair reads as a hardcoded credential.
+ */
+export declare function isHighEntropySecretAssignment(identifier: string, value: string): boolean;
+/** One raw hit of a content rule, before item/field attribution. */
+interface RuleHit {
+    /** Rule identifier that fired. */
+    readonly rule: string;
+    /** The matched text — kept in memory only; never printed or reported. */
+    readonly matched: string;
+    /** Character offset of the match within its line, for jsonl field attribution. */
+    readonly index: number;
+}
+/**
+ * Scan one added line with every content rule.
+ *
+ * Rules are evaluated independently: one line can produce several hits (a
+ * bearer header wrapping a GitHub token reports both shapes), because each is a
+ * distinct reviewed rule. The high-entropy assignment rule is regex-scan +
+ * predicate, so it is driven here rather than in the static table.
+ *
+ * @param line - The added line text (diff `+` already stripped).
+ * @returns Every rule hit on the line, in evaluation order.
+ */
+export declare function scanLineForRuleHits(line: string): RuleHit[];
+/** One source line of a diff walk, marked added or unchanged context. */
+interface WalkLine {
+    /** Line text without the diff marker. */
+    readonly text: string;
+    /** Whether the line is an added (`+`) line rather than context. */
+    readonly added: boolean;
+}
+/**
+ * Attribute a toon field to every line of a change walk.
+ *
+ * Walks the lines in file order maintaining the enclosing top-level field: a
+ * field header (added OR context) updates the tracker, so an added section row
+ * (`"ts",author,"text"`) attributes to its section (`notes`, `files`, …) even
+ * when the section header itself is unchanged context. Added lines that are
+ * their own field header attribute to that field.
+ *
+ * @param lines - Added and context lines in walk order.
+ * @returns A field name per input line (never `undefined`; `"unknown"` when no header was seen yet).
+ */
+export declare function attributeToonFields(lines: readonly WalkLine[]): string[];
+/**
+ * Parse a unified diff into per-file added lines with toon field attribution.
+ *
+ * Accepts `git diff` (with or without `a/` `b/` prefixes) and plain
+ * `diff -u` output. Removed lines are skipped — only the proposed ADDITIONS can
+ * publish new content; deletions cannot leak anything that was not already in
+ * the tracked state.
+ *
+ * @param diffText - The unified diff text.
+ * @returns One entry per changed file with added lines and attribution.
+ */
+export declare function parseUnifiedDiff(diffText: string): ChangeFile[];
+/**
+ * Run Git with the production subprocess runner.
+ *
+ * Trimmed stdout is returned as-is; a non-zero exit yields `ok: false` with the
+ * child's stderr so the fail-closed collector can report a diagnosable error.
+ *
+ * @param cwd - Directory to run in.
+ * @param args - Git argument vector.
+ * @returns The normalized subprocess result.
+ */
+export declare function runGitDefault(cwd: string, args: readonly string[]): {
+    ok: boolean;
+    stdout: string;
+    stderr: string;
+};
+/**
+ * Collect the proposed tracker change from the Git working tree.
+ *
+ * The proposed change is everything a commit would publish: staged plus unstaged
+ * modifications of tracked files under the tracker path (their added diff lines)
+ * and the full content of untracked files under it. Unreachable/deleted paths
+ * contribute nothing; operational subpaths are excluded by
+ * {@link isOperationalTrackerPath}. Any Git or read failure throws
+ * {@link GateInputError} — fail closed, never pass vacuously.
+ *
+ * @param pmDataDir - The resolved pm data directory.
+ * @param dependencies - Injectable Git runner and file reader.
+ * @returns One change entry per scanned file (empty when the tree is clean).
+ */
+export declare function collectTrackerChange(pmDataDir: string, dependencies?: GateRunDependencies): ChangeFile[];
+/** One reviewed allowlist entry for a matched content hash. */
+interface AllowlistEntry {
+    /** Human-readable justification recorded next to the exemption in review. */
+    readonly reason: string;
+}
+/**
+ * Parse a gate allowlist file.
+ *
+ * The file maps the sha256 of REVIEWED matched content to a written
+ * justification. Entries without a non-empty reason are rejected — an unreviewed
+ * exemption is how a gate rots. A missing file fails closed only when it was
+ * passed explicitly; the default location is optional so a clean repo needs no
+ * allowlist file.
+ *
+ * @param allowlistPath - Absolute path of the allowlist JSON.
+ * @param required - Whether an explicit caller named the file (missing → error).
+ * @param readFileSync - File reader (injectable).
+ * @returns Hash → justification entries.
+ */
+export declare function readGateAllowlist(allowlistPath: string, required: boolean, readFileSync?: (filePath: string) => string): Map<string, AllowlistEntry>;
+/** Default allowlist filename, resolved at the repository root when one exists. */
+export declare const GATE_ALLOWLIST_FILENAME = ".pm-github-gate-allowlist.json";
+/**
+ * Run the fail-closed privacy gate over a proposed tracker change.
+ *
+ * Resolves the change (explicit `--diff` file, or the staged/working/untracked
+ * diff under the resolved pm tracker path), scans every added line with the
+ * credential, personal-data, and host-path rules, and applies the reviewed
+ * content-hash allowlist. Any input, Git, allowlist, or scanner failure throws
+ * {@link GateInputError}; a returned report therefore always describes a
+ * completed scan.
+ *
+ * @param input - pm root, optional diff file, optional allowlist file, injectable deps.
+ * @returns The machine-readable gate report.
+ */
+export declare function runTrackerGate(input: TrackerGateInput): GateReport;
+/**
+ * Render a gate report as human-readable lines.
+ *
+ * Every line names only the rule, item, field, and short hash prefix — the
+ * matched content never appears, so gate output is safe to paste anywhere. The
+ * same lines feed the command's stderr and the import failure message, so the
+ * two surfaces cannot drift apart.
+ *
+ * @param report - The gate report to render.
+ * @returns One summary line, then one line per finding.
+ */
+export declare function formatGateReport(report: GateReport): string[];
+export {};
+//# sourceMappingURL=gate.d.ts.map

package/dist/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../gate.ts"],"names":[],"mappings":"AAuCA;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,mFAAmF;AACnF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAChC,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,qCAAqC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,mFAAmF;AACnF,UAAU,SAAS;IACjB,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,wFAAwF;AACxF,UAAU,UAAU;IAClB,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;CAC3C;AAED,mFAAmF;AACnF,MAAM,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/G;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;CACtD;AAED,oFAAoF;AACpF,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,kFAAkF;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,EAAE,CAAC;CACpH;AAOD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAsJD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU3D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CASxF;AAED,oEAAoE;AACpE,UAAU,OAAO;IACf,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAKD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAyC3D;AASD,yEAAyE;AACzE,UAAU,QAAQ;IAChB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,GAAG,MAAM,EAAE,CAOxE;AA2BD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAqG/D;AAoDD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAUnH;AAYD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,GAAE,mBAAwB,GACrC,UAAU,EAAE,CAqEd;AAMD,+DAA+D;AAC/D,UAAU,cAAc;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,OAAO,EACjB,YAAY,GAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAyD,GAC5F,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CA6B7B;AAED,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,mCAAmC,CAAC;AAwFxE;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CAuElE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAY7D"}