pm-github 2026.11.2 → 2026.11.11

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 2026.11.11 - 2026-11-11
+
+### Fixed
+
+- Explain scheduled install mismatches and preserve redacted command failure diagnostics ([pm-github-o9r7](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-o9r7.toon))
+- Packed projection fixture cleanup can mask its own test outcome ([pm-github-mes8](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-mes8.toon))
+
+### Security
+
+- Reusable Dependabot merge workflow with complete commit provenance ([pm-github-dependabot-merge](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-dependabot-merge.toon))
+
+## 2026.11.4 - 2026-11-04
+
+### Fixed
+
+- Make repeated gated imports byte-identical for closed items ([pm-github-repeat-noop](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-repeat-noop.toon))
+- Reusable workflows fail after pm package install when callers pin zero-padded release tags like v2026.11.02 ([pm-github-4gak](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-4gak.toon))
+- Allow public technical forms in the tracker privacy gate ([pm-github-01n8](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-01n8.toon))
+- Resolve an unrelated unreachable commit identity reported by whole-store privacy checks ([pm-github-privacy-store-followup](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-privacy-store-followup.toon))
+
+### Other
+
+- Bound coverage aggregation memory and compare default-heap CI behavior ([pm-github-vhi6](https://github.com/unbraind/pm-github/blob/main/.agents/pm/tasks/pm-github-vhi6.toon))
+- Approve or amend the noreply identity on the normalize-release-tag-version branch commit ([pm-github-8mkc](https://github.com/unbraind/pm-github/blob/main/.agents/pm/tasks/pm-github-8mkc.toon))
+
 ## 2026.11.1 - 2026-11-01
 
 ### Fixed

package/README.md

@@ -359,8 +359,8 @@ See [SDK adoption evidence](docs/sdk-adoption-1025.md).
 decoding first appeared in 2026.10.9, while the transaction `match` guard used
 by identity repair first appeared in 2026.10.17. The declared minimum must
 support both. Older hosts refuse installation or activation through matching
-peer/development minimum ranges and the top-level manifest floor. Development
-keeps an exact, integrity-locked SDK resolution. CI separately installs the exact
+peer dependency minimum and the top-level manifest floor. Development uses
+an independent exact, integrity-locked SDK pin. CI separately installs the exact
 minimum from npm, type-checks all production and operational SDK imports, then
 loads and exercises the packed artifact in a non-git tracker. See the
 [published SDK evidence](docs/sdk-minimum.md).
@@ -792,9 +792,20 @@ pm github gate --allowlist .pm-github-gate-allowlist.json
 It scans **only the proposed change** — the added lines and their filenames in the staged/working/untracked diff under the resolved pm tracker path (never a hardcoded `.agents/pm`; the SDK-resolved path wins), or an explicit `--diff` file — so pre-existing reviewed content is not re-litigated on every run, and removed content (which cannot publish anything new) is never scanned. A finding in a filename uses `field: "file_path"` and redacts a sensitive item id. It fails closed (non-zero, machine-readable report with `item_id` + `field` + `rule` + the sha256 `hash` of the matched content, **never the matched content itself**) on:
 
 - **credentials** — GitHub (`ghp_/gho_/ghu_/ghs_/ghr_` and fine-grained `github_pat_`), npm, AWS access key ids, Slack (including app and cookie credentials), OpenAI, Anthropic tokens, generic `Authorization: Bearer` values, `-----BEGIN … PRIVATE KEY-----` blocks, and high-entropy assignments to secret-named identifiers (`token = "…"`, `api_key: …`, `accessToken: …`) whose value has high measured entropy. UUID-shaped credential values and values containing dates receive the same checks;
-- **personal data** — email addresses other than no-reply identities (`@users.noreply.github.com`, `noreply@…`, `@noreply.…`), phone numbers in international (`+…`) or North-American (`(555) 123-4567`, `555-123-4567`) notation, and unformatted numbers under phone/tel/mobile contact labels;
+- **personal data** — email addresses other than the reserved-domain fixtures described below and no-reply identities (`@users.noreply.github.com`, `noreply@…`, `@noreply.…`), phone numbers in international (`+…`) or North-American (`(555) 123-4567`, `555-123-4567`) notation, and unformatted numbers under phone/tel/mobile contact labels;
 - **host paths** — absolute local filesystem paths (POSIX home/system directories and Windows drive paths with either separator), and named home-directory references.
 
+Public technical forms pass without a hash allowlist:
+
+- procfs interfaces: `/proc`, `/proc/`, `/proc/self/…`, `/proc/<placeholder>/…` (including the bare `root` entry directly after the `self` pid, but no path below it; a concrete numeric pid stays a refusal); sysfs interfaces under `/sys`;
+- hosted runner workspaces: the suffix `runner/work/<seg>/<seg>/…` under either `/home` or `/Users`, Windows `D:/a/<seg>/<seg>/…` with either separator, and `/opt/hostedtoolcache/…` — including the runner's own `tmp` scratch directory inside the workspace;
+- fixture emails on exactly `example.com`, `example.net`, `example.org`, bare `localhost`, or domains ending in `.example`, `.invalid`, `.test` or `.localhost`, compared case-insensitively against the whole domain;
+- SSH transport using only the `git` account: `git@host:owner/repo.git` or `ssh://git@host/owner/repo.git` (including a numeric SSH port);
+- placeholder account segments `example`, `<placeholder>`, `{placeholder}`, `$USER`, `${USER}` or `%USERNAME%` directly after `/home/`, `/Users/` or Windows `C:\Users\` (either separator, also mixed within one path).
+- markup around a path: a closing tag that names one word (`</var>`, `</root>`, `</data>`) is not a path, and a path match ends before it, so `<var>/home/<placeholder>/x</var>` is judged as the path alone. A closing tag that carries a path, such as `</home/alice>`, is still matched.
+
+Concrete home accounts, named tilde home paths (`~name/…`, also straight after any character other than a letter, a number, `.`, `_`, `~`, `-`, `/` or `\`, such as `]`, `)` or `;`; a bare `~name` token without a path is not matched), `/root`, every `/tmp` path and `/var/folders` remain refusals. So do runner paths outside that workspace shape, placeholders below a concrete account, dot-segment traversal, percent/backslash escape variants, embedded identity roots (including `/root`, `/tmp`, `/private`, `/Volumes` and the mount roots continuing into a permitted tail), any path below procfs's own `root` entry, and a second host path hiding behind any punctuation (a bracket, label colon, assignment equals, `[`, `(`, `|`, `@` and the rest) inside a permitted form. Real emails, `git` contact addresses without a transport path, other SSH account names on non-reserved domains, and look-alikes such as `notexample.com` or `example.com.evil.io` remain refused. The table-driven corpus and `node scripts/prove-gate-public-forms.ts` verify these boundaries; [measurement and mutation evidence](https://github.com/unbraind/pm-github/blob/main/docs/gate-public-forms-evidence.md) records the eight-repository read-only scan.
+
 Unreadable input, malformed or truncated diffs, binary input, invalid UTF-8, Git failures, malformed allowlists, and scanner errors fail the gate. Untracked operational state in the tracker root (`locks/`, `extensions/`, `checkpoints/`) is excluded. Explicitly staged operational files remain in scope. Staged and unstaged changes are scanned separately, including staged content that the working copy subsequently removed.
 
 **False positives** are allowlisted by *content hash*, not by pattern: put the sha256 from the finding into `.pm-github-gate-allowlist.json` at the repository root (or pass `--allowlist <file>`) with a written justification. An entry suppresses exactly the reviewed content, can never widen to a pattern, and a missing justification fails the gate:
@@ -821,9 +832,134 @@ The `gate` receipt reports the verdict, scanned file count, findings, and allowl
 
 With `--json`, successful reports go to stdout; failures use the host CLI's JSON error envelope on stderr, with the redacted gate report serialized in `detail` (`jq ' .detail | fromjson ' gate-error.json`). Unreadable inputs produce a nonzero JSON refusal.
 
+## Verified Dependabot auto-merge
+
+Use [the reusable merge workflow](.github/workflows/pm-github-dependabot-merge.yml)
+instead of copying merge logic into each repository. It clears existing
+auto-merge before tooling or metadata, then requests squash auto-merge only for
+`pull_request_target` events whose PR author, event actor and re-run actor are all
+`dependabot[bot]`. It reads **every page** of the PR commits API and requires
+each commit's API-linked author to be Dependabot and its committer to be either
+Dependabot or `web-flow`. Every commit must also have GitHub verification
+`verified: true, reason: valid`; account attribution alone can be forged through
+Git email fields.
+The verified `web-flow` case was checked against real fleet PR data, including
+the Dependabot commit in `pm-context#211`.
+
+The commit list must match the PR's positive commit count, contain unique full
+SHAs, end at its current head and remain stable across fresh API reads. Only
+successful `dependabot/fetch-metadata` classification permits the `pm-toolchain`
+group, extra explicitly allowed groups, or semver minor/patch updates. Major
+updates outside those groups wait for review. The arm request includes
+`--match-head-commit`; another read revokes it if the head changes while arming.
+
+```yaml
+name: dependabot-auto-merge
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, ready_for_review, edited]
+  schedule:
+    - cron: "23 4 * * *"
+  workflow_dispatch:
+permissions: {}
+jobs:
+  verified-auto-merge:
+    if: github.event_name == 'pull_request_target' && github.event.pull_request.user.login == 'dependabot[bot]'
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: unbraind/pm-github/.github/workflows/pm-github-dependabot-merge.yml@RELEASE_COMMIT_SHA # pm-github RELEASE_VERSION
+    with:
+      extra-allowed-groups: "" # Optional exact names, separated by commas or whitespace
+    secrets:
+      merge_token: ${{ secrets.DEPENDABOT_MERGE_TOKEN }}
+  audit-armed-requests:
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: unbraind/pm-github/.github/workflows/pm-github-dependabot-merge.yml@RELEASE_COMMIT_SHA # pm-github RELEASE_VERSION
+    with:
+      audit-only: true
+    secrets:
+      merge_token: ${{ secrets.DEPENDABOT_MERGE_TOKEN }}
+```
+
+Replace `RELEASE_COMMIT_SHA` with the full 40-character SHA of the reviewed
+release **containing this workflow**, and `RELEASE_VERSION` with that release's
+version. This workflow is new; earlier releases do not contain it. Configure
+Dependabot's `github-actions` ecosystem to maintain the SHA and same-line
+`# pm-github <version>` comment. No release is created by this change.
+
+GitHub documents [read-only tokens for Dependabot-triggered pull requests](https://docs.github.com/en/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions).
+Provide `DEPENDABOT_MERGE_TOKEN` as both an Actions secret and a Dependabot
+secret, restricted to the calling repository with Contents and Pull requests
+write permissions. The optional `merge_token` falls back to `github.token`;
+that fallback can arm or revoke only when repository/event policy actually
+grants the necessary writes. Reusable workflows cannot elevate caller
+permissions. Keep auto-merge enabled in repository settings and required checks
+and review rules on the protected base branch.
+
+Foreign commits revoke auto-merge and produce a successful job, a summary and
+`::notice` listing **short SHA and author login only**. Disallowed metadata,
+unsupported arm events (including `pull_request`), API failures and incomplete
+pagination also leave auto-merge unarmed with a clear notice. Every CLI call is
+limited to three attempts of 60 seconds each by default. The TypeScript policy
+adapter reads `DEPENDABOT_GH_TIMEOUT_SECONDS` (integer 1–60, default 60) and also
+accepts a millisecond timeout option. Invalid adapter deadlines fail before
+starting a CLI call. Pre-tooling shell calls retain a fixed 60-second deadline.
+Failed attempts discard partial
+output. A timed-out state read still attempts revocation. An
+inability to revoke is an operational failure that warns the request may remain
+armed, rather than a false successful safety claim.
+No PR files, Git author names/emails, commit messages or raw API errors are
+printed. Actions are SHA-pinned and no PR code is checked out or executed.
+The caller runs on `pull_request_target`, so its YAML and local reusable
+workflow come from the trusted default branch. Remote callers pin the reusable
+workflow to a reviewed release SHA. In both cases the standalone policy is
+fetched from that exact `job.workflow_sha`; no policy override reads a mutable
+branch or PR revision. Before this change reaches the default branch, the new
+trusted caller does not run. Configure an Actions event policy permitting
+`pull_request_target` where required; GitHub's default public-repository policy
+is scheduled for enforcement on December 2, 2026. See
+[GitHub's trusted-trigger guidance](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target).
+
+Migration: replace the **entire** copied `dependabot-auto-merge.yml` with the
+caller above. Retain `synchronize` and the PR-author-only caller guard. Other
+PR automation keeps its own merge requests; a foreign push to a Dependabot PR
+still runs because the PR author remains Dependabot. An actor guard on the
+calling job would skip that foreign push and prevent revocation.
+Keep `auto_merge_enabled` out of the caller's event types: a custom token's arm
+event belongs to its automation account and would immediately revoke its own
+request under the strict Dependabot actor policy.
+Remove any other workflow that arms Dependabot auto-merge, and clear existing
+requests when adopting the caller; installing a workflow does not retroactively
+trigger it for every open PR. This repository uses the supported local path.
+
+Keep the scheduled audit job when adopting the caller. GitHub can suppress
+workflow-generated events or park their `pull_request` runs awaiting approval;
+changing only the PR trigger does not establish an independent revocation path.
+The daily schedule and manual dispatch audit every armed Dependabot PR,
+including every page of its commits, with the same provenance validator used to
+arm. Unsafe or unverifiable snapshots are revoked; valid requests are preserved.
+Fleet callers must not schedule the audit more often than hourly; prefer daily
+plus `workflow_dispatch` to preserve shared runner capacity. Stagger daily run
+times across repositories. Use manual dispatch when an immediate sweep is needed.
+Audits never arm requests or depend on PR actor/metadata. Listing, policy-load
+or revocation failures fail visibly. Scheduled runs can be delayed or disabled
+by GitHub, so this is eventual revocation and requires operational monitoring,
+not an atomic merge guard. See [GitHub's token event rules](https://docs.github.com/en/actions/concepts/security/github_token).
+
+GitHub auto-merge is asynchronous. This workflow verifies the head it arms and
+revokes on subsequent events; it cannot atomically prevent GitHub merging a
+later push before the next workflow runs. A literal guarantee for future
+commits also needs server-enforced branch protection/review requirements that
+remain unsatisfied for unreviewed commits. Do not treat an earlier successful
+policy run as approval of a later head.
+
 ## Self-versioned workflows and Dependabot
 
-Both reusable workflows resolve their own **exact** pm-github release version at
+The sync and closeout reusable workflows resolve their own **exact** pm-github release version at
 runtime and verify the installed package version. GitHub's documented
 [`job.workflow_sha`](https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#job-context)
 is the commit of the workflow that defines the current job, including a reusable
@@ -885,8 +1021,8 @@ The group pattern is the repository name, covering both reusable workflow paths.
 Use exactly `pm-toolchain`: the fleet's existing
 [dependabot-auto-merge.yml](.github/workflows/dependabot-auto-merge.yml) enables
 `gh pr merge --auto --squash` for Dependabot PRs in that group, including calendar
-version major changes. The workflow checks the Dependabot author and repository
-owner, then the metadata group or minor/patch update type. Commit prefix and
+version major changes. The workflow checks the Dependabot author, then the
+metadata group or minor/patch update type. Commit prefix and
 labels do not control merge eligibility; the explicit values above keep PRs
 consistent. Ensure the two labels exist (GitHub ignores unknown custom labels).
 Repository auto-merge must be enabled and required branch-protection checks must
@@ -897,7 +1033,7 @@ for schedules, groups, commit messages and labels.
 
 ## Automated closeout workflow
 
-For scheduled failures, see the [run evidence and refusal guide](docs/scheduled-workflow-refusals.md).
+For scheduled failures, start with the [November 6 watch matrix and caller actions](docs/scheduled-workflow-watch-1106.md). The [historical run evidence and refusal guide](docs/scheduled-workflow-refusals.md) retains earlier incident context.
 Both maintenance workflows select one actionable reason from private command
 receipts and privacy-scan it before emitting an error annotation. Closeout
 accepts GitHub's numeric pagination aliases only after verifying repository
@@ -1185,7 +1321,23 @@ Release attribution uses the actual dates of locally available calendar tags, in
 
 Before creating an item, import checks the complete tracker for its provenance tag, GitHub URLs in provenance or link metadata, and Linear/Jira/ADO links referenced by the GitHub issue body. A unique existing external owner receives the GitHub tag and source metadata; its title, body, provider identity, creation/completion dates and release remain intact. A persisted `github_link_only` marker preserves that ownership on subsequent syncs. Free-text descriptions and bodies do not declare GitHub ownership. Ambiguous matches refuse the import before writes with `--gate` or `--atomic`. A plain multi-issue import may write earlier issues before rejecting a later ambiguous match.
 
-With `--gate` and a nonempty filtered issue list, both preview and apply results include a `plan` with source dates, closure reason, release, target identity, link/create/update action and state-conflict decision. An empty filtered issue list returns without a `plan`, including with `--gate --dry-run`. GitHub wins lifecycle conflicts for GitHub-owned imports. A canceled item that GitHub later reports as completed uses the SDK's explicit repeat-closure transition with the source reason. A linked external owner keeps its local status, and the plan records `preserve-provider-owner`; `github_state` still records the source state. Atomic transaction identity includes the latest external edit or different lifecycle generation in history. Local state edits and repeated state cycles force reconciliation, while staging and compensation keep crash retries on the same journal. Finalization runs before the SDK commits and is compensated with the batch on failure. It is idempotent and runs again after a recovered atomic journal, so an interrupted finalization can be repaired by retrying the same import before the gate permits a push.
+With `--gate` and a nonempty filtered issue list, both preview and apply results include a `plan` with source dates, closure reason, release, target identity, link/create/update action and state-conflict decision. An empty filtered issue list returns without a `plan`, including with `--gate --dry-run`. GitHub wins lifecycle conflicts for GitHub-owned imports. A canceled item that GitHub later reports as completed uses the SDK's explicit repeat-closure transition with the source reason. A linked external owner keeps its local status, and the plan records `preserve-provider-owner`; `github_state` still records the source state. Atomic transaction identity includes the latest external edit or different lifecycle generation in history. Local state edits and repeated state cycles force reconciliation, while staging and compensation keep crash retries on the same journal. Finalization runs before the SDK commits; its compensation has the known SDK limitation below. It is idempotent and runs again after a recovered atomic journal, so an interrupted finalization can be repaired by retrying the same import before the gate permits a push.
+
+**Known limitation — atomic lifecycle finalization:** On pm-cli ≥ 2026.10.26
+without transaction-owned finalization ([pm-cli#1656](https://github.com/unbraind/pm-cli/issues/1656)),
+a failure after lifecycle finalization can leave partially applied state. The
+SDK ownership guard refuses unsafe compensation; the recovery journal resumes
+when the same import is retried. Complete rollback after this boundary is not
+currently guaranteed. See [the SDK finalization analysis](docs/atomic-finalization-sdk.md).
+
+Exactly two tests are quarantined on the verified affected SDK pin, 2026.11.4:
+`real SDK atomic compensation restores an imported source lifecycle and removes new items after finalization`
+in `test/import-fidelity.test.ts`, and
+`terminal failures remove replay plans after real SDK compensation (true)` in
+`test/refresh.test.ts`. Their compensation assertions remain intact and
+re-enable automatically on any other installed SDK version. The fresh-invocation
+refresh case still runs. Repository fixture-version tests verify both actual
+quarantine predicates and skip options without installing SDK versions.
 
 An atomic apply whose complete normalized source projection already matches every item
 reports `unchanged: true`, zero imports/updates, and no transaction ID. It leaves

package/dist/gate.d.ts

@@ -148,6 +148,8 @@ interface RuleHit {
     readonly matched: string;
     /** Character offset of the match within its line, for jsonl field attribution. */
     readonly index: number;
+    /** Exclusive source end offset, including every encoded character in the match. */
+    readonly end: number;
 }
 /**
  * Scan one added line with every content rule.

package/dist/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../gate.ts"],"names":[],"mappings":"AAwCA;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,mFAAmF;AACnF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAChC,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,qCAAqC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,mFAAmF;AACnF,UAAU,SAAS;IACjB,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,wFAAwF;AACxF,UAAU,UAAU;IAClB,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;CAC3C;AAED,mFAAmF;AACnF,MAAM,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/G;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;CACtD;AAED,oFAAoF;AACpF,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,kFAAkF;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,EAAE,CAAC;IACnH,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAOD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AA6JD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU3D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CASxF;AAED,oEAAoE;AACpE,UAAU,OAAO;IACf,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AA+FD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,UAAQ,GAAG,OAAO,EAAE,CA6DhF;AASD,yEAAyE;AACzE,UAAU,QAAQ;IAChB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,GAAG,MAAM,EAAE,CAOxE;AA2BD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAqG/D;AAoDD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAUnH;AAYD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,GAAE,mBAAwB,GACrC,UAAU,EAAE,CAqEd;AAMD,+DAA+D;AAC/D,UAAU,cAAc;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,OAAO,EACjB,YAAY,GAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAyD,GAC5F,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CA6B7B;AAED,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,mCAAmC,CAAC;AA2FxE;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CA2ElE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAY7D"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../gate.ts"],"names":[],"mappings":"AAwCA;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,mFAAmF;AACnF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAChC,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,qCAAqC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,mFAAmF;AACnF,UAAU,SAAS;IACjB,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,wFAAwF;AACxF,UAAU,UAAU;IAClB,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;CAC3C;AAED,mFAAmF;AACnF,MAAM,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/G;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;CACtD;AAED,oFAAoF;AACpF,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,kFAAkF;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,EAAE,CAAC;IACnH,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAOD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAugBD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU3D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CASxF;AAED,oEAAoE;AACpE,UAAU,OAAO;IACf,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AA+FD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,UAAQ,GAAG,OAAO,EAAE,CA6DhF;AASD,yEAAyE;AACzE,UAAU,QAAQ;IAChB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,GAAG,MAAM,EAAE,CAOxE;AA2BD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAqG/D;AAoDD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAUnH;AAYD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,GAAE,mBAAwB,GACrC,UAAU,EAAE,CAqEd;AAMD,+DAA+D;AAC/D,UAAU,cAAc;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,OAAO,EACjB,YAAY,GAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAyD,GAC5F,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CA6B7B;AAED,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,mCAAmC,CAAC;AA2FxE;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CA2ElE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAY7D"}