redlinegate 0.0.1

package/dist/platforms/github/index.js

@@ -0,0 +1,54 @@
+import { RedlineError } from "../../core/errors.js";
+import { createGit } from "../../core/git.js";
+import { parseRemote } from "../detect.js";
+import { isNonNullObject } from "../shape.js";
+import { createGitHubInstall } from "./install.js";
+import { createGitHubVerify } from "./verify.js";
+export function createGitHubPlatform(opts) {
+    const gitFor = opts.gitFor ?? ((cwd) => createGit(cwd));
+    const install = createGitHubInstall(opts.client, gitFor);
+    const verify = createGitHubVerify(opts.client);
+    return {
+        host: 'github',
+        // `git.defaultBranch()` falls back to the literal 'main' when
+        // refs/remotes/origin/HEAD is not set (a shallow or freshly-created
+        // clone), so the branch below is a guess, not a fact. Nothing on the
+        // dry-run path reads it today; anything added that does must resolve it
+        // properly or report that it could not, rather than inherit the fiction.
+        localRef(cwd) {
+            const git = gitFor(cwd);
+            const identity = parseRemote(git.remoteUrl());
+            return {
+                host: 'github',
+                org: identity.org,
+                repo: identity.repo,
+                defaultBranch: git.defaultBranch(),
+            };
+        },
+        async repoRef(cwd) {
+            const identity = parseRemote(gitFor(cwd).remoteUrl());
+            const path = `/repos/${identity.org}/${identity.repo}`;
+            const repo = await opts.client.rest('GET', path);
+            if (repo.status === 401 || repo.status === 403) {
+                // "Token lacks scope" and "GitHub is down" must exit differently
+                // (3 vs 4) so CI can tell an operator problem from a host problem.
+                throw new RedlineError('permission', `GitHub returned HTTP ${repo.status} reading ${path}`, 'check the GH_TOKEN scopes, or run: gh auth login');
+            }
+            if (repo.status < 200 || repo.status >= 300) {
+                throw new RedlineError('host', `GitHub returned HTTP ${repo.status} reading ${path}`);
+            }
+            if (!isNonNullObject(repo.body) || typeof repo.body['default_branch'] !== 'string') {
+                throw new RedlineError('host', `GitHub returned an unexpected shape for ${path}`);
+            }
+            return {
+                host: 'github',
+                org: identity.org,
+                repo: identity.repo,
+                defaultBranch: repo.body['default_branch'],
+            };
+        },
+        ...install,
+        ...verify,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/platforms/github/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../cli/platforms/github/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAY,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAOjD,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAE/C,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,8DAA8D;QAC9D,oEAAoE;QACpE,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,QAAQ,CAAC,GAAW;YAClB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YAC9C,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE;aACnC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAW;YACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,UAAU,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAU,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC/C,iEAAiE;gBACjE,mEAAmE;gBACnE,MAAM,IAAI,YAAY,CACpB,YAAY,EACZ,wBAAwB,IAAI,CAAC,MAAM,YAAY,IAAI,EAAE,EACrD,kDAAkD,CACnD,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC5C,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,wBAAwB,IAAI,CAAC,MAAM,YAAY,IAAI,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACnF,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,2CAA2C,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;aAC3C,CAAC;QACJ,CAAC;QACD,GAAG,OAAO;QACV,GAAG,MAAM;KACV,CAAC;AACJ,CAAC"}

package/dist/platforms/github/install.js

@@ -0,0 +1,558 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { RedlineError } from "../../core/errors.js";
+import { isNonNullObject, isSuccess } from "../shape.js";
+import { BEGIN_PREFIX, END, findBlock, wrapBlock } from "../../render/markers.js";
+import { TEMPLATE_DIRS as PULL_REQUEST_TEMPLATE_DIRS } from "../pull-request-templates.js";
+export const RULESET_NAME = 'Redline';
+export const REQUIRED_CHECK = 'redline-gate / gate';
+const PACKAGE_ROOT = fileURLToPath(new URL('../../../', import.meta.url));
+const GATE_LABELS = [
+    { name: 'no-adr', color: 'ededed', description: 'PR intentionally ships without an ADR' },
+    {
+        name: 'redline-exempt',
+        color: 'fbca04',
+        description: 'Gate process checks soft-failed with reviewer sign-off',
+    },
+    {
+        name: 'redline-sync',
+        color: '0e8a16',
+        description: 'Automated standards sync from the Redline source repo',
+    },
+];
+function parseRulesetSummaries(body) {
+    if (!Array.isArray(body))
+        return null;
+    const summaries = [];
+    for (const item of body) {
+        if (!isNonNullObject(item) || typeof item['id'] !== 'number' || typeof item['name'] !== 'string') {
+            return null;
+        }
+        summaries.push({ id: item['id'], name: item['name'] });
+    }
+    return summaries;
+}
+function parseCreatedPullRequest(body) {
+    if (!isNonNullObject(body) || typeof body['number'] !== 'number' || typeof body['html_url'] !== 'string') {
+        return null;
+    }
+    return { number: body['number'], url: body['html_url'] };
+}
+function outcome(capability, status, detail) {
+    if (isSuccess(status))
+        return { capability, status: 'applied', detail };
+    if (status === 401 || status === 403) {
+        return { capability, status: 'denied', detail: `${detail} (needs repository admin)` };
+    }
+    if (status === 404 || status === 422) {
+        return { capability, status: 'unsupported', detail: `${detail} (not available on this repository)` };
+    }
+    return { capability, status: 'denied', detail: `${detail} (HTTP ${status})` };
+}
+// GitHub answers 404, not 403, on these admin write endpoints when a
+// fine-grained token lacks the administration scope on a repository it can
+// otherwise read — so on a write, 404 is a permission denial that must reach
+// pendingAdmin, not a missing feature. Read endpoints keep 404 = unsupported.
+function writeOutcome(capability, status, detail) {
+    if (status === 404) {
+        return { capability, status: 'denied', detail: `${detail} (needs repository admin)` };
+    }
+    return outcome(capability, status, detail);
+}
+// Combines several outcomes for one logical capability (e.g. GitHub reports
+// dependency-alerts as two separate calls, and labels are created one at a
+// time) into a single outcome. Ranked by how actionable/notable the status is
+// so a real permission denial on one sub-call is never masked by a merely
+// larger HTTP status number on another (a 404 "unsupported" must not hide a
+// 403 "denied", and an "already exists" 422 must not hide a 403 "denied").
+// `unknown` never appears here today — nothing installGate/applyPolicy/
+// enableSecurityFloor writes degrades a status into it, only verify.ts's
+// readSecurityState does — but the status union requires every member ranked.
+// It sits between `denied` and `unsupported`: a genuine denial must never be
+// masked by an indeterminate read, and an indeterminate read must never be
+// masked by a definite "not available here" or a definite success either.
+const OUTCOME_RANK = {
+    denied: 4,
+    unknown: 3,
+    unsupported: 2,
+    already: 1,
+    applied: 0,
+};
+function worstOutcome(outcomes) {
+    const [first, ...rest] = outcomes;
+    if (!first)
+        throw new Error('worstOutcome requires at least one outcome');
+    return rest.reduce((worst, next) => (OUTCOME_RANK[next.status] > OUTCOME_RANK[worst.status] ? next : worst), first);
+}
+// Writes only when the bytes differ, and answers whether they did — the same
+// contract as cli/render/standards.ts. `redline init` folds the returned file
+// list into its already-onboarded decision, so a file reported as written when
+// nothing changed leaves a modified tracked file behind with no pull request
+// to carry it: exactly what a CLI-version bump used to do to the pinned gate
+// template. `check` computes the answer and writes nothing.
+function syncFile(cwd, relPath, contents, check) {
+    const target = join(cwd, relPath);
+    const current = existsSync(target) ? readFileSync(target, 'utf8') : null;
+    if (current === contents)
+        return false;
+    if (check)
+        return true;
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, contents);
+    return true;
+}
+// The two sections workflows/redline-gate.yml actually reads out of a pull
+// request body, and the reason it is these two and not the others: the
+// `checklist` job fails the pull request outright when `## Launch readiness`
+// is missing, and the `adr` job fails a large diff whose body carries no
+// `docs/adr/` link, which is what `## Architecture decision` prompts for.
+// `## Change type` is gated by nothing (the workflow says so in a comment),
+// `## Automated review` is gated by nothing, and `# Summary` would collide
+// with the heading a repository's own template already has. Dropping the ADR
+// section would leave a merged repository failing a gate job it has no
+// affordance to satisfy.
+//
+// `satisfied` asks what the gate job asks, not what the section looks like.
+// The checklist job's awk matches the heading by prefix, so
+// `## Launch readiness checklist` already satisfies it and must not be given a
+// second, competing section. The adr job greps the whole body for `docs/adr/`,
+// so any existing ADR link satisfies it, heading or no heading.
+const GATED_SECTIONS = [
+    {
+        heading: 'Launch readiness',
+        satisfied: (template) => /^##[ \t]+Launch readiness/m.test(template),
+    },
+    {
+        heading: 'Architecture decision',
+        satisfied: (template) => template.includes('docs/adr/'),
+    },
+];
+// The gate reads a `## Redline exemption` block, so a template without one
+// leaves an author who needs a waiver with nowhere to write it. It rides along in
+// any block Redline is writing anyway, but it is deliberately NOT in
+// GATED_SECTIONS: no gate job fails for its absence, so it must never be the
+// reason a marker block appears in a template a team wrote for themselves.
+const EXEMPTION_HEADING = 'Redline exemption';
+// The headings to put inside a block, given the gated ones that still need
+// covering. Empty in, empty out: no block is created just to carry the optional
+// section.
+const blockSections = (headings) => headings.length === 0 ? [] : [...headings, EXEMPTION_HEADING];
+function gatedSections(template, headings) {
+    const kept = [];
+    let inside = false;
+    for (const line of template.split('\n')) {
+        // The packaged template carries the markers itself, so a greenfield file is
+        // marked from the first run. The marker lines are the wrapper wrapBlock
+        // adds back, never part of the body it wraps.
+        if (line.startsWith(BEGIN_PREFIX) || line.startsWith(END))
+            continue;
+        const heading = /^##\s+(.+?)\s*$/.exec(line);
+        if (heading)
+            inside = headings.includes(heading[1] ?? '');
+        if (inside)
+            kept.push(line);
+    }
+    return kept.join('\n').trim();
+}
+// GitHub's documentation names only `pull_request_template.md`. `.txt` and
+// extension-less forms are not documented, and adopting an undocumented one as
+// the merge target risks merging into a file the host never serves while
+// creating no `.md` at all — so the served name is the only candidate.
+const TEMPLATE_NAMES = ['pull_request_template.md'];
+// GitHub resolves the default template from `.github/`, the repository root
+// and `docs/` — its documentation names the three folders but no precedence.
+// The order itself lives in pull-request-templates.ts, the one source shared
+// with `redline verify` — see the comment there.
+const TEMPLATE_DIRS = PULL_REQUEST_TEMPLATE_DIRS.github;
+// Resolved by listing rather than by `existsSync`, for two reasons the review
+// found the hard way: both hosts treat the folder name as case-insensitive, and
+// `existsSync` is case-insensitive on macOS but not on Linux, so a `.GitHub/`
+// checkout was silently missed on CI and a second template written beside the
+// served one. Listing also answers `isDirectory()`, which is what stops a plain
+// file named `docs` from throwing ENOTDIR mid-run, after the gate workflow has
+// already been written.
+function candidateDirs(cwd) {
+    const entries = readdirSync(cwd, { withFileTypes: true });
+    const found = [];
+    for (const wanted of TEMPLATE_DIRS) {
+        if (wanted === '') {
+            found.push({ abs: cwd, rel: '' });
+            continue;
+        }
+        const dir = entries.find((entry) => entry.isDirectory() && entry.name.toLowerCase() === wanted);
+        if (dir)
+            found.push({ abs: join(cwd, dir.name), rel: dir.name });
+    }
+    return found;
+}
+const under = (candidate, name) => candidate.rel === '' ? name : `${candidate.rel}/${name}`;
+function findPullRequestTemplate(cwd) {
+    for (const candidate of candidateDirs(cwd)) {
+        const names = readdirSync(candidate.abs, { withFileTypes: true })
+            .filter((entry) => entry.isFile() && TEMPLATE_NAMES.includes(entry.name.toLowerCase()))
+            .map((entry) => entry.name);
+        // Two case variants in one directory: the host picks one and does not say
+        // which, so the tie-break is at least deterministic rather than whatever
+        // order the filesystem happened to list. Canonical spelling first,
+        // preferred extension next, byte order last.
+        names.sort((a, b) => {
+            const byName = TEMPLATE_NAMES.indexOf(a.toLowerCase()) - TEMPLATE_NAMES.indexOf(b.toLowerCase());
+            if (byName !== 0)
+                return byName;
+            if (a === b.toLowerCase())
+                return -1;
+            if (b === a.toLowerCase())
+                return 1;
+            return a < b ? -1 : 1;
+        });
+        const hit = names[0];
+        if (hit !== undefined)
+            return under(candidate, hit);
+    }
+    return null;
+}
+// A repository's own pull request template is a human-owned file, and this was
+// the last host-writing path in either adapter that simply overwrote one.
+// Leaving it alone is not the fix either: the gate fails any pull request
+// whose body has no `## Launch readiness` section, so an untouched brownfield
+// template would block the repository's own pull requests. So: write the
+// packaged template only where the host would resolve none, and otherwise
+// merge only the gated sections the file does not already satisfy into a
+// REDLINE marker block, leaving every other byte alone.
+function mergeTemplate(cwd, relPath, packaged, check) {
+    const target = join(cwd, relPath);
+    const existing = existsSync(target) ? readFileSync(target, 'utf8') : null;
+    if (existing === null) {
+        return { path: relPath, changed: syncFile(cwd, relPath, packaged, check), detail: `wrote ${relPath}` };
+    }
+    // Throws on a half-edited marker pair, or on markers hidden below an unclosed
+    // code fence, rather than guessing which span is Redline's — see
+    // cli/render/markers.ts. Nothing is written on that path.
+    const span = findBlock(existing, relPath);
+    if (span !== null) {
+        // Measured against what the template provides OUTSIDE the block, never the
+        // whole file. Refreshing with every gated section unconditionally put
+        // Redline's own `## Launch readiness` inside the block while the
+        // repository's stayed outside it, and the gate's awk enforces both — so the
+        // second run broke a repository the first run had merged correctly.
+        const outside = existing.slice(0, span.start) + existing.slice(span.stop + END.length);
+        const wanted = GATED_SECTIONS.filter((section) => !section.satisfied(outside)).map((section) => section.heading);
+        if (wanted.length === 0) {
+            return {
+                path: relPath,
+                changed: false,
+                detail: `${relPath} satisfies the gate outside the Redline block — left untouched`,
+            };
+        }
+        const contents = wrapBlock(existing, gatedSections(packaged, blockSections(wanted)), relPath);
+        const changed = syncFile(cwd, relPath, contents, check);
+        return {
+            path: relPath,
+            changed,
+            detail: changed
+                ? `refreshed the Redline block in ${relPath}`
+                : `${relPath} is already up to date`,
+        };
+    }
+    const missing = GATED_SECTIONS.filter((section) => !section.satisfied(existing)).map((section) => section.heading);
+    if (missing.length === 0) {
+        // Also where a repository onboarded before the packaged template carried
+        // markers lands: its marker-less file already answers both gate jobs, so it
+        // keeps what it has and Redline never rewrites it.
+        return {
+            path: relPath,
+            changed: false,
+            detail: `${relPath} already satisfies the gate on its own — left untouched`,
+        };
+    }
+    const contents = wrapBlock(existing, gatedSections(packaged, blockSections(missing)), relPath);
+    const appended = missing.map((heading) => `"## ${heading}"`).join(' and ');
+    return {
+        path: relPath,
+        changed: syncFile(cwd, relPath, contents, check),
+        detail: `kept this repository's ${relPath} and appended ${appended} inside REDLINE markers`,
+    };
+}
+// The one file `redline init` writes that cannot take the marker-block merge
+// the shared markdown artifacts take: appending to YAML gives the workflow a
+// second `name:` and `on:` key, and a file that no longer parses runs nothing
+// at all. So the only two honest answers here are "replace Redline's own file"
+// and "stop" — never "overwrite whatever was there".
+//
+// Attribution is read from the bytes rather than from the path, because the
+// path alone proves nothing and the 2.1 rollout wrote its own caller here,
+// which `redline init` exists to migrate. Deliberately generous: the
+// false-negative direction destroys a repository's file, and the
+// false-positive direction only replaces something that already carries
+// Redline's name at Redline's path.
+const CALLER_PATH = '.github/workflows/redline.yml';
+// Positive attribution, not a substring test. Almost every workflow a human
+// writes at a path called `redline.yml` says "redline" somewhere — in `name:`,
+// in a job id, in a `run:` line — so matching the word protected only the
+// repository that never mentioned it, and clobbered the ones that did. Two
+// things are Redline's own: the reusable-workflow reference every v3 caller
+// carries (the same contract cli/commands/init.ts's V3_CALLER reads to tell a
+// v3 repository from a 2.1 one), and the ownership line templates/redline.yml
+// now opens with. A 2.1 caller carries neither, and no fixture of the real
+// thing exists to pin, so it is refused rather than guessed at — `adoptCaller`
+// is where that decision belongs.
+const MANAGED_BY_REDLINE = /^#[ \t]*Managed by Redline\b/m;
+const USES_REDLINE_GATE = /\.github\/workflows\/redline-gate\.yml@/;
+function refuseForeignCaller(cwd, opts) {
+    if (opts.adoptCaller === true)
+        return;
+    const target = join(cwd, CALLER_PATH);
+    if (!existsSync(target))
+        return;
+    const existing = readFileSync(target, 'utf8');
+    if (MANAGED_BY_REDLINE.test(existing) || USES_REDLINE_GATE.test(existing))
+        return;
+    throw new RedlineError('failed', `${CALLER_PATH} already exists in this repository and carries nothing that attributes it to ` +
+        'Redline, so installing the merge gate there would destroy it. Nothing was written', 'If that workflow is already this repository\'s merge gate, re-run with --skip gate and Redline ' +
+        'will leave it in charge. Otherwise move or rename it and re-run redline init — or, if it is a ' +
+        'Redline 2.1 caller this run should replace, re-run with --adopt-caller. Redline cannot merge ' +
+        'into it the way it merges into a markdown file: a second `name:` and `on:` key would stop the ' +
+        'workflow running at all.');
+}
+function syncPullRequestTemplate(cwd, defaultPath, packaged, check) {
+    const results = [mergeTemplate(cwd, findPullRequestTemplate(cwd) ?? defaultPath, packaged, check)];
+    const details = [results[0]?.detail ?? ''];
+    const files = results.filter((result) => result.changed).map((result) => result.path);
+    return { files, changed: files.length > 0, detail: details.join('; ') };
+}
+function buildRules(policy) {
+    const rules = [
+        { type: 'deletion' },
+        { type: 'non_fast_forward' },
+        {
+            type: 'pull_request',
+            parameters: {
+                required_approving_review_count: policy.requiredApprovals,
+                dismiss_stale_reviews_on_push: policy.dismissStaleReviews,
+                require_code_owner_review: policy.requireCodeOwnerReview,
+                require_last_push_approval: true,
+                required_review_thread_resolution: policy.requireThreadResolution,
+                automatic_copilot_code_review_enabled: true,
+                allowed_merge_methods: ['squash', 'merge'],
+            },
+        },
+    ];
+    if (policy.blocking) {
+        // The check name is this adapter's own, exactly as Azure's status policy
+        // uses AZURE_STATUS_NAME/GENRE. It previously came from
+        // policy.requiredChecks, which cli/commands/init.ts passes empty — so
+        // `redline init --blocking` published a blocking ruleset that required
+        // nothing at all.
+        rules.push({
+            type: 'required_status_checks',
+            parameters: {
+                strict_required_status_checks_policy: false,
+                do_not_enforce_on_create: false,
+                required_status_checks: [{ context: REQUIRED_CHECK }],
+            },
+        });
+    }
+    return rules;
+}
+export function createGitHubInstall(client, gitFor) {
+    const repoPath = (ref) => `/repos/${ref.org}/${ref.repo}`;
+    return {
+        async enableSecurityFloor(ref) {
+            const scanning = await client.rest('PATCH', repoPath(ref), {
+                security_and_analysis: {
+                    secret_scanning: { status: 'enabled' },
+                    secret_scanning_push_protection: { status: 'enabled' },
+                },
+            });
+            const alerts = await client.rest('PUT', `${repoPath(ref)}/vulnerability-alerts`);
+            const fixes = await client.rest('PUT', `${repoPath(ref)}/automated-security-fixes`);
+            // Two independent host calls fold into one "dependency-alerts" capability.
+            // Combine by outcome severity, not by comparing raw status numbers — see
+            // worstOutcome.
+            const dependencyAlerts = worstOutcome([
+                writeOutcome('dependency-alerts', alerts.status, 'dependabot alerts (vulnerability alerts)'),
+                writeOutcome('dependency-alerts', fixes.status, 'dependabot alerts (automated security fixes)'),
+            ]);
+            return {
+                outcomes: [
+                    writeOutcome('secret-scanning', scanning.status, 'secret scanning'),
+                    writeOutcome('push-protection', scanning.status, 'secret scanning push protection'),
+                    dependencyAlerts,
+                ],
+            };
+        },
+        async applyPolicy(ref, policy) {
+            const existing = await client.rest('GET', `${repoPath(ref)}/rulesets`);
+            const payload = {
+                name: RULESET_NAME,
+                target: 'branch',
+                enforcement: 'active',
+                bypass_actors: [],
+                conditions: { ref_name: { include: ['~DEFAULT_BRANCH'], exclude: [] } },
+                rules: buildRules(policy),
+            };
+            let mergePolicy;
+            let policyApplied = false;
+            if (!isSuccess(existing.status)) {
+                // Denied (401/403) or unsupported (404/422) — never guess whether a
+                // Redline ruleset already exists, and never crash on it. Skip the
+                // write entirely; onboarding still continues below.
+                mergePolicy = outcome('merge-policy', existing.status, 'branch ruleset');
+            }
+            else {
+                const summaries = parseRulesetSummaries(existing.body);
+                if (summaries === null) {
+                    throw new RedlineError('host', 'GitHub returned an unexpected shape for the rulesets list');
+                }
+                const mine = summaries.find((r) => r.name === RULESET_NAME);
+                const method = mine ? 'PUT' : 'POST';
+                const path = mine
+                    ? `${repoPath(ref)}/rulesets/${mine.id}`
+                    : `${repoPath(ref)}/rulesets`;
+                const applied = await client.rest(method, path, payload);
+                if (applied.status === 422) {
+                    // A rejected ruleset payload is a Redline bug or a repo-settings
+                    // conflict — surfacing it as "unsupported" would leave the repo
+                    // silently policy-less with exit 0.
+                    throw new RedlineError('host', `GitHub rejected the Redline ruleset payload (HTTP 422 on ${method} ${path})`);
+                }
+                mergePolicy = writeOutcome('merge-policy', applied.status, 'branch ruleset');
+                policyApplied = isSuccess(applied.status);
+            }
+            const property = await client.rest('PATCH', `${repoPath(ref)}/properties/values`, {
+                properties: [{ property_name: 'redline', value: 'onboarded' }],
+            });
+            return {
+                outcomes: [
+                    mergePolicy,
+                    outcome('repo-property', property.status, 'repository property "redline=onboarded"'),
+                ],
+                policy: policyApplied ? policy : null,
+            };
+        },
+        async installGate(ref, cwd, opts, check = false) {
+            const files = [];
+            refuseForeignCaller(cwd, opts);
+            const caller = readFileSync(join(PACKAGE_ROOT, 'templates/redline.yml'), 'utf8')
+                .replaceAll('<org>', ref.org)
+                .replace(/adr-diff-threshold: \d+/, `adr-diff-threshold: ${opts.adrDiffThreshold}`)
+                .replace(/fail-on-dependency-severity: \w+/, `fail-on-dependency-severity: ${opts.failOnDependencySeverity}`)
+                .replace(/soft-fail-labels: .+/, `soft-fail-labels: ${opts.softFailLabels.join(',')}`)
+                .replace(/rung: \w[\w-]*/, `rung: ${opts.rung ?? 'observe'}`);
+            if (syncFile(cwd, '.github/workflows/redline.yml', caller, check)) {
+                files.push('.github/workflows/redline.yml');
+            }
+            // Read from templates/, never from this repository's own .github/:
+            // .github/ is deliberately outside package.json "files" (shipping it
+            // would push Redline's own CI workflows into every consumer), so a
+            // template read from there is absent in the published tarball and the
+            // throw lands after the workflow above has already been written.
+            const template = readFileSync(join(PACKAGE_ROOT, 'templates/github/pull_request_template.md'), 'utf8');
+            const prTemplate = syncPullRequestTemplate(cwd, '.github/pull_request_template.md', template, check);
+            files.push(...prTemplate.files);
+            if (check)
+                return { files, outcomes: [] };
+            // Deselected: not attempted, and no outcome either. An outcome for work
+            // that never happened is how a deliberate choice gets read back as a
+            // capability that failed.
+            const labelOutcomes = [];
+            for (const label of opts.manageLabels === false ? [] : GATE_LABELS) {
+                const res = await client.rest('POST', `${repoPath(ref)}/labels`, label);
+                labelOutcomes.push(res.status === 422
+                    ? { capability: 'labels', status: 'already', detail: `label "${label.name}" already exists` }
+                    : outcome('labels', res.status, `label "${label.name}"`));
+            }
+            return {
+                files,
+                outcomes: [
+                    ...(labelOutcomes.length > 0 ? [worstOutcome(labelOutcomes)] : []),
+                    {
+                        capability: 'gate',
+                        status: prTemplate.changed ? 'applied' : 'already',
+                        detail: prTemplate.detail,
+                    },
+                ],
+            };
+        },
+        async ensureReviewOwnership(ref, cwd, rules, check = false) {
+            const candidates = ['.github/CODEOWNERS', 'CODEOWNERS', 'docs/CODEOWNERS'];
+            if (candidates.some((p) => existsSync(join(cwd, p)))) {
+                return {
+                    files: [],
+                    outcomes: [
+                        {
+                            capability: 'review-ownership',
+                            status: 'already',
+                            detail: 'this repository already has a CODEOWNERS file — left untouched',
+                        },
+                    ],
+                };
+            }
+            const body = rules.map((r) => `${r.pattern} ${r.owners.join(' ')}`).join('\n');
+            // No candidate exists (checked above), so this always writes — `check`
+            // is what holds the write back on a dry run.
+            syncFile(cwd, '.github/CODEOWNERS', `# Managed by Redline.\n\n${body}\n`, check);
+            return {
+                files: ['.github/CODEOWNERS'],
+                outcomes: [
+                    { capability: 'review-ownership', status: 'applied', detail: 'seeded .github/CODEOWNERS' },
+                ],
+            };
+        },
+        async openPullRequest(ref, cwd, change) {
+            const git = gitFor(cwd);
+            // `git commit -m` commits the WHOLE index, so anything the user staged
+            // before running redline would be swept into the onboarding PR.
+            // Refusing beats `commit -- <paths>`: a partial-index commit surprises
+            // in the opposite direction.
+            if (git.hasStagedChanges()) {
+                throw new RedlineError('usage', 'this repository already has staged changes', 'commit or unstage them first, then re-run — redline will not sweep them into its onboarding pull request');
+            }
+            const originalBranch = git.currentBranch();
+            git.checkoutNewBranch(change.branch);
+            let gitFailed = false;
+            try {
+                // Stage only what Redline itself wrote — never sweep in pre-existing
+                // dirty or untracked state from the working tree (decision 6: no
+                // customer secret is ever committed by this tool).
+                git.stagePaths(change.files);
+                if (!git.hasStagedChanges()) {
+                    // Already onboarded and nothing changed: a legitimate no-op, not
+                    // an error — the caller reports it instead of a pull request.
+                    return null;
+                }
+                git.commit(change.title);
+                git.push(change.branch);
+            }
+            catch (error) {
+                gitFailed = true;
+                throw error;
+            }
+            finally {
+                // Leave the operator on their own branch, never on redline/onboard.
+                // When a git step failed its error already says where the work sits,
+                // and a failed restore must not mask it.
+                try {
+                    git.checkoutBranch(originalBranch);
+                }
+                catch (restoreError) {
+                    if (!gitFailed)
+                        throw restoreError;
+                }
+            }
+            const created = await client.rest('POST', `${repoPath(ref)}/pulls`, { title: change.title, body: change.body, head: change.branch, base: ref.defaultBranch });
+            const pr = isSuccess(created.status) ? parseCreatedPullRequest(created.body) : null;
+            if (!pr) {
+                throw new RedlineError('host', `could not open a pull request (HTTP ${created.status})`);
+            }
+            if (change.labels.length > 0) {
+                await client.rest('POST', `${repoPath(ref)}/issues/${pr.number}/labels`, {
+                    labels: change.labels,
+                });
+            }
+            return pr;
+        },
+    };
+}
+//# sourceMappingURL=install.js.map

package/dist/platforms/github/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../../cli/platforms/github/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAiBpD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,aAAa,IAAI,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE3F,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC;AACtC,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1E,MAAM,WAAW,GAAG;IAClB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,uCAAuC,EAAE;IACzF;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,wDAAwD;KACtE;IACD;QACE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,uDAAuD;KACrE;CACF,CAAC;AAYF,SAAS,qBAAqB,CAAC,IAAa;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAa;IAC5C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,OAAO,CACd,UAA2B,EAC3B,MAAc,EACd,MAAc;IAEd,IAAI,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACxE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,2BAA2B,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,qCAAqC,EAAE,CAAC;IACvG,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,MAAM,GAAG,EAAE,CAAC;AAChF,CAAC;AAED,qEAAqE;AACrE,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,SAAS,YAAY,CACnB,UAA2B,EAC3B,MAAc,EACd,MAAc;IAEd,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,2BAA2B,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,4EAA4E;AAC5E,2EAA2E;AAC3E,8EAA8E;AAC9E,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,wEAAwE;AACxE,yEAAyE;AACzE,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,YAAY,GAAgD;IAChE,MAAM,EAAE,CAAC;IACT,OAAO,EAAE,CAAC;IACV,WAAW,EAAE,CAAC;IACd,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,CAAC;CACX,CAAC;AAEF,SAAS,YAAY,CAAC,QAA6B;IACjD,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,MAAM,CAChB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EACxF,KAAK,CACN,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,4DAA4D;AAC5D,SAAS,QAAQ,CAAC,GAAW,EAAE,OAAe,EAAE,QAAgB,EAAE,KAAc;IAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IACvB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,uEAAuE;AACvE,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,uEAAuE;AACvE,yBAAyB;AACzB,EAAE;AACF,4EAA4E;AAC5E,4DAA4D;AAC5D,+EAA+E;AAC/E,+EAA+E;AAC/E,gEAAgE;AAChE,MAAM,cAAc,GAAG;IACrB;QACE,OAAO,EAAE,kBAAkB;QAC3B,SAAS,EAAE,CAAC,QAAgB,EAAW,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC;KACtF;IACD;QACE,OAAO,EAAE,uBAAuB;QAChC,SAAS,EAAE,CAAC,QAAgB,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;KACzE;CACF,CAAC;AAEF,2EAA2E;AAC3E,kFAAkF;AAClF,qEAAqE;AACrE,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAE9C,2EAA2E;AAC3E,gFAAgF;AAChF,WAAW;AACX,MAAM,aAAa,GAAG,CAAC,QAAkB,EAAY,EAAE,CACrD,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,iBAAiB,CAAC,CAAC;AAEhE,SAAS,aAAa,CAAC,QAAgB,EAAE,QAAkB;IACzD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,4EAA4E;QAC5E,wEAAwE;QACxE,8CAA8C;QAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,OAAO;YAAE,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,2EAA2E;AAC3E,+EAA+E;AAC/E,yEAAyE;AACzE,uEAAuE;AACvE,MAAM,cAAc,GAAG,CAAC,0BAA0B,CAAC,CAAC;AAEpD,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,iDAAiD;AACjD,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,CAAC;AAOxD,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,wBAAwB;AACxB,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;QACnC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAClC,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QAChG,IAAI,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,SAAoB,EAAE,IAAY,EAAU,EAAE,CAC3D,SAAS,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;AAE3D,SAAS,uBAAuB,CAAC,GAAW;IAC1C,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aAC9D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;aACtF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,0EAA0E;QAC1E,yEAAyE;QACzE,mEAAmE;QACnE,6CAA6C;QAC7C,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACjG,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAgBD,+EAA+E;AAC/E,0EAA0E;AAC1E,0EAA0E;AAC1E,8EAA8E;AAC9E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,wDAAwD;AACxD,SAAS,aAAa,CAAC,GAAW,EAAE,OAAe,EAAE,QAAgB,EAAE,KAAc;IACnF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,OAAO,EAAE,EAAE,CAAC;IACzG,CAAC;IAED,8EAA8E;IAC9E,iEAAiE;IACjE,0DAA0D;IAC1D,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,2EAA2E;QAC3E,sEAAsE;QACtE,iEAAiE;QACjE,4EAA4E;QAC5E,oEAAoE;QACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAChF,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAC7B,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,GAAG,OAAO,gEAAgE;aACnF,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9F,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO;YACP,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,kCAAkC,OAAO,EAAE;gBAC7C,CAAC,CAAC,GAAG,OAAO,wBAAwB;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAClF,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAC7B,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,yEAAyE;QACzE,4EAA4E;QAC5E,mDAAmD;QACnD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,GAAG,OAAO,yDAAyD;SAC5E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3E,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC;QAChD,MAAM,EAAE,0BAA0B,OAAO,iBAAiB,QAAQ,yBAAyB;KAC5F,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,qDAAqD;AACrD,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,qEAAqE;AACrE,iEAAiE;AACjE,wEAAwE;AACxE,oCAAoC;AACpC,MAAM,WAAW,GAAG,+BAA+B,CAAC;AACpD,4EAA4E;AAC5E,+EAA+E;AAC/E,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,+EAA+E;AAC/E,kCAAkC;AAClC,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAC3D,MAAM,iBAAiB,GAAG,yCAAyC,CAAC;AAEpE,SAAS,mBAAmB,CAAC,GAAW,EAAE,IAAiB;IACzD,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO;IAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO;IAClF,MAAM,IAAI,YAAY,CACpB,QAAQ,EACR,GAAG,WAAW,+EAA+E;QAC3F,mFAAmF,EACrF,iGAAiG;QAC/F,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,0BAA0B,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAAW,EACX,WAAmB,EACnB,QAAgB,EAChB,KAAc;IAEd,MAAM,OAAO,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,uBAAuB,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,MAAmB;IACrC,MAAM,KAAK,GAAc;QACvB,EAAE,IAAI,EAAE,UAAU,EAAE;QACpB,EAAE,IAAI,EAAE,kBAAkB,EAAE;QAC5B;YACE,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE;gBACV,+BAA+B,EAAE,MAAM,CAAC,iBAAiB;gBACzD,6BAA6B,EAAE,MAAM,CAAC,mBAAmB;gBACzD,yBAAyB,EAAE,MAAM,CAAC,sBAAsB;gBACxD,0BAA0B,EAAE,IAAI;gBAChC,iCAAiC,EAAE,MAAM,CAAC,uBAAuB;gBACjE,qCAAqC,EAAE,IAAI;gBAC3C,qBAAqB,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;aAC3C;SACF;KACF,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,yEAAyE;QACzE,wDAAwD;QACxD,sEAAsE;QACtE,uEAAuE;QACvE,kBAAkB;QAClB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE;gBACV,oCAAoC,EAAE,KAAK;gBAC3C,wBAAwB,EAAE,KAAK;gBAC/B,sBAAsB,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;aACtD;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAoB,EACpB,MAA4B;IAE5B,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IAE3E,OAAO;QACL,KAAK,CAAC,mBAAmB,CAAC,GAAY;YACpC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE;gBACzD,qBAAqB,EAAE;oBACrB,eAAe,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;oBACtC,+BAA+B,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;iBACvD;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACjF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAEpF,2EAA2E;YAC3E,yEAAyE;YACzE,gBAAgB;YAChB,MAAM,gBAAgB,GAAG,YAAY,CAAC;gBACpC,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,0CAA0C,CAAC;gBAC5F,YAAY,CAAC,mBAAmB,EAAE,KAAK,CAAC,MAAM,EAAE,8CAA8C,CAAC;aAChG,CAAC,CAAC;YAEH,OAAO;gBACL,QAAQ,EAAE;oBACR,YAAY,CAAC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;oBACnE,YAAY,CAAC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;oBACnF,gBAAgB;iBACjB;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,MAAmB;YACjD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAU,KAAK,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAEhF,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,QAAQ;gBAChB,WAAW,EAAE,QAAQ;gBACrB,aAAa,EAAE,EAAE;gBACjB,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;gBACvE,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;aAC1B,CAAC;YAEF,IAAI,WAA8B,CAAC;YACnC,IAAI,aAAa,GAAG,KAAK,CAAC;YAE1B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,oEAAoE;gBACpE,kEAAkE;gBAClE,oDAAoD;gBACpD,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC3E,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACvD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;oBACvB,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,2DAA2D,CAAC,CAAC;gBAC9F,CAAC;gBACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;gBAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAI;oBACf,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,EAAE,EAAE;oBACxC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;gBAChC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBACzD,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC3B,iEAAiE;oBACjE,gEAAgE;oBAChE,oCAAoC;oBACpC,MAAM,IAAI,YAAY,CACpB,MAAM,EACN,4DAA4D,MAAM,IAAI,IAAI,GAAG,CAC9E,CAAC;gBACJ,CAAC;gBACD,WAAW,GAAG,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBAC7E,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5C,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBAChF,UAAU,EAAE,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aAC/D,CAAC,CAAC;YAEH,OAAO;gBACL,QAAQ,EAAE;oBACR,WAAW;oBACX,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,yCAAyC,CAAC;iBACrF;gBACD,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;aACtC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,WAAW,CACf,GAAY,EACZ,GAAW,EACX,IAAiB,EACjB,KAAK,GAAG,KAAK;YAEb,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,EAAE,MAAM,CAAC;iBAC7E,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC;iBAC5B,OAAO,CAAC,yBAAyB,EAAE,uBAAuB,IAAI,CAAC,gBAAgB,EAAE,CAAC;iBAClF,OAAO,CACN,kCAAkC,EAClC,gCAAgC,IAAI,CAAC,wBAAwB,EAAE,CAChE;iBACA,OAAO,CAAC,sBAAsB,EAAE,qBAAqB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;iBACrF,OAAO,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,GAAG,EAAE,+BAA+B,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;gBAClE,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC9C,CAAC;YAED,mEAAmE;YACnE,qEAAqE;YACrE,mEAAmE;YACnE,sEAAsE;YACtE,iEAAiE;YACjE,MAAM,QAAQ,GAAG,YAAY,CAC3B,IAAI,CAAC,YAAY,EAAE,2CAA2C,CAAC,EAC/D,MAAM,CACP,CAAC;YACF,MAAM,UAAU,GAAG,uBAAuB,CACxC,GAAG,EACH,kCAAkC,EAClC,QAAQ,EACR,KAAK,CACN,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAEhC,IAAI,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAE1C,wEAAwE;YACxE,qEAAqE;YACrE,0BAA0B;YAC1B,MAAM,aAAa,GAAwB,EAAE,CAAC;YAC9C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBACnE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBACxE,aAAa,CAAC,IAAI,CAChB,GAAG,CAAC,MAAM,KAAK,GAAG;oBAChB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,CAAC,IAAI,kBAAkB,EAAE;oBAC7F,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,KAAK,CAAC,IAAI,GAAG,CAAC,CAC3D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE;oBACR,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClE;wBACE,UAAU,EAAE,MAAM;wBAClB,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;wBAClD,MAAM,EAAE,UAAU,CAAC,MAAM;qBAC1B;iBACF;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,qBAAqB,CACzB,GAAY,EACZ,GAAW,EACX,KAAsB,EACtB,KAAK,GAAG,KAAK;YAEb,MAAM,UAAU,GAAG,CAAC,oBAAoB,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;YAC3E,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,OAAO;oBACL,KAAK,EAAE,EAAE;oBACT,QAAQ,EAAE;wBACR;4BACE,UAAU,EAAE,kBAAkB;4BAC9B,MAAM,EAAE,SAAS;4BACjB,MAAM,EAAE,gEAAgE;yBACzE;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/E,uEAAuE;YACvE,6CAA6C;YAC7C,QAAQ,CAAC,GAAG,EAAE,oBAAoB,EAAE,4BAA4B,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC;YACjF,OAAO;gBACL,KAAK,EAAE,CAAC,oBAAoB,CAAC;gBAC7B,QAAQ,EAAE;oBACR,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE;iBAC3F;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAW,EAAE,MAAc;YAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,uEAAuE;YACvE,gEAAgE;YAChE,uEAAuE;YACvE,6BAA6B;YAC7B,IAAI,GAAG,CAAC,gBAAgB,EAAE,EAAE,CAAC;gBAC3B,MAAM,IAAI,YAAY,CACpB,OAAO,EACP,4CAA4C,EAC5C,0GAA0G,CAC3G,CAAC;YACJ,CAAC;YACD,MAAM,cAAc,GAAG,GAAG,CAAC,aAAa,EAAE,CAAC;YAC3C,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,CAAC;gBACH,qEAAqE;gBACrE,iEAAiE;gBACjE,mDAAmD;gBACnD,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,CAAC;oBAC5B,iEAAiE;oBACjE,8DAA8D;oBAC9D,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,oEAAoE;gBACpE,qEAAqE;gBACrE,yCAAyC;gBACzC,IAAI,CAAC;oBACH,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;gBACrC,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,IAAI,CAAC,SAAS;wBAAE,MAAM,YAAY,CAAC;gBACrC,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAC/B,MAAM,EACN,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,EACxB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,EAAE,CACzF,CAAC;YACF,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACpF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,uCAAuC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,MAAM,SAAS,EAAE;oBACvE,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;KACF,CAAC;AACJ,CAAC"}