redlinegate 0.0.1

package/dist/platforms/github/push.js

@@ -0,0 +1,102 @@
+import { RedlineError } from "../../core/errors.js";
+const repoPath = (ref) => `/repos/${ref.org}/${ref.repo}`;
+const ok = (status, body, what) => {
+    if (status >= 400 || body === null) {
+        throw new RedlineError('host', `${what} returned ${status}`);
+    }
+    return body;
+};
+// Commit a set of files onto a branch without a working copy.
+//
+// Sync runs against hundreds of repositories from one workflow. Cloning each to
+// commit a handful of rendered files would dominate the run and needs write
+// access to a checkout this process does not have, so the git data API does the
+// work: one tree built from the files, one commit, one ref update. It is also
+// atomic in a way a file-at-a-time contents API is not — a run that dies halfway
+// leaves the branch untouched rather than half-updated.
+export async function pushRemoteFiles(client, ref, push) {
+    // The base is always the default branch, never whatever the sync branch
+    // already points at: a stale sync branch must be re-based onto current main,
+    // or it would re-propose changes the repository already merged.
+    const baseRef = await client.rest('GET', `${repoPath(ref)}/git/ref/heads/${ref.defaultBranch}`);
+    const baseSha = ok(baseRef.status, baseRef.body, `reading heads/${ref.defaultBranch}`).object?.sha;
+    if (!baseSha)
+        throw new RedlineError('host', `${ref.defaultBranch} has no commit sha`);
+    const baseCommit = await client.rest('GET', `${repoPath(ref)}/git/commits/${baseSha}`);
+    const baseTree = ok(baseCommit.status, baseCommit.body, 'reading the base commit').tree?.sha;
+    if (!baseTree)
+        throw new RedlineError('host', 'base commit has no tree');
+    const tree = await client.rest('POST', `${repoPath(ref)}/git/trees`, {
+        base_tree: baseTree,
+        tree: push.files.map((file) => ({
+            path: file.path,
+            mode: '100644',
+            type: 'blob',
+            content: file.content,
+        })),
+    });
+    const treeSha = ok(tree.status, tree.body, 'creating the tree').sha;
+    if (!treeSha)
+        throw new RedlineError('host', 'tree creation returned no sha');
+    // An identical tree means the repository already carries exactly what this
+    // run would push. Committing it anyway would open a pull request with an
+    // empty diff on every scheduled run, on every already-current repository.
+    if (treeSha === baseTree)
+        return { commit: null, branch: push.branch };
+    const commit = await client.rest('POST', `${repoPath(ref)}/git/commits`, {
+        message: push.message,
+        tree: treeSha,
+        parents: [baseSha],
+    });
+    const commitSha = ok(commit.status, commit.body, 'creating the commit').sha;
+    if (!commitSha)
+        throw new RedlineError('host', 'commit creation returned no sha');
+    // Create the branch, or force it onto the new commit when a previous run left
+    // one. Force is safe here and only here: the branch is Redline's own, named
+    // by Redline, and its only content is a re-render of the same files.
+    const created = await client.rest('POST', `${repoPath(ref)}/git/refs`, {
+        ref: `refs/heads/${push.branch}`,
+        sha: commitSha,
+    });
+    if (created.status === 422) {
+        const updated = await client.rest('PATCH', `${repoPath(ref)}/git/refs/heads/${push.branch}`, { sha: commitSha, force: true });
+        ok(updated.status, updated.body ?? {}, `updating ${push.branch}`);
+    }
+    else {
+        ok(created.status, created.body ?? {}, `creating ${push.branch}`);
+    }
+    return { commit: commitSha, branch: push.branch };
+}
+// Open a pull request for a branch, or return the one already open for it.
+//
+// Idempotence is the whole requirement: sync runs on a schedule, and a target
+// whose previous pull request is still unmerged must get an updated branch, not
+// a second pull request competing with the first.
+export async function openOrUpdatePullRequest(client, ref, pr) {
+    const existing = await client.rest('GET', `${repoPath(ref)}/pulls?state=open&head=${ref.org}:${pr.branch}`);
+    const open = existing.status < 400 ? (existing.body ?? []) : [];
+    if (open.length > 0 && open[0]) {
+        const found = open[0];
+        // The branch already carries the new commit; refresh the body so a reader
+        // sees the version this run proposes rather than the one it replaced.
+        await client.rest('PATCH', `${repoPath(ref)}/pulls/${found.number}`, {
+            title: pr.title,
+            body: pr.body,
+        });
+        return { number: found.number, url: found.html_url, created: false };
+    }
+    const created = await client.rest('POST', `${repoPath(ref)}/pulls`, { title: pr.title, body: pr.body, head: pr.branch, base: ref.defaultBranch });
+    const body = ok(created.status, created.body, 'opening the pull request');
+    if (typeof body.number !== 'number') {
+        throw new RedlineError('host', 'pull request creation returned no number');
+    }
+    if (pr.labels.length > 0) {
+        // Labels are a nicety. A repository that has not created them yet must not
+        // cost the pull request that carries the standards change.
+        await client.rest(`POST`, `${repoPath(ref)}/issues/${body.number}/labels`, {
+            labels: pr.labels,
+        });
+    }
+    return { number: body.number, url: body.html_url ?? '', created: true };
+}
+//# sourceMappingURL=push.js.map

package/dist/platforms/github/push.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.js","sourceRoot":"","sources":["../../../cli/platforms/github/push.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAIpD,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;AA+B3E,MAAM,EAAE,GAAG,CAAI,MAAc,EAAE,IAAc,EAAE,IAAY,EAAK,EAAE;IAChE,IAAI,MAAM,IAAI,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,GAAG,IAAI,aAAa,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,8DAA8D;AAC9D,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,iFAAiF;AACjF,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAkC,EAClC,GAAY,EACZ,IAAgB;IAEhB,wEAAwE;IACxE,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAC/B,KAAK,EACL,GAAG,QAAQ,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,aAAa,EAAE,CACtD,CAAC;IACF,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC;IACnG,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,aAAa,oBAAoB,CAAC,CAAC;IAEvF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAClC,KAAK,EACL,GAAG,QAAQ,CAAC,GAAG,CAAC,gBAAgB,OAAO,EAAE,CAC1C,CAAC;IACF,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC;IAC7F,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAEzE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAmB,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE;QACrF,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,GAAG,CAAC;IACpE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;IAE9E,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAEvE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAmB,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE;QACzF,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,CAAC,OAAO,CAAC;KACnB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC;IAC5E,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;IAElF,8EAA8E;IAC9E,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAU,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE;QAC9E,GAAG,EAAE,cAAc,IAAI,CAAC,MAAM,EAAE;QAChC,GAAG,EAAE,SAAS;KACf,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAC/B,OAAO,EACP,GAAG,QAAQ,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,MAAM,EAAE,EAChD,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAChC,CAAC;QACF,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AACpD,CAAC;AASD,2EAA2E;AAC3E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAkC,EAClC,GAAY,EACZ,EAAqB;IAErB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,KAAK,EACL,GAAG,QAAQ,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,CACjE,CAAC;IACF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,MAAM,CAAC,IAAI,CAAU,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,MAAM,EAAE,EAAE;YAC5E,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,IAAI,EAAE,EAAE,CAAC,IAAI;SACd,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAC/B,MAAM,EACN,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,EACxB,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,EAAE,CAC7E,CAAC;IACF,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;IAC1E,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,0CAA0C,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,2EAA2E;QAC3E,2DAA2D;QAC3D,MAAM,MAAM,CAAC,IAAI,CAAU,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,MAAM,SAAS,EAAE;YAClF,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1E,CAAC"}

package/dist/platforms/github/remote.js

@@ -0,0 +1,36 @@
+import { RedlineError } from "../../core/errors.js";
+import { parseRemoteConfig } from "../remote.js";
+const repoPath = (ref) => `/repos/${ref.org}/${ref.repo}`;
+// A file read at a ref, or null when the repository does not carry it. The
+// distinction matters everywhere this is used: "no .redline.json" means not
+// onboarded, and reporting that as a read failure would turn every un-onboarded
+// repository in the estate into an error.
+export async function readRemoteFile(client, ref, path) {
+    const response = await client.rest('GET', `${repoPath(ref)}/contents/${path}?ref=${encodeURIComponent(ref.defaultBranch)}`);
+    if (response.status === 404)
+        return null;
+    if (response.status >= 400) {
+        throw new RedlineError('host', `${ref.org}/${ref.repo}: reading ${path} returned ${response.status}`);
+    }
+    const body = response.body;
+    if (!body?.content || body.encoding !== 'base64') {
+        // A path that resolves to a directory comes back as an array, and a file
+        // over 1MB comes back with an empty content field. Both are real states
+        // that would otherwise decode to an empty string and parse as invalid.
+        throw new RedlineError('host', `${ref.org}/${ref.repo}: ${path} is not a readable file (no base64 content)`);
+    }
+    return {
+        content: Buffer.from(body.content, 'base64').toString('utf8'),
+        sha: body.sha ?? '',
+    };
+}
+export async function readRemoteConfig(client, ref) {
+    const file = await readRemoteFile(client, ref, '.redline.json');
+    if (!file)
+        return { config: null, ref: ref.defaultBranch };
+    return {
+        config: parseRemoteConfig(file.content, `${ref.org}/${ref.repo}`),
+        ref: ref.defaultBranch,
+    };
+}
+//# sourceMappingURL=remote.js.map

package/dist/platforms/github/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../cli/platforms/github/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAA2B,MAAM,cAAc,CAAC;AAI1E,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;AAQ3E,2EAA2E;AAC3E,4EAA4E;AAC5E,gFAAgF;AAChF,0CAA0C;AAC1C,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAkC,EAClC,GAAY,EACZ,IAAY;IAEZ,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,KAAK,EACL,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,IAAI,QAAQ,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CACjF,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,YAAY,CACpB,MAAM,EACN,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,aAAa,IAAI,aAAa,QAAQ,CAAC,MAAM,EAAE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjD,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,IAAI,YAAY,CACpB,MAAM,EACN,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,6CAA6C,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC7D,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkC,EAClC,GAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;IAC3D,OAAO;QACL,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACjE,GAAG,EAAE,GAAG,CAAC,aAAa;KACvB,CAAC;AACJ,CAAC"}

package/dist/platforms/github/verify.js

@@ -0,0 +1,366 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { RedlineError } from "../../core/errors.js";
+import { REQUIRED_CHECK, RULESET_NAME } from "./install.js";
+import { createHostShapeError, isNonNullObject } from "../shape.js";
+const hostShapeError = createHostShapeError('GitHub');
+function assertOk(status, path) {
+    if (status < 200 || status >= 300) {
+        throw new RedlineError('host', `GitHub returned HTTP ${status} reading ${path}`);
+    }
+}
+function parseRulesetList(body) {
+    if (!Array.isArray(body))
+        throw hostShapeError('the rulesets list');
+    return body.map((item) => {
+        if (!isNonNullObject(item) || typeof item['id'] !== 'number' || typeof item['name'] !== 'string') {
+            throw hostShapeError('a ruleset summary');
+        }
+        return { id: item['id'], name: item['name'] };
+    });
+}
+// `active`, `evaluate` or `disabled`. Anything but `active` means the ruleset
+// is readable and not applying — the rules come back unchanged, so nothing
+// else in this file can tell the difference. Absent is read as active: the
+// field has always been present on a real ruleset, and guessing "not in force"
+// from a shape surprise would fail a healthy repository.
+function parseRulesetEnforcement(body) {
+    if (!isNonNullObject(body))
+        throw hostShapeError('a ruleset detail');
+    const enforcement = body['enforcement'];
+    return typeof enforcement === 'string' ? enforcement : 'active';
+}
+function parseRulesetRules(body) {
+    if (!isNonNullObject(body) || !Array.isArray(body['rules'])) {
+        throw hostShapeError('a ruleset detail');
+    }
+    return body['rules'].map((rule) => {
+        if (!isNonNullObject(rule) || typeof rule['type'] !== 'string') {
+            throw hostShapeError('a ruleset rule');
+        }
+        const parameters = rule['parameters'];
+        return {
+            type: rule['type'],
+            ...(isNonNullObject(parameters) ? { parameters } : {}),
+        };
+    });
+}
+function parsePullRequestParams(parameters) {
+    const p = parameters ?? {};
+    return {
+        requiredApprovingReviewCount: typeof p['required_approving_review_count'] === 'number'
+            ? p['required_approving_review_count']
+            : 0,
+        dismissStaleReviewsOnPush: p['dismiss_stale_reviews_on_push'] === true,
+        requireCodeOwnerReview: p['require_code_owner_review'] === true,
+        requiredReviewThreadResolution: p['required_review_thread_resolution'] === true,
+    };
+}
+function parseRequiredCheckContexts(parameters) {
+    const checks = parameters?.['required_status_checks'];
+    if (checks === undefined)
+        return [];
+    if (!Array.isArray(checks))
+        throw hostShapeError('required status checks');
+    return checks.map((c) => {
+        if (!isNonNullObject(c) || typeof c['context'] !== 'string') {
+            throw hostShapeError('a required status check');
+        }
+        return c['context'];
+    });
+}
+function parsePullRequestHeadSha(body) {
+    const head = isNonNullObject(body) ? body['head'] : undefined;
+    if (!isNonNullObject(head) || typeof head['sha'] !== 'string') {
+        throw hostShapeError('a pull request');
+    }
+    return head['sha'];
+}
+function parseCheckRunNames(body) {
+    if (!isNonNullObject(body) || !Array.isArray(body['check_runs'])) {
+        throw hostShapeError('a check-runs list');
+    }
+    return body['check_runs'].map((run) => {
+        if (!isNonNullObject(run) || typeof run['name'] !== 'string') {
+            throw hostShapeError('a check run');
+        }
+        return run['name'];
+    });
+}
+// null means GitHub did not report the block at all, which is not the same
+// thing as reporting it empty — see readSecurityState.
+function parseSecurityAnalysisStatuses(body) {
+    if (!isNonNullObject(body))
+        throw hostShapeError('a repository');
+    const analysis = body['security_and_analysis'];
+    if (analysis === undefined)
+        return null;
+    if (!isNonNullObject(analysis))
+        throw hostShapeError('security_and_analysis');
+    const statuses = {};
+    for (const [key, value] of Object.entries(analysis)) {
+        if (isNonNullObject(value) && typeof value['status'] === 'string') {
+            statuses[key] = value['status'];
+        }
+    }
+    return statuses;
+}
+function parsePullRequestNumbers(body) {
+    if (!Array.isArray(body))
+        throw hostShapeError('the pull request list');
+    return body.map((item) => {
+        if (!isNonNullObject(item) || typeof item['number'] !== 'number') {
+            throw hostShapeError('a pull request summary');
+        }
+        return item['number'];
+    });
+}
+// The caller workflow `installGate` writes. Its job id is half of the required
+// check name — templates/redline.yml carries a DO NOT RENAME THE JOB warning
+// for exactly this reason — so reading it back is what separates "the gate has
+// not run on this pull request yet" from "nothing here can ever publish that
+// check".
+export const CALLER_WORKFLOW = '.github/workflows/redline.yml';
+// The other half: whatever REQUIRED_CHECK puts after the separator, which is
+// the aggregate job id inside workflows/redline-gate.yml. Derived rather than
+// re-typed, so a change to the exported constant carries through.
+const CHECK_SEPARATOR = ' / ';
+const AGGREGATE_JOB = REQUIRED_CHECK.slice(REQUIRED_CHECK.indexOf(CHECK_SEPARATOR) + CHECK_SEPARATOR.length);
+// Still not a YAML parse — this file is Redline's own, `init` rewrites it
+// wholesale, and a zero-runtime-dependency CLI does not gain a YAML parser for
+// one question. It is structural rather than shape-matched, which is a
+// different thing: the scan finds the `jobs:` mapping and reads job ids from
+// inside it and nowhere else.
+//
+// The version that pattern-matched a two-space key anywhere in the file took
+// the last one it had seen before the `uses:` line, which in the shipped
+// template is `  pull_request:` from the `on:` block. An inline comment on the
+// job-id line — a plausible edit, given the DO NOT RENAME THE JOB banner four
+// lines above it — was enough to fail the gate with "publishes pull_request /
+// gate ... rename the job back", naming a job that exists nowhere about a job
+// id that was already correct. Where this scan cannot attribute a name it
+// returns null, whose message says the file could not be read for one; a
+// message that admits it could not tell is honest, a fabricated job name is
+// not.
+const KEY = /^\s*(?:(["'])([\w.-]+)\1|([\w.-]+))\s*:(.*)$/;
+const USES_THE_GATE = /^\s*uses:\s*["']?\S*redline-gate\.yml@/;
+const indentOf = (line) => line.length - line.trimStart().length;
+const skippable = (line) => line.trim() === '' || line.trimStart().startsWith('#');
+const keyName = (line) => {
+    const match = KEY.exec(line);
+    return match?.[2] ?? match?.[3] ?? null;
+};
+function lines(body) {
+    return body.split('\n').map((line) => (line.endsWith('\r') ? line.slice(0, -1) : line));
+}
+// A workflow nothing triggers on a pull request publishes nothing, however
+// correctly its job is named — and the ruleset still requires the check it
+// will never send. `on:` is quoted in some hand-edited workflows because bare
+// `on` is a YAML boolean, and the trigger may be inline (`on: [pull_request]`)
+// or a key in the block below it.
+export function triggersOnPullRequest(body) {
+    const all = lines(body);
+    for (let i = 0; i < all.length; i += 1) {
+        const line = all[i] ?? '';
+        if (skippable(line) || indentOf(line) !== 0 || keyName(line) !== 'on')
+            continue;
+        const inline = KEY.exec(line)?.[4] ?? '';
+        if (inline.trim() !== '')
+            return inline.includes('pull_request');
+        for (const rest of all.slice(i + 1)) {
+            if (skippable(rest))
+                continue;
+            if (indentOf(rest) === 0)
+                break;
+            if (rest.includes('pull_request'))
+                return true;
+        }
+        return false;
+    }
+    return false;
+}
+export function callerJobId(body) {
+    const all = lines(body);
+    let jobsIndent = null;
+    let jobIdIndent = null;
+    let jobId = null;
+    for (const line of all) {
+        if (skippable(line))
+            continue;
+        const indent = indentOf(line);
+        if (jobsIndent === null) {
+            // Flow style (`jobs: {redline-gate: …}`) leaves content after the colon
+            // and is deliberately not attributed: `init` does not write it, and a
+            // truthful "could not read a job" beats a guess.
+            if (keyName(line) === 'jobs' && (KEY.exec(line)?.[4] ?? '').trim() === '')
+                jobsIndent = indent;
+            continue;
+        }
+        // Back out to the level of `jobs:` or above and the block is over, so no
+        // later key can be mistaken for a job id.
+        if (indent <= jobsIndent)
+            break;
+        if (USES_THE_GATE.test(line) && jobId !== null)
+            return jobId;
+        const name = keyName(line);
+        if (name === null)
+            continue;
+        // The first key inside the block fixes the job-id column; only keys at
+        // exactly that column are job ids, so `uses:` and `with:` below one are
+        // never mistaken for another job.
+        if (jobIdIndent === null)
+            jobIdIndent = indent;
+        if (indent === jobIdIndent)
+            jobId = name;
+    }
+    return null;
+}
+// The same parse for a local file and a remote read. Sharing it is the point:
+// a remote verify that re-derived "what does this file publish" independently
+// would eventually disagree with the local one, and the two answers are the
+// difference between a repository being reported healthy and being reported
+// broken.
+export function machineryFromBody(body) {
+    const base = { path: CALLER_WORKFLOW, expected: REQUIRED_CHECK };
+    if (body === null)
+        return { ...base, present: false, publishes: null };
+    const jobId = triggersOnPullRequest(body) ? callerJobId(body) : null;
+    return {
+        ...base,
+        present: true,
+        publishes: jobId === null ? null : `${jobId}${CHECK_SEPARATOR}${AGGREGATE_JOB}`,
+    };
+}
+export function createGitHubVerify(client) {
+    const repoPath = (ref) => `/repos/${ref.org}/${ref.repo}`;
+    return {
+        async readPolicy(ref) {
+            // Status is checked before the body is parsed, as azure/verify.ts does
+            // in all four of its methods. Without it a 403 error body ({"message":
+            // "Forbidden"}) fails the shape check instead, and the operator is sent
+            // after a host bug when the real problem is a token scope.
+            const listPath = `${repoPath(ref)}/rulesets`;
+            const list = await client.rest('GET', listPath);
+            assertOk(list.status, listPath);
+            const mine = parseRulesetList(list.body).find((r) => r.name === RULESET_NAME);
+            if (!mine)
+                return null;
+            const detailPath = `${repoPath(ref)}/rulesets/${mine.id}`;
+            const detail = await client.rest('GET', detailPath);
+            assertOk(detail.status, detailPath);
+            const rules = parseRulesetRules(detail.body);
+            const prParams = parsePullRequestParams(rules.find((r) => r.type === 'pull_request')?.parameters);
+            const checksRule = rules.find((r) => r.type === 'required_status_checks');
+            const enforcement = parseRulesetEnforcement(detail.body);
+            return {
+                requiredApprovals: prParams.requiredApprovingReviewCount,
+                dismissStaleReviews: prParams.dismissStaleReviewsOnPush,
+                requireCodeOwnerReview: prParams.requireCodeOwnerReview,
+                requireThreadResolution: prParams.requiredReviewThreadResolution,
+                requiredChecks: parseRequiredCheckContexts(checksRule?.parameters),
+                blocking: checksRule !== undefined,
+                ...(enforcement === 'active'
+                    ? {}
+                    : {
+                        notEnforcedReason: `the ${RULESET_NAME} ruleset is set to "${enforcement}" rather than "active", so none of ` +
+                            'its rules apply and every setting below is readable but inert',
+                    }),
+                // No unownedSettings: the ruleset read here is the one named `Redline`
+                // and `applyPolicy` writes every field above into it, so each one is
+                // Redline's own and `verify` may hold the repository to all of them.
+            };
+        },
+        readGateMachinery(cwd) {
+            const abs = join(cwd, CALLER_WORKFLOW);
+            if (!existsSync(abs))
+                return machineryFromBody(null);
+            // A local read that cannot be completed — a directory at the path, a
+            // file the process cannot open — is a finding about this repository, not
+            // an internal defect. Unguarded it escaped verify() as "redline failed
+            // unexpectedly" with the host exit code, for a read that never left the
+            // machine.
+            let body;
+            try {
+                body = readFileSync(abs, 'utf8');
+            }
+            catch (error) {
+                throw new RedlineError('failed', `cannot read ${CALLER_WORKFLOW}: ${error instanceof Error ? error.message : String(error)}`, 'restore it from redline init, or make it readable');
+            }
+            return machineryFromBody(body);
+        },
+        async readReportedCheckNames(ref, pr) {
+            const prPath = `${repoPath(ref)}/pulls/${pr}`;
+            const detail = await client.rest('GET', prPath);
+            assertOk(detail.status, prPath);
+            const sha = parsePullRequestHeadSha(detail.body);
+            const runsPath = `${repoPath(ref)}/commits/${sha}/check-runs?per_page=100`;
+            const runs = await client.rest('GET', runsPath);
+            assertOk(runs.status, runsPath);
+            return parseCheckRunNames(runs.body);
+        },
+        async readSecurityState(ref) {
+            const path = repoPath(ref);
+            const repo = await client.rest('GET', path);
+            assertOk(repo.status, path);
+            // GitHub omits security_and_analysis entirely for a requester without
+            // admin permission. "This token cannot see it" is not "it is off", and
+            // the difference matters: `denied` is the status that files pending-admin
+            // work and rewrites .redline.json, so reading an invisible setting as a
+            // refusal let a write-but-not-admin re-run overwrite a correct record
+            // with a false one. This is an INDETERMINATE read, not a definite one —
+            // GitHub does not say the feature is absent, only that this token
+            // cannot see it — so it degrades to `unknown`, not `unsupported`.
+            // `unsupported` is reserved for a definite "this does not exist here"
+            // answer (Azure's Advanced Security-unlicensed 404 is the one adapter
+            // that has one); conflating the two would let a plain `redline verify`
+            // pass a repository nobody has actually confirmed, since `unsupported`
+            // no longer fails it on its own (see cli/commands/verify.ts). Absent
+            // block -> unknown, which isPending excludes exactly like unsupported;
+            // present but not enabled -> denied, as before.
+            const statuses = parseSecurityAnalysisStatuses(repo.body);
+            const invisible = statuses === null;
+            const stateFor = (key) => invisible ? 'unknown' : statuses[key] === 'enabled' ? 'applied' : 'denied';
+            const note = invisible ? ' (not visible to this token)' : '';
+            // Dependabot alerts live on their own endpoint, and it answers with a
+            // status rather than a body: 204 enabled, 404 disabled (the repository
+            // read above already proved the repository itself resolves, so a 404
+            // here is about the feature, not the path). 403 is the one case where
+            // nothing was learned — an indeterminate read is not an answer, and
+            // `denied` is the status that files work against an administrator. Same
+            // reasoning as the block above: this is indeterminate, not a definite
+            // "not available here", so it degrades to `unknown`. Any other non-2xx
+            // is a host failure, same as everywhere else in this file.
+            const alertsPath = `${path}/vulnerability-alerts`;
+            const alerts = await client.rest('GET', alertsPath);
+            if (alerts.status !== 404 && alerts.status !== 403)
+                assertOk(alerts.status, alertsPath);
+            const alertsStatus = alerts.status === 403 ? 'unknown' : alerts.status === 404 ? 'denied' : 'applied';
+            return {
+                outcomes: [
+                    {
+                        capability: 'secret-scanning',
+                        status: stateFor('secret_scanning'),
+                        detail: `secret scanning${note}`,
+                    },
+                    {
+                        capability: 'push-protection',
+                        status: stateFor('secret_scanning_push_protection'),
+                        detail: `secret scanning push protection${note}`,
+                    },
+                    {
+                        capability: 'dependency-alerts',
+                        status: alertsStatus,
+                        detail: `dependabot alerts (vulnerability alerts)${alertsStatus === 'unknown' ? ' (not visible to this token)' : ''}`,
+                    },
+                ],
+            };
+        },
+        async latestPullRequestNumber(ref) {
+            const path = `${repoPath(ref)}/pulls?state=all&per_page=1`;
+            const list = await client.rest('GET', path);
+            assertOk(list.status, path);
+            return parsePullRequestNumbers(list.body)[0] ?? null;
+        },
+    };
+}
+//# sourceMappingURL=verify.js.map

package/dist/platforms/github/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../cli/platforms/github/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAUpD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEpE,MAAM,cAAc,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAEtD,SAAS,QAAQ,CAAC,MAAc,EAAE,IAAY;IAC5C,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,wBAAwB,MAAM,YAAY,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAOD,SAAS,gBAAgB,CAAC,IAAa;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,cAAc,CAAC,mBAAmB,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjG,MAAM,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAC3E,+EAA+E;AAC/E,yDAAyD;AACzD,SAAS,uBAAuB,CAAC,IAAa;IAC5C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAAE,MAAM,cAAc,CAAC,kBAAkB,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACxC,OAAO,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClE,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,cAAc,CAAC,kBAAkB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAChC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,cAAc,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;QACtC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;YAClB,GAAG,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AASD,SAAS,sBAAsB,CAAC,UAA+C;IAC7E,MAAM,CAAC,GAAG,UAAU,IAAI,EAAE,CAAC;IAC3B,OAAO;QACL,4BAA4B,EAC1B,OAAO,CAAC,CAAC,iCAAiC,CAAC,KAAK,QAAQ;YACtD,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC;YACtC,CAAC,CAAC,CAAC;QACP,yBAAyB,EAAE,CAAC,CAAC,+BAA+B,CAAC,KAAK,IAAI;QACtE,sBAAsB,EAAE,CAAC,CAAC,2BAA2B,CAAC,KAAK,IAAI;QAC/D,8BAA8B,EAAE,CAAC,CAAC,mCAAmC,CAAC,KAAK,IAAI;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,UAA+C;IACjF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC,wBAAwB,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,cAAc,CAAC,wBAAwB,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC5D,MAAM,cAAc,CAAC,yBAAyB,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAa;IAC5C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa;IACvC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,cAAc,CAAC,mBAAmB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACpC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2EAA2E;AAC3E,uDAAuD;AACvD,SAAS,6BAA6B,CAAC,IAAa;IAClD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAAE,MAAM,cAAc,CAAC,cAAc,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;QAAE,MAAM,cAAc,CAAC,uBAAuB,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YAClE,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAa;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,cAAc,CAAC,uBAAuB,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,cAAc,CAAC,wBAAwB,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,UAAU;AACV,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D,6EAA6E;AAC7E,8EAA8E;AAC9E,kEAAkE;AAClE,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;AAE7G,0EAA0E;AAC1E,+EAA+E;AAC/E,uEAAuE;AACvE,6EAA6E;AAC7E,8BAA8B;AAC9B,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,yEAAyE;AACzE,4EAA4E;AAC5E,OAAO;AACP,MAAM,GAAG,GAAG,8CAA8C,CAAC;AAC3D,MAAM,aAAa,GAAG,wCAAwC,CAAC;AAE/D,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;AACjF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACpG,MAAM,OAAO,GAAG,CAAC,IAAY,EAAiB,EAAE;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC1C,CAAC,CAAC;AAEF,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,kCAAkC;AAClC,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAChF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACjE,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpC,IAAI,SAAS,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM;YAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE9B,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,wEAAwE;YACxE,sEAAsE;YACtE,iDAAiD;YACjD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,UAAU,GAAG,MAAM,CAAC;YAC/F,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,0CAA0C;QAC1C,IAAI,MAAM,IAAI,UAAU;YAAE,MAAM;QAEhC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAE7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC5B,uEAAuE;QACvE,wEAAwE;QACxE,kCAAkC;QAClC,IAAI,WAAW,KAAK,IAAI;YAAE,WAAW,GAAG,MAAM,CAAC;QAC/C,IAAI,MAAM,KAAK,WAAW;YAAE,KAAK,GAAG,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,UAAU;AACV,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IACjE,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACvE,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,OAAO;QACL,GAAG,IAAI;QACP,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,eAAe,GAAG,aAAa,EAAE;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IAE3E,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,GAAY;YAC3B,uEAAuE;YACvE,uEAAuE;YACvE,wEAAwE;YACxE,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAU,KAAK,EAAE,QAAQ,CAAC,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;YAC9E,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,MAAM,UAAU,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,EAAE,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAU,KAAK,EAAE,UAAU,CAAC,CAAC;YAC7D,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,EAAE,UAAU,CAAC,CAAC;YAClG,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC;YAE1E,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAEzD,OAAO;gBACL,iBAAiB,EAAE,QAAQ,CAAC,4BAA4B;gBACxD,mBAAmB,EAAE,QAAQ,CAAC,yBAAyB;gBACvD,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;gBACvD,uBAAuB,EAAE,QAAQ,CAAC,8BAA8B;gBAChE,cAAc,EAAE,0BAA0B,CAAC,UAAU,EAAE,UAAU,CAAC;gBAClE,QAAQ,EAAE,UAAU,KAAK,SAAS;gBAClC,GAAG,CAAC,WAAW,KAAK,QAAQ;oBAC1B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,iBAAiB,EACf,OAAO,YAAY,uBAAuB,WAAW,qCAAqC;4BAC1F,+DAA+D;qBAClE,CAAC;gBACN,uEAAuE;gBACvE,qEAAqE;gBACrE,qEAAqE;aACtE,CAAC;QACJ,CAAC;QAED,iBAAiB,CAAC,GAAW;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YACvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACrD,qEAAqE;YACrE,yEAAyE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,WAAW;YACX,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,YAAY,CACpB,QAAQ,EACR,eAAe,eAAe,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC3F,mDAAmD,CACpD,CAAC;YACJ,CAAC;YACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,GAAY,EAAE,EAAU;YACnD,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAU,KAAK,EAAE,MAAM,CAAC,CAAC;YACzD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,GAAG,0BAA0B,CAAC;YAC3E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAU,KAAK,EAAE,QAAQ,CAAC,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChC,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,GAAY;YAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAU,KAAK,EAAE,IAAI,CAAC,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5B,sEAAsE;YACtE,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,kEAAkE;YAClE,kEAAkE;YAClE,sEAAsE;YACtE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,uEAAuE;YACvE,gDAAgD;YAChD,MAAM,QAAQ,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,SAAS,GAAG,QAAQ,KAAK,IAAI,CAAC;YACpC,MAAM,QAAQ,GAAG,CAAC,GAAW,EAA+B,EAAE,CAC5D,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7E,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE,CAAC;YAE7D,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,oEAAoE;YACpE,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,2DAA2D;YAC3D,MAAM,UAAU,GAAG,GAAG,IAAI,uBAAuB,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAU,KAAK,EAAE,UAAU,CAAC,CAAC;YAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACxF,MAAM,YAAY,GAChB,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAEnF,OAAO;gBACL,QAAQ,EAAE;oBACR;wBACE,UAAU,EAAE,iBAAiB;wBAC7B,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC;wBACnC,MAAM,EAAE,kBAAkB,IAAI,EAAE;qBACjC;oBACD;wBACE,UAAU,EAAE,iBAAiB;wBAC7B,MAAM,EAAE,QAAQ,CAAC,iCAAiC,CAAC;wBACnD,MAAM,EAAE,kCAAkC,IAAI,EAAE;qBACjD;oBACD;wBACE,UAAU,EAAE,mBAAmB;wBAC/B,MAAM,EAAE,YAAY;wBACpB,MAAM,EAAE,2CACN,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAChE,EAAE;qBACH;iBACF;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,GAAY;YACxC,MAAM,IAAI,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC;YAC3D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAU,KAAK,EAAE,IAAI,CAAC,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5B,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QACvD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/platforms/http.js

@@ -0,0 +1,58 @@
+import { RedlineError } from "../core/errors.js";
+const IDEMPOTENT = new Set(['GET', 'PUT', 'PATCH', 'DELETE', 'HEAD']);
+// 429 is pre-execution (rate limiting), so any method may retry; a 5xx may have
+// committed the request server-side, so only idempotent methods retry — a retried
+// POST would duplicate the PR/policy it created.
+const RETRYABLE = (method, status) => status === 429 || (status >= 500 && IDEMPOTENT.has(method.toUpperCase()));
+const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+export function createHttp(baseUrl, headers, opts = {}) {
+    const doFetch = opts.fetch ?? globalThis.fetch;
+    const retries = opts.retries ?? 3;
+    const sleep = opts.sleep ?? defaultSleep;
+    return {
+        async request(method, path, body) {
+            const url = path.startsWith('http') ? path : `${baseUrl}${path}`;
+            const init = { method, headers: { ...headers } };
+            if (body !== undefined) {
+                init.body = JSON.stringify(body);
+                init.headers = { ...headers, 'content-type': 'application/json' };
+            }
+            let lastStatus = 0;
+            for (let attempt = 0; attempt < retries; attempt += 1) {
+                let response;
+                try {
+                    response = await doFetch(url, init);
+                }
+                catch (cause) {
+                    if (attempt === retries - 1) {
+                        throw new RedlineError('host', `request to ${url} failed: ${String(cause)}`);
+                    }
+                    await sleep(2 ** attempt * 200);
+                    continue;
+                }
+                if (RETRYABLE(method, response.status)) {
+                    lastStatus = response.status;
+                    if (attempt === retries - 1)
+                        break;
+                    await sleep(2 ** attempt * 200);
+                    continue;
+                }
+                if (response.status === 204 || response.headers.get('content-length') === '0') {
+                    return { status: response.status, body: null };
+                }
+                const text = await response.text();
+                if (text === '') {
+                    return { status: response.status, body: null };
+                }
+                try {
+                    return { status: response.status, body: JSON.parse(text) };
+                }
+                catch {
+                    throw new RedlineError('host', `request to ${url} returned ${response.status} with a body that was not JSON`);
+                }
+            }
+            throw new RedlineError('host', `request to ${url} kept returning ${lastStatus}`);
+        },
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/platforms/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../cli/platforms/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAmBjD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEtE,gFAAgF;AAChF,kFAAkF;AAClF,iDAAiD;AACjD,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,MAAc,EAAW,EAAE,CAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAE5E,MAAM,YAAY,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAE1F,MAAM,UAAU,UAAU,CACxB,OAAe,EACf,OAA+B,EAC/B,OAAoB,EAAE;IAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IAEzC,OAAO;QACL,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;YAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;YACjE,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC;YAC9D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACjC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;YACpE,CAAC;YAED,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;gBACtD,IAAI,QAAkB,CAAC;gBACvB,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,OAAO,KAAK,OAAO,GAAG,CAAC,EAAE,CAAC;wBAC5B,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,cAAc,GAAG,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC/E,CAAC;oBACD,MAAM,KAAK,CAAC,CAAC,IAAI,OAAO,GAAG,GAAG,CAAC,CAAC;oBAChC,SAAS;gBACX,CAAC;gBAED,IAAI,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;oBAC7B,IAAI,OAAO,KAAK,OAAO,GAAG,CAAC;wBAAE,MAAM;oBACnC,MAAM,KAAK,CAAC,CAAC,IAAI,OAAO,GAAG,GAAG,CAAC,CAAC;oBAChC,SAAS;gBACX,CAAC;gBAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC9E,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBACjD,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;oBAChB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBACjD,CAAC;gBACD,IAAI,CAAC;oBACH,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,EAAE,CAAC;gBAClE,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,YAAY,CACpB,MAAM,EACN,cAAc,GAAG,aAAa,QAAQ,CAAC,MAAM,gCAAgC,CAC9E,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,cAAc,GAAG,mBAAmB,UAAU,EAAE,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC"}