wicked-crew 0.9.0 → 0.9.2

package/dist/core/ado-deliver-helper.js

@@ -0,0 +1,139 @@
+/**
+ * crew#720: the Azure DevOps half of the deliver script — a small node program the script writes
+ * into its temp dir and runs with the node that runs crew. It does the three things bash cannot do
+ * safely: mint the auth header (an Entra client-credentials token for a service principal, or
+ * `Basic base64(":"+PAT)`), compare origin's URLs with the consented repository, and open (or
+ * adopt) the pull request through the REST API with a JSON body.
+ *
+ * Rules it keeps:
+ *  - credentials are read from the environment only (`CREW_ADO_*` / `AZURE_DEVOPS_EXT_PAT`), and
+ *    the minted header is written to stdout for the script to capture into an UNEXPORTED shell
+ *    variable — never to a file, argv or the log;
+ *  - the `pr` call reads the header from `WICKED_ADO_AUTH`, set one-shot on that one child;
+ *  - every request uses `redirect: 'manual'`, so the header never follows a redirect to another
+ *    host, and a 3xx is a failure;
+ *  - every message is redacted (each secret, its base64 Basic forms, JWTs, Authorization values,
+ *    URL userinfo) before it is printed.
+ *
+ * Plain JavaScript in a string on purpose: the script must not depend on where crew's dist lives
+ * (a run waits at its gate across a crew upgrade), and the same text is what the tests run.
+ */
+export const ADO_HELPER_JS = String.raw `
+const [, , cmd, ...args] = process.argv;
+const env = process.env;
+const secrets = [];
+const keep = (s) => { if (typeof s === 'string' && s.length >= 4) secrets.push(s); return s; };
+for (const n of ['AZURE_DEVOPS_EXT_PAT', 'CREW_ADO_CLIENT_SECRET', 'WICKED_ADO_AUTH']) keep(env[n]);
+if (env.WICKED_ADO_AUTH) keep(env.WICKED_ADO_AUTH.replace(/^(Basic|Bearer) /, ''));
+function redact(text) {
+  let out = String(text ?? '');
+  for (const s of secrets) {
+    for (const f of [s, Buffer.from(':' + s).toString('base64'), Buffer.from(s).toString('base64')]) out = out.split(f).join('[REDACTED]');
+  }
+  return out
+    .replace(/(authorization\s*:\s*)(basic|bearer)\s+\S+/gi, '$1$2 [REDACTED]')
+    .replace(/\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]+/g, '[REDACTED-JWT]')
+    .replace(/(\b[a-z][a-z0-9+.-]*:\/\/)[^/\s@]+@/gi, '$1[REDACTED]@');
+}
+function fail(msg, code = 3) { process.stderr.write('deliver: ' + redact(msg) + '\n'); process.exit(code); }
+const v = (n) => (typeof env[n] === 'string' ? env[n].trim() : '');
+async function call(url, init) {
+  let res;
+  try {
+    res = await fetch(url, { ...init, redirect: 'manual', signal: AbortSignal.timeout(30000) });
+  } catch (e) {
+    fail('Azure DevOps request to ' + new URL(url).host + ' failed (' + (e && e.name ? e.name : 'error') + ')');
+  }
+  const text = await res.text();
+  let json = null;
+  try { json = JSON.parse(text); } catch {}
+  return { status: res.status, ok: res.status >= 200 && res.status < 300, json, text };
+}
+// The canonical form of a remote URL: an Azure DevOps spelling becomes
+// https://dev.azure.com/<org>/<project>/_git/<repo>; anything else loses its userinfo, a trailing
+// slash and .git, and has its scheme and host lowercased. Two URLs name one repository when their
+// canonical forms are equal (case-insensitively: Azure DevOps names are).
+function canon(raw) {
+  const s = String(raw).trim();
+  const e = (x) => encodeURIComponent(decodeURIComponent(x));
+  let m = /^(?:ssh:\/\/)?[^@\/\s]+@(?:ssh\.dev\.azure\.com|vs-ssh\.visualstudio\.com)[:\/]v3\/([^\/]+)\/([^\/]+)\/([^\/]+?)\/?$/i.exec(s);
+  if (m) return ('https://dev.azure.com/' + e(m[1]) + '/' + e(m[2]) + '/_git/' + e(m[3].replace(/\.git$/i, ''))).toLowerCase();
+  let u;
+  try { u = new URL(s); } catch { return null; }
+  const host = u.hostname.toLowerCase();
+  const segs = u.pathname.split('/').filter(Boolean);
+  const g = segs.indexOf('_git');
+  if (host === 'dev.azure.com' && g === 2 && segs.length === 4) return ('https://dev.azure.com/' + e(segs[0]) + '/' + e(segs[1]) + '/_git/' + e(segs[3].replace(/\.git$/i, ''))).toLowerCase();
+  if (host.endsWith('.visualstudio.com') && g >= 1 && g === segs.length - 2) {
+    const rest = segs.slice(0, g).filter((x, i) => !(i === 0 && x.toLowerCase() === 'defaultcollection'));
+    if (rest.length !== 1) return null;
+    return ('https://dev.azure.com/' + e(host.slice(0, -'.visualstudio.com'.length)) + '/' + e(rest[0]) + '/_git/' + e(segs[g + 1].replace(/\.git$/i, ''))).toLowerCase();
+  }
+  return (u.protocol + '//' + u.host + u.pathname.replace(/\/+$/, '').replace(/\.git$/i, '')).toLowerCase();
+}
+async function header(loginBase) {
+  const tenant = v('CREW_ADO_TENANT_ID'), client = v('CREW_ADO_CLIENT_ID'), secret = v('CREW_ADO_CLIENT_SECRET');
+  if (tenant && client && secret) {
+    const body = new URLSearchParams({ grant_type: 'client_credentials', client_id: client, client_secret: secret, scope: '499b84ac-1321-427f-aa17-267ca6975798/.default' }).toString();
+    const r = await call(loginBase.replace(/\/+$/, '') + '/' + encodeURIComponent(tenant) + '/oauth2/v2.0/token', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' }, body });
+    const tok = r.json && typeof r.json.access_token === 'string' ? keep(r.json.access_token) : '';
+    if (!r.ok || !tok) fail('Entra refused the Azure DevOps service-principal credential (HTTP ' + r.status + (r.json && typeof r.json.error === 'string' ? ', ' + r.json.error : '') + ')');
+    return 'Bearer ' + tok;
+  }
+  const pat = v('AZURE_DEVOPS_EXT_PAT');
+  if (pat) return 'Basic ' + keep(Buffer.from(':' + pat).toString('base64'));
+  fail('Azure DevOps credentials not configured', 4);
+}
+const API = 'api-version=7.1';
+async function findPr(apiBase, auth, source, target) {
+  const q = new URLSearchParams({ 'searchCriteria.sourceRefName': 'refs/heads/' + source, 'searchCriteria.targetRefName': 'refs/heads/' + target, 'searchCriteria.status': 'active' });
+  const r = await call(apiBase + '/pullrequests?' + q + '&' + API, { method: 'GET', headers: { Authorization: auth, Accept: 'application/json' } });
+  if (!r.ok) return null;
+  const list = r.json && Array.isArray(r.json.value) ? r.json.value : [];
+  const mine = list.filter((p) => p && p.sourceRefName === 'refs/heads/' + source && p.targetRefName === 'refs/heads/' + target && p.status === 'active' && typeof p.pullRequestId === 'number');
+  return mine.length === 1 ? mine[0] : null;
+}
+function fitDescription(body) {
+  const MAX = 4000;
+  if (body.length <= MAX) return body;
+  const note = '\n\n_(description truncated to Azure DevOps\' 4000-character limit)_';
+  const tail = body.slice(-600);
+  return body.slice(0, MAX - tail.length - note.length) + note + tail;
+}
+async function pr(apiBase, webUrl, source, target, titleFile, bodyFile) {
+  const fs = await import('node:fs');
+  const auth = env.WICKED_ADO_AUTH || '';
+  if (!auth) fail('no Azure DevOps auth header was handed to the pull-request step');
+  let title = fs.readFileSync(titleFile, 'utf8').replace(/\n+$/, '');
+  if (title.length > 400) title = title.slice(0, 399) + '…';
+  const description = fitDescription(fs.readFileSync(bodyFile, 'utf8'));
+  const r = await call(apiBase + '/pullrequests?' + API, {
+    method: 'POST',
+    headers: { Authorization: auth, 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({ sourceRefName: 'refs/heads/' + source, targetRefName: 'refs/heads/' + target, title, description }),
+  });
+  if (r.ok && r.json && typeof r.json.pullRequestId === 'number') {
+    process.stdout.write(webUrl + '/pullrequest/' + r.json.pullRequestId + '\n');
+    return;
+  }
+  // A PR for this branch pair may already exist (a retry after the push landed, a rework): adopt
+  // it only when exactly one ACTIVE PR has this source AND target branch.
+  const existing = await findPr(apiBase, auth, source, target);
+  if (existing) {
+    process.stdout.write('deliver: ADO-PR-EXISTS ' + webUrl + '/pullrequest/' + existing.pullRequestId + '\n');
+    return;
+  }
+  const why = r.json && typeof r.json.message === 'string' ? r.json.message : r.text.slice(0, 300);
+  fail('Azure DevOps refused the pull request (HTTP ' + r.status + '): ' + why);
+}
+(async () => {
+  if (cmd === 'header') process.stdout.write((await header(args[0])) + '\n');
+  else if (cmd === 'same') {
+    const want = canon(args[0]);
+    const urls = args.slice(1).join('\n').split(/\s+/).filter(Boolean);
+    if (!want || urls.length === 0 || urls.some((u) => canon(u) !== want)) process.exit(1);
+  } else if (cmd === 'pr') await pr(...args);
+  else fail('unknown helper command ' + cmd);
+})().catch((e) => fail(e && e.message ? e.message : String(e)));
+`;
+//# sourceMappingURL=ado-deliver-helper.js.map

package/dist/core/ado-deliver-helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ado-deliver-helper.js","sourceRoot":"","sources":["../../src/core/ado-deliver-helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqHtC,CAAC"}

package/dist/core/deliver-credentials.d.ts

@@ -0,0 +1,88 @@
+/**
+ * crew#720: the deliver phase's provider credentials — ONE preflight shape for GitHub and Azure
+ * DevOps — and the Azure DevOps repository a remote URL names.
+ *
+ * Only PRESENCE is read here, never a value: the credential stays in the daemon's environment
+ * (or gh's keyring) and is consumed by the deliver script alone, inside the deliver phase (the
+ * engine strips every forge credential from worker seats, wicked-core#671).
+ *
+ * The same check runs twice: at launch (so the deliver gate card says "<provider> credentials not
+ * configured" BEFORE approval, and `GET /repos/:id/deliver-target` reports it) and in the deliver
+ * script itself before anything is staged, whose refusal parks the run at the engine's
+ * deliver-refusal gate with the work kept ({@link DELIVER_CREDENTIALS_MISSING_MARKER}).
+ */
+/** The forge a delivery goes to. `null` from {@link deliverProviderOf} = neither (a local path,
+ *  GitLab, Gitea, …): the push-only path, which needs no provider credential of crew's. */
+export type DeliverProvider = 'github' | 'azure_devops';
+/** api-types `DeliverCredentials` (crew#720) — the one preflight shape every provider shares. */
+export interface DeliverCredentials {
+    provider: DeliverProvider;
+    /** `unknown` = the probe could not answer (gh timed out); never read as `missing`. */
+    status: 'configured' | 'missing' | 'unknown';
+    /** Where the credential comes from when configured; `null` otherwise. */
+    source: 'gh_token' | 'gh_login' | 'service_principal' | 'pat' | null;
+    /** What to set when `missing`, in the order the phase tries them (env var names, commands). */
+    missing: string[];
+    /** One sentence for the gate card and the run record. */
+    message: string;
+}
+/** The env var names the Azure DevOps delivery reads (service principal first, then the PAT). */
+export declare const ADO_SP_ENV: readonly ["CREW_ADO_TENANT_ID", "CREW_ADO_CLIENT_ID", "CREW_ADO_CLIENT_SECRET"];
+export declare const ADO_PAT_ENV = "AZURE_DEVOPS_EXT_PAT";
+/**
+ * The line the deliver script prints when the provider credential is absent:
+ * `deliver: CREDENTIALS-MISSING <provider>` — before anything is staged, followed by the
+ * push-refused marker so the engine parks the run at its deliver-refusal gate.
+ */
+export declare const DELIVER_CREDENTIALS_MISSING_MARKER = "deliver: CREDENTIALS-MISSING";
+/** The Azure DevOps credential the daemon environment holds (presence only). */
+export declare function adoCredentials(env?: NodeJS.ProcessEnv): DeliverCredentials;
+/**
+ * The GitHub credential: an exported `GH_TOKEN`, else a gh login for github.com. `logins` is
+ * `gh auth status`'s answer — `[]` = gh answered with no login, `'absent'` = gh is not installed,
+ * `null` = the probe could not answer (unknown, never missing).
+ */
+export declare function githubCredentials(env: NodeJS.ProcessEnv, logins: readonly string[] | 'absent' | null): DeliverCredentials;
+/** The Azure DevOps repository a remote URL names. */
+export interface AdoRepo {
+    org: string;
+    project: string;
+    repo: string;
+    /** The canonical https git URL every authenticated fetch/push goes to. */
+    gitUrl: string;
+    /** `…/_apis/git/repositories/<repo>` — the REST base for pull requests. */
+    apiBase: string;
+    /** The repository's web URL; a PR is `<webUrl>/pullrequest/<id>`. */
+    webUrl: string;
+    /** The Entra token authority (service-principal mint). */
+    loginBase: string;
+}
+/** Is `host` an Azure DevOps host (`dev.azure.com`, `ssh.dev.azure.com`, `*.visualstudio.com`)? */
+export declare function isAdoHost(host: string | null): boolean;
+/**
+ * The Azure DevOps repository of a remote URL, or `null`. Accepts the four spellings Azure DevOps
+ * hands out — `https://[user@]dev.azure.com/<org>/<project>/_git/<repo>`,
+ * `https://<org>.visualstudio.com/[DefaultCollection/]<project>/_git/<repo>`,
+ * `git@ssh.dev.azure.com:v3/<org>/<project>/<repo>` and
+ * `<org>@vs-ssh.visualstudio.com:v3/<org>/<project>/<repo>` — and nothing looser. Userinfo is
+ * never kept. Every part is percent-decoded once and re-encoded, so the canonical URL is stable.
+ */
+export declare function adoRepoOf(url: string | null | undefined): AdoRepo | null;
+/** The provider a delivery to `originUrl` uses, or `null` (push-only / local / unknown). */
+export declare function deliverProviderOf(originUrl: string | null | undefined): DeliverProvider | null;
+/** The credential preflight a deliver card shows for an origin; `null` when no provider applies. */
+export declare function deliverCredentialsFor(originUrl: string | null | undefined, env: NodeJS.ProcessEnv, ghLogins: readonly string[] | 'absent' | null): DeliverCredentials | null;
+/** `deliver: CREDENTIALS-MISSING <provider>` in a deliver transcript → that provider, else `null`.
+ *  The LAST such line decides; the script prints it before anything reaches the remote. */
+export declare function credentialsMissingIn(text: string): DeliverProvider | null;
+/**
+ * {@link deliverCredentialsFor} with the gh probe run only when it can matter: a github.com origin
+ * with no exported GH_TOKEN (a bounded `gh auth status`, crew#737's probe). gh not installed reads
+ * `'absent'`; a probe that timed out reads unknown. Never throws.
+ */
+export declare function deliverCredentialsProbe(originUrl: string | null | undefined, env: NodeJS.ProcessEnv, probe?: () => Promise<string[] | 'absent' | null>): Promise<DeliverCredentials | null>;
+export declare function ghLoginsOrAbsent(): Promise<string[] | 'absent' | null>;
+/** The canonical `missing` reading for a provider — what the run record says after the deliver
+ *  phase refused for want of the credential (the phase read the environment it ran in). */
+export declare function missingCredentials(provider: DeliverProvider): DeliverCredentials;
+//# sourceMappingURL=deliver-credentials.d.ts.map

package/dist/core/deliver-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliver-credentials.d.ts","sourceRoot":"","sources":["../../src/core/deliver-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH;2FAC2F;AAC3F,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,cAAc,CAAC;AAExD,iGAAiG;AACjG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,eAAe,CAAC;IAC1B,sFAAsF;IACtF,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;IAC7C,yEAAyE;IACzE,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,mBAAmB,GAAG,KAAK,GAAG,IAAI,CAAC;IACrE,+FAA+F;IAC/F,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iGAAiG;AACjG,eAAO,MAAM,UAAU,iFAAkF,CAAC;AAC1G,eAAO,MAAM,WAAW,yBAAyB,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,iCAAiC,CAAC;AAOjF,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAiBvF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,GAAG,IAAI,GAAG,kBAAkB,CAmBzH;AAED,sDAAsD;AACtD,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,mGAAmG;AACnG,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAItD;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAsDxE;AAED,4FAA4F;AAC5F,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,CAM9F;AAED,oGAAoG;AACpG,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,GAAG,IAAI,GAC5C,kBAAkB,GAAG,IAAI,CAK3B;AAED;2FAC2F;AAC3F,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAOzE;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,KAAK,GAAE,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAoB,GAClE,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAMpC;AAQD,wBAAgB,gBAAgB,IAAI,OAAO,CAAC,MAAM,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAMtE;AAcD;2FAC2F;AAC3F,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,eAAe,GAAG,kBAAkB,CAEhF"}

package/dist/core/deliver-credentials.js

@@ -0,0 +1,231 @@
+/**
+ * crew#720: the deliver phase's provider credentials — ONE preflight shape for GitHub and Azure
+ * DevOps — and the Azure DevOps repository a remote URL names.
+ *
+ * Only PRESENCE is read here, never a value: the credential stays in the daemon's environment
+ * (or gh's keyring) and is consumed by the deliver script alone, inside the deliver phase (the
+ * engine strips every forge credential from worker seats, wicked-core#671).
+ *
+ * The same check runs twice: at launch (so the deliver gate card says "<provider> credentials not
+ * configured" BEFORE approval, and `GET /repos/:id/deliver-target` reports it) and in the deliver
+ * script itself before anything is staged, whose refusal parks the run at the engine's
+ * deliver-refusal gate with the work kept ({@link DELIVER_CREDENTIALS_MISSING_MARKER}).
+ */
+// A function-only import (no module-evaluation use), so the cycle with deliver.ts is inert.
+import { execFile } from 'node:child_process';
+import { originRemoteHost, parseGhAuthStatusLogins } from './deliver.js';
+import { childEnvWithBootEstateDb } from './governance-store.js';
+/** The env var names the Azure DevOps delivery reads (service principal first, then the PAT). */
+export const ADO_SP_ENV = ['CREW_ADO_TENANT_ID', 'CREW_ADO_CLIENT_ID', 'CREW_ADO_CLIENT_SECRET'];
+export const ADO_PAT_ENV = 'AZURE_DEVOPS_EXT_PAT';
+/**
+ * The line the deliver script prints when the provider credential is absent:
+ * `deliver: CREDENTIALS-MISSING <provider>` — before anything is staged, followed by the
+ * push-refused marker so the engine parks the run at its deliver-refusal gate.
+ */
+export const DELIVER_CREDENTIALS_MISSING_MARKER = 'deliver: CREDENTIALS-MISSING';
+function present(env, name) {
+    const v = env[name];
+    return typeof v === 'string' && v.trim() !== '';
+}
+/** The Azure DevOps credential the daemon environment holds (presence only). */
+export function adoCredentials(env = process.env) {
+    if (ADO_SP_ENV.every((n) => present(env, n))) {
+        return { provider: 'azure_devops', status: 'configured', source: 'service_principal', missing: [], message: 'Azure DevOps credentials: the service principal (CREW_ADO_TENANT_ID / CREW_ADO_CLIENT_ID / CREW_ADO_CLIENT_SECRET).' };
+    }
+    if (present(env, ADO_PAT_ENV)) {
+        return { provider: 'azure_devops', status: 'configured', source: 'pat', missing: [], message: `Azure DevOps credentials: a personal access token (${ADO_PAT_ENV}).` };
+    }
+    const spMissing = ADO_SP_ENV.filter((n) => !present(env, n));
+    return {
+        provider: 'azure_devops',
+        status: 'missing',
+        source: null,
+        missing: [...spMissing, ADO_PAT_ENV],
+        message: `Azure DevOps credentials not configured: set ${ADO_SP_ENV.join(', ')} (a service principal) or ${ADO_PAT_ENV} ` +
+            "in the daemon's environment and restart it. The deliver phase refuses before anything is staged and the run waits at the deliver gate with its work kept.",
+    };
+}
+/**
+ * The GitHub credential: an exported `GH_TOKEN`, else a gh login for github.com. `logins` is
+ * `gh auth status`'s answer — `[]` = gh answered with no login, `'absent'` = gh is not installed,
+ * `null` = the probe could not answer (unknown, never missing).
+ */
+export function githubCredentials(env, logins) {
+    if (present(env, 'GH_TOKEN')) {
+        return { provider: 'github', status: 'configured', source: 'gh_token', missing: [], message: 'GitHub credentials: GH_TOKEN in the daemon environment.' };
+    }
+    if (logins === null) {
+        return { provider: 'github', status: 'unknown', source: null, missing: [], message: 'GitHub credentials: gh did not answer in time; the deliver phase checks again before it stages anything.' };
+    }
+    if (logins !== 'absent' && logins.length > 0) {
+        return { provider: 'github', status: 'configured', source: 'gh_login', missing: [], message: `GitHub credentials: gh is signed in to github.com (${logins.join(', ')}).` };
+    }
+    return {
+        provider: 'github',
+        status: 'missing',
+        source: null,
+        missing: ['gh auth login', 'GH_TOKEN'],
+        message: `GitHub credentials not configured: ${logins === 'absent' ? 'gh is not installed and ' : 'gh is not signed in to github.com and '}no GH_TOKEN is exported. ` +
+            "Run `gh auth login` on this machine or export GH_TOKEN in the daemon's environment. The deliver phase refuses before anything is staged and the run waits at the deliver gate with its work kept.",
+    };
+}
+const ADO_PART = /^[A-Za-z0-9._~%() -]+$/;
+/** Is `host` an Azure DevOps host (`dev.azure.com`, `ssh.dev.azure.com`, `*.visualstudio.com`)? */
+export function isAdoHost(host) {
+    if (host === null)
+        return false;
+    const h = host.toLowerCase();
+    return h === 'dev.azure.com' || h === 'ssh.dev.azure.com' || h === 'visualstudio.com' || h.endsWith('.visualstudio.com');
+}
+/**
+ * The Azure DevOps repository of a remote URL, or `null`. Accepts the four spellings Azure DevOps
+ * hands out — `https://[user@]dev.azure.com/<org>/<project>/_git/<repo>`,
+ * `https://<org>.visualstudio.com/[DefaultCollection/]<project>/_git/<repo>`,
+ * `git@ssh.dev.azure.com:v3/<org>/<project>/<repo>` and
+ * `<org>@vs-ssh.visualstudio.com:v3/<org>/<project>/<repo>` — and nothing looser. Userinfo is
+ * never kept. Every part is percent-decoded once and re-encoded, so the canonical URL is stable.
+ */
+export function adoRepoOf(url) {
+    const raw = (url ?? '').trim();
+    if (raw === '' || !isAdoHost(originRemoteHost(raw)))
+        return null;
+    let org;
+    let project;
+    let repo;
+    const dec = (s) => {
+        try {
+            return decodeURIComponent(s);
+        }
+        catch {
+            return null;
+        }
+    };
+    const ssh = /^(?:ssh:\/\/)?[^@/\s]+@(?:ssh\.dev\.azure\.com|vs-ssh\.visualstudio\.com)[:/](?:v3\/)([^/]+)\/([^/]+)\/([^/]+?)\/?$/i.exec(raw);
+    if (ssh !== null) {
+        [org, project, repo] = [ssh[1], ssh[2], ssh[3]];
+    }
+    else {
+        let u;
+        try {
+            u = new URL(raw);
+        }
+        catch {
+            return null;
+        }
+        if (u.protocol !== 'https:')
+            return null;
+        const host = u.hostname.toLowerCase();
+        const segs = u.pathname.split('/').filter((x) => x !== '');
+        const gitAt = segs.indexOf('_git');
+        if (gitAt < 0 || gitAt !== segs.length - 2)
+            return null;
+        if (host === 'dev.azure.com') {
+            if (gitAt !== 2)
+                return null;
+            [org, project, repo] = [segs[0], segs[1], segs[3]];
+        }
+        else if (host.endsWith('.visualstudio.com')) {
+            org = host.slice(0, -'.visualstudio.com'.length);
+            const rest = segs.slice(0, gitAt).filter((s, i) => !(i === 0 && s.toLowerCase() === 'defaultcollection'));
+            if (rest.length !== 1)
+                return null;
+            [project, repo] = [rest[0], segs[gitAt + 1]];
+        }
+        else {
+            return null;
+        }
+    }
+    const parts = [org, project, repo.replace(/\.git$/i, '')].map(dec);
+    if (parts.some((p) => p === null || p === '' || !ADO_PART.test(p)))
+        return null;
+    const [o, p, r] = parts;
+    const e = encodeURIComponent;
+    const webUrl = `https://dev.azure.com/${e(o)}/${e(p)}/_git/${e(r)}`;
+    return {
+        org: o,
+        project: p,
+        repo: r,
+        gitUrl: webUrl,
+        apiBase: `https://dev.azure.com/${e(o)}/${e(p)}/_apis/git/repositories/${e(r)}`,
+        webUrl,
+        loginBase: 'https://login.microsoftonline.com',
+    };
+}
+/** The provider a delivery to `originUrl` uses, or `null` (push-only / local / unknown). */
+export function deliverProviderOf(originUrl) {
+    const host = originRemoteHost((originUrl ?? '').trim());
+    if (host === null)
+        return null;
+    if (host === 'github.com' || host === 'ssh.github.com')
+        return 'github';
+    if (adoRepoOf(originUrl) !== null)
+        return 'azure_devops';
+    return null;
+}
+/** The credential preflight a deliver card shows for an origin; `null` when no provider applies. */
+export function deliverCredentialsFor(originUrl, env, ghLogins) {
+    const provider = deliverProviderOf(originUrl);
+    if (provider === 'azure_devops')
+        return adoCredentials(env);
+    if (provider === 'github')
+        return githubCredentials(env, ghLogins);
+    return null;
+}
+/** `deliver: CREDENTIALS-MISSING <provider>` in a deliver transcript → that provider, else `null`.
+ *  The LAST such line decides; the script prints it before anything reaches the remote. */
+export function credentialsMissingIn(text) {
+    let found = null;
+    for (const line of text.split('\n')) {
+        const m = /^deliver: CREDENTIALS-MISSING (github|azure_devops)\b/.exec(line.trim());
+        if (m !== null)
+            found = m[1];
+    }
+    return found;
+}
+/**
+ * {@link deliverCredentialsFor} with the gh probe run only when it can matter: a github.com origin
+ * with no exported GH_TOKEN (a bounded `gh auth status`, crew#737's probe). gh not installed reads
+ * `'absent'`; a probe that timed out reads unknown. Never throws.
+ */
+export async function deliverCredentialsProbe(originUrl, env, probe = ghLoginsOrAbsent) {
+    const provider = deliverProviderOf(originUrl);
+    if (provider === null)
+        return null;
+    if (provider === 'azure_devops' || present(env, 'GH_TOKEN'))
+        return deliverCredentialsFor(originUrl, env, null);
+    const logins = await probe().catch(() => null);
+    return deliverCredentialsFor(originUrl, env, logins);
+}
+/** `gh auth status --hostname github.com` → the logins, `'absent'` when gh is not installed (spawn
+ *  ENOENT), `null` when it could not answer. Bounded to 4 s; one answer serves 30 s. */
+let ghMemo = null;
+/** How long one gh answer serves the launch composer and the gate card (a sign-in is rare). */
+const GH_MEMO_MS = 30_000;
+export function ghLoginsOrAbsent() {
+    const now = Date.now();
+    if (ghMemo !== null && now - ghMemo.at < GH_MEMO_MS)
+        return ghMemo.value;
+    const value = ghLoginsUncached();
+    ghMemo = { at: now, value };
+    return value;
+}
+function ghLoginsUncached() {
+    return new Promise((resolve) => {
+        execFile('gh', ['auth', 'status', '--hostname', 'github.com'], { timeout: 4_000, encoding: 'utf8', env: childEnvWithBootEstateDb(process.env) }, (err, stdout, stderr) => {
+            const code = err?.code;
+            if (code === 'ENOENT')
+                return resolve('absent');
+            // A non-numeric code (a timeout kill, another spawn failure) is no answer at all.
+            if (err !== null && typeof code !== 'number')
+                return resolve(null);
+            resolve(parseGhAuthStatusLogins(`${String(stdout ?? '')}\n${String(stderr ?? '')}`));
+        });
+    });
+}
+/** The canonical `missing` reading for a provider — what the run record says after the deliver
+ *  phase refused for want of the credential (the phase read the environment it ran in). */
+export function missingCredentials(provider) {
+    return provider === 'azure_devops' ? adoCredentials({}) : githubCredentials({}, []);
+}
+//# sourceMappingURL=deliver-credentials.js.map

package/dist/core/deliver-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliver-credentials.js","sourceRoot":"","sources":["../../src/core/deliver-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,4FAA4F;AAC5F,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAmBjE,iGAAiG;AACjG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,wBAAwB,CAAU,CAAC;AAC1G,MAAM,CAAC,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,8BAA8B,CAAC;AAEjF,SAAS,OAAO,CAAC,GAAsB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,qHAAqH,EAAE,CAAC;IACtO,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,sDAAsD,WAAW,IAAI,EAAE,CAAC;IACxK,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO;QACL,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,CAAC,GAAG,SAAS,EAAE,WAAW,CAAC;QACpC,OAAO,EACL,gDAAgD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,WAAW,GAAG;YAChH,2JAA2J;KAC9J,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAsB,EAAE,MAA2C;IACnG,IAAI,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC;IAC3J,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,0GAA0G,EAAE,CAAC;IACnM,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,sDAAsD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7K,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;QACtC,OAAO,EACL,sCAAsC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,wCAAwC,2BAA2B;YAC5J,mMAAmM;KACtM,CAAC;AACJ,CAAC;AAiBD,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAE1C,mGAAmG;AACnG,MAAM,UAAU,SAAS,CAAC,IAAmB;IAC3C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,OAAO,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,mBAAmB,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AAC3H,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,GAA8B;IACtD,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,GAAW,CAAC;IAChB,IAAI,OAAe,CAAC;IACpB,IAAI,IAAY,CAAC;IACjB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAiB,EAAE;QACvC,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,sHAAsH,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7I,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,IAAI,CAAM,CAAC;QACX,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QACxD,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC9C,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,mBAAmB,CAAC,CAAC,CAAC;YAC1G,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnC,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAiC,CAAC;IACpD,MAAM,CAAC,GAAG,kBAAkB,CAAC;IAC7B,MAAM,MAAM,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,OAAO;QACL,GAAG,EAAE,CAAC;QACN,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE;QAC/E,MAAM;QACN,SAAS,EAAE,mCAAmC;KAC/C,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAC,SAAoC;IACpE,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,QAAQ,CAAC;IACxE,IAAI,SAAS,CAAC,SAAS,CAAC,KAAK,IAAI;QAAE,OAAO,cAAc,CAAC;IACzD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,qBAAqB,CACnC,SAAoC,EACpC,GAAsB,EACtB,QAA6C;IAE7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,cAAc;QAAE,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,KAAK,GAA2B,IAAI,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,KAAK,IAAI;YAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAoB,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAoC,EACpC,GAAsB,EACtB,QAAmD,gBAAgB;IAEnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,QAAQ,KAAK,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC;QAAE,OAAO,qBAAqB,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAChH,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,qBAAqB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;wFACwF;AACxF,IAAI,MAAM,GAAsE,IAAI,CAAC;AACrF,+FAA+F;AAC/F,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,MAAM,KAAK,IAAI,IAAI,GAAG,GAAG,MAAM,CAAC,EAAE,GAAG,UAAU;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACzE,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACvK,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;YACtD,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;YAChD,kFAAkF;YAClF,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YACnE,OAAO,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,kBAAkB,CAAC,QAAyB;IAC1D,OAAO,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACtF,CAAC"}

package/dist/core/deliver.d.ts

@@ -84,6 +84,7 @@
  *     {@link deliverPrPhase}.
  */
 import type { PhaseDef, WorkflowDef } from './types.js';
+import { type AdoRepo, type DeliverCredentials } from './deliver-credentials.js';
 import { type DeliverTextFacts } from './deliver-text.js';
 /**
  * The content-address of wicked-core's built-in evidence floor (`builtin_floors::EVIDENCE_FLOOR_PIN`,
@@ -213,6 +214,12 @@ export interface DeliverScriptOptions {
     /** (crew#739) The sentinel nonce (16-64 hex digits). Absent ⇒ a fresh one per composition; a
      *  test passes one to read the sentinel deterministically. Refused at compose time otherwise. */
     nonce?: string;
+    /** (crew#720) The Azure DevOps repository this delivery goes to. Absent ⇒ derived from
+     *  `originUrl` ({@link adoRepoOf}); a test passes one to point the push and the REST calls at a
+     *  local git server and a mocked API. `null` ⇒ not an Azure DevOps delivery. */
+    adoTarget?: AdoRepo | null;
+    /** (crew#720) The provider credential preflight read at compose time, for the gate card. */
+    credentials?: DeliverCredentials | null;
 }
 /**
  * (crew#737) The configured push identity for a launch on `repoRef`: the repository's own pin
@@ -473,6 +480,8 @@ export interface DeliverTargetView {
     githubRepo: string | null;
     /** {@link newPrTargetSentence} for the launch (no run yet): the deliver gate's own sentence. */
     sentence: string;
+    /** (crew#720) `org/project/repo` for an Azure DevOps origin; `null` otherwise. */
+    adoRepo: string | null;
 }
 /** The launch-time reading of the same origin preflight the deliver gate uses (R3, crew#730). */
 export declare function deliverTargetView(originUrl: string | null | undefined): DeliverTargetView;
@@ -518,6 +527,8 @@ export interface DeliverLaunchContext {
     deliverIdentitySource?: 'repo' | 'setting';
     /** (crew#737) Whether it is signed in to gh here (`null`/absent = unknown). */
     deliverIdentitySignedIn?: boolean | null;
+    /** (crew#720) The provider credential preflight for the gate card (`null`/absent = none read). */
+    credentials?: DeliverCredentials | null;
 }
 /**
  * The `deliver` PLAN STEP a delivering PRESET launch hands the engine (DES-TEAMING-002 T3,

package/dist/core/deliver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deliver.d.ts","sourceRoot":"","sources":["../../src/core/deliver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAExD,OAAO,EAQL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AAErD,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAE1C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,2BAA2B,CAAC;AAErE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,2BAA2B,CAAC;AAErE;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAEnE;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AACzD,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AACjD,kGAAkG;AAClG,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;AAClF,4DAA4D;AAC5D,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAOtE;AAED;yDACyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;0EACsE;IACtE,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;uFACmF;IACnF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;kGAE8F;IAC9F,SAAS,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACtC;2DACuD;IACvD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iGAAiG;IACjG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;wBAKoB;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;+FAI2F;IAC3F,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;sGACkG;IAClG,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C;;uFAEmF;IACnF,uBAAuB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACzC;qGACiG;IACjG,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE;IAAE,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;CAAE,EACnH,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACjC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAI/C;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,SAAe,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAcpF;AAED;qEACqE;AACrE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAM9D;AAED;;4FAE4F;AAC5F,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,mGAAmG;AACnG,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAKD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAMD;;;;wCAIwC;AACxC,eAAO,MAAM,0BAA0B,2FACmD,CAAC;AAE3F,qFAAqF;AACrF,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,mBAAmB,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,qGAAqG;AACrG,MAAM,MAAM,MAAM,GAAG,CACnB,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACrC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC;AAEtE,eAAO,MAAM,aAAa,EAAE,MAQxB,CAAC;AAEL;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBnF;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,MAAsB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CAgChC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,2CAA2C,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,oGAAoG;AACpG,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CASlH;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,iDAAiD,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,iCAAiC,CAAC;AAEnE;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAMrD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIjE;AAkBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB,GAAG,MAAM,CAqpBxF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,cAAc,CAC5B,SAAS,GAAE,MAAM,EAAO,EACxB,MAAM,CAAC,EAAE,MAAM,EACf,IAAI,GAAE,oBAAyB,GAC9B,QAAQ,CAoBV;AAED;;;;;;GAMG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEtE;kEACkE;AAClE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmB3D;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,CAKvF;AAiBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAkB1E;AAED;sGACsG;AACtG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAoBhF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAsCvG;AAED;8FAC8F;AAC9F,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,mBAAmB,CAAC;IAC5B;iGAC6F;IAC7F,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,CAOzF;AAED;sFACsF;AACtF,wBAAgB,cAAc,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACtF,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,OAAO,EAAE,MAAM,GACd,CAAC,GAAG,SAAS,CAQf;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAyB1E;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uFAAuF;IACvF,SAAS,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACtC,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gFAAgF;IAChF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;oFACgF;IAChF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,6FAA6F;IAC7F,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,6FAA6F;IAC7F,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,+EAA+E;IAC/E,uBAAuB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB;AAC/B,+DAA+D;AAC/D,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,QAAQ,EAAE,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,GAAE,oBAAyB,GAChC;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CA+BjH;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,GAAE,oBAAyB,GAChC,WAAW,CAgDb;AAED,8FAA8F;AAC9F,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAC1C;wFACwF;AACxF,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD;;qDAEqD;AACrD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,MAAM,CAG5E;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,CAKpI"}
+{"version":3,"file":"deliver.d.ts","sourceRoot":"","sources":["../../src/core/deliver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAExD,OAAO,EAA0E,KAAK,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEzJ,OAAO,EAQL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AAErD,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAE1C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,2BAA2B,CAAC;AAErE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,2BAA2B,CAAC;AAErE;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAEnE;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AACzD,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AACjD,kGAAkG;AAClG,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;AAClF,4DAA4D;AAC5D,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAOtE;AAED;yDACyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;0EACsE;IACtE,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;uFACmF;IACnF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;kGAE8F;IAC9F,SAAS,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACtC;2DACuD;IACvD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iGAAiG;IACjG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;wBAKoB;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;+FAI2F;IAC3F,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;sGACkG;IAClG,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C;;uFAEmF;IACnF,uBAAuB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACzC;qGACiG;IACjG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;oFAEgF;IAChF,SAAS,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3B,4FAA4F;IAC5F,WAAW,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE;IAAE,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;CAAE,EACnH,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACjC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAI/C;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,SAAe,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAcpF;AAED;qEACqE;AACrE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAM9D;AAED;;4FAE4F;AAC5F,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,mGAAmG;AACnG,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAKD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAMD;;;;wCAIwC;AACxC,eAAO,MAAM,0BAA0B,2FACmD,CAAC;AAE3F,qFAAqF;AACrF,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,mBAAmB,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,qGAAqG;AACrG,MAAM,MAAM,MAAM,GAAG,CACnB,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACrC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC;AAEtE,eAAO,MAAM,aAAa,EAAE,MAQxB,CAAC;AAEL;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBnF;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,MAAsB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CAgChC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,2CAA2C,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,oGAAoG;AACpG,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CASlH;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,iDAAiD,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,iCAAiC,CAAC;AAEnE;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAMrD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIjE;AAkBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB,GAAG,MAAM,CAquBxF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,cAAc,CAC5B,SAAS,GAAE,MAAM,EAAO,EACxB,MAAM,CAAC,EAAE,MAAM,EACf,IAAI,GAAE,oBAAyB,GAC9B,QAAQ,CAoBV;AAED;;;;;;GAMG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEtE;kEACkE;AAClE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmB3D;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,CAKvF;AAiBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAkB1E;AAED;sGACsG;AACtG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAoBhF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CA6CvG;AAED;8FAC8F;AAC9F,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,mBAAmB,CAAC;IAC5B;iGAC6F;IAC7F,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,CAQzF;AAED;sFACsF;AACtF,wBAAgB,cAAc,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACtF,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,OAAO,EAAE,MAAM,GACd,CAAC,GAAG,SAAS,CAQf;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAwC1E;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uFAAuF;IACvF,SAAS,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACtC,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gFAAgF;IAChF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;oFACgF;IAChF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,6FAA6F;IAC7F,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,6FAA6F;IAC7F,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,+EAA+E;IAC/E,uBAAuB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACzC,kGAAkG;IAClG,WAAW,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB;AAC/B,+DAA+D;AAC/D,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,QAAQ,EAAE,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,GAAE,oBAAyB,GAChC;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAgCjH;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,GAAE,oBAAyB,GAChC,WAAW,CAiDb;AAED,8FAA8F;AAC9F,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAC1C;wFACwF;AACxF,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD;;qDAEqD;AACrD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,MAAM,CAG5E;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,CAKpI"}