@bevel-software/platform-core-backend 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/assets.d.ts

@@ -0,0 +1,5 @@
+/** Absolute path of the packaged core Drizzle migrations folder. */
+export declare function coreMigrationsDir(): string;
+/** Absolute path of the packaged KB seed template (`kb-template/`). */
+export declare function defaultKbTemplateDir(): string;
+//# sourceMappingURL=assets.d.ts.map

package/dist/assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../src/assets.ts"],"names":[],"mappings":"AAgBA,oEAAoE;AACpE,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/assets.js

@@ -0,0 +1,23 @@
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+/**
+ * Locations of the assets shipped INSIDE this package (`files` in
+ * package.json): the squashed core migration history (`migrations/`) and the
+ * KB seed template (`kb-template/`). Both live at the PACKAGE ROOT, and this
+ * module is a direct child of either `src/` (in-repo / tsx) or `dist/`
+ * (compiled) — so one `..` hop from the module URL reaches the package root
+ * in BOTH layouts. Resolved lazily so bundlers that rewrite `import.meta.url`
+ * still get a sensible answer at call time.
+ */
+function packageRoot() {
+    return fileURLToPath(new URL('..', import.meta.url));
+}
+/** Absolute path of the packaged core Drizzle migrations folder. */
+export function coreMigrationsDir() {
+    return path.join(packageRoot(), 'migrations');
+}
+/** Absolute path of the packaged KB seed template (`kb-template/`). */
+export function defaultKbTemplateDir() {
+    return path.join(packageRoot(), 'kb-template');
+}
+//# sourceMappingURL=assets.js.map

package/dist/assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../src/assets.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;GAQG;AACH,SAAS,WAAW;IAClB,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,YAAY,CAAC,CAAC;AAChD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC"}

package/dist/core/core-ports.d.ts

@@ -0,0 +1,83 @@
+import type { ISessionSink } from '../modules/workspace/session-sink.js';
+import type { ISystemNoticeSink, RecoveryAgentRunner } from '../modules/workflow/pending-commits.worker.js';
+import type { ILlmUsageMeter } from '../modules/tool-auth/llm-usage-meter.js';
+import type { AuthProviderPlugin } from '../modules/auth/auth.routes.js';
+import type { IErasureParticipant } from '../modules/auth/account-erasure.service.js';
+/**
+ * Every seam the enterprise overlay can fill in the CORE composition
+ * (`createCoreServices`). All fields are optional; each has a safe core-only
+ * default, so `createCoreServices(config)` with no ports yields a fully
+ * working core deployment.
+ *
+ * Two consumption patterns exist, and they matter for wiring order:
+ *
+ * - CONSTRUCTION-TIME ports (`recoveryAgent`, `systemNotice`,
+ *   `erasureParticipants`): dereferenced while core services are being
+ *   constructed. Enterprise implementations of these need core services that
+ *   don't exist yet at that point (the background-agent factory, the thread
+ *   service, …), so the enterprise root passes FORWARDING DELEGATORS / a
+ *   mutable array here and assigns the real targets right after
+ *   `createCoreServices` returns. That is safe because core only *calls* these
+ *   ports at request/commit/erasure time, long after boot — the same
+ *   late-binding pattern the composition root already uses for e.g. the MCP
+ *   OAuth revoke closure.
+ *
+ * - SERVER-TIME seams (`sessionSink`, `usageMeter`, `authProviders`): only
+ *   read when `createCoreServer` mounts routes / registers tools. Core seeds
+ *   them onto `CoreServices` from these ports (with the defaults below); the
+ *   enterprise root overwrites the `CoreServices` fields (or pushes into the
+ *   `authProviders` array) after construction, before the server is built.
+ *
+ * (Commit-time KB validation and the ontology write block are NOT ports:
+ * they are workflow lifecycle HOOKS the enterprise root registers on
+ * `workflowService.hooks` after construction — see
+ * `modules/workflow/workflow-hooks.ts`.)
+ */
+export interface CorePorts {
+    /**
+     * Backs the `start_session` tool. Core default: {@link UuidSessionSink}
+     * (a bare random id). Enterprise substitutes a sink that mints a real chat
+     * thread so the same id works end to end with `ask`.
+     */
+    sessionSink?: ISessionSink;
+    /**
+     * Recovery-agent dispatcher for the pending-commits worker. The worker
+     * requires one, so the core default is {@link noopRecoveryAgent} — a run
+     * that just returns, meaning the row stays pending until the recovery
+     * budget is exhausted and the worker escalates via `systemNotice`.
+     */
+    recoveryAgent?: RecoveryAgentRunner;
+    /**
+     * Where the pending-commits worker escalates terminal failures. Core
+     * default: {@link consoleSystemNoticeSink} (stderr, no dashboard).
+     * Enterprise passes its feedback service.
+     */
+    systemNotice?: ISystemNoticeSink;
+    /**
+     * Per-connection-key LLM usage metering shown on the connection-key
+     * management routes. Core default: {@link unmeteredLlmUsage} (no proxy,
+     * nothing to meter). Enterprise passes the LLM proxy's usage service.
+     */
+    usageMeter?: ILlmUsageMeter;
+    /**
+     * SSO login plugins the auth router mounts. Core default: `[]` (password
+     * login only). The array instance is kept on `CoreServices.authProviders`,
+     * so an enterprise root may pass an array it fills after construction.
+     */
+    authProviders?: AuthProviderPlugin[];
+    /**
+     * Module-owned GDPR-erasure slices run by `AccountErasureService`. Core
+     * default: `[]` (core erases only the rows it owns). The array reference is
+     * held — not copied — so an enterprise root may pass an array it fills after
+     * construction (participants are only iterated at erasure time).
+     */
+    erasureParticipants?: IErasureParticipant[];
+}
+/**
+ * Core default recovery agent: does nothing. The worker's retry ladder still
+ * works — a stuck row burns its recovery budget on these no-op runs and then
+ * escalates to the `systemNotice` sink, which is exactly the "no recovery
+ * agent available" behavior a core-only deployment wants.
+ */
+export declare const noopRecoveryAgent: RecoveryAgentRunner;
+//# sourceMappingURL=core-ports.d.ts.map

package/dist/core/core-ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-ports.d.ts","sourceRoot":"","sources":["../../src/core/core-ports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;OAIG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACrC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC7C;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,mBAI/B,CAAC"}

package/dist/core/core-ports.js

@@ -0,0 +1,12 @@
+/**
+ * Core default recovery agent: does nothing. The worker's retry ladder still
+ * works — a stuck row burns its recovery budget on these no-op runs and then
+ * escalates to the `systemNotice` sink, which is exactly the "no recovery
+ * agent available" behavior a core-only deployment wants.
+ */
+export const noopRecoveryAgent = {
+    async run() {
+        // Intentionally empty — see doc comment.
+    },
+};
+//# sourceMappingURL=core-ports.js.map

package/dist/core/core-ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-ports.js","sourceRoot":"","sources":["../../src/core/core-ports.ts"],"names":[],"mappings":"AAgFA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwB;IACpD,KAAK,CAAC,GAAG;QACP,yCAAyC;IAC3C,CAAC;CACF,CAAC"}

package/dist/core/create-core-server.d.ts

@@ -0,0 +1,62 @@
+import express from 'express';
+import type { Router, RequestHandler } from 'express';
+import type { SessionOntologyGate } from '../modules/workspace/session-ontology.gate.js';
+import type { CoreServices } from './create-core-services.js';
+type ExpressApp = ReturnType<typeof express>;
+/**
+ * The context handed to {@link ServerExtensions.tools}: everything an overlay
+ * needs to register its own tool defs + endpoint routes on the unified tool
+ * surface, exactly like the core modules do.
+ */
+export interface ToolSurfaceCtx {
+    registry: CoreServices['toolRegistry'];
+    router: Router;
+    toolAuth: RequestHandler;
+    toolHandler: CoreServices['toolHandlerFactory'];
+    /** Shared ontology-session boundary gate config (file tools + graph tools). */
+    sessionOntologyGate: SessionOntologyGate;
+    core: CoreServices;
+}
+/**
+ * The hook points an overlay (the enterprise app) uses to add its surfaces to
+ * the core server. Each hook maps to a fixed slot in the LOAD-BEARING mount
+ * order encoded in {@link createCoreServer} — the order comments there explain
+ * why each slot sits where it does (Express 5 fires outer middleware before
+ * route matching, so pre-JWT surfaces MUST mount before the JWT `/api` mounts).
+ */
+export interface ServerExtensions {
+    /**
+     * Request paths the global 10 MB JSON body parser must skip because the
+     * overlay's own router installs a larger parser for them (body-parser
+     * ignores a second parse once the first has run — see the comment at the
+     * parser below).
+     */
+    jsonParserExemptPaths?: string[];
+    /**
+     * Boot-time side effects that belong to the server lifecycle (startup
+     * reconciles, periodic sweeps). Runs after health/cors/json are installed,
+     * before any routes mount.
+     */
+    onBoot?(core: CoreServices): Promise<void> | void;
+    /** Un-authed overlay surfaces (e.g. OAuth callbacks hit by provider redirects). */
+    preAuth?(app: ExpressApp, core: CoreServices): void;
+    /**
+     * Overlay tool registrations on the unified tool surface. Runs after the
+     * core registrations and BEFORE the manual routes mount, preserving the
+     * "manual snapshot stays complete" invariant.
+     */
+    tools?(ctx: ToolSurfaceCtx): void;
+    /**
+     * Non-JWT overlay surfaces that historically mount AFTER the tools router
+     * but before the JWT-protected `/api` routes (LLM proxy, embed, upload).
+     * A separate phase from `preAuth` purely to preserve today's exact order.
+     */
+    postTools?(app: ExpressApp, core: CoreServices): void;
+    /** JWT-protected overlay routes; mounted after every core authed route. */
+    authed?(app: ExpressApp, core: CoreServices): void;
+}
+export declare function createCoreServer(core: CoreServices, ext?: ServerExtensions, opts?: {
+    staticDir?: string;
+}): Promise<ExpressApp>;
+export {};
+//# sourceMappingURL=create-core-server.d.ts.map

package/dist/core/create-core-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-core-server.d.ts","sourceRoot":"","sources":["../../src/core/create-core-server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AAOzF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAE9D,KAAK,UAAU,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAChD,+EAA+E;IAC/E,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,IAAI,EAAE,YAAY,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,mFAAmF;IACnF,OAAO,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACpD;;;;OAIG;IACH,KAAK,CAAC,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,SAAS,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACtD,2EAA2E;IAC3E,MAAM,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;CACpD;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,YAAY,EAClB,GAAG,GAAE,gBAAqB,EAC1B,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,OAAO,CAAC,UAAU,CAAC,CAqPrB"}

package/dist/core/create-core-server.js

@@ -0,0 +1,204 @@
+import express from 'express';
+import cors from 'cors';
+import path from 'node:path';
+import { createAuthRoutes } from '../modules/auth/auth.routes.js';
+import { createWorkspaceRoutes } from '../modules/workspace/workspace.routes.js';
+import { createDiffRoutes } from '../modules/diff/diff.routes.js';
+import { createWorkflowRoutes } from '../modules/workflow/workflow.routes.js';
+import { createEventsRoutes } from '../modules/workflow/events.routes.js';
+import { createAccessRoutes } from '../modules/access/access.routes.js';
+import { createMcpRoutes } from '../modules/mcp/mcp.routes.js';
+import { createOAuthConsentRoutes } from '../modules/mcp/oauth/oauth-consent.routes.js';
+import { mcpAuthRouter } from '@modelcontextprotocol/sdk/server/auth/router.js';
+import { createManualRoutes } from '../modules/tool-registry/manual.routes.js';
+import { createToolManualsAgentRoutes, createToolManualsBrowserRoutes, registerToolManualsTools, } from '../modules/tool-manuals/index.js';
+import { registerWorkflowTools } from '../modules/workflow/agent-tools/workflow.tools.js';
+import { registerWorkspaceTools } from '../modules/workspace/workspace.tools.js';
+import { RECOVERY_BOT_EMAIL } from '../modules/workflow/recovery-bot.js';
+import { registerSkillsTools, createSkillsRoutes } from '../modules/skills/index.js';
+import { createSecretsVaultRoutes, createSecretsVaultPublicRoutes, } from '../modules/secrets-vault/index.js';
+import { createAdminAccessRoutes } from '../modules/admin/admin-access.routes.js';
+import { GIT_SHA } from '../version.js';
+export async function createCoreServer(core, ext = {}, opts = {}) {
+    const app = express();
+    // `credentials: true` so EventSource (`withCredentials: true`) can carry
+    // the `bevel_token` cookie set at login — the only auth path the
+    // EventSource API supports. `origin: true` reflects the request origin
+    // back in `Access-Control-Allow-Origin`, which the spec requires when
+    // credentials are in play (the wildcard `*` is refused alongside
+    // credentials). Cookie itself is `SameSite=Lax`, so a hostile cross-site
+    // page still can't read events on the user's behalf.
+    //
+    // `exposedHeaders` lets a BROWSER-based MCP client (e.g. MCP Inspector) read
+    // the Streamable-HTTP session header off the `initialize` response — custom
+    // response headers are hidden from browser JS unless exposed, so without this
+    // the client can't send `Mcp-Session-Id` back and every follow-up 400s with
+    // "session id does not match any active session". `WWW-Authenticate` is
+    // exposed so a browser client can read the 401 challenge and start the OAuth
+    // discovery flow. (Native clients like Claude Code aren't subject to CORS.)
+    app.use(cors({
+        origin: true,
+        credentials: true,
+        exposedHeaders: ['Mcp-Session-Id', 'Mcp-Protocol-Version', 'WWW-Authenticate'],
+    }));
+    // Global JSON body parser. Some overlay routes carry a whole document dump
+    // (e.g. the onboarding import), so their routers install their own larger
+    // parser — skip the global one for those paths (body-parser ignores a second
+    // parse once the first has run, so without this the 10 MB global limit would
+    // shadow the route's larger limit and 413 a large-but-valid upload before it
+    // ever reaches the route).
+    const jsonExemptPaths = new Set(ext.jsonParserExemptPaths ?? []);
+    const globalJson = express.json({ limit: '10mb' });
+    app.use((req, res, next) => {
+        if (jsonExemptPaths.has(req.path))
+            return next();
+        return globalJson(req, res, next);
+    });
+    // Health check. `sha` is the git commit this build was produced from
+    // (see version.ts) so the deploy pipeline can confirm a staging/production
+    // rollout matches the merged commit before smoke-testing it.
+    app.get('/api/health', (_req, res) => {
+        res.json({ status: 'ok', sha: GIT_SHA, timestamp: Date.now() });
+    });
+    // Overlay boot-time side effects (startup reconciles, periodic sweeps).
+    await ext.onBoot?.(core);
+    // Auth routes (unprotected — login endpoint must be accessible)
+    app.use('/api', createAuthRoutes(core.authService, core.authMiddleware, core.authProviders, core.config.loginPasswordEnabled));
+    // MCP routes must mount BEFORE every `app.use('/api', authMiddleware, …)`
+    // below: Express 5 fires the outer JWT middleware before deciding whether
+    // its router has a matching route, so a request to `POST /api/mcp` carrying
+    // a connection-key (non-JWT) bearer would otherwise be 401'd by the first
+    // protected mount before this router ever saw it.
+    app.use('/api', createMcpRoutes(core.mcpService, core.externalApiKeyService, core.mcpAuthMiddleware, core.authMiddleware, core.usageMeter));
+    // MCP OAuth 2.1 authorization server: /authorize, /token, /register,
+    // /revoke + the /.well-known metadata documents (the SDK requires an
+    // app-root mount for those paths). Un-authed by design — these endpoints
+    // are hit by MCP clients with no credentials yet and by bare browser
+    // navigations; the user attaches to the flow at the JWT/cookie-authed
+    // consent routes below. Must sit before the prod SPA catch-all or the
+    // .well-known documents would be swallowed by index.html.
+    app.use(mcpAuthRouter({
+        provider: core.mcpOAuthProvider,
+        issuerUrl: new URL(core.config.publicBackendUrl),
+        resourceServerUrl: new URL('/api/mcp', core.config.publicBackendUrl),
+        scopesSupported: ['mcp'],
+        resourceName: 'Bevel MCP',
+    }));
+    // Un-authed overlay surfaces (e.g. connector OAuth callbacks hit by a
+    // provider's browser redirect with no Authorization header).
+    ext.preAuth?.(app, core);
+    // Secrets Vault OAuth callback — also hit by a provider browser redirect with
+    // no Authorization header, so it mounts UN-AUTHED here, recovering the caller
+    // from the signed `state`. The authed CRUD/start routes mount later.
+    const secretsVaultRoutesDeps = {
+        secretsVault: core.secretsVaultService,
+        toolManualService: core.toolManualService,
+        accessControl: core.accessControl,
+        stateSecret: core.config.jwtSecret,
+        publicBackendUrl: core.config.publicBackendUrl,
+        publicFrontendUrl: core.config.publicFrontendUrl,
+    };
+    app.use('/api', createSecretsVaultPublicRoutes(secretsVaultRoutesDeps));
+    // Unified tool surface — the ONE catalog, served as two UTCP manuals + each
+    // tool's module-hosted endpoint, all behind the shared `toolAuth` (connection
+    // key OR internal token). Each module registers its tool defs + hosts its
+    // routes on this one router. Mount BEFORE the JWT `/api` mounts — connection-
+    // key / internal-token bearers would be 401'd by the outer JWT middleware
+    // otherwise. Manuals are added LAST so they snapshot the full catalog:
+    // core registrations first, then the overlay's (`ext.tools`), then the
+    // manual routes.
+    const toolsRouter = express.Router();
+    const ta = core.toolAuthMiddleware;
+    const th = core.toolHandlerFactory;
+    // Shared ontology-session boundary gate config, consumed by every tool
+    // surface that touches the KB (file tools + graph tools). The gate's
+    // blocking decision runs through the workflow hooks: core registers none
+    // (tracking only); the enterprise root registers the ontology block on
+    // `workflowService.hooks` before this server is built.
+    const sessionOntologyGate = {
+        service: core.sessionOntologyService,
+        enabled: core.config.ontologySessionBlock,
+        kbDirName: core.config.kbDirName,
+        recoveryBotEmail: RECOVERY_BOT_EMAIL,
+        hooks: core.workflowService.hooks,
+    };
+    registerWorkflowTools(core.toolRegistry, toolsRouter, ta, th);
+    registerWorkspaceTools(core.toolRegistry, toolsRouter, ta, th, core.spillStore, core.accessControl, core.config.kbDirName, sessionOntologyGate, core.routineWritePolicy, core.sessionSink);
+    registerSkillsTools(core.toolRegistry, toolsRouter, ta, th, core.skillService);
+    registerToolManualsTools(core.toolRegistry, toolsRouter, ta, th, core.toolManualService, {
+        accessControl: core.accessControl,
+        // The vault satisfies the module's local VariableStatusPort — `list_tool_setup`
+        // reports configuration booleans only; secret values never ride through tools.
+        variableStatus: core.secretsVaultService,
+    });
+    // Overlay tool registrations (defs + module-hosted endpoints).
+    ext.tools?.({
+        registry: core.toolRegistry,
+        router: toolsRouter,
+        toolAuth: ta,
+        toolHandler: th,
+        sessionOntologyGate,
+        core,
+    });
+    toolsRouter.use(createManualRoutes(core.toolRegistry, core.manualAuthMiddleware, async (userId) => (await core.authService.getUserById(userId))?.email));
+    // The aggregated manual list (KB + the caller's accessible `.tool`s) + inline
+    // `.tool` sub-manuals. Mounted on the tools router so they share `manualAuth`
+    // and sit before the JWT `/api` mounts.
+    toolsRouter.use(createToolManualsAgentRoutes(core.toolManualService, core.manualAuthMiddleware, async (userId) => (await core.authService.getUserById(userId))?.email));
+    app.use('/api', toolsRouter);
+    // Non-JWT overlay surfaces that sit between the tools router and the
+    // JWT-protected `/api` routes (LLM proxy, embed, upload — see the phase
+    // doc on ServerExtensions.postTools).
+    ext.postTools?.(app, core);
+    // Protected routes
+    app.use('/api', core.authMiddleware, createWorkspaceRoutes(core.workspaceService, core.authService, core.workflowService, core.eventBus, core.accessControl, core.config.kbDirName, core.creatorAccess));
+    // Workflow is the only branches / changes / change-request surface. The
+    // former /git/*, /pr/*, /pr/:n/* routes are gone — every consumer goes
+    // through /workflow/* now.
+    app.use('/api', core.authMiddleware, createWorkflowRoutes(core.workflowService, core.workspaceService, core.authService, core.eventBus));
+    // SSE event-bus surface. The route owns its own auth gating via the
+    // injected middleware (which accepts both Bearer and the `bevel_token`
+    // cookie — the cookie path is what makes EventSource work, since the
+    // browser API can't set headers). Mounted as its own app.use so it
+    // doesn't share an outer middleware chain with the JSON routes above.
+    app.use('/api', createEventsRoutes(core.eventBus, core.authMiddleware));
+    app.use('/api', core.authMiddleware, createDiffRoutes(core.diffService, core.authService, core.workflowService, core.accessControl, core.config.kbDirName));
+    app.use('/api', core.authMiddleware, createAccessRoutes(core.accessControl, core.workspaceService, core.authService, core.workflowService, core.eventBus, core.db, core.config.kbDirName));
+    app.use('/api', core.authMiddleware, createSkillsRoutes(core.skillService));
+    // Admin-status resolver (CORE — see the note in admin-access.routes.ts;
+    // the full admin router is an enterprise `ext.authed` extension).
+    app.use('/api', core.authMiddleware, createAdminAccessRoutes(core.adminAccess));
+    app.use('/api', core.authMiddleware, createToolManualsBrowserRoutes(core.toolManualService));
+    app.use('/api', core.authMiddleware, createSecretsVaultRoutes(secretsVaultRoutesDeps));
+    // The authed tail of the MCP OAuth flow: /connect calls these to describe
+    // the pending authorization and, on Finish, to mint the one-time code. The
+    // browser arrives via redirect with no Authorization header, so the JWT
+    // middleware's bevel_token-cookie fallback is what identifies the user.
+    app.use('/api', core.authMiddleware, createOAuthConsentRoutes({
+        provider: core.mcpOAuthProvider,
+        stateSecret: core.config.jwtSecret,
+    }));
+    // JWT-protected overlay routes.
+    ext.authed?.(app, core);
+    // In production, serve the frontend static build
+    if (opts.staticDir) {
+        const frontendDist = opts.staticDir;
+        app.use(express.static(frontendDist));
+        app.get('{*path}', (req, res) => {
+            // Non-SPA namespaces must NOT resolve to index.html. In particular, an
+            // OAuth well-known metadata URL the mcpAuthRouter doesn't serve (a variant
+            // the client probes, e.g. the root protected-resource or a path-suffixed
+            // authorization-server doc) would otherwise return `200 + HTML`, which an
+            // MCP client parses as JSON → "expected object, received undefined" and
+            // the whole connection fails. A clean 404 lets discovery fall through to
+            // the variant we do serve. Same reasoning for stray `/api/*` gets.
+            if (req.path.startsWith('/.well-known/') || req.path.startsWith('/api/')) {
+                res.status(404).json({ error: 'Not found' });
+                return;
+            }
+            res.sendFile(path.join(frontendDist, 'index.html'));
+        });
+    }
+    return app;
+}
+//# sourceMappingURL=create-core-server.js.map

package/dist/core/create-core-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-core-server.js","sourceRoot":"","sources":["../../src/core/create-core-server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErF,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA2DxC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAkB,EAClB,MAAwB,EAAE,EAC1B,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,yEAAyE;IACzE,iEAAiE;IACjE,uEAAuE;IACvE,sEAAsE;IACtE,iEAAiE;IACjE,yEAAyE;IACzE,qDAAqD;IACrD,EAAE;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,GAAG,CAAC,GAAG,CACL,IAAI,CAAC;QACH,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC;KAC/E,CAAC,CACH,CAAC;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,2BAA2B;IAC3B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACjD,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,2EAA2E;IAC3E,6DAA6D;IAC7D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAEzB,gEAAgE;IAChE,GAAG,CAAC,GAAG,CACL,MAAM,EACN,gBAAgB,CACd,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,CAAC,oBAAoB,CACjC,CACF,CAAC;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,kDAAkD;IAClD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAC7B,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,qBAAqB,EAC1B,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,UAAU,CAChB,CAAC,CAAC;IAEH,qEAAqE;IACrE,qEAAqE;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,0DAA0D;IAC1D,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;QACpB,QAAQ,EAAE,IAAI,CAAC,gBAAgB;QAC/B,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAChD,iBAAiB,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACpE,eAAe,EAAE,CAAC,KAAK,CAAC;QACxB,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAC,CAAC;IAEJ,sEAAsE;IACtE,6DAA6D;IAC7D,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEzB,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,sBAAsB,GAAG;QAC7B,YAAY,EAAE,IAAI,CAAC,mBAAmB;QACtC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;QAClC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAC9C,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;KACjD,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,8BAA8B,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAExE,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,iBAAiB;IACjB,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACnC,uEAAuE;IACvE,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,uDAAuD;IACvD,MAAM,mBAAmB,GAAG;QAC1B,OAAO,EAAE,IAAI,CAAC,sBAAsB;QACpC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;QACzC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;QAChC,gBAAgB,EAAE,kBAAkB;QACpC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK;KAClC,CAAC;IACF,qBAAqB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9D,sBAAsB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3L,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/E,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,iBAAiB,EAAE;QACvF,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gFAAgF;QAChF,+EAA+E;QAC/E,cAAc,EAAE,IAAI,CAAC,mBAAmB;KACzC,CAAC,CAAC;IACH,+DAA+D;IAC/D,GAAG,CAAC,KAAK,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI,CAAC,YAAY;QAC3B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,EAAE;QACf,mBAAmB;QACnB,IAAI;KACL,CAAC,CAAC;IACH,WAAW,CAAC,GAAG,CAAC,kBAAkB,CAChC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,oBAAoB,EACzB,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CACtE,CAAC,CAAC;IACH,8EAA8E;IAC9E,8EAA8E;IAC9E,wCAAwC;IACxC,WAAW,CAAC,GAAG,CAAC,4BAA4B,CAC1C,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,oBAAoB,EACzB,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CACtE,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE7B,qEAAqE;IACrE,wEAAwE;IACxE,sCAAsC;IACtC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3B,mBAAmB;IACnB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,qBAAqB,CACxD,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,CAAC,SAAS,EACrB,IAAI,CAAC,aAAa,CACnB,CAAC,CAAC;IACH,wEAAwE;IACxE,uEAAuE;IACvE,2BAA2B;IAC3B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,oBAAoB,CACvD,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,QAAQ,CACd,CAAC,CAAC;IACH,oEAAoE;IACpE,uEAAuE;IACvE,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACxE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CACnD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,CAAC,SAAS,CACtB,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,CACrD,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,MAAM,CAAC,SAAS,CACtB,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5E,wEAAwE;IACxE,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,8BAA8B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC7F,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACvF,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC;QAC5D,QAAQ,EAAE,IAAI,CAAC,gBAAgB;QAC/B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;KACnC,CAAC,CAAC,CAAC;IAEJ,gCAAgC;IAChC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAExB,iDAAiD;IACjD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9B,uEAAuE;YACvE,2EAA2E;YAC3E,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}