@bevel-software/platform-core-backend 0.1.0

package/dist/modules/workflow/pending-commits.worker.d.ts

@@ -0,0 +1,148 @@
+/**
+ * Background worker that drains the `pending_commits` queue: claims a row,
+ * runs `commitFile + pushWithRecovery` against the workspace, and either
+ * deletes the row (success) or schedules a retry (transient failure) or a
+ * recovery-agent run (exhausted transient budget). After the
+ * recovery-agent ceiling we escalate to a `'system'` feedback notice.
+ *
+ * Design context: `lock-decoupling-plan.md`.
+ *
+ * One worker per backend process; we don't currently run multi-replica
+ * backends, so a single drain loop is fine. The `claimNext` SQL uses
+ * `FOR UPDATE SKIP LOCKED` so a future multi-replica deployment can run
+ * multiple workers without double-processing rows.
+ *
+ * Concurrency: at most one commit in flight at a time across all
+ * workspaces. We could parallelise across workspaces (different
+ * `mutex.run` keys), but the current commit volume is comfortably
+ * sequential and the simpler shape catches more potential bugs.
+ */
+import type { AuthUser } from '@bevel-software/platform-shared';
+import type { PendingCommitsService, WorkspaceDescriptor } from './pending-commits.service.js';
+import { BACKOFF_MS, N_RECOVERY, N_TRANSIENT } from './pending-commits.service.js';
+/**
+ * Where the worker escalates terminal failures — the narrow, workflow-owned
+ * slice of whatever notice sink the app provides. The enterprise app passes
+ * its feedback service (structurally compatible: its `send` accepts a wider
+ * source union); a core-only deployment can pass
+ * {@link consoleSystemNoticeSink}, which just logs.
+ */
+export interface ISystemNoticeSink {
+    send(notice: {
+        source: 'system';
+        user: {
+            id: string;
+            email: string;
+            name: string;
+        };
+        message: string;
+    }): Promise<void>;
+}
+/** Core default: terminal-failure notices go to stderr (no dashboard). */
+export declare const consoleSystemNoticeSink: ISystemNoticeSink;
+/**
+ * The recovery-agent dispatcher the worker calls when a row exhausts its
+ * transient budget. Pulled behind an interface so the unit tests can
+ * substitute a fake without bringing the entire BackgroundAgentFactory
+ * along.
+ */
+export interface RecoveryAgentRunner {
+    /**
+     * Kick off one recovery-agent run for a stuck pending commit. The
+     * agent's commits enqueue normal `pending_commits` rows that the
+     * worker drains on subsequent passes — that's how the recovery
+     * commits AND the original orphan both land.
+     *
+     * Implementations should await the agent's terminal step before
+     * returning so the worker's retry budget counts whole runs, not
+     * mid-stream tool calls.
+     */
+    run(input: {
+        workspaceId: string;
+        branch: string;
+        path: string;
+        lastError: string;
+        originalAuthorEmail: string;
+    }): Promise<void>;
+}
+/**
+ * Workflow surface the worker depends on. A subset of the real
+ * `WorkflowService` — pulled behind an interface so tests can stub the
+ * commit/push pipeline without spinning up a real git workspace.
+ */
+export interface WorkflowCommitDriver {
+    /**
+     * Commit whatever's currently on disk for `path`, then push the branch.
+     * Uses `pushWithRecovery` semantics internally (cooperative pull-rebase
+     * on non-FF). Throws when commit / push terminally fail; the worker
+     * catches and decides whether to retry or escalate.
+     */
+    runPendingCommit(workspaceId: string, branch: string, path: string, user: AuthUser): Promise<void>;
+}
+/**
+ * Source of workspaces to poll. The real implementation reads
+ * `WorkspaceService.branchDirs.keys()` — the in-memory cache of
+ * already-bootstrapped branches. Lazy-bootstrapped workspaces show up
+ * here as soon as `getOrCreateForBranch` resolves, so a freshly-touched
+ * branch's commits start draining within one poll interval.
+ */
+export interface WorkspaceProvider {
+    knownWorkspaces(): Iterable<WorkspaceDescriptor>;
+}
+export interface PendingCommitsWorkerDeps {
+    service: PendingCommitsService;
+    workflow: WorkflowCommitDriver;
+    recoveryAgent: RecoveryAgentRunner;
+    feedback: ISystemNoticeSink;
+    workspaces: WorkspaceProvider;
+    /**
+     * The synthetic identity used for `'system'` feedback notices when a
+     * row terminally fails. Author of the recovery commits themselves is
+     * the recovery agent's own configured user — that's a separate concern.
+     */
+    recoveryBot: {
+        id: string;
+        email: string;
+        name: string;
+    };
+    /** Test seam — defaults to `Date.now`. */
+    now?: () => Date;
+    /** Test seam — defaults to `setTimeout` wrapped as a promise. */
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare class PendingCommitsWorker {
+    private readonly deps;
+    private running;
+    private loopPromise;
+    private stopSignal;
+    constructor(deps: PendingCommitsWorkerDeps);
+    /**
+     * Start the drain loop. Idempotent — a second `start()` while the
+     * worker is already running is a no-op.
+     */
+    start(): void;
+    /**
+     * Stop the drain loop. Awaits the in-flight pass (so a commit
+     * mid-flight gets to finish or fail naturally), then resolves.
+     * Idempotent.
+     */
+    stop(): Promise<void>;
+    /**
+     * Run one drain pass: rotate through known workspaces, claim+process
+     * one row from each. Exposed publicly so tests can step the loop
+     * deterministically without driving `setTimeout`.
+     */
+    drainOnce(): Promise<void>;
+    private runLoop;
+    private interruptibleSleep;
+    /**
+     * Process a single claimed row. Outcome paths (see plan §lifecycle):
+     *   - commit + push succeeds → delete the row.
+     *   - throws, transient budget remains → markTransientFailure.
+     *   - throws, transient exhausted, recovery budget remains → spawn agent.
+     *   - throws, recovery exhausted → markNeedsAttention + feedback notice.
+     */
+    private processRow;
+}
+export { BACKOFF_MS, N_RECOVERY, N_TRANSIENT };
+//# sourceMappingURL=pending-commits.worker.d.ts.map

package/dist/modules/workflow/pending-commits.worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-commits.worker.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/pending-commits.worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAEV,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAGnF;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,MAAM,EAAE;QACX,MAAM,EAAE,QAAQ,CAAC;QACjB,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QAClD,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,EAAE,iBAIrC,CAAC;AASF;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;OASG;IACH,GAAG,CAAC,KAAK,EAAE;QACT,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,gBAAgB,CACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,eAAe,IAAI,QAAQ,CAAC,mBAAmB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,aAAa,EAAE,mBAAmB,CAAC;IACnC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,UAAU,EAAE,iBAAiB,CAAC;IAC9B;;;;OAIG;IACH,WAAW,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,iEAAiE;IACjE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAEnB;IACF,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,UAAU,CAAwC;gBAE9C,IAAI,EAAE,wBAAwB;IAQ1C;;;OAGG;IACH,KAAK,IAAI,IAAI;IAMb;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAa3B;;;;OAIG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;YAWlB,OAAO;YAkBP,kBAAkB;IAUhC;;;;;;OAMG;YACW,UAAU;CAsFzB;AA8CD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC"}

package/dist/modules/workflow/pending-commits.worker.js

@@ -0,0 +1,245 @@
+/**
+ * Background worker that drains the `pending_commits` queue: claims a row,
+ * runs `commitFile + pushWithRecovery` against the workspace, and either
+ * deletes the row (success) or schedules a retry (transient failure) or a
+ * recovery-agent run (exhausted transient budget). After the
+ * recovery-agent ceiling we escalate to a `'system'` feedback notice.
+ *
+ * Design context: `lock-decoupling-plan.md`.
+ *
+ * One worker per backend process; we don't currently run multi-replica
+ * backends, so a single drain loop is fine. The `claimNext` SQL uses
+ * `FOR UPDATE SKIP LOCKED` so a future multi-replica deployment can run
+ * multiple workers without double-processing rows.
+ *
+ * Concurrency: at most one commit in flight at a time across all
+ * workspaces. We could parallelise across workspaces (different
+ * `mutex.run` keys), but the current commit volume is comfortably
+ * sequential and the simpler shape catches more potential bugs.
+ */
+import { BACKOFF_MS, N_RECOVERY, N_TRANSIENT } from './pending-commits.service.js';
+import { sanitizeError } from './sanitize-error.js';
+/** Core default: terminal-failure notices go to stderr (no dashboard). */
+export const consoleSystemNoticeSink = {
+    async send(notice) {
+        console.error(`[system-notice] ${notice.user.email}: ${notice.message}`);
+    },
+};
+/**
+ * Idle poll interval between drain sweeps. Half a second is short enough
+ * that the post-save commit lag is invisible to humans, long enough that
+ * an empty queue doesn't burn DB round-trips.
+ */
+const POLL_INTERVAL_MS = 500;
+export class PendingCommitsWorker {
+    deps;
+    running = false;
+    loopPromise = null;
+    stopSignal = null;
+    constructor(deps) {
+        this.deps = {
+            ...deps,
+            now: deps.now ?? (() => new Date()),
+            sleep: deps.sleep ?? defaultSleep,
+        };
+    }
+    /**
+     * Start the drain loop. Idempotent — a second `start()` while the
+     * worker is already running is a no-op.
+     */
+    start() {
+        if (this.running)
+            return;
+        this.running = true;
+        this.loopPromise = this.runLoop();
+    }
+    /**
+     * Stop the drain loop. Awaits the in-flight pass (so a commit
+     * mid-flight gets to finish or fail naturally), then resolves.
+     * Idempotent.
+     */
+    async stop() {
+        if (!this.running)
+            return;
+        this.running = false;
+        // Unblock the sleep early so shutdown isn't gated on POLL_INTERVAL_MS.
+        if (this.stopSignal) {
+            const signal = this.stopSignal;
+            this.stopSignal = null;
+            signal();
+        }
+        await this.loopPromise;
+        this.loopPromise = null;
+    }
+    /**
+     * Run one drain pass: rotate through known workspaces, claim+process
+     * one row from each. Exposed publicly so tests can step the loop
+     * deterministically without driving `setTimeout`.
+     */
+    async drainOnce() {
+        for (const workspace of this.deps.workspaces.knownWorkspaces()) {
+            // Bail mid-sweep if stop() fired — the in-flight workspace gets
+            // to finish but we don't start a new one.
+            if (!this.running)
+                return;
+            const row = await this.deps.service.claimNext(workspace.id, this.deps.now());
+            if (!row)
+                continue;
+            await this.processRow(row);
+        }
+    }
+    async runLoop() {
+        while (this.running) {
+            try {
+                await this.drainOnce();
+            }
+            catch (err) {
+                // A throw out of drainOnce means something inside the loop
+                // itself failed — claimNext, processRow's outer scope, etc.
+                // Log loudly and keep looping; the next pass may succeed.
+                console.error('[pending-commits] worker loop iteration threw:', err instanceof Error ? err.stack ?? err.message : err);
+            }
+            if (!this.running)
+                break;
+            await this.interruptibleSleep(POLL_INTERVAL_MS);
+        }
+    }
+    async interruptibleSleep(ms) {
+        if (!this.running)
+            return;
+        await Promise.race([
+            this.deps.sleep(ms),
+            new Promise((resolve) => {
+                this.stopSignal = resolve;
+            }),
+        ]);
+    }
+    /**
+     * Process a single claimed row. Outcome paths (see plan §lifecycle):
+     *   - commit + push succeeds → delete the row.
+     *   - throws, transient budget remains → markTransientFailure.
+     *   - throws, transient exhausted, recovery budget remains → spawn agent.
+     *   - throws, recovery exhausted → markNeedsAttention + feedback notice.
+     */
+    async processRow(row) {
+        const user = {
+            // The worker doesn't have a real `users.id` for the commit author —
+            // commit attribution flows through `git commit --author="Name <email>"`,
+            // not through any FK. Drop a synthetic id so the AuthUser shape is
+            // satisfied without hitting the users table.
+            id: `pending-commit-author:${row.authorEmail}`,
+            email: row.authorEmail,
+            name: row.authorName,
+        };
+        try {
+            await this.deps.workflow.runPendingCommit(row.workspaceId, row.branch, row.path, user);
+            await this.deps.service.markSucceeded(row.id);
+            return;
+        }
+        catch (err) {
+            // Sanitize once at the source: this string flows into the DB
+            // (`pending_commits.last_error`), stdout logs, the recovery-agent
+            // LLM prompt, AND the user-facing feedback notice. Git stderr can
+            // contain credentialed URLs ("https://x-access-token:ghp_…@…"); we
+            // can't undo a persisted leak, so mask before any of them sees it.
+            const message = sanitizeError(err);
+            const nextAttempts = row.attempts + 1;
+            if (nextAttempts < N_TRANSIENT) {
+                // Transient — back off and retry on the next sweep that finds
+                // the backoff elapsed.
+                await this.deps.service.markTransientFailure(row.id, message);
+                console.warn(`[pending-commits] transient failure ws=${row.workspaceId} branch=${row.branch} path=${row.path} attempt=${nextAttempts}/${N_TRANSIENT}: ${message}`);
+                return;
+            }
+            if (row.recoveryAgentRuns < N_RECOVERY) {
+                // Transient budget exhausted — hand off to the recovery agent.
+                // markRecoveryStarted resets `attempts` so the post-recovery
+                // commits get a fresh transient budget.
+                await this.deps.service.markRecoveryStarted(row.id);
+                console.warn(`[pending-commits] transient budget exhausted ws=${row.workspaceId} branch=${row.branch} path=${row.path}; spawning recovery agent (run ${row.recoveryAgentRuns + 1}/${N_RECOVERY}): ${message}`);
+                try {
+                    await this.deps.recoveryAgent.run({
+                        workspaceId: row.workspaceId,
+                        branch: row.branch,
+                        path: row.path,
+                        lastError: message,
+                        originalAuthorEmail: row.authorEmail,
+                    });
+                }
+                catch (agentErr) {
+                    // The recovery agent itself crashed (rare — would mean broken
+                    // codemode wiring, missing deps, etc.). Treat it the same as
+                    // the agent finishing without resolving the issue — the row
+                    // stays `pending` and the next worker pass will hit the same
+                    // underlying error or escalate after another recovery cycle.
+                    console.error(`[pending-commits] recovery agent threw for ws=${row.workspaceId} path=${row.path}:`, sanitizeError(agentErr));
+                }
+                return;
+            }
+            // Recovery budget exhausted — escalate.
+            await this.deps.service.markNeedsAttention(row.id, message);
+            console.error(`[pending-commits] TERMINAL ws=${row.workspaceId} branch=${row.branch} path=${row.path} after ${N_RECOVERY} recovery runs: ${message}`);
+            try {
+                await this.deps.feedback.send({
+                    source: 'system',
+                    user: this.deps.recoveryBot,
+                    message: terminalFailureNotice(row, message),
+                });
+            }
+            catch (feedbackErr) {
+                // Don't let a feedback-sink hiccup mask the underlying terminal
+                // failure — the row is already `needs_attention` and the next
+                // process restart will keep logging it. Just note that the
+                // notice didn't reach the dashboard.
+                console.error(`[pending-commits] failed to emit terminal-failure feedback notice for ws=${row.workspaceId} path=${row.path}:`, sanitizeError(feedbackErr));
+            }
+        }
+    }
+}
+function terminalFailureNotice(row, error) {
+    const elapsedMs = Date.now() - row.queuedAt.getTime();
+    const elapsed = formatElapsed(elapsedMs);
+    return [
+        `[pending_commits] Terminal commit failure after ${N_RECOVERY} recovery attempts.`,
+        '',
+        `Workspace: ${row.workspaceId}`,
+        `Branch:    ${row.branch}`,
+        `Path:      ${row.path}`,
+        `Original author: ${row.authorEmail}`,
+        `Queued at: ${row.queuedAt.toISOString()} (${elapsed} ago)`,
+        `Last error: ${error}`,
+        '',
+        "This file's bytes are on disk in the workspace but have never been",
+        'committed to git. The recovery agent attempted to fix the underlying',
+        `issue ${N_RECOVERY} times without success.`,
+        '',
+        'Investigate manually:',
+        '  - shell into the deployment, cd into the workspace dir',
+        "  - inspect `git status` and the file's on-disk state",
+        '  - either commit the file manually (after fixing the underlying issue)',
+        '    or delete the row from pending_commits if the file should be',
+        '    discarded.',
+    ].join('\n');
+}
+function formatElapsed(ms) {
+    if (ms < 1000)
+        return `${ms}ms`;
+    const s = Math.floor(ms / 1000);
+    if (s < 60)
+        return `${s}s`;
+    const m = Math.floor(s / 60);
+    if (m < 60)
+        return `${m}m`;
+    const h = Math.floor(m / 60);
+    if (h < 24)
+        return `${h}h`;
+    const d = Math.floor(h / 24);
+    return `${d}d`;
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+// Re-exports so consumers can pull worker + constants from one place
+// without reaching into the service file for the budgets.
+export { BACKOFF_MS, N_RECOVERY, N_TRANSIENT };
+//# sourceMappingURL=pending-commits.worker.js.map

package/dist/modules/workflow/pending-commits.worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-commits.worker.js","sourceRoot":"","sources":["../../../src/modules/workflow/pending-commits.worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAiBpD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,KAAK,CAAC,IAAI,CAAC,MAAM;QACf,OAAO,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AA6E7B,MAAM,OAAO,oBAAoB;IACd,IAAI,CAEnB;IACM,OAAO,GAAG,KAAK,CAAC;IAChB,WAAW,GAAyB,IAAI,CAAC;IACzC,UAAU,GAAmC,IAAI,CAAC;IAE1D,YAAY,IAA8B;QACxC,IAAI,CAAC,IAAI,GAAG;YACV,GAAG,IAAI;YACP,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;YACnC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,YAAY;SAClC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,uEAAuE;QACvE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;YAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,MAAM,EAAE,CAAC;QACX,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS;QACb,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,CAAC;YAC/D,gEAAgE;YAChE,0CAA0C;YAC1C,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,OAAO;YAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC7E,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,2DAA2D;gBAC3D,4DAA4D;gBAC5D,0DAA0D;gBAC1D,OAAO,CAAC,KAAK,CACX,gDAAgD,EAChD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACtD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,MAAM;YACzB,MAAM,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,EAAU;QACzC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;YAC5B,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,UAAU,CAAC,GAAkB;QACzC,MAAM,IAAI,GAAa;YACrB,oEAAoE;YACpE,yEAAyE;YACzE,mEAAmE;YACnE,6CAA6C;YAC7C,EAAE,EAAE,yBAAyB,GAAG,CAAC,WAAW,EAAE;YAC9C,KAAK,EAAE,GAAG,CAAC,WAAW;YACtB,IAAI,EAAE,GAAG,CAAC,UAAU;SACrB,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvF,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6DAA6D;YAC7D,kEAAkE;YAClE,kEAAkE;YAClE,mEAAmE;YACnE,mEAAmE;YACnE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;YAEtC,IAAI,YAAY,GAAG,WAAW,EAAE,CAAC;gBAC/B,8DAA8D;gBAC9D,uBAAuB;gBACvB,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC9D,OAAO,CAAC,IAAI,CACV,0CAA0C,GAAG,CAAC,WAAW,WAAW,GAAG,CAAC,MAAM,SAAS,GAAG,CAAC,IAAI,YAAY,YAAY,IAAI,WAAW,KAAK,OAAO,EAAE,CACrJ,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,iBAAiB,GAAG,UAAU,EAAE,CAAC;gBACvC,+DAA+D;gBAC/D,6DAA6D;gBAC7D,wCAAwC;gBACxC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,IAAI,CACV,mDAAmD,GAAG,CAAC,WAAW,WAAW,GAAG,CAAC,MAAM,SAAS,GAAG,CAAC,IAAI,kCAAkC,GAAG,CAAC,iBAAiB,GAAG,CAAC,IAAI,UAAU,MAAM,OAAO,EAAE,CACjM,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;wBAChC,WAAW,EAAE,GAAG,CAAC,WAAW;wBAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,SAAS,EAAE,OAAO;wBAClB,mBAAmB,EAAE,GAAG,CAAC,WAAW;qBACrC,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,QAAQ,EAAE,CAAC;oBAClB,8DAA8D;oBAC9D,6DAA6D;oBAC7D,4DAA4D;oBAC5D,6DAA6D;oBAC7D,6DAA6D;oBAC7D,OAAO,CAAC,KAAK,CACX,iDAAiD,GAAG,CAAC,WAAW,SAAS,GAAG,CAAC,IAAI,GAAG,EACpF,aAAa,CAAC,QAAQ,CAAC,CACxB,CAAC;gBACJ,CAAC;gBACD,OAAO;YACT,CAAC;YAED,wCAAwC;YACxC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC5D,OAAO,CAAC,KAAK,CACX,iCAAiC,GAAG,CAAC,WAAW,WAAW,GAAG,CAAC,MAAM,SAAS,GAAG,CAAC,IAAI,UAAU,UAAU,mBAAmB,OAAO,EAAE,CACvI,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC5B,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;oBAC3B,OAAO,EAAE,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;iBAC7C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,gEAAgE;gBAChE,8DAA8D;gBAC9D,2DAA2D;gBAC3D,qCAAqC;gBACrC,OAAO,CAAC,KAAK,CACX,4EAA4E,GAAG,CAAC,WAAW,SAAS,GAAG,CAAC,IAAI,GAAG,EAC/G,aAAa,CAAC,WAAW,CAAC,CAC3B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,qBAAqB,CAAC,GAAkB,EAAE,KAAa;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO;QACL,mDAAmD,UAAU,qBAAqB;QAClF,EAAE;QACF,cAAc,GAAG,CAAC,WAAW,EAAE;QAC/B,cAAc,GAAG,CAAC,MAAM,EAAE;QAC1B,cAAc,GAAG,CAAC,IAAI,EAAE;QACxB,oBAAoB,GAAG,CAAC,WAAW,EAAE;QACrC,cAAc,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,OAAO;QAC3D,eAAe,KAAK,EAAE;QACtB,EAAE;QACF,oEAAoE;QACpE,sEAAsE;QACtE,SAAS,UAAU,yBAAyB;QAC5C,EAAE;QACF,uBAAuB;QACvB,0DAA0D;QAC1D,uDAAuD;QACvD,yEAAyE;QACzE,kEAAkE;QAClE,gBAAgB;KACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,IAAI,EAAE,GAAG,IAAI;QAAE,OAAO,GAAG,EAAE,IAAI,CAAC;IAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC,GAAG,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,qEAAqE;AACrE,0DAA0D;AAC1D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC"}

package/dist/modules/workflow/read-only-filesystem.d.ts

@@ -0,0 +1,24 @@
+import { LocalFilesystem, type CopyOptions, type FileContent, type RemoveOptions, type WriteOptions } from '@mastra/core/workspace';
+/**
+ * A `LocalFilesystem` that permits reads but refuses every mutating operation.
+ * Mastra hands the agent the workspace filesystem's tools (write_file /
+ * edit_file / delete / mkdir / move / copy); for consumer personas we hand it
+ * this instead so those tools exist but fail closed — the agent can read and
+ * explore the ontology, but cannot change it.
+ *
+ * The architect agent keeps the lock-aware `LockingFilesystem` (which commits +
+ * pushes); consumer agents get no write path at all.
+ */
+export declare class ReadOnlyFilesystem extends LocalFilesystem {
+    private static deny;
+    writeFile(_path: string, _content: FileContent, _options?: WriteOptions): Promise<void>;
+    appendFile(_path: string, _content: FileContent): Promise<void>;
+    deleteFile(_path: string, _options?: RemoveOptions): Promise<void>;
+    copyFile(_src: string, _dest: string, _options?: CopyOptions): Promise<void>;
+    moveFile(_src: string, _dest: string, _options?: CopyOptions): Promise<void>;
+    mkdir(_path: string, _options?: {
+        recursive?: boolean;
+    }): Promise<void>;
+    rmdir(_path: string, _options?: RemoveOptions): Promise<void>;
+}
+//# sourceMappingURL=read-only-filesystem.d.ts.map

package/dist/modules/workflow/read-only-filesystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only-filesystem.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/read-only-filesystem.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,OAAO,CAAC,MAAM,CAAC,IAAI;IAOJ,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvF,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/D,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5E,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5E,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAG7E"}

package/dist/modules/workflow/read-only-filesystem.js

@@ -0,0 +1,39 @@
+import { LocalFilesystem, } from '@mastra/core/workspace';
+/**
+ * A `LocalFilesystem` that permits reads but refuses every mutating operation.
+ * Mastra hands the agent the workspace filesystem's tools (write_file /
+ * edit_file / delete / mkdir / move / copy); for consumer personas we hand it
+ * this instead so those tools exist but fail closed — the agent can read and
+ * explore the ontology, but cannot change it.
+ *
+ * The architect agent keeps the lock-aware `LockingFilesystem` (which commits +
+ * pushes); consumer agents get no write path at all.
+ */
+export class ReadOnlyFilesystem extends LocalFilesystem {
+    static deny(op) {
+        throw new Error(`This assistant is read-only — "${op}" is not allowed. ` +
+            `It can read and analyze the knowledge base, but cannot modify it.`);
+    }
+    async writeFile(_path, _content, _options) {
+        ReadOnlyFilesystem.deny('write_file');
+    }
+    async appendFile(_path, _content) {
+        ReadOnlyFilesystem.deny('append_file');
+    }
+    async deleteFile(_path, _options) {
+        ReadOnlyFilesystem.deny('delete_file');
+    }
+    async copyFile(_src, _dest, _options) {
+        ReadOnlyFilesystem.deny('copy_file');
+    }
+    async moveFile(_src, _dest, _options) {
+        ReadOnlyFilesystem.deny('move_file');
+    }
+    async mkdir(_path, _options) {
+        ReadOnlyFilesystem.deny('mkdir');
+    }
+    async rmdir(_path, _options) {
+        ReadOnlyFilesystem.deny('rmdir');
+    }
+}
+//# sourceMappingURL=read-only-filesystem.js.map

package/dist/modules/workflow/read-only-filesystem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only-filesystem.js","sourceRoot":"","sources":["../../../src/modules/workflow/read-only-filesystem.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,GAKhB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IAC7C,MAAM,CAAC,IAAI,CAAC,EAAU;QAC5B,MAAM,IAAI,KAAK,CACb,kCAAkC,EAAE,oBAAoB;YACtD,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,QAAqB,EAAE,QAAuB;QACpF,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAEQ,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAqB;QAC5D,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAwB;QAC/D,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,KAAa,EAAE,QAAsB;QACzE,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAEQ,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,KAAa,EAAE,QAAsB;QACzE,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAEQ,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,QAAkC;QACpE,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAEQ,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,QAAwB;QAC1D,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/modules/workflow/recovery-bot.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Synthetic user identity the pending-commits pipeline uses for:
+ *
+ *   1. The recovery agent's commit authorship — when the background
+ *      agent resolves a non-FF conflict and lands a resolution commit,
+ *      that commit needs an author. The recovery bot is a stable
+ *      attribution that's clearly "the system" rather than any human.
+ *   2. The `'system'` feedback notice's `user_id` FK — feedback
+ *      submissions reference `users(id)`, so we need a real row.
+ *   3. The startup-sweep enqueue of orphaned dirty files — those have
+ *      no recoverable original author, and the recovery bot fits the
+ *      "this is the system reconciling state" framing.
+ *
+ * Email convention mirrors the routine-bot pattern (`<role>-bot@<host>`)
+ * so admins can tell at a glance what an automation account is for. The
+ * `RECOVERY_BOT_EMAIL` env override mirrors `ROUTINE_BOT_EMAIL`.
+ */
+import type { AuthUser } from '@bevel-software/platform-shared';
+import type { Database } from '../database/connection.js';
+export declare const RECOVERY_BOT_EMAIL: string;
+export declare const RECOVERY_BOT_NAME = "Bevel Recovery Bot";
+/**
+ * Idempotent ensure-or-fetch of the recovery-bot user row. Modelled on
+ * `RoutineRunnerService.ensureBotUser` — same race-safe shape via
+ * `onConflictDoNothing` + re-select.
+ *
+ * Called once at composition-root boot; the resolved `AuthUser` is then
+ * cached for the lifetime of the process (the row never changes).
+ */
+export declare function ensureRecoveryBotUser(db: Database): Promise<AuthUser>;
+//# sourceMappingURL=recovery-bot.d.ts.map

package/dist/modules/workflow/recovery-bot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-bot.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/recovery-bot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAG1D,eAAO,MAAM,kBAAkB,QAEhB,CAAC;AAEhB,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmC3E"}

package/dist/modules/workflow/recovery-bot.js

@@ -0,0 +1,64 @@
+/**
+ * Synthetic user identity the pending-commits pipeline uses for:
+ *
+ *   1. The recovery agent's commit authorship — when the background
+ *      agent resolves a non-FF conflict and lands a resolution commit,
+ *      that commit needs an author. The recovery bot is a stable
+ *      attribution that's clearly "the system" rather than any human.
+ *   2. The `'system'` feedback notice's `user_id` FK — feedback
+ *      submissions reference `users(id)`, so we need a real row.
+ *   3. The startup-sweep enqueue of orphaned dirty files — those have
+ *      no recoverable original author, and the recovery bot fits the
+ *      "this is the system reconciling state" framing.
+ *
+ * Email convention mirrors the routine-bot pattern (`<role>-bot@<host>`)
+ * so admins can tell at a glance what an automation account is for. The
+ * `RECOVERY_BOT_EMAIL` env override mirrors `ROUTINE_BOT_EMAIL`.
+ */
+import { eq } from 'drizzle-orm';
+import { users } from '../database/schema.js';
+export const RECOVERY_BOT_EMAIL = (process.env.RECOVERY_BOT_EMAIL ?? 'recovery-bot@bevel.local').toLowerCase();
+export const RECOVERY_BOT_NAME = 'Bevel Recovery Bot';
+/**
+ * Idempotent ensure-or-fetch of the recovery-bot user row. Modelled on
+ * `RoutineRunnerService.ensureBotUser` — same race-safe shape via
+ * `onConflictDoNothing` + re-select.
+ *
+ * Called once at composition-root boot; the resolved `AuthUser` is then
+ * cached for the lifetime of the process (the row never changes).
+ */
+export async function ensureRecoveryBotUser(db) {
+    const inserted = await db
+        .insert(users)
+        .values({ email: RECOVERY_BOT_EMAIL, name: RECOVERY_BOT_NAME })
+        .onConflictDoNothing({ target: users.email })
+        .returning();
+    if (inserted.length > 0) {
+        const row = inserted[0];
+        console.log(`[pending-commits] created recovery-bot user id=${row.id} email=${row.email}`);
+        return {
+            id: row.id,
+            email: row.email,
+            name: row.name,
+            avatarUrl: row.avatarUrl ?? undefined,
+        };
+    }
+    const [row] = await db
+        .select()
+        .from(users)
+        .where(eq(users.email, RECOVERY_BOT_EMAIL))
+        .limit(1);
+    if (!row) {
+        // Vanishingly unlikely: the row exists for the conflict to fire but is
+        // gone by the time we re-select. Surface loudly rather than crashing
+        // on `row.id` below.
+        throw new Error(`recovery-bot user (${RECOVERY_BOT_EMAIL}) disappeared between insert-conflict and re-select`);
+    }
+    return {
+        id: row.id,
+        email: row.email,
+        name: row.name,
+        avatarUrl: row.avatarUrl ?? undefined,
+    };
+}
+//# sourceMappingURL=recovery-bot.js.map

package/dist/modules/workflow/recovery-bot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-bot.js","sourceRoot":"","sources":["../../../src/modules/workflow/recovery-bot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,0BAA0B,CAC7D,CAAC,WAAW,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAY;IACtD,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAC9D,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;SAC5C,SAAS,EAAE,CAAC;IACf,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,kDAAkD,GAAG,CAAC,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3F,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;SACtC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;SAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,uEAAuE;QACvE,qEAAqE;QACrE,qBAAqB;QACrB,MAAM,IAAI,KAAK,CACb,sBAAsB,kBAAkB,qDAAqD,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;KACtC,CAAC;AACJ,CAAC"}