@bevel-software/platform-core-backend 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +202 -0
- package/dist/assets.d.ts +5 -0
- package/dist/assets.d.ts.map +1 -0
- package/dist/assets.js +23 -0
- package/dist/assets.js.map +1 -0
- package/dist/core/core-ports.d.ts +83 -0
- package/dist/core/core-ports.d.ts.map +1 -0
- package/dist/core/core-ports.js +12 -0
- package/dist/core/core-ports.js.map +1 -0
- package/dist/core/create-core-server.d.ts +62 -0
- package/dist/core/create-core-server.d.ts.map +1 -0
- package/dist/core/create-core-server.js +204 -0
- package/dist/core/create-core-server.js.map +1 -0
- package/dist/core/create-core-services.d.ts +95 -0
- package/dist/core/create-core-services.d.ts.map +1 -0
- package/dist/core/create-core-services.js +352 -0
- package/dist/core/create-core-services.js.map +1 -0
- package/dist/core-config.d.ts +119 -0
- package/dist/core-config.d.ts.map +1 -0
- package/dist/core-config.js +240 -0
- package/dist/core-config.js.map +1 -0
- package/dist/index.d.ts +36 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +36 -0
- package/dist/index.js.map +1 -0
- package/dist/modules/access/access-control.interface.d.ts +348 -0
- package/dist/modules/access/access-control.interface.d.ts.map +1 -0
- package/dist/modules/access/access-control.interface.js +2 -0
- package/dist/modules/access/access-control.interface.js.map +1 -0
- package/dist/modules/access/access-control.service.d.ts +323 -0
- package/dist/modules/access/access-control.service.d.ts.map +1 -0
- package/dist/modules/access/access-control.service.js +1431 -0
- package/dist/modules/access/access-control.service.js.map +1 -0
- package/dist/modules/access/access-errors.d.ts +34 -0
- package/dist/modules/access/access-errors.d.ts.map +1 -0
- package/dist/modules/access/access-errors.js +40 -0
- package/dist/modules/access/access-errors.js.map +1 -0
- package/dist/modules/access/access-mutation.service.d.ts +176 -0
- package/dist/modules/access/access-mutation.service.d.ts.map +1 -0
- package/dist/modules/access/access-mutation.service.js +307 -0
- package/dist/modules/access/access-mutation.service.js.map +1 -0
- package/dist/modules/access/access-splice.d.ts +98 -0
- package/dist/modules/access/access-splice.d.ts.map +1 -0
- package/dist/modules/access/access-splice.js +346 -0
- package/dist/modules/access/access-splice.js.map +1 -0
- package/dist/modules/access/access.routes.d.ts +10 -0
- package/dist/modules/access/access.routes.d.ts.map +1 -0
- package/dist/modules/access/access.routes.js +757 -0
- package/dist/modules/access/access.routes.js.map +1 -0
- package/dist/modules/access/creator-access.d.ts +113 -0
- package/dist/modules/access/creator-access.d.ts.map +1 -0
- package/dist/modules/access/creator-access.js +212 -0
- package/dist/modules/access/creator-access.js.map +1 -0
- package/dist/modules/access/kb-read-filter.d.ts +41 -0
- package/dist/modules/access/kb-read-filter.d.ts.map +1 -0
- package/dist/modules/access/kb-read-filter.js +60 -0
- package/dist/modules/access/kb-read-filter.js.map +1 -0
- package/dist/modules/access/roles-admin.service.d.ts +240 -0
- package/dist/modules/access/roles-admin.service.d.ts.map +1 -0
- package/dist/modules/access/roles-admin.service.js +630 -0
- package/dist/modules/access/roles-admin.service.js.map +1 -0
- package/dist/modules/access/roles-edit.d.ts +91 -0
- package/dist/modules/access/roles-edit.d.ts.map +1 -0
- package/dist/modules/access/roles-edit.js +232 -0
- package/dist/modules/access/roles-edit.js.map +1 -0
- package/dist/modules/access/roles-yaml-guard.d.ts +56 -0
- package/dist/modules/access/roles-yaml-guard.d.ts.map +1 -0
- package/dist/modules/access/roles-yaml-guard.js +79 -0
- package/dist/modules/access/roles-yaml-guard.js.map +1 -0
- package/dist/modules/admin/admin-access.routes.d.ts +18 -0
- package/dist/modules/admin/admin-access.routes.d.ts.map +1 -0
- package/dist/modules/admin/admin-access.routes.js +26 -0
- package/dist/modules/admin/admin-access.routes.js.map +1 -0
- package/dist/modules/admin/admin-access.service.d.ts +24 -0
- package/dist/modules/admin/admin-access.service.d.ts.map +1 -0
- package/dist/modules/admin/admin-access.service.js +41 -0
- package/dist/modules/admin/admin-access.service.js.map +1 -0
- package/dist/modules/admin/admin.interface.d.ts +11 -0
- package/dist/modules/admin/admin.interface.d.ts.map +1 -0
- package/dist/modules/admin/admin.interface.js +2 -0
- package/dist/modules/admin/admin.interface.js.map +1 -0
- package/dist/modules/auth/account-erasure.service.d.ts +80 -0
- package/dist/modules/auth/account-erasure.service.d.ts.map +1 -0
- package/dist/modules/auth/account-erasure.service.js +91 -0
- package/dist/modules/auth/account-erasure.service.js.map +1 -0
- package/dist/modules/auth/auth.middleware.d.ts +23 -0
- package/dist/modules/auth/auth.middleware.d.ts.map +1 -0
- package/dist/modules/auth/auth.middleware.js +68 -0
- package/dist/modules/auth/auth.middleware.js.map +1 -0
- package/dist/modules/auth/auth.routes.d.ts +25 -0
- package/dist/modules/auth/auth.routes.d.ts.map +1 -0
- package/dist/modules/auth/auth.routes.js +72 -0
- package/dist/modules/auth/auth.routes.js.map +1 -0
- package/dist/modules/auth/auth.service.d.ts +76 -0
- package/dist/modules/auth/auth.service.d.ts.map +1 -0
- package/dist/modules/auth/auth.service.js +168 -0
- package/dist/modules/auth/auth.service.js.map +1 -0
- package/dist/modules/code-mode/code-mode-names.d.ts +16 -0
- package/dist/modules/code-mode/code-mode-names.d.ts.map +1 -0
- package/dist/modules/code-mode/code-mode-names.js +30 -0
- package/dist/modules/code-mode/code-mode-names.js.map +1 -0
- package/dist/modules/code-mode/code-mode.tool.d.ts +13 -0
- package/dist/modules/code-mode/code-mode.tool.d.ts.map +1 -0
- package/dist/modules/code-mode/code-mode.tool.js +112 -0
- package/dist/modules/code-mode/code-mode.tool.js.map +1 -0
- package/dist/modules/code-mode/index.d.ts +3 -0
- package/dist/modules/code-mode/index.d.ts.map +1 -0
- package/dist/modules/code-mode/index.js +3 -0
- package/dist/modules/code-mode/index.js.map +1 -0
- package/dist/modules/database/connection.d.ts +6 -0
- package/dist/modules/database/connection.d.ts.map +1 -0
- package/dist/modules/database/connection.js +12 -0
- package/dist/modules/database/connection.js.map +1 -0
- package/dist/modules/database/core-schema.d.ts +2273 -0
- package/dist/modules/database/core-schema.d.ts.map +1 -0
- package/dist/modules/database/core-schema.js +413 -0
- package/dist/modules/database/core-schema.js.map +1 -0
- package/dist/modules/database/migrate.d.ts +10 -0
- package/dist/modules/database/migrate.d.ts.map +1 -0
- package/dist/modules/database/migrate.js +40 -0
- package/dist/modules/database/migrate.js.map +1 -0
- package/dist/modules/database/schema.d.ts +12 -0
- package/dist/modules/database/schema.d.ts.map +1 -0
- package/dist/modules/database/schema.js +12 -0
- package/dist/modules/database/schema.js.map +1 -0
- package/dist/modules/diff/diff-paths.d.ts +2 -0
- package/dist/modules/diff/diff-paths.d.ts.map +1 -0
- package/dist/modules/diff/diff-paths.js +9 -0
- package/dist/modules/diff/diff-paths.js.map +1 -0
- package/dist/modules/diff/diff.config.d.ts +8 -0
- package/dist/modules/diff/diff.config.d.ts.map +1 -0
- package/dist/modules/diff/diff.config.js +13 -0
- package/dist/modules/diff/diff.config.js.map +1 -0
- package/dist/modules/diff/diff.interface.d.ts +73 -0
- package/dist/modules/diff/diff.interface.d.ts.map +1 -0
- package/dist/modules/diff/diff.interface.js +2 -0
- package/dist/modules/diff/diff.interface.js.map +1 -0
- package/dist/modules/diff/diff.routes.d.ts +35 -0
- package/dist/modules/diff/diff.routes.d.ts.map +1 -0
- package/dist/modules/diff/diff.routes.js +228 -0
- package/dist/modules/diff/diff.routes.js.map +1 -0
- package/dist/modules/diff/diff.service.d.ts +51 -0
- package/dist/modules/diff/diff.service.d.ts.map +1 -0
- package/dist/modules/diff/diff.service.js +489 -0
- package/dist/modules/diff/diff.service.js.map +1 -0
- package/dist/modules/diff/line-diff.d.ts +16 -0
- package/dist/modules/diff/line-diff.d.ts.map +1 -0
- package/dist/modules/diff/line-diff.js +67 -0
- package/dist/modules/diff/line-diff.js.map +1 -0
- package/dist/modules/mcp/mcp-auth.middleware.d.ts +27 -0
- package/dist/modules/mcp/mcp-auth.middleware.d.ts.map +1 -0
- package/dist/modules/mcp/mcp-auth.middleware.js +116 -0
- package/dist/modules/mcp/mcp-auth.middleware.js.map +1 -0
- package/dist/modules/mcp/mcp-session-store.d.ts +74 -0
- package/dist/modules/mcp/mcp-session-store.d.ts.map +1 -0
- package/dist/modules/mcp/mcp-session-store.js +131 -0
- package/dist/modules/mcp/mcp-session-store.js.map +1 -0
- package/dist/modules/mcp/mcp.routes.d.ts +24 -0
- package/dist/modules/mcp/mcp.routes.d.ts.map +1 -0
- package/dist/modules/mcp/mcp.routes.js +229 -0
- package/dist/modules/mcp/mcp.routes.js.map +1 -0
- package/dist/modules/mcp/mcp.service.d.ts +198 -0
- package/dist/modules/mcp/mcp.service.d.ts.map +1 -0
- package/dist/modules/mcp/mcp.service.js +840 -0
- package/dist/modules/mcp/mcp.service.js.map +1 -0
- package/dist/modules/mcp/oauth/bevel-oauth-provider.d.ts +76 -0
- package/dist/modules/mcp/oauth/bevel-oauth-provider.d.ts.map +1 -0
- package/dist/modules/mcp/oauth/bevel-oauth-provider.js +291 -0
- package/dist/modules/mcp/oauth/bevel-oauth-provider.js.map +1 -0
- package/dist/modules/mcp/oauth/oauth-consent.routes.d.ts +18 -0
- package/dist/modules/mcp/oauth/oauth-consent.routes.d.ts.map +1 -0
- package/dist/modules/mcp/oauth/oauth-consent.routes.js +52 -0
- package/dist/modules/mcp/oauth/oauth-consent.routes.js.map +1 -0
- package/dist/modules/mcp/oauth/oauth-state.d.ts +32 -0
- package/dist/modules/mcp/oauth/oauth-state.d.ts.map +1 -0
- package/dist/modules/mcp/oauth/oauth-state.js +34 -0
- package/dist/modules/mcp/oauth/oauth-state.js.map +1 -0
- package/dist/modules/secrets-vault/db-secrets-vault.service.d.ts +92 -0
- package/dist/modules/secrets-vault/db-secrets-vault.service.d.ts.map +1 -0
- package/dist/modules/secrets-vault/db-secrets-vault.service.js +728 -0
- package/dist/modules/secrets-vault/db-secrets-vault.service.js.map +1 -0
- package/dist/modules/secrets-vault/index.d.ts +7 -0
- package/dist/modules/secrets-vault/index.d.ts.map +1 -0
- package/dist/modules/secrets-vault/index.js +6 -0
- package/dist/modules/secrets-vault/index.js.map +1 -0
- package/dist/modules/secrets-vault/mcp-oauth-discovery.service.d.ts +63 -0
- package/dist/modules/secrets-vault/mcp-oauth-discovery.service.d.ts.map +1 -0
- package/dist/modules/secrets-vault/mcp-oauth-discovery.service.js +269 -0
- package/dist/modules/secrets-vault/mcp-oauth-discovery.service.js.map +1 -0
- package/dist/modules/secrets-vault/secrets-variable-loader.d.ts +46 -0
- package/dist/modules/secrets-vault/secrets-variable-loader.d.ts.map +1 -0
- package/dist/modules/secrets-vault/secrets-variable-loader.js +87 -0
- package/dist/modules/secrets-vault/secrets-variable-loader.js.map +1 -0
- package/dist/modules/secrets-vault/secrets-vault.contract.d.ts +210 -0
- package/dist/modules/secrets-vault/secrets-vault.contract.d.ts.map +1 -0
- package/dist/modules/secrets-vault/secrets-vault.contract.js +90 -0
- package/dist/modules/secrets-vault/secrets-vault.contract.js.map +1 -0
- package/dist/modules/secrets-vault/secrets-vault.routes.d.ts +30 -0
- package/dist/modules/secrets-vault/secrets-vault.routes.d.ts.map +1 -0
- package/dist/modules/secrets-vault/secrets-vault.routes.js +490 -0
- package/dist/modules/secrets-vault/secrets-vault.routes.js.map +1 -0
- package/dist/modules/skills/index.d.ts +5 -0
- package/dist/modules/skills/index.d.ts.map +1 -0
- package/dist/modules/skills/index.js +4 -0
- package/dist/modules/skills/index.js.map +1 -0
- package/dist/modules/skills/skills.contract.d.ts +58 -0
- package/dist/modules/skills/skills.contract.d.ts.map +1 -0
- package/dist/modules/skills/skills.contract.js +10 -0
- package/dist/modules/skills/skills.contract.js.map +1 -0
- package/dist/modules/skills/skills.routes.d.ts +15 -0
- package/dist/modules/skills/skills.routes.d.ts.map +1 -0
- package/dist/modules/skills/skills.routes.js +34 -0
- package/dist/modules/skills/skills.routes.js.map +1 -0
- package/dist/modules/skills/skills.service.d.ts +21 -0
- package/dist/modules/skills/skills.service.d.ts.map +1 -0
- package/dist/modules/skills/skills.service.js +202 -0
- package/dist/modules/skills/skills.service.js.map +1 -0
- package/dist/modules/skills/skills.tools.d.ts +15 -0
- package/dist/modules/skills/skills.tools.d.ts.map +1 -0
- package/dist/modules/skills/skills.tools.js +96 -0
- package/dist/modules/skills/skills.tools.js.map +1 -0
- package/dist/modules/tool-auth/external-api-key.errors.d.ts +14 -0
- package/dist/modules/tool-auth/external-api-key.errors.d.ts.map +1 -0
- package/dist/modules/tool-auth/external-api-key.errors.js +23 -0
- package/dist/modules/tool-auth/external-api-key.errors.js.map +1 -0
- package/dist/modules/tool-auth/external-api-key.interface.d.ts +90 -0
- package/dist/modules/tool-auth/external-api-key.interface.d.ts.map +1 -0
- package/dist/modules/tool-auth/external-api-key.interface.js +2 -0
- package/dist/modules/tool-auth/external-api-key.interface.js.map +1 -0
- package/dist/modules/tool-auth/external-api-key.service.d.ts +25 -0
- package/dist/modules/tool-auth/external-api-key.service.d.ts.map +1 -0
- package/dist/modules/tool-auth/external-api-key.service.js +164 -0
- package/dist/modules/tool-auth/external-api-key.service.js.map +1 -0
- package/dist/modules/tool-auth/internal-token.service.d.ts +62 -0
- package/dist/modules/tool-auth/internal-token.service.d.ts.map +1 -0
- package/dist/modules/tool-auth/internal-token.service.js +85 -0
- package/dist/modules/tool-auth/internal-token.service.js.map +1 -0
- package/dist/modules/tool-auth/llm-usage-meter.d.ts +16 -0
- package/dist/modules/tool-auth/llm-usage-meter.d.ts.map +1 -0
- package/dist/modules/tool-auth/llm-usage-meter.js +6 -0
- package/dist/modules/tool-auth/llm-usage-meter.js.map +1 -0
- package/dist/modules/tool-auth/tool-auth.middleware.d.ts +101 -0
- package/dist/modules/tool-auth/tool-auth.middleware.d.ts.map +1 -0
- package/dist/modules/tool-auth/tool-auth.middleware.js +166 -0
- package/dist/modules/tool-auth/tool-auth.middleware.js.map +1 -0
- package/dist/modules/tool-helpers/index.d.ts +19 -0
- package/dist/modules/tool-helpers/index.d.ts.map +1 -0
- package/dist/modules/tool-helpers/index.js +18 -0
- package/dist/modules/tool-helpers/index.js.map +1 -0
- package/dist/modules/tool-helpers/tool-context.d.ts +35 -0
- package/dist/modules/tool-helpers/tool-context.d.ts.map +1 -0
- package/dist/modules/tool-helpers/tool-context.js +66 -0
- package/dist/modules/tool-helpers/tool-context.js.map +1 -0
- package/dist/modules/tool-helpers/tool-def.d.ts +33 -0
- package/dist/modules/tool-helpers/tool-def.d.ts.map +1 -0
- package/dist/modules/tool-helpers/tool-def.js +57 -0
- package/dist/modules/tool-helpers/tool-def.js.map +1 -0
- package/dist/modules/tool-helpers/tool-handler.d.ts +19 -0
- package/dist/modules/tool-helpers/tool-handler.d.ts.map +1 -0
- package/dist/modules/tool-helpers/tool-handler.js +84 -0
- package/dist/modules/tool-helpers/tool-handler.js.map +1 -0
- package/dist/modules/tool-helpers/tool.contract.d.ts +64 -0
- package/dist/modules/tool-helpers/tool.contract.d.ts.map +1 -0
- package/dist/modules/tool-helpers/tool.contract.js +24 -0
- package/dist/modules/tool-helpers/tool.contract.js.map +1 -0
- package/dist/modules/tool-helpers/validate-token.d.ts +31 -0
- package/dist/modules/tool-helpers/validate-token.d.ts.map +1 -0
- package/dist/modules/tool-helpers/validate-token.js +20 -0
- package/dist/modules/tool-helpers/validate-token.js.map +1 -0
- package/dist/modules/tool-manuals/index.d.ts +5 -0
- package/dist/modules/tool-manuals/index.d.ts.map +1 -0
- package/dist/modules/tool-manuals/index.js +5 -0
- package/dist/modules/tool-manuals/index.js.map +1 -0
- package/dist/modules/tool-manuals/tool-manuals.contract.d.ts +182 -0
- package/dist/modules/tool-manuals/tool-manuals.contract.d.ts.map +1 -0
- package/dist/modules/tool-manuals/tool-manuals.contract.js +19 -0
- package/dist/modules/tool-manuals/tool-manuals.contract.js.map +1 -0
- package/dist/modules/tool-manuals/tool-manuals.routes.d.ts +24 -0
- package/dist/modules/tool-manuals/tool-manuals.routes.d.ts.map +1 -0
- package/dist/modules/tool-manuals/tool-manuals.routes.js +102 -0
- package/dist/modules/tool-manuals/tool-manuals.routes.js.map +1 -0
- package/dist/modules/tool-manuals/tool-manuals.service.d.ts +108 -0
- package/dist/modules/tool-manuals/tool-manuals.service.d.ts.map +1 -0
- package/dist/modules/tool-manuals/tool-manuals.service.js +710 -0
- package/dist/modules/tool-manuals/tool-manuals.service.js.map +1 -0
- package/dist/modules/tool-manuals/tool-manuals.tools.d.ts +35 -0
- package/dist/modules/tool-manuals/tool-manuals.tools.d.ts.map +1 -0
- package/dist/modules/tool-manuals/tool-manuals.tools.js +157 -0
- package/dist/modules/tool-manuals/tool-manuals.tools.js.map +1 -0
- package/dist/modules/tool-registry/manual.routes.d.ts +6 -0
- package/dist/modules/tool-registry/manual.routes.d.ts.map +1 -0
- package/dist/modules/tool-registry/manual.routes.js +76 -0
- package/dist/modules/tool-registry/manual.routes.js.map +1 -0
- package/dist/modules/tool-registry/tool-registry.d.ts +23 -0
- package/dist/modules/tool-registry/tool-registry.d.ts.map +1 -0
- package/dist/modules/tool-registry/tool-registry.js +46 -0
- package/dist/modules/tool-registry/tool-registry.js.map +1 -0
- package/dist/modules/tool-registry/tool.contract.d.ts +48 -0
- package/dist/modules/tool-registry/tool.contract.d.ts.map +1 -0
- package/dist/modules/tool-registry/tool.contract.js +2 -0
- package/dist/modules/tool-registry/tool.contract.js.map +1 -0
- package/dist/modules/workflow/agent-tools/workflow.tools.d.ts +14 -0
- package/dist/modules/workflow/agent-tools/workflow.tools.d.ts.map +1 -0
- package/dist/modules/workflow/agent-tools/workflow.tools.js +437 -0
- package/dist/modules/workflow/agent-tools/workflow.tools.js.map +1 -0
- package/dist/modules/workflow/event-bus.d.ts +107 -0
- package/dist/modules/workflow/event-bus.d.ts.map +1 -0
- package/dist/modules/workflow/event-bus.js +224 -0
- package/dist/modules/workflow/event-bus.js.map +1 -0
- package/dist/modules/workflow/events.routes.d.ts +80 -0
- package/dist/modules/workflow/events.routes.d.ts.map +1 -0
- package/dist/modules/workflow/events.routes.js +216 -0
- package/dist/modules/workflow/events.routes.js.map +1 -0
- package/dist/modules/workflow/file-change-notifier.d.ts +38 -0
- package/dist/modules/workflow/file-change-notifier.d.ts.map +1 -0
- package/dist/modules/workflow/file-change-notifier.js +22 -0
- package/dist/modules/workflow/file-change-notifier.js.map +1 -0
- package/dist/modules/workflow/file-lock.service.d.ts +57 -0
- package/dist/modules/workflow/file-lock.service.d.ts.map +1 -0
- package/dist/modules/workflow/file-lock.service.js +202 -0
- package/dist/modules/workflow/file-lock.service.js.map +1 -0
- package/dist/modules/workflow/git/branch-name.d.ts +10 -0
- package/dist/modules/workflow/git/branch-name.d.ts.map +1 -0
- package/dist/modules/workflow/git/branch-name.js +76 -0
- package/dist/modules/workflow/git/branch-name.js.map +1 -0
- package/dist/modules/workflow/git/clone-config.d.ts +61 -0
- package/dist/modules/workflow/git/clone-config.d.ts.map +1 -0
- package/dist/modules/workflow/git/clone-config.js +69 -0
- package/dist/modules/workflow/git/clone-config.js.map +1 -0
- package/dist/modules/workflow/git/git-version.d.ts +34 -0
- package/dist/modules/workflow/git/git-version.d.ts.map +1 -0
- package/dist/modules/workflow/git/git-version.js +63 -0
- package/dist/modules/workflow/git/git-version.js.map +1 -0
- package/dist/modules/workflow/git/git.service.d.ts +427 -0
- package/dist/modules/workflow/git/git.service.d.ts.map +1 -0
- package/dist/modules/workflow/git/git.service.js +1987 -0
- package/dist/modules/workflow/git/git.service.js.map +1 -0
- package/dist/modules/workflow/git/mutex.d.ts +11 -0
- package/dist/modules/workflow/git/mutex.d.ts.map +1 -0
- package/dist/modules/workflow/git/mutex.js +23 -0
- package/dist/modules/workflow/git/mutex.js.map +1 -0
- package/dist/modules/workflow/git/pull-request.service.d.ts +124 -0
- package/dist/modules/workflow/git/pull-request.service.d.ts.map +1 -0
- package/dist/modules/workflow/git/pull-request.service.js +328 -0
- package/dist/modules/workflow/git/pull-request.service.js.map +1 -0
- package/dist/modules/workflow/locking-filesystem.d.ts +133 -0
- package/dist/modules/workflow/locking-filesystem.d.ts.map +1 -0
- package/dist/modules/workflow/locking-filesystem.js +400 -0
- package/dist/modules/workflow/locking-filesystem.js.map +1 -0
- package/dist/modules/workflow/pending-commits.service.d.ts +221 -0
- package/dist/modules/workflow/pending-commits.service.d.ts.map +1 -0
- package/dist/modules/workflow/pending-commits.service.js +364 -0
- package/dist/modules/workflow/pending-commits.service.js.map +1 -0
- package/dist/modules/workflow/pending-commits.worker.d.ts +148 -0
- package/dist/modules/workflow/pending-commits.worker.d.ts.map +1 -0
- package/dist/modules/workflow/pending-commits.worker.js +245 -0
- package/dist/modules/workflow/pending-commits.worker.js.map +1 -0
- package/dist/modules/workflow/read-only-filesystem.d.ts +24 -0
- package/dist/modules/workflow/read-only-filesystem.d.ts.map +1 -0
- package/dist/modules/workflow/read-only-filesystem.js +39 -0
- package/dist/modules/workflow/read-only-filesystem.js.map +1 -0
- package/dist/modules/workflow/recovery-bot.d.ts +31 -0
- package/dist/modules/workflow/recovery-bot.d.ts.map +1 -0
- package/dist/modules/workflow/recovery-bot.js +64 -0
- package/dist/modules/workflow/recovery-bot.js.map +1 -0
- package/dist/modules/workflow/review-workflow/review-workflow.interface.d.ts +137 -0
- package/dist/modules/workflow/review-workflow/review-workflow.interface.d.ts.map +1 -0
- package/dist/modules/workflow/review-workflow/review-workflow.interface.js +2 -0
- package/dist/modules/workflow/review-workflow/review-workflow.interface.js.map +1 -0
- package/dist/modules/workflow/review-workflow/review-workflow.service.d.ts +26 -0
- package/dist/modules/workflow/review-workflow/review-workflow.service.d.ts.map +1 -0
- package/dist/modules/workflow/review-workflow/review-workflow.service.js +636 -0
- package/dist/modules/workflow/review-workflow/review-workflow.service.js.map +1 -0
- package/dist/modules/workflow/sanitize-error.d.ts +29 -0
- package/dist/modules/workflow/sanitize-error.d.ts.map +1 -0
- package/dist/modules/workflow/sanitize-error.js +60 -0
- package/dist/modules/workflow/sanitize-error.js.map +1 -0
- package/dist/modules/workflow/session-ontology.policy.d.ts +52 -0
- package/dist/modules/workflow/session-ontology.policy.d.ts.map +1 -0
- package/dist/modules/workflow/session-ontology.policy.js +62 -0
- package/dist/modules/workflow/session-ontology.policy.js.map +1 -0
- package/dist/modules/workflow/session-ontology.service.d.ts +100 -0
- package/dist/modules/workflow/session-ontology.service.d.ts.map +1 -0
- package/dist/modules/workflow/session-ontology.service.js +143 -0
- package/dist/modules/workflow/session-ontology.service.js.map +1 -0
- package/dist/modules/workflow/workflow-hooks.d.ts +87 -0
- package/dist/modules/workflow/workflow-hooks.d.ts.map +1 -0
- package/dist/modules/workflow/workflow-hooks.js +35 -0
- package/dist/modules/workflow/workflow-hooks.js.map +1 -0
- package/dist/modules/workflow/workflow.errors.d.ts +171 -0
- package/dist/modules/workflow/workflow.errors.d.ts.map +1 -0
- package/dist/modules/workflow/workflow.errors.js +260 -0
- package/dist/modules/workflow/workflow.errors.js.map +1 -0
- package/dist/modules/workflow/workflow.routes.d.ts +26 -0
- package/dist/modules/workflow/workflow.routes.d.ts.map +1 -0
- package/dist/modules/workflow/workflow.routes.js +804 -0
- package/dist/modules/workflow/workflow.routes.js.map +1 -0
- package/dist/modules/workflow/workflow.service.d.ts +385 -0
- package/dist/modules/workflow/workflow.service.d.ts.map +1 -0
- package/dist/modules/workflow/workflow.service.js +1155 -0
- package/dist/modules/workflow/workflow.service.js.map +1 -0
- package/dist/modules/workspace/bevel-ignore.d.ts +25 -0
- package/dist/modules/workspace/bevel-ignore.d.ts.map +1 -0
- package/dist/modules/workspace/bevel-ignore.js +57 -0
- package/dist/modules/workspace/bevel-ignore.js.map +1 -0
- package/dist/modules/workspace/kb-seed.interface.d.ts +36 -0
- package/dist/modules/workspace/kb-seed.interface.d.ts.map +1 -0
- package/dist/modules/workspace/kb-seed.interface.js +2 -0
- package/dist/modules/workspace/kb-seed.interface.js.map +1 -0
- package/dist/modules/workspace/kb-seed.service.d.ts +70 -0
- package/dist/modules/workspace/kb-seed.service.d.ts.map +1 -0
- package/dist/modules/workspace/kb-seed.service.js +325 -0
- package/dist/modules/workspace/kb-seed.service.js.map +1 -0
- package/dist/modules/workspace/routine-write-policy.d.ts +49 -0
- package/dist/modules/workspace/routine-write-policy.d.ts.map +1 -0
- package/dist/modules/workspace/routine-write-policy.js +46 -0
- package/dist/modules/workspace/routine-write-policy.js.map +1 -0
- package/dist/modules/workspace/session-ontology.gate.d.ts +112 -0
- package/dist/modules/workspace/session-ontology.gate.d.ts.map +1 -0
- package/dist/modules/workspace/session-ontology.gate.js +161 -0
- package/dist/modules/workspace/session-ontology.gate.js.map +1 -0
- package/dist/modules/workspace/session-sink.d.ts +25 -0
- package/dist/modules/workspace/session-sink.d.ts.map +1 -0
- package/dist/modules/workspace/session-sink.js +8 -0
- package/dist/modules/workspace/session-sink.js.map +1 -0
- package/dist/modules/workspace/spill-store.d.ts +24 -0
- package/dist/modules/workspace/spill-store.d.ts.map +1 -0
- package/dist/modules/workspace/spill-store.js +87 -0
- package/dist/modules/workspace/spill-store.js.map +1 -0
- package/dist/modules/workspace/workspace.routes.d.ts +25 -0
- package/dist/modules/workspace/workspace.routes.d.ts.map +1 -0
- package/dist/modules/workspace/workspace.routes.js +1046 -0
- package/dist/modules/workspace/workspace.routes.js.map +1 -0
- package/dist/modules/workspace/workspace.service.d.ts +339 -0
- package/dist/modules/workspace/workspace.service.d.ts.map +1 -0
- package/dist/modules/workspace/workspace.service.js +1221 -0
- package/dist/modules/workspace/workspace.service.js.map +1 -0
- package/dist/modules/workspace/workspace.tools.d.ts +19 -0
- package/dist/modules/workspace/workspace.tools.d.ts.map +1 -0
- package/dist/modules/workspace/workspace.tools.js +767 -0
- package/dist/modules/workspace/workspace.tools.js.map +1 -0
- package/dist/shared/frontmatter-id.d.ts +35 -0
- package/dist/shared/frontmatter-id.d.ts.map +1 -0
- package/dist/shared/frontmatter-id.js +68 -0
- package/dist/shared/frontmatter-id.js.map +1 -0
- package/dist/shared/fs-walk.d.ts +9 -0
- package/dist/shared/fs-walk.d.ts.map +1 -0
- package/dist/shared/fs-walk.js +34 -0
- package/dist/shared/fs-walk.js.map +1 -0
- package/dist/shared/hash-email.d.ts +11 -0
- package/dist/shared/hash-email.d.ts.map +1 -0
- package/dist/shared/hash-email.js +14 -0
- package/dist/shared/hash-email.js.map +1 -0
- package/dist/shared/kb-layout.d.ts +38 -0
- package/dist/shared/kb-layout.d.ts.map +1 -0
- package/dist/shared/kb-layout.js +102 -0
- package/dist/shared/kb-layout.js.map +1 -0
- package/dist/shared/kb-layout.test.d.ts +2 -0
- package/dist/shared/kb-layout.test.d.ts.map +1 -0
- package/dist/shared/kb-layout.test.js +67 -0
- package/dist/shared/kb-layout.test.js.map +1 -0
- package/dist/shared/ssrf.d.ts +20 -0
- package/dist/shared/ssrf.d.ts.map +1 -0
- package/dist/shared/ssrf.js +89 -0
- package/dist/shared/ssrf.js.map +1 -0
- package/dist/shared/token-crypto.d.ts +16 -0
- package/dist/shared/token-crypto.d.ts.map +1 -0
- package/dist/shared/token-crypto.js +49 -0
- package/dist/shared/token-crypto.js.map +1 -0
- package/dist/shared/ttl-cache.d.ts +16 -0
- package/dist/shared/ttl-cache.d.ts.map +1 -0
- package/dist/shared/ttl-cache.js +27 -0
- package/dist/shared/ttl-cache.js.map +1 -0
- package/dist/shared/utcp-namespace.d.ts +46 -0
- package/dist/shared/utcp-namespace.d.ts.map +1 -0
- package/dist/shared/utcp-namespace.js +82 -0
- package/dist/shared/utcp-namespace.js.map +1 -0
- package/dist/version.d.ts +17 -0
- package/dist/version.d.ts.map +1 -0
- package/dist/version.js +19 -0
- package/dist/version.js.map +1 -0
- package/kb-template/.bevelignore +21 -0
- package/kb-template/Agents/.gitkeep +0 -0
- package/kb-template/Agents/README.md +38 -0
- package/kb-template/CLAUDE.md +419 -0
- package/kb-template/Data/.gitkeep +0 -0
- package/kb-template/Data/README.md +39 -0
- package/kb-template/KnowledgeBase/.gitkeep +0 -0
- package/kb-template/KnowledgeBase/README.md +37 -0
- package/kb-template/Pipelines/.gitkeep +0 -0
- package/kb-template/Pipelines/README.md +38 -0
- package/kb-template/Skills/.gitkeep +0 -0
- package/kb-template/Skills/README.md +32 -0
- package/kb-template/Tools/.gitkeep +0 -0
- package/kb-template/Tools/README.md +42 -0
- package/kb-template/access.md +36 -0
- package/migrations/0000_core_init.sql +243 -0
- package/migrations/meta/0000_snapshot.json +1480 -0
- package/migrations/meta/_journal.json +13 -0
- package/package.json +80 -0
- package/src/assets.ts +25 -0
- package/src/core/core-ports.ts +91 -0
- package/src/core/create-core-server.ts +338 -0
- package/src/core/create-core-services.ts +501 -0
- package/src/core-config.ts +257 -0
- package/src/index.ts +69 -0
- package/src/modules/access/__tests__/access-control.atref-batch.test.ts +98 -0
- package/src/modules/access/__tests__/access-control.read-batch.test.ts +132 -0
- package/src/modules/access/__tests__/access-control.service.test.ts +1011 -0
- package/src/modules/access/__tests__/access-mutation.service.test.ts +439 -0
- package/src/modules/access/__tests__/access-splice.test.ts +247 -0
- package/src/modules/access/__tests__/access.routes.revoke.test.ts +407 -0
- package/src/modules/access/__tests__/creator-access.test.ts +217 -0
- package/src/modules/access/__tests__/grant-sources.test.ts +204 -0
- package/src/modules/access/__tests__/kb-read-filter.test.ts +70 -0
- package/src/modules/access/__tests__/roles-admin.service.test.ts +469 -0
- package/src/modules/access/__tests__/roles-edit.test.ts +138 -0
- package/src/modules/access/__tests__/roles-yaml-guard.test.ts +70 -0
- package/src/modules/access/__tests__/roles.routes.test.ts +234 -0
- package/src/modules/access/access-control.interface.ts +383 -0
- package/src/modules/access/access-control.service.ts +1794 -0
- package/src/modules/access/access-errors.ts +60 -0
- package/src/modules/access/access-mutation.service.ts +369 -0
- package/src/modules/access/access-splice.ts +413 -0
- package/src/modules/access/access.routes.ts +894 -0
- package/src/modules/access/creator-access.ts +270 -0
- package/src/modules/access/kb-read-filter.ts +76 -0
- package/src/modules/access/roles-admin.service.ts +741 -0
- package/src/modules/access/roles-edit.ts +248 -0
- package/src/modules/access/roles-yaml-guard.ts +89 -0
- package/src/modules/admin/admin-access.routes.ts +29 -0
- package/src/modules/admin/admin-access.service.ts +38 -0
- package/src/modules/admin/admin.interface.ts +10 -0
- package/src/modules/auth/account-erasure.service.ts +183 -0
- package/src/modules/auth/auth.middleware.ts +78 -0
- package/src/modules/auth/auth.routes.ts +97 -0
- package/src/modules/auth/auth.service.ts +199 -0
- package/src/modules/code-mode/code-mode-names.ts +38 -0
- package/src/modules/code-mode/code-mode.tool.ts +117 -0
- package/src/modules/code-mode/index.ts +6 -0
- package/src/modules/database/connection.ts +15 -0
- package/src/modules/database/core-schema.ts +431 -0
- package/src/modules/database/migrate.ts +43 -0
- package/src/modules/database/schema.ts +11 -0
- package/src/modules/diff/__tests__/diff.routes.read-gate.test.ts +87 -0
- package/src/modules/diff/__tests__/diff.routes.rejectPathsLocked.test.ts +150 -0
- package/src/modules/diff/__tests__/diff.service.seed-atomicity.test.ts +184 -0
- package/src/modules/diff/__tests__/diff.service.test.ts +202 -0
- package/src/modules/diff/diff-paths.ts +9 -0
- package/src/modules/diff/diff.config.ts +12 -0
- package/src/modules/diff/diff.interface.ts +78 -0
- package/src/modules/diff/diff.routes.ts +277 -0
- package/src/modules/diff/diff.service.ts +508 -0
- package/src/modules/diff/line-diff.ts +79 -0
- package/src/modules/mcp/__tests__/bevel-oauth-provider.test.ts +287 -0
- package/src/modules/mcp/__tests__/mcp-auth.middleware.test.ts +249 -0
- package/src/modules/mcp/__tests__/mcp-proxy-helpers.test.ts +253 -0
- package/src/modules/mcp/__tests__/mcp-session-store.test.ts +151 -0
- package/src/modules/mcp/__tests__/mcp.e2e.test.ts +150 -0
- package/src/modules/mcp/__tests__/mcp.routes.delete.test.ts +92 -0
- package/src/modules/mcp/__tests__/mcp.service.test.ts +414 -0
- package/src/modules/mcp/mcp-auth.middleware.ts +126 -0
- package/src/modules/mcp/mcp-session-store.ts +162 -0
- package/src/modules/mcp/mcp.routes.ts +263 -0
- package/src/modules/mcp/mcp.service.ts +973 -0
- package/src/modules/mcp/oauth/bevel-oauth-provider.ts +401 -0
- package/src/modules/mcp/oauth/oauth-consent.routes.ts +60 -0
- package/src/modules/mcp/oauth/oauth-state.ts +61 -0
- package/src/modules/secrets-vault/__tests__/connect-pending.route.test.ts +277 -0
- package/src/modules/secrets-vault/__tests__/db-secrets-vault.oauth.test.ts +206 -0
- package/src/modules/secrets-vault/__tests__/mcp-oauth-discovery.service.test.ts +178 -0
- package/src/modules/secrets-vault/__tests__/scopes-covered.test.ts +101 -0
- package/src/modules/secrets-vault/__tests__/secrets-variable-loader.test.ts +54 -0
- package/src/modules/secrets-vault/__tests__/tool-owner-gate.route.test.ts +143 -0
- package/src/modules/secrets-vault/db-secrets-vault.service.ts +792 -0
- package/src/modules/secrets-vault/index.ts +25 -0
- package/src/modules/secrets-vault/mcp-oauth-discovery.service.ts +289 -0
- package/src/modules/secrets-vault/secrets-variable-loader.ts +104 -0
- package/src/modules/secrets-vault/secrets-vault.contract.ts +270 -0
- package/src/modules/secrets-vault/secrets-vault.routes.ts +526 -0
- package/src/modules/skills/__tests__/skills.service.test.ts +176 -0
- package/src/modules/skills/index.ts +10 -0
- package/src/modules/skills/skills.contract.ts +54 -0
- package/src/modules/skills/skills.routes.ts +38 -0
- package/src/modules/skills/skills.service.ts +245 -0
- package/src/modules/skills/skills.tools.ts +121 -0
- package/src/modules/tool-auth/__tests__/external-api-key.service.test.ts +358 -0
- package/src/modules/tool-auth/__tests__/internal-token.service.test.ts +79 -0
- package/src/modules/tool-auth/__tests__/manual-auth.middleware.test.ts +88 -0
- package/src/modules/tool-auth/external-api-key.errors.ts +25 -0
- package/src/modules/tool-auth/external-api-key.interface.ts +99 -0
- package/src/modules/tool-auth/external-api-key.service.ts +209 -0
- package/src/modules/tool-auth/internal-token.service.ts +124 -0
- package/src/modules/tool-auth/llm-usage-meter.ts +19 -0
- package/src/modules/tool-auth/tool-auth.middleware.ts +220 -0
- package/src/modules/tool-helpers/__tests__/phase0-loopback-spike.test.ts +129 -0
- package/src/modules/tool-helpers/__tests__/phase4-tools.test.ts +95 -0
- package/src/modules/tool-helpers/__tests__/tools-surface.test.ts +146 -0
- package/src/modules/tool-helpers/__tests__/validate-token.test.ts +75 -0
- package/src/modules/tool-helpers/index.ts +18 -0
- package/src/modules/tool-helpers/tool-context.ts +98 -0
- package/src/modules/tool-helpers/tool-def.ts +73 -0
- package/src/modules/tool-helpers/tool-handler.ts +91 -0
- package/src/modules/tool-helpers/tool.contract.ts +85 -0
- package/src/modules/tool-helpers/validate-token.ts +50 -0
- package/src/modules/tool-manuals/__tests__/tool-manuals.mcp-oauth.test.ts +200 -0
- package/src/modules/tool-manuals/__tests__/tool-manuals.service.test.ts +499 -0
- package/src/modules/tool-manuals/__tests__/tool-manuals.tools.test.ts +156 -0
- package/src/modules/tool-manuals/index.ts +12 -0
- package/src/modules/tool-manuals/tool-manuals.contract.ts +183 -0
- package/src/modules/tool-manuals/tool-manuals.routes.ts +110 -0
- package/src/modules/tool-manuals/tool-manuals.service.ts +781 -0
- package/src/modules/tool-manuals/tool-manuals.tools.ts +202 -0
- package/src/modules/tool-registry/__tests__/tool-registry.test.ts +64 -0
- package/src/modules/tool-registry/manual.routes.ts +87 -0
- package/src/modules/tool-registry/tool-registry.ts +55 -0
- package/src/modules/tool-registry/tool.contract.ts +52 -0
- package/src/modules/workflow/__tests__/event-bus.test.ts +322 -0
- package/src/modules/workflow/__tests__/file-change-notifier.test.ts +51 -0
- package/src/modules/workflow/__tests__/format-affected-owners.test.ts +67 -0
- package/src/modules/workflow/__tests__/locking-filesystem.test.ts +445 -0
- package/src/modules/workflow/__tests__/pending-commits.canonical.test.ts +36 -0
- package/src/modules/workflow/__tests__/pending-commits.worker.test.ts +243 -0
- package/src/modules/workflow/__tests__/preserve-roles-yaml.test.ts +308 -0
- package/src/modules/workflow/__tests__/sanitize-error.test.ts +67 -0
- package/src/modules/workflow/__tests__/session-ontology.policy.test.ts +62 -0
- package/src/modules/workflow/__tests__/session-ontology.service.test.ts +200 -0
- package/src/modules/workflow/__tests__/workflow.service.commitFileWhileLocked.test.ts +232 -0
- package/src/modules/workflow/__tests__/workflow.service.facade.test.ts +380 -0
- package/src/modules/workflow/__tests__/workflow.service.releaseLock.test.ts +340 -0
- package/src/modules/workflow/agent-tools/__tests__/workflow.tools.test.ts +192 -0
- package/src/modules/workflow/agent-tools/workflow.tools.ts +502 -0
- package/src/modules/workflow/event-bus.ts +262 -0
- package/src/modules/workflow/events.routes.ts +266 -0
- package/src/modules/workflow/file-change-notifier.ts +54 -0
- package/src/modules/workflow/file-lock.service.ts +269 -0
- package/src/modules/workflow/git/__tests__/branch-name.test.ts +86 -0
- package/src/modules/workflow/git/__tests__/branchAuthor.test.ts +80 -0
- package/src/modules/workflow/git/__tests__/clone-config.test.ts +15 -0
- package/src/modules/workflow/git/__tests__/git-test-helpers.ts +47 -0
- package/src/modules/workflow/git/__tests__/git-version.failure.test.ts +24 -0
- package/src/modules/workflow/git/__tests__/git-version.test.ts +49 -0
- package/src/modules/workflow/git/__tests__/git.service.accessGating.test.ts +389 -0
- package/src/modules/workflow/git/__tests__/git.service.changedFilesForPr.test.ts +124 -0
- package/src/modules/workflow/git/__tests__/git.service.commitChanges.test.ts +105 -0
- package/src/modules/workflow/git/__tests__/git.service.commitFile.test.ts +211 -0
- package/src/modules/workflow/git/__tests__/git.service.createBranch.test.ts +154 -0
- package/src/modules/workflow/git/__tests__/git.service.deleteBranch.test.ts +320 -0
- package/src/modules/workflow/git/__tests__/git.service.diffFileAtCommit.test.ts +202 -0
- package/src/modules/workflow/git/__tests__/git.service.diffFileBetweenBranches.test.ts +453 -0
- package/src/modules/workflow/git/__tests__/git.service.list-branches.test.ts +198 -0
- package/src/modules/workflow/git/__tests__/git.service.listTrackedFiles.test.ts +125 -0
- package/src/modules/workflow/git/__tests__/git.service.logForFile.test.ts +219 -0
- package/src/modules/workflow/git/__tests__/git.service.mergeChangeRequest.test.ts +145 -0
- package/src/modules/workflow/git/__tests__/git.service.pendingChanges.test.ts +240 -0
- package/src/modules/workflow/git/__tests__/git.service.postMergePull.test.ts +272 -0
- package/src/modules/workflow/git/__tests__/git.service.pull.test.ts +232 -0
- package/src/modules/workflow/git/__tests__/git.service.readFileAtRef.test.ts +101 -0
- package/src/modules/workflow/git/__tests__/git.service.status.test.ts +127 -0
- package/src/modules/workflow/git/__tests__/mutex.test.ts +78 -0
- package/src/modules/workflow/git/__tests__/pull-request.service.test.ts +225 -0
- package/src/modules/workflow/git/__tests__/pull-request.service.viewer-can-cancel.test.ts +101 -0
- package/src/modules/workflow/git/branch-name.ts +70 -0
- package/src/modules/workflow/git/clone-config.ts +71 -0
- package/src/modules/workflow/git/git-version.ts +70 -0
- package/src/modules/workflow/git/git.service.ts +2248 -0
- package/src/modules/workflow/git/mutex.ts +22 -0
- package/src/modules/workflow/git/pull-request.service.ts +447 -0
- package/src/modules/workflow/locking-filesystem.ts +489 -0
- package/src/modules/workflow/pending-commits.service.ts +444 -0
- package/src/modules/workflow/pending-commits.worker.ts +361 -0
- package/src/modules/workflow/read-only-filesystem.ts +54 -0
- package/src/modules/workflow/recovery-bot.ts +73 -0
- package/src/modules/workflow/review-workflow/__tests__/approval-states.test.ts +560 -0
- package/src/modules/workflow/review-workflow/__tests__/cancel-pr.test.ts +176 -0
- package/src/modules/workflow/review-workflow/__tests__/merge-gate.test.ts +258 -0
- package/src/modules/workflow/review-workflow/review-workflow.interface.ts +199 -0
- package/src/modules/workflow/review-workflow/review-workflow.service.ts +806 -0
- package/src/modules/workflow/sanitize-error.ts +62 -0
- package/src/modules/workflow/session-ontology.policy.ts +70 -0
- package/src/modules/workflow/session-ontology.service.ts +178 -0
- package/src/modules/workflow/workflow-hooks.ts +101 -0
- package/src/modules/workflow/workflow.errors.ts +285 -0
- package/src/modules/workflow/workflow.routes.ts +858 -0
- package/src/modules/workflow/workflow.service.ts +1555 -0
- package/src/modules/workspace/__tests__/kb-seed.service.test.ts +213 -0
- package/src/modules/workspace/__tests__/routine-write-policy.test.ts +68 -0
- package/src/modules/workspace/__tests__/session-ontology.gate.test.ts +237 -0
- package/src/modules/workspace/__tests__/spill-store.test.ts +43 -0
- package/src/modules/workspace/__tests__/workspace.routes.create-grant.test.ts +233 -0
- package/src/modules/workspace/__tests__/workspace.routes.delete.test.ts +176 -0
- package/src/modules/workspace/__tests__/workspace.routes.download.test.ts +303 -0
- package/src/modules/workspace/__tests__/workspace.routes.read-gate.test.ts +276 -0
- package/src/modules/workspace/__tests__/workspace.service.read-filter.test.ts +120 -0
- package/src/modules/workspace/__tests__/workspace.service.test.ts +565 -0
- package/src/modules/workspace/__tests__/workspace.tools.test.ts +504 -0
- package/src/modules/workspace/bevel-ignore.ts +62 -0
- package/src/modules/workspace/kb-seed.interface.ts +36 -0
- package/src/modules/workspace/kb-seed.service.ts +361 -0
- package/src/modules/workspace/routine-write-policy.ts +79 -0
- package/src/modules/workspace/session-ontology.gate.ts +189 -0
- package/src/modules/workspace/session-sink.ts +25 -0
- package/src/modules/workspace/spill-store.ts +87 -0
- package/src/modules/workspace/workspace.routes.ts +1114 -0
- package/src/modules/workspace/workspace.service.ts +1343 -0
- package/src/modules/workspace/workspace.tools.ts +885 -0
- package/src/shared/__tests__/frontmatter-id.test.ts +88 -0
- package/src/shared/__tests__/fs-walk.test.ts +42 -0
- package/src/shared/__tests__/ssrf.test.ts +53 -0
- package/src/shared/__tests__/utcp-namespace.test.ts +19 -0
- package/src/shared/frontmatter-id.ts +72 -0
- package/src/shared/fs-walk.ts +30 -0
- package/src/shared/hash-email.ts +14 -0
- package/src/shared/kb-layout.test.ts +88 -0
- package/src/shared/kb-layout.ts +101 -0
- package/src/shared/ssrf.ts +78 -0
- package/src/shared/token-crypto.ts +54 -0
- package/src/shared/ttl-cache.ts +27 -0
- package/src/shared/utcp-namespace.ts +88 -0
- package/src/version.ts +19 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"review-workflow.service.js","sourceRoot":"","sources":["../../../../src/modules/workflow/review-workflow/review-workflow.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAa3C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEnG,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAO1D,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,wBAAwB;AACxB,MAAM,YAAY,GAAG,OAAgB,CAAC;AACtC,MAAM,kBAAkB,GAAG,UAAU,CAAC;AACtC,qFAAqF;AACrF,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CACpE,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CACxC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,gBAAiB,SAAQ,mBAAmB;IAChD,YAAY,MAAiC;QAC3C,KAAK,CACH,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qCAAqC,EACpF,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CACnC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,iBAAkB,SAAQ,mBAAmB;IACjD,YAAY,OAAiB;QAC3B,KAAK,CAAC,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,EAAE,GAAG,EAAE;YACpE,mBAAmB,EAAE,OAAO;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,mBAAoB,SAAQ,mBAAmB;IACnD,YAAY,MAAc;QACxB,KAAK,CAAC,iBAAiB,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,iBAAkB,SAAQ,mBAAmB;IACjD,YAAY,MAAmE;QAC7E,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG;YACtB,cAAc,EAAW,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,iDAAiD,EAAE;YAChG,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,yFAAyF,EAAE;YACxI,gBAAgB,EAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,6BAA6B,EAAE;SAC7E,CAAC,MAAM,CAAC,CAAC;QACV,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,eAAgB,SAAQ,mBAAmB;IAC/C;QACE,KAAK,CACH,sHAAsH,EACtH,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,gBAAiB,SAAQ,mBAAmB;IAChD,YAAY,MAA+C;QACzD,MAAM,GAAG,GACP,MAAM,KAAK,iBAAiB;YAC1B,CAAC,CAAC,0CAA0C;YAC5C,CAAC,CAAC,2CAA2C,CAAC;QAClD,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,eAAgB,SAAQ,mBAAmB;IAC/C;QACE,KAAK,CACH,yEAAyE,EACzE,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAAC,0CAA0C,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAwB;IAC/C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,uBAAuB,CAAC,iCAAiC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,sEAAsE;AACtE,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAClF,SAAS,eAAe,CAAC,KAAc,EAAE,SAAiB;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAuB,CAAC,GAAG,SAAS,uBAAuB,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,CAAS;IACnC,OAAO,CAAC,KAAK,UAAU,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,CAAoB;IAC1C,MAAM,WAAW,GACf,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,CAAoB;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,iBAAiB,CAAC,KAAK;aACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;aACzD,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO;IAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;IAClF,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAC;IAC5F,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,KAAK,CAAC,GAAmC;IAChD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE;QACxD,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,SAAS;QAC3B,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,SAAS;QAC3B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,SAAS;QACnC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,qBAAqB;IAEb;IACA;IACA;IACA;IAJnB,YACmB,EAAY,EACZ,aAA6B,EAC7B,gBAAkC,EAClC,GAAe;QAHf,OAAE,GAAF,EAAE,CAAU;QACZ,kBAAa,GAAb,aAAa,CAAgB;QAC7B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,QAAG,GAAH,GAAG,CAAY;IAC/B,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aACxC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,WAAW,CACf,QAAgB,EAChB,IAAc,EACd,KAAyB,EACzB,OAAe;QAEf,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;QAExE,oFAAoF;QACpF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAC;QACzE,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,8CAA8C;QAC9C,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC5D,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;iBACzB,MAAM,EAAE;iBACR,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAC1E;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,uBAAuB,CAAC,qCAAqC,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,CAAC;YACN,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5C,UAAU,EAAE,IAAI,CAAC,IAAI;YACrB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;YACxB,OAAO;YACP,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;SACjC,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,WAAW,CACf,SAAiB,EACjB,QAAgB,EAChB,IAAc,EACd,IAAY;QAEZ,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACzC,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;aAC3E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACjD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;aAC3E,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,QAAgB,EAAE,IAAc;QACrE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;aAC3E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,UAAU,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,QAAgB,EAChB,KAAwB,EACxB,OAAe,EACf,UAAkB,EAClB,cAA6B,EAC7B,WAAoB,EACpB,WAAoB;QAEpB,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAE9B,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,6DAA6D;QAC7D,EAAE;QACF,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,OAAO,GAAG,UAAU,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,iBAAiB,GAQjB,IAAI,GAAG,EAAE,CAAC;QACd,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,oEAAoE;QACpE,qEAAqE;QACrE,IAAI,sBAAsB,GAAyB,IAAI,GAAG,EAAE,CAAC;QAC7D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrF,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,4BAA4B,CACpE,WAAW,EACX,OAAO,EACP,KAAK,CACN,CAAC;gBACF,IAAI,QAAQ;oBAAE,iBAAiB,GAAG,QAAQ,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CACV,iEAAiE,QAAQ,UAAU,UAAU,IAAI,EACjG,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,CACvD,WAAW,EACX,OAAO,EACP,WAAW,EACX,KAAK,CACN,CAAC;oBACF,IAAI,KAAK;wBAAE,sBAAsB,GAAG,KAAK,CAAC;gBAC5C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,IAAI,CACV,uDAAuD,QAAQ,WAAW,WAAW,GAAG,EACxF,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,0DAA0D;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEjD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAqB,EAAE;YAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACnD,KAAK,EAAE,EAAE;gBACT,KAAK,EAAE,EAAuC;gBAC9C,MAAM,EAAE,IAAI,GAAG,EAAU;aAC1B,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;YAE1D,MAAM,UAAU,GAAwB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3D,KAAK,EAAE,CAAC,CAAC,aAAa;gBACtB,IAAI,EAAE,CAAC,CAAC,YAAY;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;gBACtC,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,OAAO;gBAC9B,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,KAAK;aACvF,CAAC,CAAC,CAAC;YAEJ,sEAAsE;YACtE,sEAAsE;YACtE,qEAAqE;YACrE,6DAA6D;YAC7D,yEAAyE;YACzE,yEAAyE;YACzE,qEAAqE;YACrE,uDAAuD;YACvD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YACvE,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,IAAI,IAAI,GAAG,EAAU,CAAC;YACpE,MAAM,mBAAmB,GACvB,CAAC,kBAAkB,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;gBAChD,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,EAAE;oBACJ,MAAM,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;oBACpD,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;wBAAE,OAAO,KAAK,CAAC;oBACxC,OAAO,kBAAkB;wBACvB,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC;wBACpC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACzC,CAAC,CACF,CAAC;YAEJ,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,iBAAiB,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;gBACnE,UAAU;gBACV,UAAU,EAAE,mBAAmB;gBAC/B,gBAAgB,EAAE,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI;aACjE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CACf,QAAgB,EAChB,IAAY,EACZ,IAAc,EACd,KAAwB,EACxB,OAAe,EACf,UAAkB,EAClB,cAA6B,EAC7B,WAAmB;QAEnB,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;QACxE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,CAAC,CAAC;QAE9E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAChD,CAAC;QAED,oEAAoE;QACpE,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,mDAAmD;QACnD,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CACvD,WAAW,EACX,UAAU,UAAU,EAAE,EACtB,IAAI,CAAC,KAAK,EACV,IAAI,CACL,CAAC;QACF,IAAI,UAAU,KAAK,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEpD,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC;YACN,QAAQ;YACR,IAAI;YACJ,aAAa,EAAE,WAAW;YAC1B,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,OAAO;SACR,CAAC;aACD,mBAAmB,EAAE,CAAC;QAEzB,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACnG,CAAC;IAED,iBAAiB,CAAC,KAAqB;QACrC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC7D,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC/C,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,qCAAqC;QACrC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QACpE,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,uCAAuC;QACvC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;gBAAE,SAAS;YACjC,IAAI,CAAC,CAAC,UAAU;gBAAE,SAAS;YAE3B,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC,IAAI,yBAAyB,CAAC,CAAC;YAChF,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,IAAI,SAAS,KAAK,GAAG,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,OAAO,CACX,QAAgB,EAChB,IAAc,EACd,OAAe,EACf,SAA8B,EAC9B,KAAuB,EACvB,OAAe,EACf,UAAkB,EAClB,WAAmB,EACnB,OAA6B,EAAE;QAE/B,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;QACxE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,CAAC,CAAC;QAC9E,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;QAEhF,sEAAsE;QACtE,0EAA0E;QAC1E,2EAA2E;QAC3E,oDAAoD;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAED,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,+DAA+D;QAC/D,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CACpD,WAAW,EACX,UAAU,UAAU,EAAE,EACtB,IAAI,CAAC,KAAK,EACV,YAAY,CACb,CAAC;YACF,IAAI,OAAO,KAAK,IAAI;gBAAE,MAAM,IAAI,eAAe,EAAE,CAAC;QACpD,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;aAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,QAAQ,YAAY,CAAC,CAAC;QACpF,wEAAwE;QACxE,6EAA6E;QAC7E,gEAAgE;QAChE,IAAI,EAAE,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC;gBAC1B,EAAE,CAAC,KAAK,KAAK,QAAQ;oBACnB,CAAC,CAAC,8CAA8C;oBAChD,CAAC,CAAC,gCAAgC;aACrC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,CAAC;YACN,QAAQ;YACR,gBAAgB;YAChB,eAAe,EAAE,IAAI,CAAC,IAAI;YAC1B,cAAc,EAAE,OAAO;YACvB,WAAW,EAAE,YAAY;YACzB,SAAS,EAAE,KAAK;SACjB,CAAC;aACD,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAEpC,sEAAsE;QACtE,6EAA6E;QAC7E,qEAAqE;QACrE,MAAM,OAAO,GAAG,GAAG,OAAO,MAAM,QAAQ,GAAG,CAAC;QAC5C,MAAM,YAAY,GAChB,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACrC,CAAC,CAAC,wCAAwC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACzF,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,uBAAuB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;QAE/E,8EAA8E;QAC9E,6EAA6E;QAC7E,8EAA8E;QAC9E,qEAAqE;QACrE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;QACxF,IAAI,WAAkE,CAAC;QACvE,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAC7C,aAAa,CAAC,EAAE,EAChB,EAAE,CAAC,YAAY,EACf,EAAE,CAAC,YAAY,EACf,EAAE,OAAO,EAAE,IAAI,EAAE,EACjB,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAChF,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;iBACnE,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC;gBACH,SAAS,EAAE,KAAK;gBAChB,WAAW,EAAE,IAAI,IAAI,EAAE;gBACvB,KAAK,EAAE,cAAc,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACpD,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC,MAAM,IAAI,2BAA2B,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;QAC7F,CAAC;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;aACnG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;aAC1E,SAAS,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,oEAAoE;YACpE,sEAAsE;YACtE,MAAM,SAAS,GAAG,sFAAsF,CAAC;YACzG,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;iBACxD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;aACrC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAEvC,OAAO;YACL,QAAQ;YACR,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,IAAc,EACd,KAAuB,EACvB,YAA2B,EAC3B,UAAkB,EAClB,WAAmB;QAEnB,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,CAAC,CAAC;QAC9E,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;QAEhF,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QACtE,IAAI,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAExE,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,4EAA4E;QAC5E,oEAAoE;QACpE,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,YAAY,KAAK,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,uEAAuE;YACvE,qEAAqE;YACrE,2CAA2C;YAC3C,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CACpD,WAAW,EACX,UAAU,UAAU,EAAE,EACtB,IAAI,CAAC,KAAK,EACV,YAAY,CACb,CAAC;gBACF,aAAa,GAAG,OAAO,KAAK,IAAI,CAAC;YACnC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,eAAe,EAAE,CAAC;QAEnE,wEAAwE;QACxE,yEAAyE;QACzE,gEAAgE;QAChE,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;aACvD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;aACjF,SAAS,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;QAExC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;iBACxB,MAAM,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC;iBACvC,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;iBAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QAChG,CAAC;QAED,OAAO;YACL,QAAQ;YACR,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;SAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,QAAgB,EAChB,IAAY,EACZ,IAAc,EACd,KAAwB,EACxB,OAAe,EACf,UAAkB,EAClB,cAA6B,EAC7B,WAAmB;QAEnB,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;QAExE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEpD,0EAA0E;QAC1E,uEAAuE;QACvE,4DAA4D;QAC5D,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACtC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EAC9B,EAAE,CAAC,eAAe,CAAC,aAAa,EAAE,WAAW,CAAC,CAC/C,CACF,CAAC;QAEJ,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACnG,CAAC;CACF"}
|
|
@@ -0,0 +1,29 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Shared error-text sanitizer for the pending-commits failure pipeline.
|
|
3
|
+
*
|
|
4
|
+
* Two consumers — both forward error text outside of trust boundaries:
|
|
5
|
+
*
|
|
6
|
+
* - `pending-commits.worker.ts` writes `lastError` into the database
|
|
7
|
+
* (`pending_commits.last_error`) and logs the same string to stdout.
|
|
8
|
+
* - the recovery-agent runner (an enterprise `RecoveryAgentRunner` impl,
|
|
9
|
+
* e.g. `modules/agent/background-recovery-agent.runner.ts`) interpolates
|
|
10
|
+
* the message into an LLM prompt that hits OpenAI.
|
|
11
|
+
*
|
|
12
|
+
* Git surfaces credentialed URLs verbatim in stderr (`fatal: unable to
|
|
13
|
+
* access 'https://x-access-token:ghp_…@github.com/…'`), and the underlying
|
|
14
|
+
* `git push` shell-out can also yield `Authorization: Bearer …` headers
|
|
15
|
+
* when remote helpers are involved. We strip the obvious patterns and clip
|
|
16
|
+
* the result so a runaway stack trace can't blow past prompt budgets.
|
|
17
|
+
*
|
|
18
|
+
* Intentional non-goals: this is best-effort regex masking, not a full
|
|
19
|
+
* secret-detection pipeline. We're catching the formats we actually see;
|
|
20
|
+
* a determined attacker could still smuggle a credential through, but the
|
|
21
|
+
* worker doesn't see attacker-controlled error text in the first place.
|
|
22
|
+
*/
|
|
23
|
+
/**
|
|
24
|
+
* Normalise an unknown thrown value into a single-line string with secrets
|
|
25
|
+
* masked and length capped. Safe to log, persist, or interpolate into an
|
|
26
|
+
* LLM prompt.
|
|
27
|
+
*/
|
|
28
|
+
export declare function sanitizeError(err: unknown): string;
|
|
29
|
+
//# sourceMappingURL=sanitize-error.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sanitize-error.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/sanitize-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAsBH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAalD"}
|
|
@@ -0,0 +1,60 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Shared error-text sanitizer for the pending-commits failure pipeline.
|
|
3
|
+
*
|
|
4
|
+
* Two consumers — both forward error text outside of trust boundaries:
|
|
5
|
+
*
|
|
6
|
+
* - `pending-commits.worker.ts` writes `lastError` into the database
|
|
7
|
+
* (`pending_commits.last_error`) and logs the same string to stdout.
|
|
8
|
+
* - the recovery-agent runner (an enterprise `RecoveryAgentRunner` impl,
|
|
9
|
+
* e.g. `modules/agent/background-recovery-agent.runner.ts`) interpolates
|
|
10
|
+
* the message into an LLM prompt that hits OpenAI.
|
|
11
|
+
*
|
|
12
|
+
* Git surfaces credentialed URLs verbatim in stderr (`fatal: unable to
|
|
13
|
+
* access 'https://x-access-token:ghp_…@github.com/…'`), and the underlying
|
|
14
|
+
* `git push` shell-out can also yield `Authorization: Bearer …` headers
|
|
15
|
+
* when remote helpers are involved. We strip the obvious patterns and clip
|
|
16
|
+
* the result so a runaway stack trace can't blow past prompt budgets.
|
|
17
|
+
*
|
|
18
|
+
* Intentional non-goals: this is best-effort regex masking, not a full
|
|
19
|
+
* secret-detection pipeline. We're catching the formats we actually see;
|
|
20
|
+
* a determined attacker could still smuggle a credential through, but the
|
|
21
|
+
* worker doesn't see attacker-controlled error text in the first place.
|
|
22
|
+
*/
|
|
23
|
+
/** Truncation cap for prompts / DB column. ~200 chars keeps prompts tight. */
|
|
24
|
+
const MAX_LEN = 200;
|
|
25
|
+
const REDACTIONS = [
|
|
26
|
+
// `https://user:pass@host/…` and the GitHub-specific `x-access-token:…@`
|
|
27
|
+
// form `git push` prints. Keep the scheme + host so the message still
|
|
28
|
+
// hints at what was being talked to.
|
|
29
|
+
[/(https?:\/\/)[^/\s@]+:[^/\s@]+@/gi, '$1[REDACTED]@'],
|
|
30
|
+
// `Authorization: Bearer <token>` headers (proxy / smart-http output).
|
|
31
|
+
[/(authorization:\s*bearer\s+)\S+/gi, '$1[REDACTED]'],
|
|
32
|
+
// `token=<value>` / `secret=<value>` / `api_key=<value>` style params.
|
|
33
|
+
[/((?:token|secret|api[_-]?key|access[_-]?token|password)\s*[:=]\s*)\S+/gi, '$1[REDACTED]'],
|
|
34
|
+
// Bare hex blobs long enough to be tokens (≥32 chars). Catches `ghp_*`
|
|
35
|
+
// *after* the `token=` mask above strips obvious labels — this one is
|
|
36
|
+
// the fallback for unlabelled hex secrets.
|
|
37
|
+
[/[a-f0-9]{32,}/gi, '[REDACTED]'],
|
|
38
|
+
// Anything that looks like a GitHub PAT / fine-grained PAT prefix.
|
|
39
|
+
[/(gh[pousr]_|github_pat_)[A-Za-z0-9_]+/g, '[REDACTED]'],
|
|
40
|
+
];
|
|
41
|
+
/**
|
|
42
|
+
* Normalise an unknown thrown value into a single-line string with secrets
|
|
43
|
+
* masked and length capped. Safe to log, persist, or interpolate into an
|
|
44
|
+
* LLM prompt.
|
|
45
|
+
*/
|
|
46
|
+
export function sanitizeError(err) {
|
|
47
|
+
const raw = err instanceof Error ? err.message : String(err);
|
|
48
|
+
// Collapse newlines + control chars so the result is a single line. Stack
|
|
49
|
+
// traces are deliberately dropped — `err.message` is the meaningful part;
|
|
50
|
+
// the stack would be over-budget after truncation anyway.
|
|
51
|
+
let out = raw.replace(/\s+/g, ' ').trim();
|
|
52
|
+
for (const [pattern, replacement] of REDACTIONS) {
|
|
53
|
+
out = out.replace(pattern, replacement);
|
|
54
|
+
}
|
|
55
|
+
if (out.length > MAX_LEN) {
|
|
56
|
+
out = out.slice(0, MAX_LEN - 1) + '…';
|
|
57
|
+
}
|
|
58
|
+
return out;
|
|
59
|
+
}
|
|
60
|
+
//# sourceMappingURL=sanitize-error.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sanitize-error.js","sourceRoot":"","sources":["../../../src/modules/workflow/sanitize-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,8EAA8E;AAC9E,MAAM,OAAO,GAAG,GAAG,CAAC;AAEpB,MAAM,UAAU,GAAqC;IACnD,yEAAyE;IACzE,sEAAsE;IACtE,qCAAqC;IACrC,CAAC,mCAAmC,EAAE,eAAe,CAAC;IACtD,uEAAuE;IACvE,CAAC,mCAAmC,EAAE,cAAc,CAAC;IACrD,uEAAuE;IACvE,CAAC,yEAAyE,EAAE,cAAc,CAAC;IAC3F,uEAAuE;IACvE,sEAAsE;IACtE,2CAA2C;IAC3C,CAAC,iBAAiB,EAAE,YAAY,CAAC;IACjC,mEAAmE;IACnE,CAAC,wCAAwC,EAAE,YAAY,CAAC;CACzD,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,0EAA0E;IAC1E,0EAA0E;IAC1E,0DAA0D;IAC1D,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,UAAU,EAAE,CAAC;QAChD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Ontology-session boundary — the PURE decision core (no IO, no DB).
|
|
3
|
+
*
|
|
4
|
+
* Model: each run/session accumulates the SET of named ontologies it has
|
|
5
|
+
* touched (via any read or write). The rule is asymmetric:
|
|
6
|
+
*
|
|
7
|
+
* READS — always allowed. A read that touches a named ontology RECORDS it
|
|
8
|
+
* into the session's touched set (so it can poison later writes).
|
|
9
|
+
* WRITES — allowed only while the session is confined to a SINGLE named
|
|
10
|
+
* ontology and the write targets that same ontology. The moment a
|
|
11
|
+
* session has touched two or more named ontologies (typically by
|
|
12
|
+
* reading across them), EVERY subsequent write is blocked — "read
|
|
13
|
+
* across ontologies → you can't write anymore at all."
|
|
14
|
+
*
|
|
15
|
+
* Neutral touches (`ontologyOf` → null: root config, Skills, root-level
|
|
16
|
+
* Knowledge, non-KB) never record and never block. See
|
|
17
|
+
* `docs/rp4-ontology-boundary-plan-v2.md`.
|
|
18
|
+
*
|
|
19
|
+
* `SessionOntologyService` (Postgres-backed) persists the touched set and calls
|
|
20
|
+
* these helpers; this module keeps the rule itself testable in isolation.
|
|
21
|
+
*/
|
|
22
|
+
import type { Ontology } from '@bevel-software/platform-shared';
|
|
23
|
+
/** Outcome of a write check against the session's touched-ontology set. */
|
|
24
|
+
export type WriteDecision = {
|
|
25
|
+
allow: true;
|
|
26
|
+
} | {
|
|
27
|
+
allow: false;
|
|
28
|
+
reason: 'multi-ontology' | 'different-ontology';
|
|
29
|
+
touched: string[];
|
|
30
|
+
attempted: string;
|
|
31
|
+
};
|
|
32
|
+
/**
|
|
33
|
+
* The set of NAMED ontologies a session has touched after this operation. A
|
|
34
|
+
* neutral operation (`ontology === null`) adds nothing. Pure — returns a new
|
|
35
|
+
* set, never mutates the input.
|
|
36
|
+
*/
|
|
37
|
+
export declare function recordTouch(touched: ReadonlySet<string>, ontology: Ontology): Set<string>;
|
|
38
|
+
/**
|
|
39
|
+
* Decide whether a WRITE to `attempted` is allowed given the ontologies the
|
|
40
|
+
* session has already touched (NOT counting this write yet).
|
|
41
|
+
*
|
|
42
|
+
* - A write to a neutral path (`attempted === null`) is always allowed.
|
|
43
|
+
* - If the session has already touched two or more named ontologies, the
|
|
44
|
+
* write is blocked (`multi-ontology`) — reading across ontologies poisoned
|
|
45
|
+
* the session's write ability.
|
|
46
|
+
* - If the session has touched exactly one named ontology and it differs from
|
|
47
|
+
* the write target, the write is blocked (`different-ontology`).
|
|
48
|
+
* - If the session is unpinned (touched none) or its single touched ontology
|
|
49
|
+
* equals the target, the write is allowed.
|
|
50
|
+
*/
|
|
51
|
+
export declare function decideWrite(touched: ReadonlySet<string>, attempted: Ontology): WriteDecision;
|
|
52
|
+
//# sourceMappingURL=session-ontology.policy.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"session-ontology.policy.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/session-ontology.policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAEhE,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GACrB;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GACf;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5G;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAIzF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,GAAG,aAAa,CAgB5F"}
|
|
@@ -0,0 +1,62 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Ontology-session boundary — the PURE decision core (no IO, no DB).
|
|
3
|
+
*
|
|
4
|
+
* Model: each run/session accumulates the SET of named ontologies it has
|
|
5
|
+
* touched (via any read or write). The rule is asymmetric:
|
|
6
|
+
*
|
|
7
|
+
* READS — always allowed. A read that touches a named ontology RECORDS it
|
|
8
|
+
* into the session's touched set (so it can poison later writes).
|
|
9
|
+
* WRITES — allowed only while the session is confined to a SINGLE named
|
|
10
|
+
* ontology and the write targets that same ontology. The moment a
|
|
11
|
+
* session has touched two or more named ontologies (typically by
|
|
12
|
+
* reading across them), EVERY subsequent write is blocked — "read
|
|
13
|
+
* across ontologies → you can't write anymore at all."
|
|
14
|
+
*
|
|
15
|
+
* Neutral touches (`ontologyOf` → null: root config, Skills, root-level
|
|
16
|
+
* Knowledge, non-KB) never record and never block. See
|
|
17
|
+
* `docs/rp4-ontology-boundary-plan-v2.md`.
|
|
18
|
+
*
|
|
19
|
+
* `SessionOntologyService` (Postgres-backed) persists the touched set and calls
|
|
20
|
+
* these helpers; this module keeps the rule itself testable in isolation.
|
|
21
|
+
*/
|
|
22
|
+
/**
|
|
23
|
+
* The set of NAMED ontologies a session has touched after this operation. A
|
|
24
|
+
* neutral operation (`ontology === null`) adds nothing. Pure — returns a new
|
|
25
|
+
* set, never mutates the input.
|
|
26
|
+
*/
|
|
27
|
+
export function recordTouch(touched, ontology) {
|
|
28
|
+
const next = new Set(touched);
|
|
29
|
+
if (ontology !== null)
|
|
30
|
+
next.add(ontology);
|
|
31
|
+
return next;
|
|
32
|
+
}
|
|
33
|
+
/**
|
|
34
|
+
* Decide whether a WRITE to `attempted` is allowed given the ontologies the
|
|
35
|
+
* session has already touched (NOT counting this write yet).
|
|
36
|
+
*
|
|
37
|
+
* - A write to a neutral path (`attempted === null`) is always allowed.
|
|
38
|
+
* - If the session has already touched two or more named ontologies, the
|
|
39
|
+
* write is blocked (`multi-ontology`) — reading across ontologies poisoned
|
|
40
|
+
* the session's write ability.
|
|
41
|
+
* - If the session has touched exactly one named ontology and it differs from
|
|
42
|
+
* the write target, the write is blocked (`different-ontology`).
|
|
43
|
+
* - If the session is unpinned (touched none) or its single touched ontology
|
|
44
|
+
* equals the target, the write is allowed.
|
|
45
|
+
*/
|
|
46
|
+
export function decideWrite(touched, attempted) {
|
|
47
|
+
if (attempted === null)
|
|
48
|
+
return { allow: true };
|
|
49
|
+
// The set of named ontologies the session would span if this write lands.
|
|
50
|
+
const spanned = new Set(touched);
|
|
51
|
+
spanned.add(attempted);
|
|
52
|
+
if (spanned.size <= 1)
|
|
53
|
+
return { allow: true };
|
|
54
|
+
// spanned.size >= 2 — the write would put the session across a boundary.
|
|
55
|
+
const touchedList = [...touched].sort();
|
|
56
|
+
if (touched.size >= 2) {
|
|
57
|
+
return { allow: false, reason: 'multi-ontology', touched: touchedList, attempted };
|
|
58
|
+
}
|
|
59
|
+
// Exactly one prior ontology, and it isn't the write target.
|
|
60
|
+
return { allow: false, reason: 'different-ontology', touched: touchedList, attempted };
|
|
61
|
+
}
|
|
62
|
+
//# sourceMappingURL=session-ontology.policy.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"session-ontology.policy.js","sourceRoot":"","sources":["../../../src/modules/workflow/session-ontology.policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AASH;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAA4B,EAAE,QAAkB;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,QAAQ,KAAK,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,OAA4B,EAAE,SAAmB;IAC3E,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAE/C,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEvB,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAE9C,yEAAyE;IACzE,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACrF,CAAC;IACD,6DAA6D;IAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACzF,CAAC"}
|
|
@@ -0,0 +1,100 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Ontology-session boundary — the touched-set store (Postgres + cache).
|
|
3
|
+
*
|
|
4
|
+
* Each session accumulates the SET of named ontologies it has touched. The gate
|
|
5
|
+
* calls `checkOperation` for every gated agent tool call:
|
|
6
|
+
*
|
|
7
|
+
* READ (isWrite=false) → always allowed; RECORD the touched ontology so it
|
|
8
|
+
* can poison later writes.
|
|
9
|
+
* WRITE (isWrite=true) → allowed only while the session is confined to a
|
|
10
|
+
* single named ontology equal to the target; once the
|
|
11
|
+
* session has touched ≥2 ontologies, every write is
|
|
12
|
+
* blocked. An allowed write also records its ontology.
|
|
13
|
+
*
|
|
14
|
+
* Neutral operations (`ontologyOf` → null) never record and never block.
|
|
15
|
+
*
|
|
16
|
+
* ┌── checkOperation(sessionId, wsPath, isWrite) ───────────────────────────┐
|
|
17
|
+
* │ ont = ontologyOf(wsPath) │
|
|
18
|
+
* │ ont === null → { allow:true } (neutral; no record) │
|
|
19
|
+
* │ touched = loadTouched(sessionId) (cache, else SELECT) │
|
|
20
|
+
* │ WRITE → decideWrite(touched, ont); if blocked, return block (no record) │
|
|
21
|
+
* │ record(sessionId, ont) (idempotent INSERT; update cache) │
|
|
22
|
+
* │ return { allow:true } │
|
|
23
|
+
* └──────────────────────────────────────────────────────────────────────────┘
|
|
24
|
+
*
|
|
25
|
+
* Postgres is the source of truth so the boundary survives a backend restart.
|
|
26
|
+
* The cache holds each session's touched set; a miss re-reads PG. See
|
|
27
|
+
* `docs/rp4-ontology-boundary-plan-v2.md`.
|
|
28
|
+
*
|
|
29
|
+
* Eviction: `delete(sessionId)` at run end is the PRIMARY reclamation;
|
|
30
|
+
* `sweepOlderThan` is the abandoned-run backstop; the MCP layer also calls
|
|
31
|
+
* `delete` from its `onEvict` hook.
|
|
32
|
+
*/
|
|
33
|
+
import type { Database } from '../database/connection.js';
|
|
34
|
+
export type OperationDecision = {
|
|
35
|
+
allow: true;
|
|
36
|
+
touched: string[];
|
|
37
|
+
} | {
|
|
38
|
+
allow: false;
|
|
39
|
+
reason: 'multi-ontology' | 'different-ontology';
|
|
40
|
+
touched: string[];
|
|
41
|
+
attempted: string;
|
|
42
|
+
};
|
|
43
|
+
export interface ISessionOntologyService {
|
|
44
|
+
/**
|
|
45
|
+
* Evaluate and record a gated agent operation. Reads always allow (and
|
|
46
|
+
* record); writes allow only while confined to a single ontology. Neutral
|
|
47
|
+
* paths always allow and record nothing.
|
|
48
|
+
*/
|
|
49
|
+
checkOperation(sessionId: string, wsPath: string, isWrite: boolean, kbDirName?: string): Promise<OperationDecision>;
|
|
50
|
+
/** Evaluate/record against an already-resolved ontology (used by graph tools). */
|
|
51
|
+
checkOntology(sessionId: string, ontology: string | null, isWrite: boolean): Promise<OperationDecision>;
|
|
52
|
+
/** The set of ontologies a session has touched. */
|
|
53
|
+
getTouched(sessionId: string): Promise<string[]>;
|
|
54
|
+
/** Reclaim a session's touched set (run end / MCP onEvict). */
|
|
55
|
+
delete(sessionId: string): Promise<void>;
|
|
56
|
+
/** Backstop: drop touch rows older than `cutoff` (abandoned runs). */
|
|
57
|
+
sweepOlderThan(cutoff: Date): Promise<number>;
|
|
58
|
+
}
|
|
59
|
+
export declare class SessionOntologyService implements ISessionOntologyService {
|
|
60
|
+
private readonly db;
|
|
61
|
+
/**
|
|
62
|
+
* Write-through cache of each session's touched-ontology set. A present entry
|
|
63
|
+
* is authoritative for the session (we only ever add to it in-process); a
|
|
64
|
+
* miss re-reads Postgres. Keyed by the agent thread / sessionId.
|
|
65
|
+
*/
|
|
66
|
+
private readonly cache;
|
|
67
|
+
/**
|
|
68
|
+
* Serializes each session's read→decide→record path. Without it, two
|
|
69
|
+
* concurrent same-session writes (parallel tool calls in one turn) could both
|
|
70
|
+
* observe a singleton/empty touched set and both be allowed to different
|
|
71
|
+
* ontologies before either INSERT lands — defeating the boundary. Different
|
|
72
|
+
* sessions never contend.
|
|
73
|
+
*/
|
|
74
|
+
private readonly locks;
|
|
75
|
+
constructor(db: Database);
|
|
76
|
+
/**
|
|
77
|
+
* Resolve `wsPath` to its ontology and evaluate/record the operation. Thin
|
|
78
|
+
* wrapper over {@link checkOntology} for the common path-based call site.
|
|
79
|
+
*/
|
|
80
|
+
checkOperation(sessionId: string, wsPath: string, isWrite: boolean, kbDirName?: string): Promise<OperationDecision>;
|
|
81
|
+
/**
|
|
82
|
+
* Evaluate (and, when allowed, record) an operation against an
|
|
83
|
+
* already-resolved ontology. Neutral ops always allow and record nothing;
|
|
84
|
+
* reads always allow and record; writes allow only while the session stays
|
|
85
|
+
* confined to the single target ontology (see {@link decideWrite}). A blocked
|
|
86
|
+
* write records nothing.
|
|
87
|
+
*/
|
|
88
|
+
checkOntology(sessionId: string, ontology: string | null, isWrite: boolean): Promise<OperationDecision>;
|
|
89
|
+
/** The sorted set of named ontologies this session has touched so far. */
|
|
90
|
+
getTouched(sessionId: string): Promise<string[]>;
|
|
91
|
+
/** Reclaim a session's touched set from both the cache and Postgres (run end / MCP onEvict). */
|
|
92
|
+
delete(sessionId: string): Promise<void>;
|
|
93
|
+
/** Backstop sweep: drop touch rows older than `cutoff` (abandoned runs) and return how many were removed. */
|
|
94
|
+
sweepOlderThan(cutoff: Date): Promise<number>;
|
|
95
|
+
/** Load a session's touched set from cache, else from Postgres (and cache it). */
|
|
96
|
+
private loadTouched;
|
|
97
|
+
/** Record a touched ontology (idempotent) and update the cache. */
|
|
98
|
+
private record;
|
|
99
|
+
}
|
|
100
|
+
//# sourceMappingURL=session-ontology.service.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"session-ontology.service.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/session-ontology.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAK1D,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5G,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpH,kFAAkF;IAClF,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxG,mDAAmD;IACnD,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,+DAA+D;IAC/D,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,sEAAsE;IACtE,cAAc,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,qBAAa,sBAAuB,YAAW,uBAAuB;IAiBxD,OAAO,CAAC,QAAQ,CAAC,EAAE;IAhB/B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkC;IAExD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;gBAEjB,EAAE,EAAE,QAAQ;IAEzC;;;OAGG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,CAAC;IAI7B;;;;;;OAMG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA+B7G,0EAA0E;IACpE,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAItD,gGAAgG;IAC1F,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9C,6GAA6G;IACvG,cAAc,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAWnD,kFAAkF;YACpE,WAAW;IAYzB,mEAAmE;YACrD,MAAM;CAQrB"}
|
|
@@ -0,0 +1,143 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Ontology-session boundary — the touched-set store (Postgres + cache).
|
|
3
|
+
*
|
|
4
|
+
* Each session accumulates the SET of named ontologies it has touched. The gate
|
|
5
|
+
* calls `checkOperation` for every gated agent tool call:
|
|
6
|
+
*
|
|
7
|
+
* READ (isWrite=false) → always allowed; RECORD the touched ontology so it
|
|
8
|
+
* can poison later writes.
|
|
9
|
+
* WRITE (isWrite=true) → allowed only while the session is confined to a
|
|
10
|
+
* single named ontology equal to the target; once the
|
|
11
|
+
* session has touched ≥2 ontologies, every write is
|
|
12
|
+
* blocked. An allowed write also records its ontology.
|
|
13
|
+
*
|
|
14
|
+
* Neutral operations (`ontologyOf` → null) never record and never block.
|
|
15
|
+
*
|
|
16
|
+
* ┌── checkOperation(sessionId, wsPath, isWrite) ───────────────────────────┐
|
|
17
|
+
* │ ont = ontologyOf(wsPath) │
|
|
18
|
+
* │ ont === null → { allow:true } (neutral; no record) │
|
|
19
|
+
* │ touched = loadTouched(sessionId) (cache, else SELECT) │
|
|
20
|
+
* │ WRITE → decideWrite(touched, ont); if blocked, return block (no record) │
|
|
21
|
+
* │ record(sessionId, ont) (idempotent INSERT; update cache) │
|
|
22
|
+
* │ return { allow:true } │
|
|
23
|
+
* └──────────────────────────────────────────────────────────────────────────┘
|
|
24
|
+
*
|
|
25
|
+
* Postgres is the source of truth so the boundary survives a backend restart.
|
|
26
|
+
* The cache holds each session's touched set; a miss re-reads PG. See
|
|
27
|
+
* `docs/rp4-ontology-boundary-plan-v2.md`.
|
|
28
|
+
*
|
|
29
|
+
* Eviction: `delete(sessionId)` at run end is the PRIMARY reclamation;
|
|
30
|
+
* `sweepOlderThan` is the abandoned-run backstop; the MCP layer also calls
|
|
31
|
+
* `delete` from its `onEvict` hook.
|
|
32
|
+
*/
|
|
33
|
+
import { eq, lt } from 'drizzle-orm';
|
|
34
|
+
import { ontologyOf } from '../../shared/kb-layout.js';
|
|
35
|
+
import { sessionOntologyTouches } from '../database/schema.js';
|
|
36
|
+
import { recordTouch, decideWrite } from './session-ontology.policy.js';
|
|
37
|
+
import { WorkspaceMutex } from './git/mutex.js';
|
|
38
|
+
export class SessionOntologyService {
|
|
39
|
+
db;
|
|
40
|
+
/**
|
|
41
|
+
* Write-through cache of each session's touched-ontology set. A present entry
|
|
42
|
+
* is authoritative for the session (we only ever add to it in-process); a
|
|
43
|
+
* miss re-reads Postgres. Keyed by the agent thread / sessionId.
|
|
44
|
+
*/
|
|
45
|
+
cache = new Map();
|
|
46
|
+
/**
|
|
47
|
+
* Serializes each session's read→decide→record path. Without it, two
|
|
48
|
+
* concurrent same-session writes (parallel tool calls in one turn) could both
|
|
49
|
+
* observe a singleton/empty touched set and both be allowed to different
|
|
50
|
+
* ontologies before either INSERT lands — defeating the boundary. Different
|
|
51
|
+
* sessions never contend.
|
|
52
|
+
*/
|
|
53
|
+
locks = new WorkspaceMutex();
|
|
54
|
+
constructor(db) {
|
|
55
|
+
this.db = db;
|
|
56
|
+
}
|
|
57
|
+
/**
|
|
58
|
+
* Resolve `wsPath` to its ontology and evaluate/record the operation. Thin
|
|
59
|
+
* wrapper over {@link checkOntology} for the common path-based call site.
|
|
60
|
+
*/
|
|
61
|
+
async checkOperation(sessionId, wsPath, isWrite, kbDirName) {
|
|
62
|
+
return this.checkOntology(sessionId, ontologyOf(wsPath, kbDirName), isWrite);
|
|
63
|
+
}
|
|
64
|
+
/**
|
|
65
|
+
* Evaluate (and, when allowed, record) an operation against an
|
|
66
|
+
* already-resolved ontology. Neutral ops always allow and record nothing;
|
|
67
|
+
* reads always allow and record; writes allow only while the session stays
|
|
68
|
+
* confined to the single target ontology (see {@link decideWrite}). A blocked
|
|
69
|
+
* write records nothing.
|
|
70
|
+
*/
|
|
71
|
+
async checkOntology(sessionId, ontology, isWrite) {
|
|
72
|
+
// Neutral operation: always allowed, records nothing. No state mutation, so
|
|
73
|
+
// it needs no per-session serialization.
|
|
74
|
+
if (ontology === null) {
|
|
75
|
+
const touched = await this.loadTouched(sessionId);
|
|
76
|
+
return { allow: true, touched: [...touched].sort() };
|
|
77
|
+
}
|
|
78
|
+
// Serialize the decide+record path per session so concurrent same-session
|
|
79
|
+
// operations can't both pass the boundary on a stale touched set.
|
|
80
|
+
return this.locks.run(sessionId, async () => {
|
|
81
|
+
const touched = await this.loadTouched(sessionId);
|
|
82
|
+
if (isWrite) {
|
|
83
|
+
const decision = decideWrite(touched, ontology);
|
|
84
|
+
if (!decision.allow) {
|
|
85
|
+
return {
|
|
86
|
+
allow: false,
|
|
87
|
+
reason: decision.reason,
|
|
88
|
+
touched: decision.touched,
|
|
89
|
+
attempted: decision.attempted,
|
|
90
|
+
};
|
|
91
|
+
}
|
|
92
|
+
}
|
|
93
|
+
// Allowed (read, or a write confined to one ontology): record the touch.
|
|
94
|
+
await this.record(sessionId, ontology, touched);
|
|
95
|
+
return { allow: true, touched: [...recordTouch(touched, ontology)].sort() };
|
|
96
|
+
});
|
|
97
|
+
}
|
|
98
|
+
/** The sorted set of named ontologies this session has touched so far. */
|
|
99
|
+
async getTouched(sessionId) {
|
|
100
|
+
return [...(await this.loadTouched(sessionId))].sort();
|
|
101
|
+
}
|
|
102
|
+
/** Reclaim a session's touched set from both the cache and Postgres (run end / MCP onEvict). */
|
|
103
|
+
async delete(sessionId) {
|
|
104
|
+
this.cache.delete(sessionId);
|
|
105
|
+
await this.db.delete(sessionOntologyTouches).where(eq(sessionOntologyTouches.sessionId, sessionId));
|
|
106
|
+
}
|
|
107
|
+
/** Backstop sweep: drop touch rows older than `cutoff` (abandoned runs) and return how many were removed. */
|
|
108
|
+
async sweepOlderThan(cutoff) {
|
|
109
|
+
const removed = await this.db
|
|
110
|
+
.delete(sessionOntologyTouches)
|
|
111
|
+
.where(lt(sessionOntologyTouches.touchedAt, cutoff))
|
|
112
|
+
.returning({ sessionId: sessionOntologyTouches.sessionId });
|
|
113
|
+
// A swept session may have other (newer) rows; drop its cache entry so the
|
|
114
|
+
// next op re-reads the authoritative remaining set from Postgres.
|
|
115
|
+
for (const r of removed)
|
|
116
|
+
this.cache.delete(r.sessionId);
|
|
117
|
+
return removed.length;
|
|
118
|
+
}
|
|
119
|
+
/** Load a session's touched set from cache, else from Postgres (and cache it). */
|
|
120
|
+
async loadTouched(sessionId) {
|
|
121
|
+
const cached = this.cache.get(sessionId);
|
|
122
|
+
if (cached)
|
|
123
|
+
return cached;
|
|
124
|
+
const rows = await this.db
|
|
125
|
+
.select({ ontology: sessionOntologyTouches.ontology })
|
|
126
|
+
.from(sessionOntologyTouches)
|
|
127
|
+
.where(eq(sessionOntologyTouches.sessionId, sessionId));
|
|
128
|
+
const set = new Set(rows.map((r) => r.ontology));
|
|
129
|
+
this.cache.set(sessionId, set);
|
|
130
|
+
return set;
|
|
131
|
+
}
|
|
132
|
+
/** Record a touched ontology (idempotent) and update the cache. */
|
|
133
|
+
async record(sessionId, ontology, current) {
|
|
134
|
+
if (current.has(ontology))
|
|
135
|
+
return; // already recorded; no DB write needed
|
|
136
|
+
await this.db
|
|
137
|
+
.insert(sessionOntologyTouches)
|
|
138
|
+
.values({ sessionId, ontology })
|
|
139
|
+
.onConflictDoNothing({ target: [sessionOntologyTouches.sessionId, sessionOntologyTouches.ontology] });
|
|
140
|
+
current.add(ontology);
|
|
141
|
+
}
|
|
142
|
+
}
|
|
143
|
+
//# sourceMappingURL=session-ontology.service.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"session-ontology.service.js","sourceRoot":"","sources":["../../../src/modules/workflow/session-ontology.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAsB,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAuBhD,MAAM,OAAO,sBAAsB;IAiBJ;IAhB7B;;;;OAIG;IACc,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAExD;;;;;;OAMG;IACc,KAAK,GAAG,IAAI,cAAc,EAAE,CAAC;IAE9C,YAA6B,EAAY;QAAZ,OAAE,GAAF,EAAE,CAAU;IAAG,CAAC;IAE7C;;;OAGG;IACH,KAAK,CAAC,cAAc,CAClB,SAAiB,EACjB,MAAc,EACd,OAAgB,EAChB,SAAkB;QAElB,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,QAAuB,EAAE,OAAgB;QAC9E,4EAA4E;QAC5E,yCAAyC;QACzC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,CAAC;QAED,0EAA0E;QAC1E,kEAAkE;QAClE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAElD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,QAAQ,GAAkB,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC/D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACpB,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;wBACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;qBAC9B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,yEAAyE;YACzE,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACtG,CAAC;IAED,6GAA6G;IAC7G,KAAK,CAAC,cAAc,CAAC,MAAY;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;aACnD,SAAS,CAAC,EAAE,SAAS,EAAE,sBAAsB,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9D,2EAA2E;QAC3E,kEAAkE;QAClE,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAED,kFAAkF;IAC1E,KAAK,CAAC,WAAW,CAAC,SAAiB;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC,EAAE,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC;aACrD,IAAI,CAAC,sBAAsB,CAAC;aAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC/B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mEAAmE;IAC3D,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,QAAgB,EAAE,OAAoB;QAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,uCAAuC;QAC1E,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aAC/B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;CACF"}
|
|
@@ -0,0 +1,87 @@
|
|
|
1
|
+
import type { ValidationReport } from '@bevel-software/platform-shared';
|
|
2
|
+
/**
|
|
3
|
+
* Workflow lifecycle hooks — the generic seam that replaced the
|
|
4
|
+
* constructor-injected KB validator (and the core-owned ontology write block).
|
|
5
|
+
* Core code invokes the hooks at fixed lifecycle points; the modules that OWN
|
|
6
|
+
* the behavior (the enterprise kb/kb-graph modules today) register handlers in
|
|
7
|
+
* the composition root, right after `createCoreServices` returns. Core
|
|
8
|
+
* registers none, so a core-only deployment runs every hook point as a no-op.
|
|
9
|
+
*
|
|
10
|
+
* Two hook kinds with deliberately different failure semantics:
|
|
11
|
+
*
|
|
12
|
+
* - `commitValidation` — ADVISORY. Runs at commit time in `GitService`
|
|
13
|
+
* (`commit` / `commitFile`), exactly where the injected `IKbValidator`
|
|
14
|
+
* used to run. A returned report with `mustFix` entries is logged/surfaced
|
|
15
|
+
* but NEVER blocks the commit, and a hook that throws is caught and logged
|
|
16
|
+
* (see CLAUDE.md "Validation is advisory"). The signature mirrors the old
|
|
17
|
+
* `runValidation(workspaceId)` shape so `KbValidatorService` registers
|
|
18
|
+
* with a one-line adapter.
|
|
19
|
+
*
|
|
20
|
+
* - `preWrite` — BLOCKING. Runs before a gated agent write (file-write
|
|
21
|
+
* tools) or a write-capable shell command; a hook that throws REJECTS the
|
|
22
|
+
* operation (the error propagates to the tool caller). This is where the
|
|
23
|
+
* enterprise ontology-session block registers; core registers nothing, so
|
|
24
|
+
* core never blocks (touch TRACKING stays core — see
|
|
25
|
+
* `session-ontology.gate.ts`).
|
|
26
|
+
*/
|
|
27
|
+
/** What `GitService` knows at the advisory commit-validation point. */
|
|
28
|
+
export interface CommitValidationContext {
|
|
29
|
+
workspaceId: string;
|
|
30
|
+
branch: string;
|
|
31
|
+
/**
|
|
32
|
+
* Repo-relative paths the commit will include — the full touched set for
|
|
33
|
+
* `commit()`, a single element for the one-file `commitFile()` path.
|
|
34
|
+
*/
|
|
35
|
+
paths: string[];
|
|
36
|
+
}
|
|
37
|
+
/**
|
|
38
|
+
* Advisory commit-time validation. Return a report to have the caller log /
|
|
39
|
+
* surface it (or `void` for "nothing to say"). Throwing is tolerated — the
|
|
40
|
+
* caller catches and logs, never blocks the commit.
|
|
41
|
+
*/
|
|
42
|
+
export type CommitValidationHook = (ctx: CommitValidationContext) => Promise<ValidationReport | void>;
|
|
43
|
+
/**
|
|
44
|
+
* What the pre-write gate knows when it consults the blocking hooks. The core
|
|
45
|
+
* gate has already resolved all skip conditions (boundary flag off, neutral
|
|
46
|
+
* path, non-agent caller, recovery bot, missing session id — see
|
|
47
|
+
* `resolveGatedSession`), so by hook time there is always a session id.
|
|
48
|
+
*/
|
|
49
|
+
export type PreWriteContext =
|
|
50
|
+
/** A path-addressed content write (write_file/edit_file/mkdir/move/copy/unzip…). */
|
|
51
|
+
{
|
|
52
|
+
kind: 'file-write';
|
|
53
|
+
sessionId: string;
|
|
54
|
+
wsPath: string;
|
|
55
|
+
}
|
|
56
|
+
/** A write-capable operation with no resolvable target path (execute_command). */
|
|
57
|
+
| {
|
|
58
|
+
kind: 'shell';
|
|
59
|
+
sessionId: string;
|
|
60
|
+
};
|
|
61
|
+
/** Blocking pre-write hook: throw to reject the write; return to allow. */
|
|
62
|
+
export type PreWriteHook = (ctx: PreWriteContext) => Promise<void>;
|
|
63
|
+
/**
|
|
64
|
+
* The registry instance. ONE per composition (created in
|
|
65
|
+
* `createCoreServices`, shared by `GitService` and exposed as
|
|
66
|
+
* `WorkflowService.hooks` for the composition root to register against).
|
|
67
|
+
*/
|
|
68
|
+
export declare class WorkflowHooks {
|
|
69
|
+
private readonly commitValidation;
|
|
70
|
+
private readonly preWrite;
|
|
71
|
+
/** Register an advisory commit-time validation hook. */
|
|
72
|
+
onCommitValidation(hook: CommitValidationHook): void;
|
|
73
|
+
/** Register a blocking pre-write hook. */
|
|
74
|
+
onPreWrite(hook: PreWriteHook): void;
|
|
75
|
+
/**
|
|
76
|
+
* The registered commit-validation hooks, for the caller (`GitService`) to
|
|
77
|
+
* iterate with its own advisory catch-and-log semantics.
|
|
78
|
+
*/
|
|
79
|
+
commitValidationHooks(): readonly CommitValidationHook[];
|
|
80
|
+
/**
|
|
81
|
+
* Run every blocking pre-write hook in registration order. The first throw
|
|
82
|
+
* propagates and rejects the write; with no hooks registered (core-only)
|
|
83
|
+
* this resolves immediately.
|
|
84
|
+
*/
|
|
85
|
+
runPreWrite(ctx: PreWriteContext): Promise<void>;
|
|
86
|
+
}
|
|
87
|
+
//# sourceMappingURL=workflow-hooks.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"workflow-hooks.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/workflow-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,uEAAuE;AACvE,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,GAAG,EAAE,uBAAuB,KACzB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,MAAM,eAAe;AACzB,oFAAoF;AAClF;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC3D,kFAAkF;GAChF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnE;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAE/C,wDAAwD;IACxD,kBAAkB,CAAC,IAAI,EAAE,oBAAoB,GAAG,IAAI;IAIpD,0CAA0C;IAC1C,UAAU,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAIpC;;;OAGG;IACH,qBAAqB,IAAI,SAAS,oBAAoB,EAAE;IAIxD;;;;OAIG;IACG,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAKvD"}
|