@bevel-software/platform-core-backend 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (720) hide show
  1. package/LICENSE +202 -0
  2. package/dist/assets.d.ts +5 -0
  3. package/dist/assets.d.ts.map +1 -0
  4. package/dist/assets.js +23 -0
  5. package/dist/assets.js.map +1 -0
  6. package/dist/core/core-ports.d.ts +83 -0
  7. package/dist/core/core-ports.d.ts.map +1 -0
  8. package/dist/core/core-ports.js +12 -0
  9. package/dist/core/core-ports.js.map +1 -0
  10. package/dist/core/create-core-server.d.ts +62 -0
  11. package/dist/core/create-core-server.d.ts.map +1 -0
  12. package/dist/core/create-core-server.js +204 -0
  13. package/dist/core/create-core-server.js.map +1 -0
  14. package/dist/core/create-core-services.d.ts +95 -0
  15. package/dist/core/create-core-services.d.ts.map +1 -0
  16. package/dist/core/create-core-services.js +352 -0
  17. package/dist/core/create-core-services.js.map +1 -0
  18. package/dist/core-config.d.ts +119 -0
  19. package/dist/core-config.d.ts.map +1 -0
  20. package/dist/core-config.js +240 -0
  21. package/dist/core-config.js.map +1 -0
  22. package/dist/index.d.ts +36 -0
  23. package/dist/index.d.ts.map +1 -0
  24. package/dist/index.js +36 -0
  25. package/dist/index.js.map +1 -0
  26. package/dist/modules/access/access-control.interface.d.ts +348 -0
  27. package/dist/modules/access/access-control.interface.d.ts.map +1 -0
  28. package/dist/modules/access/access-control.interface.js +2 -0
  29. package/dist/modules/access/access-control.interface.js.map +1 -0
  30. package/dist/modules/access/access-control.service.d.ts +323 -0
  31. package/dist/modules/access/access-control.service.d.ts.map +1 -0
  32. package/dist/modules/access/access-control.service.js +1431 -0
  33. package/dist/modules/access/access-control.service.js.map +1 -0
  34. package/dist/modules/access/access-errors.d.ts +34 -0
  35. package/dist/modules/access/access-errors.d.ts.map +1 -0
  36. package/dist/modules/access/access-errors.js +40 -0
  37. package/dist/modules/access/access-errors.js.map +1 -0
  38. package/dist/modules/access/access-mutation.service.d.ts +176 -0
  39. package/dist/modules/access/access-mutation.service.d.ts.map +1 -0
  40. package/dist/modules/access/access-mutation.service.js +307 -0
  41. package/dist/modules/access/access-mutation.service.js.map +1 -0
  42. package/dist/modules/access/access-splice.d.ts +98 -0
  43. package/dist/modules/access/access-splice.d.ts.map +1 -0
  44. package/dist/modules/access/access-splice.js +346 -0
  45. package/dist/modules/access/access-splice.js.map +1 -0
  46. package/dist/modules/access/access.routes.d.ts +10 -0
  47. package/dist/modules/access/access.routes.d.ts.map +1 -0
  48. package/dist/modules/access/access.routes.js +757 -0
  49. package/dist/modules/access/access.routes.js.map +1 -0
  50. package/dist/modules/access/creator-access.d.ts +113 -0
  51. package/dist/modules/access/creator-access.d.ts.map +1 -0
  52. package/dist/modules/access/creator-access.js +212 -0
  53. package/dist/modules/access/creator-access.js.map +1 -0
  54. package/dist/modules/access/kb-read-filter.d.ts +41 -0
  55. package/dist/modules/access/kb-read-filter.d.ts.map +1 -0
  56. package/dist/modules/access/kb-read-filter.js +60 -0
  57. package/dist/modules/access/kb-read-filter.js.map +1 -0
  58. package/dist/modules/access/roles-admin.service.d.ts +240 -0
  59. package/dist/modules/access/roles-admin.service.d.ts.map +1 -0
  60. package/dist/modules/access/roles-admin.service.js +630 -0
  61. package/dist/modules/access/roles-admin.service.js.map +1 -0
  62. package/dist/modules/access/roles-edit.d.ts +91 -0
  63. package/dist/modules/access/roles-edit.d.ts.map +1 -0
  64. package/dist/modules/access/roles-edit.js +232 -0
  65. package/dist/modules/access/roles-edit.js.map +1 -0
  66. package/dist/modules/access/roles-yaml-guard.d.ts +56 -0
  67. package/dist/modules/access/roles-yaml-guard.d.ts.map +1 -0
  68. package/dist/modules/access/roles-yaml-guard.js +79 -0
  69. package/dist/modules/access/roles-yaml-guard.js.map +1 -0
  70. package/dist/modules/admin/admin-access.routes.d.ts +18 -0
  71. package/dist/modules/admin/admin-access.routes.d.ts.map +1 -0
  72. package/dist/modules/admin/admin-access.routes.js +26 -0
  73. package/dist/modules/admin/admin-access.routes.js.map +1 -0
  74. package/dist/modules/admin/admin-access.service.d.ts +24 -0
  75. package/dist/modules/admin/admin-access.service.d.ts.map +1 -0
  76. package/dist/modules/admin/admin-access.service.js +41 -0
  77. package/dist/modules/admin/admin-access.service.js.map +1 -0
  78. package/dist/modules/admin/admin.interface.d.ts +11 -0
  79. package/dist/modules/admin/admin.interface.d.ts.map +1 -0
  80. package/dist/modules/admin/admin.interface.js +2 -0
  81. package/dist/modules/admin/admin.interface.js.map +1 -0
  82. package/dist/modules/auth/account-erasure.service.d.ts +80 -0
  83. package/dist/modules/auth/account-erasure.service.d.ts.map +1 -0
  84. package/dist/modules/auth/account-erasure.service.js +91 -0
  85. package/dist/modules/auth/account-erasure.service.js.map +1 -0
  86. package/dist/modules/auth/auth.middleware.d.ts +23 -0
  87. package/dist/modules/auth/auth.middleware.d.ts.map +1 -0
  88. package/dist/modules/auth/auth.middleware.js +68 -0
  89. package/dist/modules/auth/auth.middleware.js.map +1 -0
  90. package/dist/modules/auth/auth.routes.d.ts +25 -0
  91. package/dist/modules/auth/auth.routes.d.ts.map +1 -0
  92. package/dist/modules/auth/auth.routes.js +72 -0
  93. package/dist/modules/auth/auth.routes.js.map +1 -0
  94. package/dist/modules/auth/auth.service.d.ts +76 -0
  95. package/dist/modules/auth/auth.service.d.ts.map +1 -0
  96. package/dist/modules/auth/auth.service.js +168 -0
  97. package/dist/modules/auth/auth.service.js.map +1 -0
  98. package/dist/modules/code-mode/code-mode-names.d.ts +16 -0
  99. package/dist/modules/code-mode/code-mode-names.d.ts.map +1 -0
  100. package/dist/modules/code-mode/code-mode-names.js +30 -0
  101. package/dist/modules/code-mode/code-mode-names.js.map +1 -0
  102. package/dist/modules/code-mode/code-mode.tool.d.ts +13 -0
  103. package/dist/modules/code-mode/code-mode.tool.d.ts.map +1 -0
  104. package/dist/modules/code-mode/code-mode.tool.js +112 -0
  105. package/dist/modules/code-mode/code-mode.tool.js.map +1 -0
  106. package/dist/modules/code-mode/index.d.ts +3 -0
  107. package/dist/modules/code-mode/index.d.ts.map +1 -0
  108. package/dist/modules/code-mode/index.js +3 -0
  109. package/dist/modules/code-mode/index.js.map +1 -0
  110. package/dist/modules/database/connection.d.ts +6 -0
  111. package/dist/modules/database/connection.d.ts.map +1 -0
  112. package/dist/modules/database/connection.js +12 -0
  113. package/dist/modules/database/connection.js.map +1 -0
  114. package/dist/modules/database/core-schema.d.ts +2273 -0
  115. package/dist/modules/database/core-schema.d.ts.map +1 -0
  116. package/dist/modules/database/core-schema.js +413 -0
  117. package/dist/modules/database/core-schema.js.map +1 -0
  118. package/dist/modules/database/migrate.d.ts +10 -0
  119. package/dist/modules/database/migrate.d.ts.map +1 -0
  120. package/dist/modules/database/migrate.js +40 -0
  121. package/dist/modules/database/migrate.js.map +1 -0
  122. package/dist/modules/database/schema.d.ts +12 -0
  123. package/dist/modules/database/schema.d.ts.map +1 -0
  124. package/dist/modules/database/schema.js +12 -0
  125. package/dist/modules/database/schema.js.map +1 -0
  126. package/dist/modules/diff/diff-paths.d.ts +2 -0
  127. package/dist/modules/diff/diff-paths.d.ts.map +1 -0
  128. package/dist/modules/diff/diff-paths.js +9 -0
  129. package/dist/modules/diff/diff-paths.js.map +1 -0
  130. package/dist/modules/diff/diff.config.d.ts +8 -0
  131. package/dist/modules/diff/diff.config.d.ts.map +1 -0
  132. package/dist/modules/diff/diff.config.js +13 -0
  133. package/dist/modules/diff/diff.config.js.map +1 -0
  134. package/dist/modules/diff/diff.interface.d.ts +73 -0
  135. package/dist/modules/diff/diff.interface.d.ts.map +1 -0
  136. package/dist/modules/diff/diff.interface.js +2 -0
  137. package/dist/modules/diff/diff.interface.js.map +1 -0
  138. package/dist/modules/diff/diff.routes.d.ts +35 -0
  139. package/dist/modules/diff/diff.routes.d.ts.map +1 -0
  140. package/dist/modules/diff/diff.routes.js +228 -0
  141. package/dist/modules/diff/diff.routes.js.map +1 -0
  142. package/dist/modules/diff/diff.service.d.ts +51 -0
  143. package/dist/modules/diff/diff.service.d.ts.map +1 -0
  144. package/dist/modules/diff/diff.service.js +489 -0
  145. package/dist/modules/diff/diff.service.js.map +1 -0
  146. package/dist/modules/diff/line-diff.d.ts +16 -0
  147. package/dist/modules/diff/line-diff.d.ts.map +1 -0
  148. package/dist/modules/diff/line-diff.js +67 -0
  149. package/dist/modules/diff/line-diff.js.map +1 -0
  150. package/dist/modules/mcp/mcp-auth.middleware.d.ts +27 -0
  151. package/dist/modules/mcp/mcp-auth.middleware.d.ts.map +1 -0
  152. package/dist/modules/mcp/mcp-auth.middleware.js +116 -0
  153. package/dist/modules/mcp/mcp-auth.middleware.js.map +1 -0
  154. package/dist/modules/mcp/mcp-session-store.d.ts +74 -0
  155. package/dist/modules/mcp/mcp-session-store.d.ts.map +1 -0
  156. package/dist/modules/mcp/mcp-session-store.js +131 -0
  157. package/dist/modules/mcp/mcp-session-store.js.map +1 -0
  158. package/dist/modules/mcp/mcp.routes.d.ts +24 -0
  159. package/dist/modules/mcp/mcp.routes.d.ts.map +1 -0
  160. package/dist/modules/mcp/mcp.routes.js +229 -0
  161. package/dist/modules/mcp/mcp.routes.js.map +1 -0
  162. package/dist/modules/mcp/mcp.service.d.ts +198 -0
  163. package/dist/modules/mcp/mcp.service.d.ts.map +1 -0
  164. package/dist/modules/mcp/mcp.service.js +840 -0
  165. package/dist/modules/mcp/mcp.service.js.map +1 -0
  166. package/dist/modules/mcp/oauth/bevel-oauth-provider.d.ts +76 -0
  167. package/dist/modules/mcp/oauth/bevel-oauth-provider.d.ts.map +1 -0
  168. package/dist/modules/mcp/oauth/bevel-oauth-provider.js +291 -0
  169. package/dist/modules/mcp/oauth/bevel-oauth-provider.js.map +1 -0
  170. package/dist/modules/mcp/oauth/oauth-consent.routes.d.ts +18 -0
  171. package/dist/modules/mcp/oauth/oauth-consent.routes.d.ts.map +1 -0
  172. package/dist/modules/mcp/oauth/oauth-consent.routes.js +52 -0
  173. package/dist/modules/mcp/oauth/oauth-consent.routes.js.map +1 -0
  174. package/dist/modules/mcp/oauth/oauth-state.d.ts +32 -0
  175. package/dist/modules/mcp/oauth/oauth-state.d.ts.map +1 -0
  176. package/dist/modules/mcp/oauth/oauth-state.js +34 -0
  177. package/dist/modules/mcp/oauth/oauth-state.js.map +1 -0
  178. package/dist/modules/secrets-vault/db-secrets-vault.service.d.ts +92 -0
  179. package/dist/modules/secrets-vault/db-secrets-vault.service.d.ts.map +1 -0
  180. package/dist/modules/secrets-vault/db-secrets-vault.service.js +728 -0
  181. package/dist/modules/secrets-vault/db-secrets-vault.service.js.map +1 -0
  182. package/dist/modules/secrets-vault/index.d.ts +7 -0
  183. package/dist/modules/secrets-vault/index.d.ts.map +1 -0
  184. package/dist/modules/secrets-vault/index.js +6 -0
  185. package/dist/modules/secrets-vault/index.js.map +1 -0
  186. package/dist/modules/secrets-vault/mcp-oauth-discovery.service.d.ts +63 -0
  187. package/dist/modules/secrets-vault/mcp-oauth-discovery.service.d.ts.map +1 -0
  188. package/dist/modules/secrets-vault/mcp-oauth-discovery.service.js +269 -0
  189. package/dist/modules/secrets-vault/mcp-oauth-discovery.service.js.map +1 -0
  190. package/dist/modules/secrets-vault/secrets-variable-loader.d.ts +46 -0
  191. package/dist/modules/secrets-vault/secrets-variable-loader.d.ts.map +1 -0
  192. package/dist/modules/secrets-vault/secrets-variable-loader.js +87 -0
  193. package/dist/modules/secrets-vault/secrets-variable-loader.js.map +1 -0
  194. package/dist/modules/secrets-vault/secrets-vault.contract.d.ts +210 -0
  195. package/dist/modules/secrets-vault/secrets-vault.contract.d.ts.map +1 -0
  196. package/dist/modules/secrets-vault/secrets-vault.contract.js +90 -0
  197. package/dist/modules/secrets-vault/secrets-vault.contract.js.map +1 -0
  198. package/dist/modules/secrets-vault/secrets-vault.routes.d.ts +30 -0
  199. package/dist/modules/secrets-vault/secrets-vault.routes.d.ts.map +1 -0
  200. package/dist/modules/secrets-vault/secrets-vault.routes.js +490 -0
  201. package/dist/modules/secrets-vault/secrets-vault.routes.js.map +1 -0
  202. package/dist/modules/skills/index.d.ts +5 -0
  203. package/dist/modules/skills/index.d.ts.map +1 -0
  204. package/dist/modules/skills/index.js +4 -0
  205. package/dist/modules/skills/index.js.map +1 -0
  206. package/dist/modules/skills/skills.contract.d.ts +58 -0
  207. package/dist/modules/skills/skills.contract.d.ts.map +1 -0
  208. package/dist/modules/skills/skills.contract.js +10 -0
  209. package/dist/modules/skills/skills.contract.js.map +1 -0
  210. package/dist/modules/skills/skills.routes.d.ts +15 -0
  211. package/dist/modules/skills/skills.routes.d.ts.map +1 -0
  212. package/dist/modules/skills/skills.routes.js +34 -0
  213. package/dist/modules/skills/skills.routes.js.map +1 -0
  214. package/dist/modules/skills/skills.service.d.ts +21 -0
  215. package/dist/modules/skills/skills.service.d.ts.map +1 -0
  216. package/dist/modules/skills/skills.service.js +202 -0
  217. package/dist/modules/skills/skills.service.js.map +1 -0
  218. package/dist/modules/skills/skills.tools.d.ts +15 -0
  219. package/dist/modules/skills/skills.tools.d.ts.map +1 -0
  220. package/dist/modules/skills/skills.tools.js +96 -0
  221. package/dist/modules/skills/skills.tools.js.map +1 -0
  222. package/dist/modules/tool-auth/external-api-key.errors.d.ts +14 -0
  223. package/dist/modules/tool-auth/external-api-key.errors.d.ts.map +1 -0
  224. package/dist/modules/tool-auth/external-api-key.errors.js +23 -0
  225. package/dist/modules/tool-auth/external-api-key.errors.js.map +1 -0
  226. package/dist/modules/tool-auth/external-api-key.interface.d.ts +90 -0
  227. package/dist/modules/tool-auth/external-api-key.interface.d.ts.map +1 -0
  228. package/dist/modules/tool-auth/external-api-key.interface.js +2 -0
  229. package/dist/modules/tool-auth/external-api-key.interface.js.map +1 -0
  230. package/dist/modules/tool-auth/external-api-key.service.d.ts +25 -0
  231. package/dist/modules/tool-auth/external-api-key.service.d.ts.map +1 -0
  232. package/dist/modules/tool-auth/external-api-key.service.js +164 -0
  233. package/dist/modules/tool-auth/external-api-key.service.js.map +1 -0
  234. package/dist/modules/tool-auth/internal-token.service.d.ts +62 -0
  235. package/dist/modules/tool-auth/internal-token.service.d.ts.map +1 -0
  236. package/dist/modules/tool-auth/internal-token.service.js +85 -0
  237. package/dist/modules/tool-auth/internal-token.service.js.map +1 -0
  238. package/dist/modules/tool-auth/llm-usage-meter.d.ts +16 -0
  239. package/dist/modules/tool-auth/llm-usage-meter.d.ts.map +1 -0
  240. package/dist/modules/tool-auth/llm-usage-meter.js +6 -0
  241. package/dist/modules/tool-auth/llm-usage-meter.js.map +1 -0
  242. package/dist/modules/tool-auth/tool-auth.middleware.d.ts +101 -0
  243. package/dist/modules/tool-auth/tool-auth.middleware.d.ts.map +1 -0
  244. package/dist/modules/tool-auth/tool-auth.middleware.js +166 -0
  245. package/dist/modules/tool-auth/tool-auth.middleware.js.map +1 -0
  246. package/dist/modules/tool-helpers/index.d.ts +19 -0
  247. package/dist/modules/tool-helpers/index.d.ts.map +1 -0
  248. package/dist/modules/tool-helpers/index.js +18 -0
  249. package/dist/modules/tool-helpers/index.js.map +1 -0
  250. package/dist/modules/tool-helpers/tool-context.d.ts +35 -0
  251. package/dist/modules/tool-helpers/tool-context.d.ts.map +1 -0
  252. package/dist/modules/tool-helpers/tool-context.js +66 -0
  253. package/dist/modules/tool-helpers/tool-context.js.map +1 -0
  254. package/dist/modules/tool-helpers/tool-def.d.ts +33 -0
  255. package/dist/modules/tool-helpers/tool-def.d.ts.map +1 -0
  256. package/dist/modules/tool-helpers/tool-def.js +57 -0
  257. package/dist/modules/tool-helpers/tool-def.js.map +1 -0
  258. package/dist/modules/tool-helpers/tool-handler.d.ts +19 -0
  259. package/dist/modules/tool-helpers/tool-handler.d.ts.map +1 -0
  260. package/dist/modules/tool-helpers/tool-handler.js +84 -0
  261. package/dist/modules/tool-helpers/tool-handler.js.map +1 -0
  262. package/dist/modules/tool-helpers/tool.contract.d.ts +64 -0
  263. package/dist/modules/tool-helpers/tool.contract.d.ts.map +1 -0
  264. package/dist/modules/tool-helpers/tool.contract.js +24 -0
  265. package/dist/modules/tool-helpers/tool.contract.js.map +1 -0
  266. package/dist/modules/tool-helpers/validate-token.d.ts +31 -0
  267. package/dist/modules/tool-helpers/validate-token.d.ts.map +1 -0
  268. package/dist/modules/tool-helpers/validate-token.js +20 -0
  269. package/dist/modules/tool-helpers/validate-token.js.map +1 -0
  270. package/dist/modules/tool-manuals/index.d.ts +5 -0
  271. package/dist/modules/tool-manuals/index.d.ts.map +1 -0
  272. package/dist/modules/tool-manuals/index.js +5 -0
  273. package/dist/modules/tool-manuals/index.js.map +1 -0
  274. package/dist/modules/tool-manuals/tool-manuals.contract.d.ts +182 -0
  275. package/dist/modules/tool-manuals/tool-manuals.contract.d.ts.map +1 -0
  276. package/dist/modules/tool-manuals/tool-manuals.contract.js +19 -0
  277. package/dist/modules/tool-manuals/tool-manuals.contract.js.map +1 -0
  278. package/dist/modules/tool-manuals/tool-manuals.routes.d.ts +24 -0
  279. package/dist/modules/tool-manuals/tool-manuals.routes.d.ts.map +1 -0
  280. package/dist/modules/tool-manuals/tool-manuals.routes.js +102 -0
  281. package/dist/modules/tool-manuals/tool-manuals.routes.js.map +1 -0
  282. package/dist/modules/tool-manuals/tool-manuals.service.d.ts +108 -0
  283. package/dist/modules/tool-manuals/tool-manuals.service.d.ts.map +1 -0
  284. package/dist/modules/tool-manuals/tool-manuals.service.js +710 -0
  285. package/dist/modules/tool-manuals/tool-manuals.service.js.map +1 -0
  286. package/dist/modules/tool-manuals/tool-manuals.tools.d.ts +35 -0
  287. package/dist/modules/tool-manuals/tool-manuals.tools.d.ts.map +1 -0
  288. package/dist/modules/tool-manuals/tool-manuals.tools.js +157 -0
  289. package/dist/modules/tool-manuals/tool-manuals.tools.js.map +1 -0
  290. package/dist/modules/tool-registry/manual.routes.d.ts +6 -0
  291. package/dist/modules/tool-registry/manual.routes.d.ts.map +1 -0
  292. package/dist/modules/tool-registry/manual.routes.js +76 -0
  293. package/dist/modules/tool-registry/manual.routes.js.map +1 -0
  294. package/dist/modules/tool-registry/tool-registry.d.ts +23 -0
  295. package/dist/modules/tool-registry/tool-registry.d.ts.map +1 -0
  296. package/dist/modules/tool-registry/tool-registry.js +46 -0
  297. package/dist/modules/tool-registry/tool-registry.js.map +1 -0
  298. package/dist/modules/tool-registry/tool.contract.d.ts +48 -0
  299. package/dist/modules/tool-registry/tool.contract.d.ts.map +1 -0
  300. package/dist/modules/tool-registry/tool.contract.js +2 -0
  301. package/dist/modules/tool-registry/tool.contract.js.map +1 -0
  302. package/dist/modules/workflow/agent-tools/workflow.tools.d.ts +14 -0
  303. package/dist/modules/workflow/agent-tools/workflow.tools.d.ts.map +1 -0
  304. package/dist/modules/workflow/agent-tools/workflow.tools.js +437 -0
  305. package/dist/modules/workflow/agent-tools/workflow.tools.js.map +1 -0
  306. package/dist/modules/workflow/event-bus.d.ts +107 -0
  307. package/dist/modules/workflow/event-bus.d.ts.map +1 -0
  308. package/dist/modules/workflow/event-bus.js +224 -0
  309. package/dist/modules/workflow/event-bus.js.map +1 -0
  310. package/dist/modules/workflow/events.routes.d.ts +80 -0
  311. package/dist/modules/workflow/events.routes.d.ts.map +1 -0
  312. package/dist/modules/workflow/events.routes.js +216 -0
  313. package/dist/modules/workflow/events.routes.js.map +1 -0
  314. package/dist/modules/workflow/file-change-notifier.d.ts +38 -0
  315. package/dist/modules/workflow/file-change-notifier.d.ts.map +1 -0
  316. package/dist/modules/workflow/file-change-notifier.js +22 -0
  317. package/dist/modules/workflow/file-change-notifier.js.map +1 -0
  318. package/dist/modules/workflow/file-lock.service.d.ts +57 -0
  319. package/dist/modules/workflow/file-lock.service.d.ts.map +1 -0
  320. package/dist/modules/workflow/file-lock.service.js +202 -0
  321. package/dist/modules/workflow/file-lock.service.js.map +1 -0
  322. package/dist/modules/workflow/git/branch-name.d.ts +10 -0
  323. package/dist/modules/workflow/git/branch-name.d.ts.map +1 -0
  324. package/dist/modules/workflow/git/branch-name.js +76 -0
  325. package/dist/modules/workflow/git/branch-name.js.map +1 -0
  326. package/dist/modules/workflow/git/clone-config.d.ts +61 -0
  327. package/dist/modules/workflow/git/clone-config.d.ts.map +1 -0
  328. package/dist/modules/workflow/git/clone-config.js +69 -0
  329. package/dist/modules/workflow/git/clone-config.js.map +1 -0
  330. package/dist/modules/workflow/git/git-version.d.ts +34 -0
  331. package/dist/modules/workflow/git/git-version.d.ts.map +1 -0
  332. package/dist/modules/workflow/git/git-version.js +63 -0
  333. package/dist/modules/workflow/git/git-version.js.map +1 -0
  334. package/dist/modules/workflow/git/git.service.d.ts +427 -0
  335. package/dist/modules/workflow/git/git.service.d.ts.map +1 -0
  336. package/dist/modules/workflow/git/git.service.js +1987 -0
  337. package/dist/modules/workflow/git/git.service.js.map +1 -0
  338. package/dist/modules/workflow/git/mutex.d.ts +11 -0
  339. package/dist/modules/workflow/git/mutex.d.ts.map +1 -0
  340. package/dist/modules/workflow/git/mutex.js +23 -0
  341. package/dist/modules/workflow/git/mutex.js.map +1 -0
  342. package/dist/modules/workflow/git/pull-request.service.d.ts +124 -0
  343. package/dist/modules/workflow/git/pull-request.service.d.ts.map +1 -0
  344. package/dist/modules/workflow/git/pull-request.service.js +328 -0
  345. package/dist/modules/workflow/git/pull-request.service.js.map +1 -0
  346. package/dist/modules/workflow/locking-filesystem.d.ts +133 -0
  347. package/dist/modules/workflow/locking-filesystem.d.ts.map +1 -0
  348. package/dist/modules/workflow/locking-filesystem.js +400 -0
  349. package/dist/modules/workflow/locking-filesystem.js.map +1 -0
  350. package/dist/modules/workflow/pending-commits.service.d.ts +221 -0
  351. package/dist/modules/workflow/pending-commits.service.d.ts.map +1 -0
  352. package/dist/modules/workflow/pending-commits.service.js +364 -0
  353. package/dist/modules/workflow/pending-commits.service.js.map +1 -0
  354. package/dist/modules/workflow/pending-commits.worker.d.ts +148 -0
  355. package/dist/modules/workflow/pending-commits.worker.d.ts.map +1 -0
  356. package/dist/modules/workflow/pending-commits.worker.js +245 -0
  357. package/dist/modules/workflow/pending-commits.worker.js.map +1 -0
  358. package/dist/modules/workflow/read-only-filesystem.d.ts +24 -0
  359. package/dist/modules/workflow/read-only-filesystem.d.ts.map +1 -0
  360. package/dist/modules/workflow/read-only-filesystem.js +39 -0
  361. package/dist/modules/workflow/read-only-filesystem.js.map +1 -0
  362. package/dist/modules/workflow/recovery-bot.d.ts +31 -0
  363. package/dist/modules/workflow/recovery-bot.d.ts.map +1 -0
  364. package/dist/modules/workflow/recovery-bot.js +64 -0
  365. package/dist/modules/workflow/recovery-bot.js.map +1 -0
  366. package/dist/modules/workflow/review-workflow/review-workflow.interface.d.ts +137 -0
  367. package/dist/modules/workflow/review-workflow/review-workflow.interface.d.ts.map +1 -0
  368. package/dist/modules/workflow/review-workflow/review-workflow.interface.js +2 -0
  369. package/dist/modules/workflow/review-workflow/review-workflow.interface.js.map +1 -0
  370. package/dist/modules/workflow/review-workflow/review-workflow.service.d.ts +26 -0
  371. package/dist/modules/workflow/review-workflow/review-workflow.service.d.ts.map +1 -0
  372. package/dist/modules/workflow/review-workflow/review-workflow.service.js +636 -0
  373. package/dist/modules/workflow/review-workflow/review-workflow.service.js.map +1 -0
  374. package/dist/modules/workflow/sanitize-error.d.ts +29 -0
  375. package/dist/modules/workflow/sanitize-error.d.ts.map +1 -0
  376. package/dist/modules/workflow/sanitize-error.js +60 -0
  377. package/dist/modules/workflow/sanitize-error.js.map +1 -0
  378. package/dist/modules/workflow/session-ontology.policy.d.ts +52 -0
  379. package/dist/modules/workflow/session-ontology.policy.d.ts.map +1 -0
  380. package/dist/modules/workflow/session-ontology.policy.js +62 -0
  381. package/dist/modules/workflow/session-ontology.policy.js.map +1 -0
  382. package/dist/modules/workflow/session-ontology.service.d.ts +100 -0
  383. package/dist/modules/workflow/session-ontology.service.d.ts.map +1 -0
  384. package/dist/modules/workflow/session-ontology.service.js +143 -0
  385. package/dist/modules/workflow/session-ontology.service.js.map +1 -0
  386. package/dist/modules/workflow/workflow-hooks.d.ts +87 -0
  387. package/dist/modules/workflow/workflow-hooks.d.ts.map +1 -0
  388. package/dist/modules/workflow/workflow-hooks.js +35 -0
  389. package/dist/modules/workflow/workflow-hooks.js.map +1 -0
  390. package/dist/modules/workflow/workflow.errors.d.ts +171 -0
  391. package/dist/modules/workflow/workflow.errors.d.ts.map +1 -0
  392. package/dist/modules/workflow/workflow.errors.js +260 -0
  393. package/dist/modules/workflow/workflow.errors.js.map +1 -0
  394. package/dist/modules/workflow/workflow.routes.d.ts +26 -0
  395. package/dist/modules/workflow/workflow.routes.d.ts.map +1 -0
  396. package/dist/modules/workflow/workflow.routes.js +804 -0
  397. package/dist/modules/workflow/workflow.routes.js.map +1 -0
  398. package/dist/modules/workflow/workflow.service.d.ts +385 -0
  399. package/dist/modules/workflow/workflow.service.d.ts.map +1 -0
  400. package/dist/modules/workflow/workflow.service.js +1155 -0
  401. package/dist/modules/workflow/workflow.service.js.map +1 -0
  402. package/dist/modules/workspace/bevel-ignore.d.ts +25 -0
  403. package/dist/modules/workspace/bevel-ignore.d.ts.map +1 -0
  404. package/dist/modules/workspace/bevel-ignore.js +57 -0
  405. package/dist/modules/workspace/bevel-ignore.js.map +1 -0
  406. package/dist/modules/workspace/kb-seed.interface.d.ts +36 -0
  407. package/dist/modules/workspace/kb-seed.interface.d.ts.map +1 -0
  408. package/dist/modules/workspace/kb-seed.interface.js +2 -0
  409. package/dist/modules/workspace/kb-seed.interface.js.map +1 -0
  410. package/dist/modules/workspace/kb-seed.service.d.ts +70 -0
  411. package/dist/modules/workspace/kb-seed.service.d.ts.map +1 -0
  412. package/dist/modules/workspace/kb-seed.service.js +325 -0
  413. package/dist/modules/workspace/kb-seed.service.js.map +1 -0
  414. package/dist/modules/workspace/routine-write-policy.d.ts +49 -0
  415. package/dist/modules/workspace/routine-write-policy.d.ts.map +1 -0
  416. package/dist/modules/workspace/routine-write-policy.js +46 -0
  417. package/dist/modules/workspace/routine-write-policy.js.map +1 -0
  418. package/dist/modules/workspace/session-ontology.gate.d.ts +112 -0
  419. package/dist/modules/workspace/session-ontology.gate.d.ts.map +1 -0
  420. package/dist/modules/workspace/session-ontology.gate.js +161 -0
  421. package/dist/modules/workspace/session-ontology.gate.js.map +1 -0
  422. package/dist/modules/workspace/session-sink.d.ts +25 -0
  423. package/dist/modules/workspace/session-sink.d.ts.map +1 -0
  424. package/dist/modules/workspace/session-sink.js +8 -0
  425. package/dist/modules/workspace/session-sink.js.map +1 -0
  426. package/dist/modules/workspace/spill-store.d.ts +24 -0
  427. package/dist/modules/workspace/spill-store.d.ts.map +1 -0
  428. package/dist/modules/workspace/spill-store.js +87 -0
  429. package/dist/modules/workspace/spill-store.js.map +1 -0
  430. package/dist/modules/workspace/workspace.routes.d.ts +25 -0
  431. package/dist/modules/workspace/workspace.routes.d.ts.map +1 -0
  432. package/dist/modules/workspace/workspace.routes.js +1046 -0
  433. package/dist/modules/workspace/workspace.routes.js.map +1 -0
  434. package/dist/modules/workspace/workspace.service.d.ts +339 -0
  435. package/dist/modules/workspace/workspace.service.d.ts.map +1 -0
  436. package/dist/modules/workspace/workspace.service.js +1221 -0
  437. package/dist/modules/workspace/workspace.service.js.map +1 -0
  438. package/dist/modules/workspace/workspace.tools.d.ts +19 -0
  439. package/dist/modules/workspace/workspace.tools.d.ts.map +1 -0
  440. package/dist/modules/workspace/workspace.tools.js +767 -0
  441. package/dist/modules/workspace/workspace.tools.js.map +1 -0
  442. package/dist/shared/frontmatter-id.d.ts +35 -0
  443. package/dist/shared/frontmatter-id.d.ts.map +1 -0
  444. package/dist/shared/frontmatter-id.js +68 -0
  445. package/dist/shared/frontmatter-id.js.map +1 -0
  446. package/dist/shared/fs-walk.d.ts +9 -0
  447. package/dist/shared/fs-walk.d.ts.map +1 -0
  448. package/dist/shared/fs-walk.js +34 -0
  449. package/dist/shared/fs-walk.js.map +1 -0
  450. package/dist/shared/hash-email.d.ts +11 -0
  451. package/dist/shared/hash-email.d.ts.map +1 -0
  452. package/dist/shared/hash-email.js +14 -0
  453. package/dist/shared/hash-email.js.map +1 -0
  454. package/dist/shared/kb-layout.d.ts +38 -0
  455. package/dist/shared/kb-layout.d.ts.map +1 -0
  456. package/dist/shared/kb-layout.js +102 -0
  457. package/dist/shared/kb-layout.js.map +1 -0
  458. package/dist/shared/kb-layout.test.d.ts +2 -0
  459. package/dist/shared/kb-layout.test.d.ts.map +1 -0
  460. package/dist/shared/kb-layout.test.js +67 -0
  461. package/dist/shared/kb-layout.test.js.map +1 -0
  462. package/dist/shared/ssrf.d.ts +20 -0
  463. package/dist/shared/ssrf.d.ts.map +1 -0
  464. package/dist/shared/ssrf.js +89 -0
  465. package/dist/shared/ssrf.js.map +1 -0
  466. package/dist/shared/token-crypto.d.ts +16 -0
  467. package/dist/shared/token-crypto.d.ts.map +1 -0
  468. package/dist/shared/token-crypto.js +49 -0
  469. package/dist/shared/token-crypto.js.map +1 -0
  470. package/dist/shared/ttl-cache.d.ts +16 -0
  471. package/dist/shared/ttl-cache.d.ts.map +1 -0
  472. package/dist/shared/ttl-cache.js +27 -0
  473. package/dist/shared/ttl-cache.js.map +1 -0
  474. package/dist/shared/utcp-namespace.d.ts +46 -0
  475. package/dist/shared/utcp-namespace.d.ts.map +1 -0
  476. package/dist/shared/utcp-namespace.js +82 -0
  477. package/dist/shared/utcp-namespace.js.map +1 -0
  478. package/dist/version.d.ts +17 -0
  479. package/dist/version.d.ts.map +1 -0
  480. package/dist/version.js +19 -0
  481. package/dist/version.js.map +1 -0
  482. package/kb-template/.bevelignore +21 -0
  483. package/kb-template/Agents/.gitkeep +0 -0
  484. package/kb-template/Agents/README.md +38 -0
  485. package/kb-template/CLAUDE.md +419 -0
  486. package/kb-template/Data/.gitkeep +0 -0
  487. package/kb-template/Data/README.md +39 -0
  488. package/kb-template/KnowledgeBase/.gitkeep +0 -0
  489. package/kb-template/KnowledgeBase/README.md +37 -0
  490. package/kb-template/Pipelines/.gitkeep +0 -0
  491. package/kb-template/Pipelines/README.md +38 -0
  492. package/kb-template/Skills/.gitkeep +0 -0
  493. package/kb-template/Skills/README.md +32 -0
  494. package/kb-template/Tools/.gitkeep +0 -0
  495. package/kb-template/Tools/README.md +42 -0
  496. package/kb-template/access.md +36 -0
  497. package/migrations/0000_core_init.sql +243 -0
  498. package/migrations/meta/0000_snapshot.json +1480 -0
  499. package/migrations/meta/_journal.json +13 -0
  500. package/package.json +80 -0
  501. package/src/assets.ts +25 -0
  502. package/src/core/core-ports.ts +91 -0
  503. package/src/core/create-core-server.ts +338 -0
  504. package/src/core/create-core-services.ts +501 -0
  505. package/src/core-config.ts +257 -0
  506. package/src/index.ts +69 -0
  507. package/src/modules/access/__tests__/access-control.atref-batch.test.ts +98 -0
  508. package/src/modules/access/__tests__/access-control.read-batch.test.ts +132 -0
  509. package/src/modules/access/__tests__/access-control.service.test.ts +1011 -0
  510. package/src/modules/access/__tests__/access-mutation.service.test.ts +439 -0
  511. package/src/modules/access/__tests__/access-splice.test.ts +247 -0
  512. package/src/modules/access/__tests__/access.routes.revoke.test.ts +407 -0
  513. package/src/modules/access/__tests__/creator-access.test.ts +217 -0
  514. package/src/modules/access/__tests__/grant-sources.test.ts +204 -0
  515. package/src/modules/access/__tests__/kb-read-filter.test.ts +70 -0
  516. package/src/modules/access/__tests__/roles-admin.service.test.ts +469 -0
  517. package/src/modules/access/__tests__/roles-edit.test.ts +138 -0
  518. package/src/modules/access/__tests__/roles-yaml-guard.test.ts +70 -0
  519. package/src/modules/access/__tests__/roles.routes.test.ts +234 -0
  520. package/src/modules/access/access-control.interface.ts +383 -0
  521. package/src/modules/access/access-control.service.ts +1794 -0
  522. package/src/modules/access/access-errors.ts +60 -0
  523. package/src/modules/access/access-mutation.service.ts +369 -0
  524. package/src/modules/access/access-splice.ts +413 -0
  525. package/src/modules/access/access.routes.ts +894 -0
  526. package/src/modules/access/creator-access.ts +270 -0
  527. package/src/modules/access/kb-read-filter.ts +76 -0
  528. package/src/modules/access/roles-admin.service.ts +741 -0
  529. package/src/modules/access/roles-edit.ts +248 -0
  530. package/src/modules/access/roles-yaml-guard.ts +89 -0
  531. package/src/modules/admin/admin-access.routes.ts +29 -0
  532. package/src/modules/admin/admin-access.service.ts +38 -0
  533. package/src/modules/admin/admin.interface.ts +10 -0
  534. package/src/modules/auth/account-erasure.service.ts +183 -0
  535. package/src/modules/auth/auth.middleware.ts +78 -0
  536. package/src/modules/auth/auth.routes.ts +97 -0
  537. package/src/modules/auth/auth.service.ts +199 -0
  538. package/src/modules/code-mode/code-mode-names.ts +38 -0
  539. package/src/modules/code-mode/code-mode.tool.ts +117 -0
  540. package/src/modules/code-mode/index.ts +6 -0
  541. package/src/modules/database/connection.ts +15 -0
  542. package/src/modules/database/core-schema.ts +431 -0
  543. package/src/modules/database/migrate.ts +43 -0
  544. package/src/modules/database/schema.ts +11 -0
  545. package/src/modules/diff/__tests__/diff.routes.read-gate.test.ts +87 -0
  546. package/src/modules/diff/__tests__/diff.routes.rejectPathsLocked.test.ts +150 -0
  547. package/src/modules/diff/__tests__/diff.service.seed-atomicity.test.ts +184 -0
  548. package/src/modules/diff/__tests__/diff.service.test.ts +202 -0
  549. package/src/modules/diff/diff-paths.ts +9 -0
  550. package/src/modules/diff/diff.config.ts +12 -0
  551. package/src/modules/diff/diff.interface.ts +78 -0
  552. package/src/modules/diff/diff.routes.ts +277 -0
  553. package/src/modules/diff/diff.service.ts +508 -0
  554. package/src/modules/diff/line-diff.ts +79 -0
  555. package/src/modules/mcp/__tests__/bevel-oauth-provider.test.ts +287 -0
  556. package/src/modules/mcp/__tests__/mcp-auth.middleware.test.ts +249 -0
  557. package/src/modules/mcp/__tests__/mcp-proxy-helpers.test.ts +253 -0
  558. package/src/modules/mcp/__tests__/mcp-session-store.test.ts +151 -0
  559. package/src/modules/mcp/__tests__/mcp.e2e.test.ts +150 -0
  560. package/src/modules/mcp/__tests__/mcp.routes.delete.test.ts +92 -0
  561. package/src/modules/mcp/__tests__/mcp.service.test.ts +414 -0
  562. package/src/modules/mcp/mcp-auth.middleware.ts +126 -0
  563. package/src/modules/mcp/mcp-session-store.ts +162 -0
  564. package/src/modules/mcp/mcp.routes.ts +263 -0
  565. package/src/modules/mcp/mcp.service.ts +973 -0
  566. package/src/modules/mcp/oauth/bevel-oauth-provider.ts +401 -0
  567. package/src/modules/mcp/oauth/oauth-consent.routes.ts +60 -0
  568. package/src/modules/mcp/oauth/oauth-state.ts +61 -0
  569. package/src/modules/secrets-vault/__tests__/connect-pending.route.test.ts +277 -0
  570. package/src/modules/secrets-vault/__tests__/db-secrets-vault.oauth.test.ts +206 -0
  571. package/src/modules/secrets-vault/__tests__/mcp-oauth-discovery.service.test.ts +178 -0
  572. package/src/modules/secrets-vault/__tests__/scopes-covered.test.ts +101 -0
  573. package/src/modules/secrets-vault/__tests__/secrets-variable-loader.test.ts +54 -0
  574. package/src/modules/secrets-vault/__tests__/tool-owner-gate.route.test.ts +143 -0
  575. package/src/modules/secrets-vault/db-secrets-vault.service.ts +792 -0
  576. package/src/modules/secrets-vault/index.ts +25 -0
  577. package/src/modules/secrets-vault/mcp-oauth-discovery.service.ts +289 -0
  578. package/src/modules/secrets-vault/secrets-variable-loader.ts +104 -0
  579. package/src/modules/secrets-vault/secrets-vault.contract.ts +270 -0
  580. package/src/modules/secrets-vault/secrets-vault.routes.ts +526 -0
  581. package/src/modules/skills/__tests__/skills.service.test.ts +176 -0
  582. package/src/modules/skills/index.ts +10 -0
  583. package/src/modules/skills/skills.contract.ts +54 -0
  584. package/src/modules/skills/skills.routes.ts +38 -0
  585. package/src/modules/skills/skills.service.ts +245 -0
  586. package/src/modules/skills/skills.tools.ts +121 -0
  587. package/src/modules/tool-auth/__tests__/external-api-key.service.test.ts +358 -0
  588. package/src/modules/tool-auth/__tests__/internal-token.service.test.ts +79 -0
  589. package/src/modules/tool-auth/__tests__/manual-auth.middleware.test.ts +88 -0
  590. package/src/modules/tool-auth/external-api-key.errors.ts +25 -0
  591. package/src/modules/tool-auth/external-api-key.interface.ts +99 -0
  592. package/src/modules/tool-auth/external-api-key.service.ts +209 -0
  593. package/src/modules/tool-auth/internal-token.service.ts +124 -0
  594. package/src/modules/tool-auth/llm-usage-meter.ts +19 -0
  595. package/src/modules/tool-auth/tool-auth.middleware.ts +220 -0
  596. package/src/modules/tool-helpers/__tests__/phase0-loopback-spike.test.ts +129 -0
  597. package/src/modules/tool-helpers/__tests__/phase4-tools.test.ts +95 -0
  598. package/src/modules/tool-helpers/__tests__/tools-surface.test.ts +146 -0
  599. package/src/modules/tool-helpers/__tests__/validate-token.test.ts +75 -0
  600. package/src/modules/tool-helpers/index.ts +18 -0
  601. package/src/modules/tool-helpers/tool-context.ts +98 -0
  602. package/src/modules/tool-helpers/tool-def.ts +73 -0
  603. package/src/modules/tool-helpers/tool-handler.ts +91 -0
  604. package/src/modules/tool-helpers/tool.contract.ts +85 -0
  605. package/src/modules/tool-helpers/validate-token.ts +50 -0
  606. package/src/modules/tool-manuals/__tests__/tool-manuals.mcp-oauth.test.ts +200 -0
  607. package/src/modules/tool-manuals/__tests__/tool-manuals.service.test.ts +499 -0
  608. package/src/modules/tool-manuals/__tests__/tool-manuals.tools.test.ts +156 -0
  609. package/src/modules/tool-manuals/index.ts +12 -0
  610. package/src/modules/tool-manuals/tool-manuals.contract.ts +183 -0
  611. package/src/modules/tool-manuals/tool-manuals.routes.ts +110 -0
  612. package/src/modules/tool-manuals/tool-manuals.service.ts +781 -0
  613. package/src/modules/tool-manuals/tool-manuals.tools.ts +202 -0
  614. package/src/modules/tool-registry/__tests__/tool-registry.test.ts +64 -0
  615. package/src/modules/tool-registry/manual.routes.ts +87 -0
  616. package/src/modules/tool-registry/tool-registry.ts +55 -0
  617. package/src/modules/tool-registry/tool.contract.ts +52 -0
  618. package/src/modules/workflow/__tests__/event-bus.test.ts +322 -0
  619. package/src/modules/workflow/__tests__/file-change-notifier.test.ts +51 -0
  620. package/src/modules/workflow/__tests__/format-affected-owners.test.ts +67 -0
  621. package/src/modules/workflow/__tests__/locking-filesystem.test.ts +445 -0
  622. package/src/modules/workflow/__tests__/pending-commits.canonical.test.ts +36 -0
  623. package/src/modules/workflow/__tests__/pending-commits.worker.test.ts +243 -0
  624. package/src/modules/workflow/__tests__/preserve-roles-yaml.test.ts +308 -0
  625. package/src/modules/workflow/__tests__/sanitize-error.test.ts +67 -0
  626. package/src/modules/workflow/__tests__/session-ontology.policy.test.ts +62 -0
  627. package/src/modules/workflow/__tests__/session-ontology.service.test.ts +200 -0
  628. package/src/modules/workflow/__tests__/workflow.service.commitFileWhileLocked.test.ts +232 -0
  629. package/src/modules/workflow/__tests__/workflow.service.facade.test.ts +380 -0
  630. package/src/modules/workflow/__tests__/workflow.service.releaseLock.test.ts +340 -0
  631. package/src/modules/workflow/agent-tools/__tests__/workflow.tools.test.ts +192 -0
  632. package/src/modules/workflow/agent-tools/workflow.tools.ts +502 -0
  633. package/src/modules/workflow/event-bus.ts +262 -0
  634. package/src/modules/workflow/events.routes.ts +266 -0
  635. package/src/modules/workflow/file-change-notifier.ts +54 -0
  636. package/src/modules/workflow/file-lock.service.ts +269 -0
  637. package/src/modules/workflow/git/__tests__/branch-name.test.ts +86 -0
  638. package/src/modules/workflow/git/__tests__/branchAuthor.test.ts +80 -0
  639. package/src/modules/workflow/git/__tests__/clone-config.test.ts +15 -0
  640. package/src/modules/workflow/git/__tests__/git-test-helpers.ts +47 -0
  641. package/src/modules/workflow/git/__tests__/git-version.failure.test.ts +24 -0
  642. package/src/modules/workflow/git/__tests__/git-version.test.ts +49 -0
  643. package/src/modules/workflow/git/__tests__/git.service.accessGating.test.ts +389 -0
  644. package/src/modules/workflow/git/__tests__/git.service.changedFilesForPr.test.ts +124 -0
  645. package/src/modules/workflow/git/__tests__/git.service.commitChanges.test.ts +105 -0
  646. package/src/modules/workflow/git/__tests__/git.service.commitFile.test.ts +211 -0
  647. package/src/modules/workflow/git/__tests__/git.service.createBranch.test.ts +154 -0
  648. package/src/modules/workflow/git/__tests__/git.service.deleteBranch.test.ts +320 -0
  649. package/src/modules/workflow/git/__tests__/git.service.diffFileAtCommit.test.ts +202 -0
  650. package/src/modules/workflow/git/__tests__/git.service.diffFileBetweenBranches.test.ts +453 -0
  651. package/src/modules/workflow/git/__tests__/git.service.list-branches.test.ts +198 -0
  652. package/src/modules/workflow/git/__tests__/git.service.listTrackedFiles.test.ts +125 -0
  653. package/src/modules/workflow/git/__tests__/git.service.logForFile.test.ts +219 -0
  654. package/src/modules/workflow/git/__tests__/git.service.mergeChangeRequest.test.ts +145 -0
  655. package/src/modules/workflow/git/__tests__/git.service.pendingChanges.test.ts +240 -0
  656. package/src/modules/workflow/git/__tests__/git.service.postMergePull.test.ts +272 -0
  657. package/src/modules/workflow/git/__tests__/git.service.pull.test.ts +232 -0
  658. package/src/modules/workflow/git/__tests__/git.service.readFileAtRef.test.ts +101 -0
  659. package/src/modules/workflow/git/__tests__/git.service.status.test.ts +127 -0
  660. package/src/modules/workflow/git/__tests__/mutex.test.ts +78 -0
  661. package/src/modules/workflow/git/__tests__/pull-request.service.test.ts +225 -0
  662. package/src/modules/workflow/git/__tests__/pull-request.service.viewer-can-cancel.test.ts +101 -0
  663. package/src/modules/workflow/git/branch-name.ts +70 -0
  664. package/src/modules/workflow/git/clone-config.ts +71 -0
  665. package/src/modules/workflow/git/git-version.ts +70 -0
  666. package/src/modules/workflow/git/git.service.ts +2248 -0
  667. package/src/modules/workflow/git/mutex.ts +22 -0
  668. package/src/modules/workflow/git/pull-request.service.ts +447 -0
  669. package/src/modules/workflow/locking-filesystem.ts +489 -0
  670. package/src/modules/workflow/pending-commits.service.ts +444 -0
  671. package/src/modules/workflow/pending-commits.worker.ts +361 -0
  672. package/src/modules/workflow/read-only-filesystem.ts +54 -0
  673. package/src/modules/workflow/recovery-bot.ts +73 -0
  674. package/src/modules/workflow/review-workflow/__tests__/approval-states.test.ts +560 -0
  675. package/src/modules/workflow/review-workflow/__tests__/cancel-pr.test.ts +176 -0
  676. package/src/modules/workflow/review-workflow/__tests__/merge-gate.test.ts +258 -0
  677. package/src/modules/workflow/review-workflow/review-workflow.interface.ts +199 -0
  678. package/src/modules/workflow/review-workflow/review-workflow.service.ts +806 -0
  679. package/src/modules/workflow/sanitize-error.ts +62 -0
  680. package/src/modules/workflow/session-ontology.policy.ts +70 -0
  681. package/src/modules/workflow/session-ontology.service.ts +178 -0
  682. package/src/modules/workflow/workflow-hooks.ts +101 -0
  683. package/src/modules/workflow/workflow.errors.ts +285 -0
  684. package/src/modules/workflow/workflow.routes.ts +858 -0
  685. package/src/modules/workflow/workflow.service.ts +1555 -0
  686. package/src/modules/workspace/__tests__/kb-seed.service.test.ts +213 -0
  687. package/src/modules/workspace/__tests__/routine-write-policy.test.ts +68 -0
  688. package/src/modules/workspace/__tests__/session-ontology.gate.test.ts +237 -0
  689. package/src/modules/workspace/__tests__/spill-store.test.ts +43 -0
  690. package/src/modules/workspace/__tests__/workspace.routes.create-grant.test.ts +233 -0
  691. package/src/modules/workspace/__tests__/workspace.routes.delete.test.ts +176 -0
  692. package/src/modules/workspace/__tests__/workspace.routes.download.test.ts +303 -0
  693. package/src/modules/workspace/__tests__/workspace.routes.read-gate.test.ts +276 -0
  694. package/src/modules/workspace/__tests__/workspace.service.read-filter.test.ts +120 -0
  695. package/src/modules/workspace/__tests__/workspace.service.test.ts +565 -0
  696. package/src/modules/workspace/__tests__/workspace.tools.test.ts +504 -0
  697. package/src/modules/workspace/bevel-ignore.ts +62 -0
  698. package/src/modules/workspace/kb-seed.interface.ts +36 -0
  699. package/src/modules/workspace/kb-seed.service.ts +361 -0
  700. package/src/modules/workspace/routine-write-policy.ts +79 -0
  701. package/src/modules/workspace/session-ontology.gate.ts +189 -0
  702. package/src/modules/workspace/session-sink.ts +25 -0
  703. package/src/modules/workspace/spill-store.ts +87 -0
  704. package/src/modules/workspace/workspace.routes.ts +1114 -0
  705. package/src/modules/workspace/workspace.service.ts +1343 -0
  706. package/src/modules/workspace/workspace.tools.ts +885 -0
  707. package/src/shared/__tests__/frontmatter-id.test.ts +88 -0
  708. package/src/shared/__tests__/fs-walk.test.ts +42 -0
  709. package/src/shared/__tests__/ssrf.test.ts +53 -0
  710. package/src/shared/__tests__/utcp-namespace.test.ts +19 -0
  711. package/src/shared/frontmatter-id.ts +72 -0
  712. package/src/shared/fs-walk.ts +30 -0
  713. package/src/shared/hash-email.ts +14 -0
  714. package/src/shared/kb-layout.test.ts +88 -0
  715. package/src/shared/kb-layout.ts +101 -0
  716. package/src/shared/ssrf.ts +78 -0
  717. package/src/shared/token-crypto.ts +54 -0
  718. package/src/shared/ttl-cache.ts +27 -0
  719. package/src/shared/utcp-namespace.ts +88 -0
  720. package/src/version.ts +19 -0
@@ -0,0 +1 @@
1
+ {"version":3,"file":"review-workflow.service.js","sourceRoot":"","sources":["../../../../src/modules/workflow/review-workflow/review-workflow.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAa3C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEnG,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAO1D,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,wBAAwB;AACxB,MAAM,YAAY,GAAG,OAAgB,CAAC;AACtC,MAAM,kBAAkB,GAAG,UAAU,CAAC;AACtC,qFAAqF;AACrF,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CACpE,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CACxC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,gBAAiB,SAAQ,mBAAmB;IAChD,YAAY,MAAiC;QAC3C,KAAK,CACH,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qCAAqC,EACpF,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CACnC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,iBAAkB,SAAQ,mBAAmB;IACjD,YAAY,OAAiB;QAC3B,KAAK,CAAC,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,EAAE,GAAG,EAAE;YACpE,mBAAmB,EAAE,OAAO;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,mBAAoB,SAAQ,mBAAmB;IACnD,YAAY,MAAc;QACxB,KAAK,CAAC,iBAAiB,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,iBAAkB,SAAQ,mBAAmB;IACjD,YAAY,MAAmE;QAC7E,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG;YACtB,cAAc,EAAW,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,iDAAiD,EAAE;YAChG,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,yFAAyF,EAAE;YACxI,gBAAgB,EAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,6BAA6B,EAAE;SAC7E,CAAC,MAAM,CAAC,CAAC;QACV,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,eAAgB,SAAQ,mBAAmB;IAC/C;QACE,KAAK,CACH,sHAAsH,EACtH,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,gBAAiB,SAAQ,mBAAmB;IAChD,YAAY,MAA+C;QACzD,MAAM,GAAG,GACP,MAAM,KAAK,iBAAiB;YAC1B,CAAC,CAAC,0CAA0C;YAC5C,CAAC,CAAC,2CAA2C,CAAC;QAClD,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,eAAgB,SAAQ,mBAAmB;IAC/C;QACE,KAAK,CACH,yEAAyE,EACzE,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAAC,0CAA0C,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAwB;IAC/C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,uBAAuB,CAAC,iCAAiC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,sEAAsE;AACtE,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAClF,SAAS,eAAe,CAAC,KAAc,EAAE,SAAiB;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAuB,CAAC,GAAG,SAAS,uBAAuB,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,CAAS;IACnC,OAAO,CAAC,KAAK,UAAU,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,CAAoB;IAC1C,MAAM,WAAW,GACf,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,CAAoB;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,iBAAiB,CAAC,KAAK;aACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;aACzD,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO;IAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;IAClF,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAC;IAC5F,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,KAAK,CAAC,GAAmC;IAChD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE;QACxD,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,SAAS;QAC3B,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,SAAS;QAC3B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,SAAS;QACnC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,qBAAqB;IAEb;IACA;IACA;IACA;IAJnB,YACmB,EAAY,EACZ,aAA6B,EAC7B,gBAAkC,EAClC,GAAe;QAHf,OAAE,GAAF,EAAE,CAAU;QACZ,kBAAa,GAAb,aAAa,CAAgB;QAC7B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,QAAG,GAAH,GAAG,CAAY;IAC/B,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aACxC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,WAAW,CACf,QAAgB,EAChB,IAAc,EACd,KAAyB,EACzB,OAAe;QAEf,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;QAExE,oFAAoF;QACpF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAC;QACzE,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,8CAA8C;QAC9C,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC5D,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;iBACzB,MAAM,EAAE;iBACR,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAC1E;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,uBAAuB,CAAC,qCAAqC,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,CAAC;YACN,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5C,UAAU,EAAE,IAAI,CAAC,IAAI;YACrB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;YACxB,OAAO;YACP,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;SACjC,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,WAAW,CACf,SAAiB,EACjB,QAAgB,EAChB,IAAc,EACd,IAAY;QAEZ,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACzC,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;aAC3E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACjD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;aAC3E,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,QAAgB,EAAE,IAAc;QACrE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;aAC3E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,UAAU,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,QAAgB,EAChB,KAAwB,EACxB,OAAe,EACf,UAAkB,EAClB,cAA6B,EAC7B,WAAoB,EACpB,WAAoB;QAEpB,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAE9B,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,6DAA6D;QAC7D,EAAE;QACF,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,OAAO,GAAG,UAAU,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,iBAAiB,GAQjB,IAAI,GAAG,EAAE,CAAC;QACd,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,oEAAoE;QACpE,qEAAqE;QACrE,IAAI,sBAAsB,GAAyB,IAAI,GAAG,EAAE,CAAC;QAC7D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrF,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,4BAA4B,CACpE,WAAW,EACX,OAAO,EACP,KAAK,CACN,CAAC;gBACF,IAAI,QAAQ;oBAAE,iBAAiB,GAAG,QAAQ,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CACV,iEAAiE,QAAQ,UAAU,UAAU,IAAI,EACjG,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,CACvD,WAAW,EACX,OAAO,EACP,WAAW,EACX,KAAK,CACN,CAAC;oBACF,IAAI,KAAK;wBAAE,sBAAsB,GAAG,KAAK,CAAC;gBAC5C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,IAAI,CACV,uDAAuD,QAAQ,WAAW,WAAW,GAAG,EACxF,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,0DAA0D;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEjD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAqB,EAAE;YAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACnD,KAAK,EAAE,EAAE;gBACT,KAAK,EAAE,EAAuC;gBAC9C,MAAM,EAAE,IAAI,GAAG,EAAU;aAC1B,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;YAE1D,MAAM,UAAU,GAAwB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3D,KAAK,EAAE,CAAC,CAAC,aAAa;gBACtB,IAAI,EAAE,CAAC,CAAC,YAAY;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;gBACtC,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,OAAO;gBAC9B,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,KAAK;aACvF,CAAC,CAAC,CAAC;YAEJ,sEAAsE;YACtE,sEAAsE;YACtE,qEAAqE;YACrE,6DAA6D;YAC7D,yEAAyE;YACzE,yEAAyE;YACzE,qEAAqE;YACrE,uDAAuD;YACvD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YACvE,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,IAAI,IAAI,GAAG,EAAU,CAAC;YACpE,MAAM,mBAAmB,GACvB,CAAC,kBAAkB,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;gBAChD,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,EAAE;oBACJ,MAAM,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;oBACpD,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;wBAAE,OAAO,KAAK,CAAC;oBACxC,OAAO,kBAAkB;wBACvB,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC;wBACpC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACzC,CAAC,CACF,CAAC;YAEJ,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,iBAAiB,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;gBACnE,UAAU;gBACV,UAAU,EAAE,mBAAmB;gBAC/B,gBAAgB,EAAE,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI;aACjE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CACf,QAAgB,EAChB,IAAY,EACZ,IAAc,EACd,KAAwB,EACxB,OAAe,EACf,UAAkB,EAClB,cAA6B,EAC7B,WAAmB;QAEnB,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;QACxE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,CAAC,CAAC;QAE9E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAChD,CAAC;QAED,oEAAoE;QACpE,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,mDAAmD;QACnD,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CACvD,WAAW,EACX,UAAU,UAAU,EAAE,EACtB,IAAI,CAAC,KAAK,EACV,IAAI,CACL,CAAC;QACF,IAAI,UAAU,KAAK,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEpD,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC;YACN,QAAQ;YACR,IAAI;YACJ,aAAa,EAAE,WAAW;YAC1B,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,OAAO;SACR,CAAC;aACD,mBAAmB,EAAE,CAAC;QAEzB,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACnG,CAAC;IAED,iBAAiB,CAAC,KAAqB;QACrC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC7D,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC/C,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,qCAAqC;QACrC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QACpE,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,uCAAuC;QACvC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;gBAAE,SAAS;YACjC,IAAI,CAAC,CAAC,UAAU;gBAAE,SAAS;YAE3B,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC,IAAI,yBAAyB,CAAC,CAAC;YAChF,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,IAAI,SAAS,KAAK,GAAG,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,OAAO,CACX,QAAgB,EAChB,IAAc,EACd,OAAe,EACf,SAA8B,EAC9B,KAAuB,EACvB,OAAe,EACf,UAAkB,EAClB,WAAmB,EACnB,OAA6B,EAAE;QAE/B,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;QACxE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,CAAC,CAAC;QAC9E,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;QAEhF,sEAAsE;QACtE,0EAA0E;QAC1E,2EAA2E;QAC3E,oDAAoD;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAED,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,+DAA+D;QAC/D,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CACpD,WAAW,EACX,UAAU,UAAU,EAAE,EACtB,IAAI,CAAC,KAAK,EACV,YAAY,CACb,CAAC;YACF,IAAI,OAAO,KAAK,IAAI;gBAAE,MAAM,IAAI,eAAe,EAAE,CAAC;QACpD,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;aAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,QAAQ,YAAY,CAAC,CAAC;QACpF,wEAAwE;QACxE,6EAA6E;QAC7E,gEAAgE;QAChE,IAAI,EAAE,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC;gBAC1B,EAAE,CAAC,KAAK,KAAK,QAAQ;oBACnB,CAAC,CAAC,8CAA8C;oBAChD,CAAC,CAAC,gCAAgC;aACrC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,CAAC;YACN,QAAQ;YACR,gBAAgB;YAChB,eAAe,EAAE,IAAI,CAAC,IAAI;YAC1B,cAAc,EAAE,OAAO;YACvB,WAAW,EAAE,YAAY;YACzB,SAAS,EAAE,KAAK;SACjB,CAAC;aACD,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAEpC,sEAAsE;QACtE,6EAA6E;QAC7E,qEAAqE;QACrE,MAAM,OAAO,GAAG,GAAG,OAAO,MAAM,QAAQ,GAAG,CAAC;QAC5C,MAAM,YAAY,GAChB,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACrC,CAAC,CAAC,wCAAwC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACzF,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,uBAAuB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;QAE/E,8EAA8E;QAC9E,6EAA6E;QAC7E,8EAA8E;QAC9E,qEAAqE;QACrE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;QACxF,IAAI,WAAkE,CAAC;QACvE,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAC7C,aAAa,CAAC,EAAE,EAChB,EAAE,CAAC,YAAY,EACf,EAAE,CAAC,YAAY,EACf,EAAE,OAAO,EAAE,IAAI,EAAE,EACjB,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAChF,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;iBACnE,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC;gBACH,SAAS,EAAE,KAAK;gBAChB,WAAW,EAAE,IAAI,IAAI,EAAE;gBACvB,KAAK,EAAE,cAAc,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACpD,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC,MAAM,IAAI,2BAA2B,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;QAC7F,CAAC;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;aACnG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;aAC1E,SAAS,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,oEAAoE;YACpE,sEAAsE;YACtE,MAAM,SAAS,GAAG,sFAAsF,CAAC;YACzG,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;iBACxD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;aACrC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAEvC,OAAO;YACL,QAAQ;YACR,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,IAAc,EACd,KAAuB,EACvB,YAA2B,EAC3B,UAAkB,EAClB,WAAmB;QAEnB,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,CAAC,CAAC;QAC9E,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;QAEhF,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QACtE,IAAI,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAExE,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,4EAA4E;QAC5E,oEAAoE;QACpE,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,YAAY,KAAK,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,uEAAuE;YACvE,qEAAqE;YACrE,2CAA2C;YAC3C,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CACpD,WAAW,EACX,UAAU,UAAU,EAAE,EACtB,IAAI,CAAC,KAAK,EACV,YAAY,CACb,CAAC;gBACF,aAAa,GAAG,OAAO,KAAK,IAAI,CAAC;YACnC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,eAAe,EAAE,CAAC;QAEnE,wEAAwE;QACxE,yEAAyE;QACzE,gEAAgE;QAChE,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;aACvD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;aACjF,SAAS,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;QAExC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;iBACxB,MAAM,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC;iBACvC,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;iBAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QAChG,CAAC;QAED,OAAO;YACL,QAAQ;YACR,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;SAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,QAAgB,EAChB,IAAY,EACZ,IAAc,EACd,KAAwB,EACxB,OAAe,EACf,UAAkB,EAClB,cAA6B,EAC7B,WAAmB;QAEnB,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;QAExE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEpD,0EAA0E;QAC1E,uEAAuE;QACvE,4DAA4D;QAC5D,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACtC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EAC9B,EAAE,CAAC,eAAe,CAAC,aAAa,EAAE,WAAW,CAAC,CAC/C,CACF,CAAC;QAEJ,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACnG,CAAC;CACF"}
@@ -0,0 +1,29 @@
1
+ /**
2
+ * Shared error-text sanitizer for the pending-commits failure pipeline.
3
+ *
4
+ * Two consumers — both forward error text outside of trust boundaries:
5
+ *
6
+ * - `pending-commits.worker.ts` writes `lastError` into the database
7
+ * (`pending_commits.last_error`) and logs the same string to stdout.
8
+ * - the recovery-agent runner (an enterprise `RecoveryAgentRunner` impl,
9
+ * e.g. `modules/agent/background-recovery-agent.runner.ts`) interpolates
10
+ * the message into an LLM prompt that hits OpenAI.
11
+ *
12
+ * Git surfaces credentialed URLs verbatim in stderr (`fatal: unable to
13
+ * access 'https://x-access-token:ghp_…@github.com/…'`), and the underlying
14
+ * `git push` shell-out can also yield `Authorization: Bearer …` headers
15
+ * when remote helpers are involved. We strip the obvious patterns and clip
16
+ * the result so a runaway stack trace can't blow past prompt budgets.
17
+ *
18
+ * Intentional non-goals: this is best-effort regex masking, not a full
19
+ * secret-detection pipeline. We're catching the formats we actually see;
20
+ * a determined attacker could still smuggle a credential through, but the
21
+ * worker doesn't see attacker-controlled error text in the first place.
22
+ */
23
+ /**
24
+ * Normalise an unknown thrown value into a single-line string with secrets
25
+ * masked and length capped. Safe to log, persist, or interpolate into an
26
+ * LLM prompt.
27
+ */
28
+ export declare function sanitizeError(err: unknown): string;
29
+ //# sourceMappingURL=sanitize-error.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"sanitize-error.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/sanitize-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAsBH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAalD"}
@@ -0,0 +1,60 @@
1
+ /**
2
+ * Shared error-text sanitizer for the pending-commits failure pipeline.
3
+ *
4
+ * Two consumers — both forward error text outside of trust boundaries:
5
+ *
6
+ * - `pending-commits.worker.ts` writes `lastError` into the database
7
+ * (`pending_commits.last_error`) and logs the same string to stdout.
8
+ * - the recovery-agent runner (an enterprise `RecoveryAgentRunner` impl,
9
+ * e.g. `modules/agent/background-recovery-agent.runner.ts`) interpolates
10
+ * the message into an LLM prompt that hits OpenAI.
11
+ *
12
+ * Git surfaces credentialed URLs verbatim in stderr (`fatal: unable to
13
+ * access 'https://x-access-token:ghp_…@github.com/…'`), and the underlying
14
+ * `git push` shell-out can also yield `Authorization: Bearer …` headers
15
+ * when remote helpers are involved. We strip the obvious patterns and clip
16
+ * the result so a runaway stack trace can't blow past prompt budgets.
17
+ *
18
+ * Intentional non-goals: this is best-effort regex masking, not a full
19
+ * secret-detection pipeline. We're catching the formats we actually see;
20
+ * a determined attacker could still smuggle a credential through, but the
21
+ * worker doesn't see attacker-controlled error text in the first place.
22
+ */
23
+ /** Truncation cap for prompts / DB column. ~200 chars keeps prompts tight. */
24
+ const MAX_LEN = 200;
25
+ const REDACTIONS = [
26
+ // `https://user:pass@host/…` and the GitHub-specific `x-access-token:…@`
27
+ // form `git push` prints. Keep the scheme + host so the message still
28
+ // hints at what was being talked to.
29
+ [/(https?:\/\/)[^/\s@]+:[^/\s@]+@/gi, '$1[REDACTED]@'],
30
+ // `Authorization: Bearer <token>` headers (proxy / smart-http output).
31
+ [/(authorization:\s*bearer\s+)\S+/gi, '$1[REDACTED]'],
32
+ // `token=<value>` / `secret=<value>` / `api_key=<value>` style params.
33
+ [/((?:token|secret|api[_-]?key|access[_-]?token|password)\s*[:=]\s*)\S+/gi, '$1[REDACTED]'],
34
+ // Bare hex blobs long enough to be tokens (≥32 chars). Catches `ghp_*`
35
+ // *after* the `token=` mask above strips obvious labels — this one is
36
+ // the fallback for unlabelled hex secrets.
37
+ [/[a-f0-9]{32,}/gi, '[REDACTED]'],
38
+ // Anything that looks like a GitHub PAT / fine-grained PAT prefix.
39
+ [/(gh[pousr]_|github_pat_)[A-Za-z0-9_]+/g, '[REDACTED]'],
40
+ ];
41
+ /**
42
+ * Normalise an unknown thrown value into a single-line string with secrets
43
+ * masked and length capped. Safe to log, persist, or interpolate into an
44
+ * LLM prompt.
45
+ */
46
+ export function sanitizeError(err) {
47
+ const raw = err instanceof Error ? err.message : String(err);
48
+ // Collapse newlines + control chars so the result is a single line. Stack
49
+ // traces are deliberately dropped — `err.message` is the meaningful part;
50
+ // the stack would be over-budget after truncation anyway.
51
+ let out = raw.replace(/\s+/g, ' ').trim();
52
+ for (const [pattern, replacement] of REDACTIONS) {
53
+ out = out.replace(pattern, replacement);
54
+ }
55
+ if (out.length > MAX_LEN) {
56
+ out = out.slice(0, MAX_LEN - 1) + '…';
57
+ }
58
+ return out;
59
+ }
60
+ //# sourceMappingURL=sanitize-error.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"sanitize-error.js","sourceRoot":"","sources":["../../../src/modules/workflow/sanitize-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,8EAA8E;AAC9E,MAAM,OAAO,GAAG,GAAG,CAAC;AAEpB,MAAM,UAAU,GAAqC;IACnD,yEAAyE;IACzE,sEAAsE;IACtE,qCAAqC;IACrC,CAAC,mCAAmC,EAAE,eAAe,CAAC;IACtD,uEAAuE;IACvE,CAAC,mCAAmC,EAAE,cAAc,CAAC;IACrD,uEAAuE;IACvE,CAAC,yEAAyE,EAAE,cAAc,CAAC;IAC3F,uEAAuE;IACvE,sEAAsE;IACtE,2CAA2C;IAC3C,CAAC,iBAAiB,EAAE,YAAY,CAAC;IACjC,mEAAmE;IACnE,CAAC,wCAAwC,EAAE,YAAY,CAAC;CACzD,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,0EAA0E;IAC1E,0EAA0E;IAC1E,0DAA0D;IAC1D,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,UAAU,EAAE,CAAC;QAChD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
@@ -0,0 +1,52 @@
1
+ /**
2
+ * Ontology-session boundary — the PURE decision core (no IO, no DB).
3
+ *
4
+ * Model: each run/session accumulates the SET of named ontologies it has
5
+ * touched (via any read or write). The rule is asymmetric:
6
+ *
7
+ * READS — always allowed. A read that touches a named ontology RECORDS it
8
+ * into the session's touched set (so it can poison later writes).
9
+ * WRITES — allowed only while the session is confined to a SINGLE named
10
+ * ontology and the write targets that same ontology. The moment a
11
+ * session has touched two or more named ontologies (typically by
12
+ * reading across them), EVERY subsequent write is blocked — "read
13
+ * across ontologies → you can't write anymore at all."
14
+ *
15
+ * Neutral touches (`ontologyOf` → null: root config, Skills, root-level
16
+ * Knowledge, non-KB) never record and never block. See
17
+ * `docs/rp4-ontology-boundary-plan-v2.md`.
18
+ *
19
+ * `SessionOntologyService` (Postgres-backed) persists the touched set and calls
20
+ * these helpers; this module keeps the rule itself testable in isolation.
21
+ */
22
+ import type { Ontology } from '@bevel-software/platform-shared';
23
+ /** Outcome of a write check against the session's touched-ontology set. */
24
+ export type WriteDecision = {
25
+ allow: true;
26
+ } | {
27
+ allow: false;
28
+ reason: 'multi-ontology' | 'different-ontology';
29
+ touched: string[];
30
+ attempted: string;
31
+ };
32
+ /**
33
+ * The set of NAMED ontologies a session has touched after this operation. A
34
+ * neutral operation (`ontology === null`) adds nothing. Pure — returns a new
35
+ * set, never mutates the input.
36
+ */
37
+ export declare function recordTouch(touched: ReadonlySet<string>, ontology: Ontology): Set<string>;
38
+ /**
39
+ * Decide whether a WRITE to `attempted` is allowed given the ontologies the
40
+ * session has already touched (NOT counting this write yet).
41
+ *
42
+ * - A write to a neutral path (`attempted === null`) is always allowed.
43
+ * - If the session has already touched two or more named ontologies, the
44
+ * write is blocked (`multi-ontology`) — reading across ontologies poisoned
45
+ * the session's write ability.
46
+ * - If the session has touched exactly one named ontology and it differs from
47
+ * the write target, the write is blocked (`different-ontology`).
48
+ * - If the session is unpinned (touched none) or its single touched ontology
49
+ * equals the target, the write is allowed.
50
+ */
51
+ export declare function decideWrite(touched: ReadonlySet<string>, attempted: Ontology): WriteDecision;
52
+ //# sourceMappingURL=session-ontology.policy.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"session-ontology.policy.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/session-ontology.policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAEhE,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GACrB;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GACf;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5G;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAIzF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,GAAG,aAAa,CAgB5F"}
@@ -0,0 +1,62 @@
1
+ /**
2
+ * Ontology-session boundary — the PURE decision core (no IO, no DB).
3
+ *
4
+ * Model: each run/session accumulates the SET of named ontologies it has
5
+ * touched (via any read or write). The rule is asymmetric:
6
+ *
7
+ * READS — always allowed. A read that touches a named ontology RECORDS it
8
+ * into the session's touched set (so it can poison later writes).
9
+ * WRITES — allowed only while the session is confined to a SINGLE named
10
+ * ontology and the write targets that same ontology. The moment a
11
+ * session has touched two or more named ontologies (typically by
12
+ * reading across them), EVERY subsequent write is blocked — "read
13
+ * across ontologies → you can't write anymore at all."
14
+ *
15
+ * Neutral touches (`ontologyOf` → null: root config, Skills, root-level
16
+ * Knowledge, non-KB) never record and never block. See
17
+ * `docs/rp4-ontology-boundary-plan-v2.md`.
18
+ *
19
+ * `SessionOntologyService` (Postgres-backed) persists the touched set and calls
20
+ * these helpers; this module keeps the rule itself testable in isolation.
21
+ */
22
+ /**
23
+ * The set of NAMED ontologies a session has touched after this operation. A
24
+ * neutral operation (`ontology === null`) adds nothing. Pure — returns a new
25
+ * set, never mutates the input.
26
+ */
27
+ export function recordTouch(touched, ontology) {
28
+ const next = new Set(touched);
29
+ if (ontology !== null)
30
+ next.add(ontology);
31
+ return next;
32
+ }
33
+ /**
34
+ * Decide whether a WRITE to `attempted` is allowed given the ontologies the
35
+ * session has already touched (NOT counting this write yet).
36
+ *
37
+ * - A write to a neutral path (`attempted === null`) is always allowed.
38
+ * - If the session has already touched two or more named ontologies, the
39
+ * write is blocked (`multi-ontology`) — reading across ontologies poisoned
40
+ * the session's write ability.
41
+ * - If the session has touched exactly one named ontology and it differs from
42
+ * the write target, the write is blocked (`different-ontology`).
43
+ * - If the session is unpinned (touched none) or its single touched ontology
44
+ * equals the target, the write is allowed.
45
+ */
46
+ export function decideWrite(touched, attempted) {
47
+ if (attempted === null)
48
+ return { allow: true };
49
+ // The set of named ontologies the session would span if this write lands.
50
+ const spanned = new Set(touched);
51
+ spanned.add(attempted);
52
+ if (spanned.size <= 1)
53
+ return { allow: true };
54
+ // spanned.size >= 2 — the write would put the session across a boundary.
55
+ const touchedList = [...touched].sort();
56
+ if (touched.size >= 2) {
57
+ return { allow: false, reason: 'multi-ontology', touched: touchedList, attempted };
58
+ }
59
+ // Exactly one prior ontology, and it isn't the write target.
60
+ return { allow: false, reason: 'different-ontology', touched: touchedList, attempted };
61
+ }
62
+ //# sourceMappingURL=session-ontology.policy.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"session-ontology.policy.js","sourceRoot":"","sources":["../../../src/modules/workflow/session-ontology.policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AASH;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAA4B,EAAE,QAAkB;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,QAAQ,KAAK,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,OAA4B,EAAE,SAAmB;IAC3E,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAE/C,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEvB,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAE9C,yEAAyE;IACzE,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACrF,CAAC;IACD,6DAA6D;IAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACzF,CAAC"}
@@ -0,0 +1,100 @@
1
+ /**
2
+ * Ontology-session boundary — the touched-set store (Postgres + cache).
3
+ *
4
+ * Each session accumulates the SET of named ontologies it has touched. The gate
5
+ * calls `checkOperation` for every gated agent tool call:
6
+ *
7
+ * READ (isWrite=false) → always allowed; RECORD the touched ontology so it
8
+ * can poison later writes.
9
+ * WRITE (isWrite=true) → allowed only while the session is confined to a
10
+ * single named ontology equal to the target; once the
11
+ * session has touched ≥2 ontologies, every write is
12
+ * blocked. An allowed write also records its ontology.
13
+ *
14
+ * Neutral operations (`ontologyOf` → null) never record and never block.
15
+ *
16
+ * ┌── checkOperation(sessionId, wsPath, isWrite) ───────────────────────────┐
17
+ * │ ont = ontologyOf(wsPath) │
18
+ * │ ont === null → { allow:true } (neutral; no record) │
19
+ * │ touched = loadTouched(sessionId) (cache, else SELECT) │
20
+ * │ WRITE → decideWrite(touched, ont); if blocked, return block (no record) │
21
+ * │ record(sessionId, ont) (idempotent INSERT; update cache) │
22
+ * │ return { allow:true } │
23
+ * └──────────────────────────────────────────────────────────────────────────┘
24
+ *
25
+ * Postgres is the source of truth so the boundary survives a backend restart.
26
+ * The cache holds each session's touched set; a miss re-reads PG. See
27
+ * `docs/rp4-ontology-boundary-plan-v2.md`.
28
+ *
29
+ * Eviction: `delete(sessionId)` at run end is the PRIMARY reclamation;
30
+ * `sweepOlderThan` is the abandoned-run backstop; the MCP layer also calls
31
+ * `delete` from its `onEvict` hook.
32
+ */
33
+ import type { Database } from '../database/connection.js';
34
+ export type OperationDecision = {
35
+ allow: true;
36
+ touched: string[];
37
+ } | {
38
+ allow: false;
39
+ reason: 'multi-ontology' | 'different-ontology';
40
+ touched: string[];
41
+ attempted: string;
42
+ };
43
+ export interface ISessionOntologyService {
44
+ /**
45
+ * Evaluate and record a gated agent operation. Reads always allow (and
46
+ * record); writes allow only while confined to a single ontology. Neutral
47
+ * paths always allow and record nothing.
48
+ */
49
+ checkOperation(sessionId: string, wsPath: string, isWrite: boolean, kbDirName?: string): Promise<OperationDecision>;
50
+ /** Evaluate/record against an already-resolved ontology (used by graph tools). */
51
+ checkOntology(sessionId: string, ontology: string | null, isWrite: boolean): Promise<OperationDecision>;
52
+ /** The set of ontologies a session has touched. */
53
+ getTouched(sessionId: string): Promise<string[]>;
54
+ /** Reclaim a session's touched set (run end / MCP onEvict). */
55
+ delete(sessionId: string): Promise<void>;
56
+ /** Backstop: drop touch rows older than `cutoff` (abandoned runs). */
57
+ sweepOlderThan(cutoff: Date): Promise<number>;
58
+ }
59
+ export declare class SessionOntologyService implements ISessionOntologyService {
60
+ private readonly db;
61
+ /**
62
+ * Write-through cache of each session's touched-ontology set. A present entry
63
+ * is authoritative for the session (we only ever add to it in-process); a
64
+ * miss re-reads Postgres. Keyed by the agent thread / sessionId.
65
+ */
66
+ private readonly cache;
67
+ /**
68
+ * Serializes each session's read→decide→record path. Without it, two
69
+ * concurrent same-session writes (parallel tool calls in one turn) could both
70
+ * observe a singleton/empty touched set and both be allowed to different
71
+ * ontologies before either INSERT lands — defeating the boundary. Different
72
+ * sessions never contend.
73
+ */
74
+ private readonly locks;
75
+ constructor(db: Database);
76
+ /**
77
+ * Resolve `wsPath` to its ontology and evaluate/record the operation. Thin
78
+ * wrapper over {@link checkOntology} for the common path-based call site.
79
+ */
80
+ checkOperation(sessionId: string, wsPath: string, isWrite: boolean, kbDirName?: string): Promise<OperationDecision>;
81
+ /**
82
+ * Evaluate (and, when allowed, record) an operation against an
83
+ * already-resolved ontology. Neutral ops always allow and record nothing;
84
+ * reads always allow and record; writes allow only while the session stays
85
+ * confined to the single target ontology (see {@link decideWrite}). A blocked
86
+ * write records nothing.
87
+ */
88
+ checkOntology(sessionId: string, ontology: string | null, isWrite: boolean): Promise<OperationDecision>;
89
+ /** The sorted set of named ontologies this session has touched so far. */
90
+ getTouched(sessionId: string): Promise<string[]>;
91
+ /** Reclaim a session's touched set from both the cache and Postgres (run end / MCP onEvict). */
92
+ delete(sessionId: string): Promise<void>;
93
+ /** Backstop sweep: drop touch rows older than `cutoff` (abandoned runs) and return how many were removed. */
94
+ sweepOlderThan(cutoff: Date): Promise<number>;
95
+ /** Load a session's touched set from cache, else from Postgres (and cache it). */
96
+ private loadTouched;
97
+ /** Record a touched ontology (idempotent) and update the cache. */
98
+ private record;
99
+ }
100
+ //# sourceMappingURL=session-ontology.service.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"session-ontology.service.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/session-ontology.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAK1D,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5G,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpH,kFAAkF;IAClF,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxG,mDAAmD;IACnD,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,+DAA+D;IAC/D,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,sEAAsE;IACtE,cAAc,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,qBAAa,sBAAuB,YAAW,uBAAuB;IAiBxD,OAAO,CAAC,QAAQ,CAAC,EAAE;IAhB/B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkC;IAExD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;gBAEjB,EAAE,EAAE,QAAQ;IAEzC;;;OAGG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,CAAC;IAI7B;;;;;;OAMG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA+B7G,0EAA0E;IACpE,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAItD,gGAAgG;IAC1F,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9C,6GAA6G;IACvG,cAAc,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAWnD,kFAAkF;YACpE,WAAW;IAYzB,mEAAmE;YACrD,MAAM;CAQrB"}
@@ -0,0 +1,143 @@
1
+ /**
2
+ * Ontology-session boundary — the touched-set store (Postgres + cache).
3
+ *
4
+ * Each session accumulates the SET of named ontologies it has touched. The gate
5
+ * calls `checkOperation` for every gated agent tool call:
6
+ *
7
+ * READ (isWrite=false) → always allowed; RECORD the touched ontology so it
8
+ * can poison later writes.
9
+ * WRITE (isWrite=true) → allowed only while the session is confined to a
10
+ * single named ontology equal to the target; once the
11
+ * session has touched ≥2 ontologies, every write is
12
+ * blocked. An allowed write also records its ontology.
13
+ *
14
+ * Neutral operations (`ontologyOf` → null) never record and never block.
15
+ *
16
+ * ┌── checkOperation(sessionId, wsPath, isWrite) ───────────────────────────┐
17
+ * │ ont = ontologyOf(wsPath) │
18
+ * │ ont === null → { allow:true } (neutral; no record) │
19
+ * │ touched = loadTouched(sessionId) (cache, else SELECT) │
20
+ * │ WRITE → decideWrite(touched, ont); if blocked, return block (no record) │
21
+ * │ record(sessionId, ont) (idempotent INSERT; update cache) │
22
+ * │ return { allow:true } │
23
+ * └──────────────────────────────────────────────────────────────────────────┘
24
+ *
25
+ * Postgres is the source of truth so the boundary survives a backend restart.
26
+ * The cache holds each session's touched set; a miss re-reads PG. See
27
+ * `docs/rp4-ontology-boundary-plan-v2.md`.
28
+ *
29
+ * Eviction: `delete(sessionId)` at run end is the PRIMARY reclamation;
30
+ * `sweepOlderThan` is the abandoned-run backstop; the MCP layer also calls
31
+ * `delete` from its `onEvict` hook.
32
+ */
33
+ import { eq, lt } from 'drizzle-orm';
34
+ import { ontologyOf } from '../../shared/kb-layout.js';
35
+ import { sessionOntologyTouches } from '../database/schema.js';
36
+ import { recordTouch, decideWrite } from './session-ontology.policy.js';
37
+ import { WorkspaceMutex } from './git/mutex.js';
38
+ export class SessionOntologyService {
39
+ db;
40
+ /**
41
+ * Write-through cache of each session's touched-ontology set. A present entry
42
+ * is authoritative for the session (we only ever add to it in-process); a
43
+ * miss re-reads Postgres. Keyed by the agent thread / sessionId.
44
+ */
45
+ cache = new Map();
46
+ /**
47
+ * Serializes each session's read→decide→record path. Without it, two
48
+ * concurrent same-session writes (parallel tool calls in one turn) could both
49
+ * observe a singleton/empty touched set and both be allowed to different
50
+ * ontologies before either INSERT lands — defeating the boundary. Different
51
+ * sessions never contend.
52
+ */
53
+ locks = new WorkspaceMutex();
54
+ constructor(db) {
55
+ this.db = db;
56
+ }
57
+ /**
58
+ * Resolve `wsPath` to its ontology and evaluate/record the operation. Thin
59
+ * wrapper over {@link checkOntology} for the common path-based call site.
60
+ */
61
+ async checkOperation(sessionId, wsPath, isWrite, kbDirName) {
62
+ return this.checkOntology(sessionId, ontologyOf(wsPath, kbDirName), isWrite);
63
+ }
64
+ /**
65
+ * Evaluate (and, when allowed, record) an operation against an
66
+ * already-resolved ontology. Neutral ops always allow and record nothing;
67
+ * reads always allow and record; writes allow only while the session stays
68
+ * confined to the single target ontology (see {@link decideWrite}). A blocked
69
+ * write records nothing.
70
+ */
71
+ async checkOntology(sessionId, ontology, isWrite) {
72
+ // Neutral operation: always allowed, records nothing. No state mutation, so
73
+ // it needs no per-session serialization.
74
+ if (ontology === null) {
75
+ const touched = await this.loadTouched(sessionId);
76
+ return { allow: true, touched: [...touched].sort() };
77
+ }
78
+ // Serialize the decide+record path per session so concurrent same-session
79
+ // operations can't both pass the boundary on a stale touched set.
80
+ return this.locks.run(sessionId, async () => {
81
+ const touched = await this.loadTouched(sessionId);
82
+ if (isWrite) {
83
+ const decision = decideWrite(touched, ontology);
84
+ if (!decision.allow) {
85
+ return {
86
+ allow: false,
87
+ reason: decision.reason,
88
+ touched: decision.touched,
89
+ attempted: decision.attempted,
90
+ };
91
+ }
92
+ }
93
+ // Allowed (read, or a write confined to one ontology): record the touch.
94
+ await this.record(sessionId, ontology, touched);
95
+ return { allow: true, touched: [...recordTouch(touched, ontology)].sort() };
96
+ });
97
+ }
98
+ /** The sorted set of named ontologies this session has touched so far. */
99
+ async getTouched(sessionId) {
100
+ return [...(await this.loadTouched(sessionId))].sort();
101
+ }
102
+ /** Reclaim a session's touched set from both the cache and Postgres (run end / MCP onEvict). */
103
+ async delete(sessionId) {
104
+ this.cache.delete(sessionId);
105
+ await this.db.delete(sessionOntologyTouches).where(eq(sessionOntologyTouches.sessionId, sessionId));
106
+ }
107
+ /** Backstop sweep: drop touch rows older than `cutoff` (abandoned runs) and return how many were removed. */
108
+ async sweepOlderThan(cutoff) {
109
+ const removed = await this.db
110
+ .delete(sessionOntologyTouches)
111
+ .where(lt(sessionOntologyTouches.touchedAt, cutoff))
112
+ .returning({ sessionId: sessionOntologyTouches.sessionId });
113
+ // A swept session may have other (newer) rows; drop its cache entry so the
114
+ // next op re-reads the authoritative remaining set from Postgres.
115
+ for (const r of removed)
116
+ this.cache.delete(r.sessionId);
117
+ return removed.length;
118
+ }
119
+ /** Load a session's touched set from cache, else from Postgres (and cache it). */
120
+ async loadTouched(sessionId) {
121
+ const cached = this.cache.get(sessionId);
122
+ if (cached)
123
+ return cached;
124
+ const rows = await this.db
125
+ .select({ ontology: sessionOntologyTouches.ontology })
126
+ .from(sessionOntologyTouches)
127
+ .where(eq(sessionOntologyTouches.sessionId, sessionId));
128
+ const set = new Set(rows.map((r) => r.ontology));
129
+ this.cache.set(sessionId, set);
130
+ return set;
131
+ }
132
+ /** Record a touched ontology (idempotent) and update the cache. */
133
+ async record(sessionId, ontology, current) {
134
+ if (current.has(ontology))
135
+ return; // already recorded; no DB write needed
136
+ await this.db
137
+ .insert(sessionOntologyTouches)
138
+ .values({ sessionId, ontology })
139
+ .onConflictDoNothing({ target: [sessionOntologyTouches.sessionId, sessionOntologyTouches.ontology] });
140
+ current.add(ontology);
141
+ }
142
+ }
143
+ //# sourceMappingURL=session-ontology.service.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"session-ontology.service.js","sourceRoot":"","sources":["../../../src/modules/workflow/session-ontology.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAsB,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAuBhD,MAAM,OAAO,sBAAsB;IAiBJ;IAhB7B;;;;OAIG;IACc,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAExD;;;;;;OAMG;IACc,KAAK,GAAG,IAAI,cAAc,EAAE,CAAC;IAE9C,YAA6B,EAAY;QAAZ,OAAE,GAAF,EAAE,CAAU;IAAG,CAAC;IAE7C;;;OAGG;IACH,KAAK,CAAC,cAAc,CAClB,SAAiB,EACjB,MAAc,EACd,OAAgB,EAChB,SAAkB;QAElB,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,QAAuB,EAAE,OAAgB;QAC9E,4EAA4E;QAC5E,yCAAyC;QACzC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,CAAC;QAED,0EAA0E;QAC1E,kEAAkE;QAClE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAElD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,QAAQ,GAAkB,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC/D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACpB,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;wBACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;qBAC9B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,yEAAyE;YACzE,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACtG,CAAC;IAED,6GAA6G;IAC7G,KAAK,CAAC,cAAc,CAAC,MAAY;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;aACnD,SAAS,CAAC,EAAE,SAAS,EAAE,sBAAsB,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9D,2EAA2E;QAC3E,kEAAkE;QAClE,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAED,kFAAkF;IAC1E,KAAK,CAAC,WAAW,CAAC,SAAiB;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC,EAAE,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC;aACrD,IAAI,CAAC,sBAAsB,CAAC;aAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC/B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mEAAmE;IAC3D,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,QAAgB,EAAE,OAAoB;QAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,uCAAuC;QAC1E,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aAC/B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;CACF"}
@@ -0,0 +1,87 @@
1
+ import type { ValidationReport } from '@bevel-software/platform-shared';
2
+ /**
3
+ * Workflow lifecycle hooks — the generic seam that replaced the
4
+ * constructor-injected KB validator (and the core-owned ontology write block).
5
+ * Core code invokes the hooks at fixed lifecycle points; the modules that OWN
6
+ * the behavior (the enterprise kb/kb-graph modules today) register handlers in
7
+ * the composition root, right after `createCoreServices` returns. Core
8
+ * registers none, so a core-only deployment runs every hook point as a no-op.
9
+ *
10
+ * Two hook kinds with deliberately different failure semantics:
11
+ *
12
+ * - `commitValidation` — ADVISORY. Runs at commit time in `GitService`
13
+ * (`commit` / `commitFile`), exactly where the injected `IKbValidator`
14
+ * used to run. A returned report with `mustFix` entries is logged/surfaced
15
+ * but NEVER blocks the commit, and a hook that throws is caught and logged
16
+ * (see CLAUDE.md "Validation is advisory"). The signature mirrors the old
17
+ * `runValidation(workspaceId)` shape so `KbValidatorService` registers
18
+ * with a one-line adapter.
19
+ *
20
+ * - `preWrite` — BLOCKING. Runs before a gated agent write (file-write
21
+ * tools) or a write-capable shell command; a hook that throws REJECTS the
22
+ * operation (the error propagates to the tool caller). This is where the
23
+ * enterprise ontology-session block registers; core registers nothing, so
24
+ * core never blocks (touch TRACKING stays core — see
25
+ * `session-ontology.gate.ts`).
26
+ */
27
+ /** What `GitService` knows at the advisory commit-validation point. */
28
+ export interface CommitValidationContext {
29
+ workspaceId: string;
30
+ branch: string;
31
+ /**
32
+ * Repo-relative paths the commit will include — the full touched set for
33
+ * `commit()`, a single element for the one-file `commitFile()` path.
34
+ */
35
+ paths: string[];
36
+ }
37
+ /**
38
+ * Advisory commit-time validation. Return a report to have the caller log /
39
+ * surface it (or `void` for "nothing to say"). Throwing is tolerated — the
40
+ * caller catches and logs, never blocks the commit.
41
+ */
42
+ export type CommitValidationHook = (ctx: CommitValidationContext) => Promise<ValidationReport | void>;
43
+ /**
44
+ * What the pre-write gate knows when it consults the blocking hooks. The core
45
+ * gate has already resolved all skip conditions (boundary flag off, neutral
46
+ * path, non-agent caller, recovery bot, missing session id — see
47
+ * `resolveGatedSession`), so by hook time there is always a session id.
48
+ */
49
+ export type PreWriteContext =
50
+ /** A path-addressed content write (write_file/edit_file/mkdir/move/copy/unzip…). */
51
+ {
52
+ kind: 'file-write';
53
+ sessionId: string;
54
+ wsPath: string;
55
+ }
56
+ /** A write-capable operation with no resolvable target path (execute_command). */
57
+ | {
58
+ kind: 'shell';
59
+ sessionId: string;
60
+ };
61
+ /** Blocking pre-write hook: throw to reject the write; return to allow. */
62
+ export type PreWriteHook = (ctx: PreWriteContext) => Promise<void>;
63
+ /**
64
+ * The registry instance. ONE per composition (created in
65
+ * `createCoreServices`, shared by `GitService` and exposed as
66
+ * `WorkflowService.hooks` for the composition root to register against).
67
+ */
68
+ export declare class WorkflowHooks {
69
+ private readonly commitValidation;
70
+ private readonly preWrite;
71
+ /** Register an advisory commit-time validation hook. */
72
+ onCommitValidation(hook: CommitValidationHook): void;
73
+ /** Register a blocking pre-write hook. */
74
+ onPreWrite(hook: PreWriteHook): void;
75
+ /**
76
+ * The registered commit-validation hooks, for the caller (`GitService`) to
77
+ * iterate with its own advisory catch-and-log semantics.
78
+ */
79
+ commitValidationHooks(): readonly CommitValidationHook[];
80
+ /**
81
+ * Run every blocking pre-write hook in registration order. The first throw
82
+ * propagates and rejects the write; with no hooks registered (core-only)
83
+ * this resolves immediately.
84
+ */
85
+ runPreWrite(ctx: PreWriteContext): Promise<void>;
86
+ }
87
+ //# sourceMappingURL=workflow-hooks.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"workflow-hooks.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/workflow-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,uEAAuE;AACvE,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,GAAG,EAAE,uBAAuB,KACzB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,MAAM,eAAe;AACzB,oFAAoF;AAClF;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC3D,kFAAkF;GAChF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnE;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAE/C,wDAAwD;IACxD,kBAAkB,CAAC,IAAI,EAAE,oBAAoB,GAAG,IAAI;IAIpD,0CAA0C;IAC1C,UAAU,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAIpC;;;OAGG;IACH,qBAAqB,IAAI,SAAS,oBAAoB,EAAE;IAIxD;;;;OAIG;IACG,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAKvD"}