@bevel-software/platform-core-backend 0.14.0 → 0.15.1

package/dist/modules/plugins/discovery/plugin-source.d.ts

@@ -0,0 +1,96 @@
+import type { KbWalkListener } from '../../../shared/kb-walk.js';
+/**
+ * Plugin DISCOVERY as an interface — the one seam between "what a plugin is
+ * on disk" and everything that consumes plugins (the plugin index, the link
+ * index, the tool-manual scanner, the compiler).
+ *
+ * Two providers implement it:
+ *
+ *   - `native.source.ts`  — the Agent Plugins layout this platform writes:
+ *                           `Plugins/<Name>/plugin.json` (+ `mcp.json`,
+ *                           `access.md`, the hexis extension block).
+ *   - `bundle-dialect/`   — a customer's source layout: `plugin.bundle.json`
+ *                           files at any depth, pointing at skill roots and at
+ *                           an MCP profile in a registry. Read-only, and
+ *                           deletable as a unit once that customer migrates.
+ *
+ * Consumers see only {@link DiscoveredPlugin}: parsed objects, never files.
+ * A provider that reads a different file shape changes nothing downstream.
+ */
+export interface DiscoveredPlugin {
+    /**
+     * The plugin's IDENTITY everywhere a URL, a grant or a marketplace names
+     * it: the manifest's `name` — an Agent Plugins identifier — or the folder
+     * name folded into one when the manifest declares none it can be. A bundle
+     * plugin's is the bundle's `name`. Unique per source.
+     */
+    name: string;
+    /** What a person sees it called: the manifest's `displayName`, else the folder name. */
+    displayName: string;
+    /** Repo-relative folder holding the plugin, e.g. `Plugins/GTM`. */
+    folder: string;
+    /** The same folder relative to the plugins root, e.g. `GTM` or `functional/x/y`. */
+    relFolder: string;
+    /** A personal folder (`Plugins/personal-<id>`): a place, not a plugin. */
+    personal: boolean;
+    /**
+     * Whether the plugin EXISTS by the index's rule. Native: its folder carries
+     * an `access.md` (a bare directory is a ghost git left behind). Dialect:
+     * always — the bundle file is the existence.
+     */
+    exists: boolean;
+    /** The Agent Plugins manifest, parsed (a dialect synthesises one). Null when absent or unparsable. */
+    manifest: Record<string, unknown> | null;
+    /** The manifest's raw text, for readers that want the extension block verbatim (native only). */
+    manifestText: string | null;
+    /** Repo-relative roots the plugin LINKS skills from — a skill folder or a folder of skills. */
+    linkedRoots: string[];
+    /** The `mcpServers` map of the plugin's `mcp.json`, parsed; null when it has none. */
+    mcpServers: Record<string, unknown> | null;
+    /** The raw `mcp.json` text, when it exists on disk (native only). */
+    mcpJsonText: string | null;
+    /**
+     * Whether hexis manages this plugin's links — writes them, grants the
+     * plugin's principal on the skill, reports a missing grant as needing
+     * repair. False for a dialect, whose links are plain references and whose
+     * skills' own scopes decide readability.
+     */
+    linksAreManaged: boolean;
+}
+export interface Discovery {
+    plugins: DiscoveredPlugin[];
+    /** What was skipped and why — unparsable files, unknown profiles. */
+    warnings: string[];
+    /**
+     * HOLES: identity-bearing things that exist but could NOT be read
+     * (permissions, I/O), repo-relative — a folder that could not be listed,
+     * a manifest or bundle that could not be opened. Nothing behind a hole is
+     * in `plugins`: not absent, unseen, and never listed under a guessed name.
+     * A file that carries no identity (an `mcp.json`) is never a hole; its
+     * failure is a warning. A reader that only shows what it can carries on
+     * (the catalog does); a WRITER that keys a change on the set of plugins
+     * (a rename claiming a name) must refuse while this is not empty, or it
+     * may take an identity it could not see.
+     */
+    unreadable: string[];
+}
+/** What one walk yields when discovery shares it: the plugins, and every hole the walk met anywhere. */
+export interface PluginSourceWalk {
+    discovery: Discovery;
+    /** Every folder the walk could not list, repo-relative — under the plugins root or anywhere else. */
+    holes: string[];
+}
+export interface PluginSource {
+    /** A short name for logs and the settings screen. */
+    readonly dialect: string;
+    /** Enumerate the plugins in a KB checkout. Never throws: a broken tree yields warnings. */
+    discover(kbRoot: string): Promise<Discovery>;
+    /**
+     * Discover while driving other listeners from the SAME walk — a writer
+     * that needs plugins and grant files alike reads the tree once, and sees
+     * one set of holes. Optional: a source that cannot share its walk is
+     * discovered on its own and the caller walks separately.
+     */
+    walkWith?(kbRoot: string, listeners: readonly KbWalkListener[]): Promise<PluginSourceWalk>;
+}
+//# sourceMappingURL=plugin-source.d.ts.map

package/dist/modules/plugins/discovery/plugin-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-source.d.ts","sourceRoot":"","sources":["../../../../src/modules/plugins/discovery/plugin-source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,sGAAsG;IACtG,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,iGAAiG;IACjG,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,+FAA+F;IAC/F,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,qEAAqE;IACrE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,qEAAqE;IACrE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;;;OAUG;IACH,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,SAAS,CAAC;IACrB,qGAAqG;IACrG,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC5F"}

package/dist/modules/plugins/discovery/plugin-source.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=plugin-source.js.map

package/dist/modules/plugins/discovery/plugin-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-source.js","sourceRoot":"","sources":["../../../../src/modules/plugins/discovery/plugin-source.ts"],"names":[],"mappings":""}

package/dist/modules/plugins/index.d.ts

@@ -1,7 +1,16 @@
 export { PluginIndexService, pluginsWorkspaceId } from './plugins.service.js';
 export { PluginProvisionService, PluginProvisionError, pluginAccessMd, personalAccessMd, } from './plugin-provision.service.js';
 export { JoinRequestsService, type JoinRequest } from './join-requests.service.js';
+export { PluginLinkIndex, type LinkMembership, type PluginLinks } from './plugin-links.js';
+export { PluginLinksService, PluginLinkError } from './plugin-links.service.js';
+export { PluginRenameService, PluginRenameError, renamePluginPrincipalInText } from './plugin-rename.service.js';
+export { compileMarketplace, type VirtualTree, type CompileInput, type MarketplaceOptions } from './compile/compile-marketplace.js';
+export { MarketplaceCompilerService, type CompileAudience } from './compile/marketplace-compiler.service.js';
+export type { PluginSource, PluginSourceWalk, DiscoveredPlugin, Discovery } from './discovery/plugin-source.js';
+export { walkKb, type KbWalkListener, type KbWalkResult } from '../../shared/kb-walk.js';
+export { KbPluginSource } from './discovery/kb-plugin-source.js';
+export { DEFAULT_REGISTRY_PATH } from './discovery/bundle-dialect/bundle.source.js';
 export { pendingProposals, type JoinProposal } from './join-proposals.js';
 export { createPluginsRoutes } from './plugins.routes.js';
-export type { IPluginIndexService, PluginCatalogEntry, PluginSummary, ResolvedPrincipals, ResolvedReaders, } from './plugins.contract.js';
+export type { IPluginIndexService, PluginCatalogEntry, PluginMembership, PluginSummary, ResolvedPrincipals, ResolvedReaders, } from './plugins.contract.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/modules/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,eAAe,GAChB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACjH,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACpI,OAAO,EAAE,0BAA0B,EAAE,KAAK,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAC7G,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAChH,OAAO,EAAE,MAAM,EAAE,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,eAAe,GAChB,MAAM,uBAAuB,CAAC"}

package/dist/modules/plugins/index.js

@@ -1,6 +1,14 @@
 export { PluginIndexService, pluginsWorkspaceId } from './plugins.service.js';
 export { PluginProvisionService, PluginProvisionError, pluginAccessMd, personalAccessMd, } from './plugin-provision.service.js';
 export { JoinRequestsService } from './join-requests.service.js';
+export { PluginLinkIndex } from './plugin-links.js';
+export { PluginLinksService, PluginLinkError } from './plugin-links.service.js';
+export { PluginRenameService, PluginRenameError, renamePluginPrincipalInText } from './plugin-rename.service.js';
+export { compileMarketplace } from './compile/compile-marketplace.js';
+export { MarketplaceCompilerService } from './compile/marketplace-compiler.service.js';
+export { walkKb } from '../../shared/kb-walk.js';
+export { KbPluginSource } from './discovery/kb-plugin-source.js';
+export { DEFAULT_REGISTRY_PATH } from './discovery/bundle-dialect/bundle.source.js';
 export { pendingProposals } from './join-proposals.js';
 export { createPluginsRoutes } from './plugins.routes.js';
 //# sourceMappingURL=index.js.map

package/dist/modules/plugins/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAoB,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAqB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAoB,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,eAAe,EAAyC,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACjH,OAAO,EAAE,kBAAkB,EAAgE,MAAM,kCAAkC,CAAC;AACpI,OAAO,EAAE,0BAA0B,EAAwB,MAAM,2CAA2C,CAAC;AAE7G,OAAO,EAAE,MAAM,EAA0C,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAqB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/modules/plugins/plugin-links.d.ts

@@ -0,0 +1,66 @@
+import type { WorkspaceService } from '../workspace/workspace.service.js';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import type { ISkillService } from '../skills/skills.contract.js';
+import type { PluginMembership } from './plugins.contract.js';
+import type { PluginSource } from './discovery/plugin-source.js';
+/** One plugin's links, resolved against the released catalog. */
+export interface PluginLinks {
+    /** The plugin's name — its identity to people and URLs. */
+    name: string;
+    /** Repo-relative plugin folder. */
+    folder: string;
+    /** The roots the manifest declares, normalised. */
+    roots: string[];
+    /** Skill folders the roots resolve to (released catalog only). */
+    linkedSkills: string[];
+    /** Roots that resolve to no released skill — a typo, or a skill not yet merged. */
+    unresolvedRoots: string[];
+    /** Whether hexis writes these links and checks their grants — see `DiscoveredPlugin`. */
+    linksAreManaged: boolean;
+}
+export interface LinkMembership {
+    /** skill path → every plugin that holds it, inline or by link. */
+    bySkill: Map<string, PluginMembership[]>;
+    /** plugin folder → its links. Every plugin folder appears, linked or not. */
+    byPlugin: Map<string, PluginLinks>;
+}
+/**
+ * The link index: which shared skills each plugin links, and — the other way
+ * round — which plugins each skill belongs to, whether by sitting inside the
+ * plugin folder or by being linked from its manifest.
+ *
+ * Plugins come from the configured {@link PluginSource} (native manifests, or
+ * a customer dialect); resolution runs against the RELEASED catalog
+ * (`skillService.listSkills()`, unfiltered), never the file system: the
+ * catalog already applies the leaf-folder rule, the `.bevelignore` layers
+ * and the global-name dedup, and a second walk here would be a second
+ * opinion about what a skill is.
+ *
+ * `granted` is the consistency check the amber dot renders: a linked skill
+ * whose own access rules DO grant the plugin's `plugin/<Name>/read`
+ * principal (directly or from a scope above it). The link service writes
+ * that grant with the link; only a hand edit takes it away.
+ *
+ * Cached briefly, dropped by `invalidate()` from the same file-change
+ * subscriber that drops the plugin index, so a link committed on the default
+ * branch shows within one round-trip.
+ */
+export declare class PluginLinkIndex {
+    private readonly workspaceService;
+    private readonly skillService;
+    private readonly accessControl;
+    private readonly kbDirName;
+    private readonly source;
+    private readonly cache;
+    constructor(workspaceService: WorkspaceService, skillService: ISkillService, accessControl: IAccessControl, kbDirName: string, now?: () => number, source?: PluginSource);
+    invalidate(): void;
+    membership(): Promise<LinkMembership>;
+    /** Convenience: the memberships of one skill (empty when it is in no plugin). */
+    pluginsOf(skillPath: string): Promise<PluginMembership[]>;
+    private build;
+    /** Whether the skill folder's effective readers include the plugin's read principal. */
+    private isGranted;
+}
+/** The default-branch workspace id every link resolution runs against. */
+export declare function linksWorkspaceId(): string;
+//# sourceMappingURL=plugin-links.d.ts.map

package/dist/modules/plugins/plugin-links.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-links.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/plugin-links.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAGlE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAKjE,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kEAAkE;IAClE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mFAAmF;IACnF,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,yFAAyF;IACzF,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzC,6EAA6E;IAC7E,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAE1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IARzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA2B;gBAG9B,gBAAgB,EAAE,gBAAgB,EAClC,YAAY,EAAE,aAAa,EAC3B,aAAa,EAAE,cAAc,EAC7B,SAAS,EAAE,MAAM,EAClC,GAAG,GAAE,MAAM,MAAiB,EACX,MAAM,GAAE,YAAmC;IAK9D,UAAU,IAAI,IAAI;IAIZ,UAAU,IAAI,OAAO,CAAC,cAAc,CAAC;IAgB3C,iFAAiF;IAC3E,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAMjD,KAAK;IAoEnB,wFAAwF;YAC1E,SAAS;CAUxB;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC"}

package/dist/modules/plugins/plugin-links.js

@@ -0,0 +1,160 @@
+import path from 'node:path';
+import { DEFAULT_BRANCH, pluginManifestName, skillUnderRoot } from '@bevel-software/platform-shared';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
+import { TtlCache } from '../../shared/ttl-cache.js';
+import { canonicalRoleName, pluginPrincipalKey } from '../access-model/access-grammar.js';
+import { KbPluginSource } from './discovery/kb-plugin-source.js';
+const CACHE_TTL_MS = 60_000;
+/**
+ * The link index: which shared skills each plugin links, and — the other way
+ * round — which plugins each skill belongs to, whether by sitting inside the
+ * plugin folder or by being linked from its manifest.
+ *
+ * Plugins come from the configured {@link PluginSource} (native manifests, or
+ * a customer dialect); resolution runs against the RELEASED catalog
+ * (`skillService.listSkills()`, unfiltered), never the file system: the
+ * catalog already applies the leaf-folder rule, the `.bevelignore` layers
+ * and the global-name dedup, and a second walk here would be a second
+ * opinion about what a skill is.
+ *
+ * `granted` is the consistency check the amber dot renders: a linked skill
+ * whose own access rules DO grant the plugin's `plugin/<Name>/read`
+ * principal (directly or from a scope above it). The link service writes
+ * that grant with the link; only a hand edit takes it away.
+ *
+ * Cached briefly, dropped by `invalidate()` from the same file-change
+ * subscriber that drops the plugin index, so a link committed on the default
+ * branch shows within one round-trip.
+ */
+export class PluginLinkIndex {
+    workspaceService;
+    skillService;
+    accessControl;
+    kbDirName;
+    source;
+    cache;
+    constructor(workspaceService, skillService, accessControl, kbDirName, now = Date.now, source = new KbPluginSource()) {
+        this.workspaceService = workspaceService;
+        this.skillService = skillService;
+        this.accessControl = accessControl;
+        this.kbDirName = kbDirName;
+        this.source = source;
+        this.cache = new TtlCache(CACHE_TTL_MS, now);
+    }
+    invalidate() {
+        this.cache.invalidate();
+    }
+    async membership() {
+        const cached = this.cache.get();
+        if (cached)
+            return cached;
+        // Token first, like the other catalogs: an `invalidate()` landing while
+        // the build reads the pre-change tree must not be undone by storing that
+        // read afterwards.
+        const token = this.cache.begin();
+        const built = await this.build();
+        // A degraded read (no workspace yet) is served but not stored — the same
+        // reasoning as the plugin index: caching a failure hides every link for
+        // a full TTL after its cause is gone.
+        if (built === null)
+            return { bySkill: new Map(), byPlugin: new Map() };
+        this.cache.set(built, token);
+        return built;
+    }
+    /** Convenience: the memberships of one skill (empty when it is in no plugin). */
+    async pluginsOf(skillPath) {
+        return (await this.membership()).bySkill.get(skillPath) ?? [];
+    }
+    // --- internal --------------------------------------------------------------
+    async build() {
+        let wsId;
+        let kbRoot;
+        try {
+            wsId = (await this.workspaceService.getOrCreateForBranch(DEFAULT_BRANCH)).id;
+            kbRoot = path.join(await this.workspaceService.getWorkspacePath(wsId), this.kbDirName);
+        }
+        catch {
+            return null;
+        }
+        const skills = await this.skillService.listSkills(undefined);
+        const bySkill = new Map();
+        const byPlugin = new Map();
+        const add = (skillPath, m) => {
+            const list = bySkill.get(skillPath) ?? [];
+            if (!list.some((x) => x.name === m.name))
+                list.push(m);
+            bySkill.set(skillPath, list);
+        };
+        const discovered = await this.source.discover(kbRoot);
+        for (const w of discovered.warnings)
+            console.warn(`[plugins] ${w}`);
+        // Inline skills: the ones sitting INSIDE a plugin's folder, matched by
+        // folder prefix (a plugin may sit at any depth, so the second path
+        // segment says nothing). Personal folders are places, not plugins —
+        // their skills belong to nobody's plugin.
+        const ownerOf = (skillPath) => discovered.plugins.find((p) => !p.personal && p.exists && skillPath.startsWith(`${p.folder}/`));
+        for (const s of skills) {
+            const owner = ownerOf(s.path);
+            if (owner)
+                add(s.path, { name: owner.name, linked: false, granted: true });
+        }
+        for (const plugin of discovered.plugins) {
+            // Personal folders are places, not plugins; a manifest without the
+            // access.md that makes a plugin EXIST is a ghost the index and the
+            // compiler omit, so it must not be linkable or hold grants either.
+            if (plugin.personal || !plugin.exists)
+                continue;
+            const roots = plugin.linkedRoots;
+            const linkedSkills = [];
+            const unresolvedRoots = [];
+            for (const root of roots) {
+                const hits = skills.filter((s) => skillUnderRoot(s.path, root)).map((s) => s.path);
+                if (hits.length === 0)
+                    unresolvedRoots.push(root);
+                for (const hit of hits)
+                    if (!linkedSkills.includes(hit))
+                        linkedSkills.push(hit);
+            }
+            byPlugin.set(plugin.name, {
+                name: plugin.name,
+                folder: plugin.folder,
+                roots,
+                linkedSkills,
+                unresolvedRoots,
+                linksAreManaged: plugin.linksAreManaged,
+            });
+            if (linkedSkills.length === 0)
+                continue;
+            const token = pluginPrincipalKey(pluginManifestName(plugin.name), 'read');
+            for (const skillPath of linkedSkills) {
+                // A skill that also sits INSIDE this plugin folder is inline, and its
+                // inline membership already stands.
+                if (skillPath.startsWith(`${plugin.folder}/`))
+                    continue;
+                // An unmanaged (dialect) link is a plain reference: nothing to grant,
+                // nothing to repair — the skill's own scope decides who reads it.
+                const granted = plugin.linksAreManaged ? await this.isGranted(wsId, skillPath, token) : true;
+                add(skillPath, { name: plugin.name, linked: true, granted });
+            }
+        }
+        return { bySkill, byPlugin };
+    }
+    /** Whether the skill folder's effective readers include the plugin's read principal. */
+    async isGranted(wsId, skillPath, token) {
+        try {
+            const readers = await this.accessControl.eligibleReaders(wsId, skillPath);
+            if (!readers.restricted)
+                return true; // readable by everyone — the plugin's members included
+            // The resolver reports display names; compare through the one canonicaliser.
+            return (readers.principals ?? []).some((p) => p.kind === 'plugin' && canonicalRoleName(p.name) === token);
+        }
+        catch {
+            return false; // fail closed: an unreadable tree reports the link as needing repair
+        }
+    }
+}
+/** The default-branch workspace id every link resolution runs against. */
+export function linksWorkspaceId() {
+    return workspaceIdForBranch(DEFAULT_BRANCH);
+}
+//# sourceMappingURL=plugin-links.js.map

package/dist/modules/plugins/plugin-links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-links.js","sourceRoot":"","sources":["../../../src/modules/plugins/plugin-links.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAErG,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAG1F,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEjE,MAAM,YAAY,GAAG,MAAM,CAAC;AAyB5B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,eAAe;IAIP;IACA;IACA;IACA;IAEA;IARF,KAAK,CAA2B;IAEjD,YACmB,gBAAkC,EAClC,YAA2B,EAC3B,aAA6B,EAC7B,SAAiB,EAClC,MAAoB,IAAI,CAAC,GAAG,EACX,SAAuB,IAAI,cAAc,EAAE;QAL3C,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,iBAAY,GAAZ,YAAY,CAAe;QAC3B,kBAAa,GAAb,aAAa,CAAgB;QAC7B,cAAS,GAAT,SAAS,CAAQ;QAEjB,WAAM,GAAN,MAAM,CAAqC;QAE5D,IAAI,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,wEAAwE;QACxE,yEAAyE;QACzE,mBAAmB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,yEAAyE;QACzE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QACvE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,SAAS,CAAC,SAAiB;QAC/B,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;IAED,8EAA8E;IAEtE,KAAK,CAAC,KAAK;QACjB,IAAI,IAAY,CAAC;QACjB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,SAAiB,EAAE,CAAmB,EAAE,EAAE;YACrD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAEpE,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,0CAA0C;QAC1C,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,EAAE,CACpC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAClG,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,KAAK;gBAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACxC,mEAAmE;YACnE,mEAAmE;YACnE,mEAAmE;YACnE,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,SAAS;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;YACjC,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,MAAM,eAAe,GAAa,EAAE,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClD,KAAK,MAAM,GAAG,IAAI,IAAI;oBAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;wBAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClF,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;gBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK;gBACL,YAAY;gBACZ,eAAe;gBACf,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACxC,MAAM,KAAK,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC1E,KAAK,MAAM,SAAS,IAAI,YAAY,EAAE,CAAC;gBACrC,sEAAsE;gBACtE,oCAAoC;gBACpC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,SAAS;gBACxD,sEAAsE;gBACtE,kEAAkE;gBAClE,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC7F,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAED,wFAAwF;IAChF,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,SAAiB,EAAE,KAAa;QACpE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC1E,IAAI,CAAC,OAAO,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC,CAAC,uDAAuD;YAC7F,6EAA6E;YAC7E,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;QAC5G,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,qEAAqE;QACrF,CAAC;IACH,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB;IAC9B,OAAO,oBAAoB,CAAC,cAAc,CAAC,CAAC;AAC9C,CAAC"}

package/dist/modules/plugins/plugin-links.service.d.ts

@@ -0,0 +1,114 @@
+import { type AuthUser } from '@bevel-software/platform-shared';
+import type { WorkspaceService } from '../workspace/workspace.service.js';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import type { ISkillService } from '../skills/skills.contract.js';
+import type { ProvisionCommitDriver } from './plugin-provision.service.js';
+import { type PluginLinkIndex } from './plugin-links.js';
+/** A refusal the route passes through: message + HTTP status + a machine-readable kind. */
+export declare class PluginLinkError extends Error {
+    readonly status: number;
+    readonly payload: Record<string, unknown>;
+    constructor(message: string, status: number, payload?: Record<string, unknown>);
+}
+/**
+ * Linking shared skills into plugins — the writer behind "add an existing
+ * skill to this plugin".
+ *
+ * A link is TWO edits that only make sense together:
+ *
+ *   1. the skill's root goes into the plugin manifest's
+ *      `extensions["software.bevel.hexis"].skills` list (see
+ *      `HEXIS_LINKED_SKILLS_KEY`), which is what the catalog, the plugin page
+ *      and the compiled distribution read;
+ *   2. the skill folder's own `access.md` grants `read` to
+ *      `plugin/<Name>/read` and `write` to `plugin/<Name>/write`, which is
+ *      what lets the plugin's members actually read it — ownership decides,
+ *      the plugin is a view (see `plugin-principals.ts`).
+ *
+ * Which is why linking needs write on BOTH sides: on the plugin folder (to
+ * edit its manifest) and on the skill's root (to edit its access rules). A
+ * manager who lacks the second gets a 409 the UI turns into "request write
+ * access", not a link that silently shares nothing.
+ *
+ * Unlinking removes the manifest entry, and revokes the two tokens only when
+ * the actor may edit the skill's rules — otherwise the grant stays, and the
+ * skill page says so, for a skill editor to remove.
+ *
+ * Repair re-grants the tokens for a link that exists but whose grant was
+ * hand-removed: the amber dot's one action.
+ *
+ * Every operation is serialised on BOTH sides it writes — the plugin's
+ * manifest slug (the same key provisioning locks on) and the skill root whose
+ * access.md carries the grant — and lands as ordinary default-branch commits
+ * through the pending-commit driver, so the write gate and the per-user push
+ * gate apply exactly as they do to any edit.
+ */
+export declare class PluginLinksService {
+    private readonly workspaceService;
+    private readonly commits;
+    private readonly accessControl;
+    private readonly skillService;
+    private readonly links;
+    private readonly kbDirName;
+    private readonly events?;
+    private readonly onChanged?;
+    private readonly locks;
+    private readonly mutation;
+    constructor(workspaceService: WorkspaceService, commits: ProvisionCommitDriver, accessControl: IAccessControl, skillService: ISkillService, links: PluginLinkIndex, kbDirName: string, events?: {
+        emit(event: {
+            kind: "fs-tree-changed";
+            workspaceId: string;
+            branch: string;
+        }): void;
+    } | undefined, onChanged?: (() => void) | undefined);
+    link(user: AuthUser, plugin: string, rawRoot: string): Promise<{
+        root: string;
+        skills: string[];
+    }>;
+    unlink(user: AuthUser, plugin: string, rawRoot: string): Promise<{
+        root: string;
+        revoked: boolean;
+    }>;
+    repair(user: AuthUser, plugin: string, rawRoot: string): Promise<{
+        root: string;
+    }>;
+    /**
+     * ONE reservation for both sides of a link: the plugin's manifest AND the
+     * skill root's access.md. Two plugins linking the same root write the same
+     * file, and serialising on the plugin alone let them interleave, one splice
+     * overwriting the other's grant. `runAll` takes both keys atomically, so
+     * nothing nests and no ordering discipline is needed.
+     */
+    private lockKeys;
+    /**
+     * The two grants a link carries: members read, managers write — written as
+     * the CANONICAL keys (slugged name), the spelling every comparison uses, so
+     * a repeated link finds its grant and an unlink finds what to revoke
+     * whatever the folder is called.
+     */
+    private tokens;
+    private grantTokens;
+    private rootOrThrow;
+    /**
+     * Released skills under the root — the catalog's answer, not the file
+     * system's. A RETIRED skill is kept for its owners and never shared onward:
+     * the grant lands on the ROOT folder, so a root that holds a retired skill
+     * anywhere beneath it cannot be linked at all — the grant would reach the
+     * retired one too. The refusal names them so the manager can link the
+     * active skills individually instead.
+     */
+    private resolvedSkills;
+    /**
+     * The exact on-disk plugin folder for `name`, or 404. Personal folders are
+     * not plugins, but that is the MEMBERSHIP's verdict (discovery marks the
+     * `personal-*` prefix personal only directly under the root), not a rule
+     * on the name — a nested plugin may be called anything.
+     */
+    private pluginFolder;
+    /** The repo-relative folder of a known plugin (any depth). */
+    private folderOf;
+    private requirePluginWrite;
+    private readManifest;
+    private changed;
+}
+//# sourceMappingURL=plugin-links.service.d.ts.map

package/dist/modules/plugins/plugin-links.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-links.service.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/plugin-links.service.ts"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,QAAQ,EACd,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAK5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE3E,2FAA2F;AAC3F,qBAAa,eAAgB,SAAQ,KAAK;IAGtC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFzC,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAKjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,kBAAkB;IAK3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAGxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAb7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;gBAG9B,gBAAgB,EAAE,gBAAgB,EAClC,OAAO,EAAE,qBAAqB,EAC9B,aAAa,EAAE,cAAc,EAC7B,YAAY,EAAE,aAAa,EAC3B,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE;QACxB,IAAI,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,iBAAiB,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;KACrF,YAAA,EACgB,SAAS,CAAC,GAAE,MAAM,IAAI,aAAA;IAKnC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA+ClG,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAgDpG,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IA4BxF;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;IAIhB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;YAQA,WAAW;IASzB,OAAO,CAAC,WAAW;IAQnB;;;;;;;OAOG;YACW,cAAc;IAa5B;;;;;OAKG;YACW,YAAY;IAqB1B,8DAA8D;YAChD,QAAQ;YAMR,kBAAkB;YAOlB,YAAY;IA0C1B,OAAO,CAAC,OAAO;CAMhB"}