@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/access-model/roles-yaml-guard.js

@@ -5,7 +5,7 @@
  * app. The runtime resolver's `loadModel` HARD-THROWS `AccessConfigError` on a
  * parse failure, and `isAdmin` swallows that into `false` for EVERYONE — so a
  * single malformed `roles.yaml` is an app-wide, in-app-unrecoverable admin
- * lockout. The dedicated Roles & Members service already validates every
+ * lockout. The dedicated App roles service already validates every
  * candidate before writing (`assertLoadable`), but the two RAW write paths do
  * not:
  *   - the human editor save  (`PUT /workspace/:id/file`)
@@ -20,7 +20,7 @@
  * The break-glass recovery path (for a file that got broken some OTHER way —
  * a direct git push, a pre-guard commit) lives in `roles-admin.service.ts`.
  */
-import { parseRolesYaml } from './access-grammar.js';
+import { GROUP_REF_PREFIX, canonicalRoleName, parseRolesYaml, parseYamlSubset } from './access-grammar.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
 /** Repo-relative basename of the roles file (it lives at the KB repo root). */
 export const ROLES_YAML_BASENAME = 'roles.yaml';
@@ -68,12 +68,162 @@ export function assertRolesYamlParsable(content) {
  * path is nonsensical and left alone.
  */
 export function makeRolesYamlWriteValidator(kbDirName) {
-    return (path, content) => {
+    const validate = (path, content) => {
         if (typeof content !== 'string')
             return;
         if (!isRolesYamlPath(path, kbDirName))
             return;
         assertRolesYamlParsable(content);
     };
+    validate.appliesTo = (path) => isRolesYamlPath(path, kbDirName);
+    return validate;
+}
+/** What an agent is told to do instead of creating a role. */
+export const NEW_ROLE_GUIDANCE = 'App roles are pre-set — add people to existing roles, and use a GROUP for a task- or team-scoped set of people.';
+/**
+ * An AGENT write whose candidate `roles.yaml` declares a role the current file
+ * does not. Same 422 shape as {@link RolesYamlInvalidError}; the message is
+ * self-contained because a tool error reaches the agent as its message alone,
+ * and the agent relays it to its user.
+ */
+export class RolesYamlNewRoleError extends WorkflowDomainError {
+    roleNames;
+    constructor(roleNames) {
+        const quoted = roleNames.map((n) => `'${n}'`).join(', ');
+        super(`roles.yaml was not saved: agents never create app roles, and ${quoted} ` +
+            `${roleNames.length === 1 ? 'is not an existing role' : 'are not existing roles'}. ${NEW_ROLE_GUIDANCE}`, 422, { kind: 'roles-yaml-new-role', roleNames });
+        this.name = 'RolesYamlNewRoleError';
+        this.roleNames = roleNames;
+    }
+}
+/**
+ * The role names `text` declares, canonical → display spelling. Lenient on
+ * purpose: a current file with a bad email still vouches for its role names.
+ * Text that is absent or not a `roles:` mapping declares none.
+ */
+function declaredRoleNames(text) {
+    const names = new Map();
+    if (text === null)
+        return names;
+    const parsed = parseYamlSubset(text);
+    if (!parsed.ok)
+        return names;
+    const roles = parsed.value?.roles;
+    if (roles == null || typeof roles !== 'object' || Array.isArray(roles))
+        return names;
+    for (const display of Object.keys(roles)) {
+        const canonical = canonicalRoleName(display);
+        if (canonical && !names.has(canonical))
+            names.set(canonical, display.trim());
+    }
+    return names;
+}
+/**
+ * Throw {@link RolesYamlNewRoleError} if `candidate` declares a role name
+ * (compared canonically, so a respelling is not new) absent from `current`.
+ * A rename is a delete plus a create, so it is refused for the created name.
+ */
+export function assertNoNewRoles(current, candidate) {
+    const existing = declaredRoleNames(current);
+    const created = [...declaredRoleNames(candidate)]
+        .filter(([canonical]) => !existing.has(canonical))
+        .map(([, display]) => display);
+    if (created.length > 0)
+        throw new RolesYamlNewRoleError(created);
+}
+/**
+ * An AGENT write whose candidate `roles.yaml` adds a `- group:<Name>` entry
+ * naming no group in the active group source. The resolver ignores such an
+ * entry with only a log warning — the role silently reaches nobody — so it is
+ * refused up front, naming each entry, in the same 422 shape as the others.
+ */
+export class RolesYamlUnknownGroupError extends WorkflowDomainError {
+    entries;
+    constructor(entries, sourceFile) {
+        const listed = entries.map((e) => `'- ${e.entry}' under role '${e.role}'`).join(', ');
+        super(`roles.yaml was not saved: ${listed} ${entries.length === 1 ? 'names a group' : 'name groups'} ` +
+            `that ${sourceFile} does not declare. Group names are matched case- and whitespace-insensitively; ` +
+            'use an existing group, or create the group first.', 422, { kind: 'roles-yaml-unknown-group', entries, sourceFile });
+        this.name = 'RolesYamlUnknownGroupError';
+        this.entries = entries;
+    }
+}
+/** Every `- group:<Name>` entry `text` declares, in file order. Lenient, like {@link declaredRoleNames}. */
+function groupEntries(text) {
+    const out = [];
+    if (text === null)
+        return out;
+    const parsed = parseYamlSubset(text);
+    if (!parsed.ok)
+        return out;
+    const roles = parsed.value?.roles;
+    if (roles == null || typeof roles !== 'object' || Array.isArray(roles))
+        return out;
+    for (const [display, members] of Object.entries(roles)) {
+        if (!Array.isArray(members))
+            continue;
+        for (const member of members) {
+            if (typeof member !== 'string')
+                continue;
+            const entry = member.trim();
+            if (!entry.toLowerCase().startsWith(GROUP_REF_PREFIX))
+                continue;
+            out.push({
+                role: display.trim(),
+                roleCanonical: canonicalRoleName(display),
+                entry,
+                group: canonicalRoleName(entry.slice(GROUP_REF_PREFIX.length)),
+            });
+        }
+    }
+    return out;
+}
+/**
+ * Throw {@link RolesYamlUnknownGroupError} if `candidate` adds a group entry
+ * whose name (compared canonically) the active group source does not declare.
+ * Only ADDED entries are checked: an entry already in `current` whose group
+ * has since been retired is left alone, so it cannot block an unrelated
+ * membership edit.
+ */
+export function assertKnownGroups(current, candidate, active) {
+    if (active === null)
+        return;
+    const key = (e) => `${e.roleCanonical}\n${e.group}`;
+    const existing = new Set(groupEntries(current).map(key));
+    const unknown = groupEntries(candidate)
+        .filter((e) => !existing.has(key(e)) && !active.groups.has(e.group))
+        .map(({ role, entry }) => ({ role, entry }));
+    if (unknown.length > 0)
+        throw new RolesYamlUnknownGroupError(unknown, active.sourceFile);
+}
+/**
+ * The agent's `roles.yaml` gate: everything {@link makeRolesYamlWriteValidator}
+ * refuses, plus any role the current file does not declare and — when
+ * `loadGroups` is given — any added `- group:<Name>` entry naming a group the
+ * active group source does not declare. Agents manage
+ * membership only; the human editor and the App roles service keep the plain
+ * validator. `readCurrent` returns the file's current text, null when absent.
+ * Content of any type is checked — decoded as UTF-8 — so bytes cannot slip past.
+ *
+ * `readCurrent` is read afresh on every call, never cached: `LockingFilesystem`
+ * calls this validator before taking the lock (a cheap early refusal) and again
+ * once the `roles.yaml` lock is held, on the bytes that land. That second call
+ * is the decisive one — it compares against the file as the other roles.yaml
+ * writers, which coordinate on the same lock, left it — so a role deleted while
+ * the write waited cannot be reinstated, and one added meanwhile is not refused.
+ */
+export function makeAgentRolesYamlWriteValidator(kbDirName, readCurrent, loadGroups) {
+    const validate = async (path, content) => {
+        if (!isRolesYamlPath(path, kbDirName))
+            return;
+        const text = typeof content === 'string' ? content : Buffer.from(content).toString('utf-8');
+        assertRolesYamlParsable(text);
+        const current = await readCurrent();
+        assertNoNewRoles(current, text);
+        if (loadGroups)
+            assertKnownGroups(current, text, await loadGroups());
+    };
+    validate.appliesTo = (path) => isRolesYamlPath(path, kbDirName);
+    return validate;
 }
 //# sourceMappingURL=roles-yaml-guard.js.map

package/dist/modules/access-model/roles-yaml-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles-yaml-guard.js","sourceRoot":"","sources":["../../../src/modules/access-model/roles-yaml-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEhD;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,MAAM,CAAW;IAC1B,YAAY,MAAgB;QAC1B,KAAK,CACH,kDAAkD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACrE,GAAG,EACH,EAAE,IAAI,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,EAAE,CACxD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,gBAAwB,EAAE,SAAiB;IACzE,MAAM,IAAI,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAC/C,OAAO,IAAI,KAAK,GAAG,SAAS,IAAI,mBAAmB,EAAE,IAAI,IAAI,KAAK,mBAAmB,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB;IAEjB,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO;QACxC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;YAAE,OAAO;QAC9C,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"roles-yaml-guard.js","sourceRoot":"","sources":["../../../src/modules/access-model/roles-yaml-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3G,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAGpE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEhD;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,MAAM,CAAW;IAC1B,YAAY,MAAgB;QAC1B,KAAK,CACH,kDAAkD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACrE,GAAG,EACH,EAAE,IAAI,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,EAAE,CACxD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,gBAAwB,EAAE,SAAiB;IACzE,MAAM,IAAI,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAC/C,OAAO,IAAI,KAAK,GAAG,SAAS,IAAI,mBAAmB,EAAE,IAAI,IAAI,KAAK,mBAAmB,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB;IAEjB,MAAM,QAAQ,GAAoE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;QAClG,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO;QACxC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;YAAE,OAAO;QAC9C,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC;IACF,QAAQ,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,MAAM,iBAAiB,GAC5B,iHAAiH,CAAC;AAEpH;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,SAAS,CAAW;IAC7B,YAAY,SAAmB;QAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,KAAK,CACH,gEAAgE,MAAM,GAAG;YACvE,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,wBAAwB,KAAK,iBAAiB,EAAE,EAC1G,GAAG,EACH,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAC3C,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAmB;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAI,MAAM,CAAC,KAAwC,EAAE,KAAK,CAAC;IACtE,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAsB,EAAE,SAAiB;IACxE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;SAC9C,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,OAAO,0BAA2B,SAAQ,mBAAmB;IACxD,OAAO,CAAoC;IACpD,YAAY,OAA0C,EAAE,UAAkB;QACxE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,iBAAiB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtF,KAAK,CACH,6BAA6B,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,GAAG;YAC9F,QAAQ,UAAU,iFAAiF;YACnG,mDAAmD,EACrD,GAAG,EACH,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,UAAU,EAAE,CAC1D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,4GAA4G;AAC5G,SAAS,YAAY,CAAC,IAAmB;IACvC,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAC9B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAC3B,MAAM,KAAK,GAAI,MAAM,CAAC,KAAwC,EAAE,KAAK,CAAC;IACtE,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACnF,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,SAAS;YACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;gBAAE,SAAS;YAChE,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;gBACpB,aAAa,EAAE,iBAAiB,CAAC,OAAO,CAAC;gBACzC,KAAK;gBACL,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAsB,EACtB,SAAiB,EACjB,MAAiC;IAEjC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC;SACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAiB,EACjB,WAAyC,EACzC,UAAqD;IAErD,MAAM,QAAQ,GAAmB,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QACvD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;YAAE,OAAO;QAC9C,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5F,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;QACpC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,UAAU;YAAE,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC;IACF,QAAQ,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChE,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/modules/admin/admin-access.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-access.service.d.ts","sourceRoot":"","sources":["../../../src/modules/admin/admin-access.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAE1D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAXjB,aAAa,EAAE,cAAc,EAC7B,gBAAgB,EAAE,gBAAgB;IACnD,mFAAmF;IAClE,MAAM,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC;IAChD;;;;;;OAMG;IACc,iBAAiB,GAAE,MAAM,EAAO;IAG7C,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;CAkB3D"}
+{"version":3,"file":"admin-access.service.d.ts","sourceRoot":"","sources":["../../../src/modules/admin/admin-access.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAI5E,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAG1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAE1D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAXjB,aAAa,EAAE,cAAc,EAC7B,gBAAgB,EAAE,gBAAgB;IACnD,mFAAmF;IAClE,MAAM,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC;IAChD;;;;;;OAMG;IACc,iBAAiB,GAAE,MAAM,EAAO;IAG7C,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;CAkB3D"}

package/dist/modules/admin/admin-access.service.js

@@ -1,4 +1,7 @@
+import { logger } from '../../shared/logging.js';
+const log = logger('admin');
 import { workspaceIdForBranch } from '../../shared/workspace-id.js';
+import { canonicalEmail } from '../../shared/email-identity.js';
 /**
  * Admin = holder of the `Admin` role in `roles.yaml`. We resolve it through the
  * access model exactly as the rest of the app does — `canWrite('roles.yaml')` is
@@ -33,7 +36,7 @@ export class AdminAccessService {
     async isAdmin(email) {
         if (!email)
             return false;
-        const normalized = email.trim().toLowerCase();
+        const normalized = canonicalEmail(email);
         if (this.alwaysAdminEmails.includes(normalized))
             return true;
         try {
@@ -47,7 +50,7 @@ export class AdminAccessService {
         catch (err) {
             // Log so an admin lockout caused by a clone / roles.yaml failure is
             // diagnosable rather than a silent denial.
-            console.warn('[admin] isAdmin resolution failed:', err instanceof Error ? err.message : String(err));
+            log.warn('isAdmin resolution failed:', { err });
             return false;
         }
     }

package/dist/modules/admin/admin-access.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-access.service.js","sourceRoot":"","sources":["../../../src/modules/admin/admin-access.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGpE;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IAEV;IACA;IAEA;IAQA;IAZnB,YACmB,aAA6B,EAC7B,gBAAkC;IACnD,mFAAmF;IAClE,MAA+B;IAChD;;;;;;OAMG;IACc,oBAA8B,EAAE;QAXhC,kBAAa,GAAb,aAAa,CAAgB;QAC7B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAElC,WAAM,GAAN,MAAM,CAAyB;QAQ/B,sBAAiB,GAAjB,iBAAiB,CAAe;IAChD,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAyB;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,CAAC;YACH,qEAAqE;YACrE,gEAAgE;YAChE,uEAAuE;YACvE,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/E,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACzD,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,2CAA2C;YAC3C,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACrG,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"admin-access.service.js","sourceRoot":"","sources":["../../../src/modules/admin/admin-access.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAE5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAGhE;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IAEV;IACA;IAEA;IAQA;IAZnB,YACmB,aAA6B,EAC7B,gBAAkC;IACnD,mFAAmF;IAClE,MAA+B;IAChD;;;;;;OAMG;IACc,oBAA8B,EAAE;QAXhC,kBAAa,GAAb,aAAa,CAAgB;QAC7B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAElC,WAAM,GAAN,MAAM,CAAyB;QAQ/B,sBAAiB,GAAjB,iBAAiB,CAAe;IAChD,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAyB;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,CAAC;YACH,qEAAqE;YACrE,gEAAgE;YAChE,uEAAuE;YACvE,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/E,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACzD,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,2CAA2C;YAC3C,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/modules/agent-instructions/agent-instructions.routes.d.ts

@@ -0,0 +1,21 @@
+import express, { type RequestHandler } from 'express';
+import type { AgentPreambleReader } from './read-preamble.js';
+/**
+ * The agent-facing instructions route, mounted on the tools router beside
+ * `GET /agent/all-tools` and behind the same `manualAuth` (a connection key,
+ * an internal token or a browser JWT):
+ *
+ *   GET /agent/instructions   the composed text both channels are built from,
+ *                             as the composer returns it. The local `hexis-mcp`
+ *                             bridge reads it at startup; the External agent
+ *                             access card reads it to show what agents get.
+ *
+ * The hosted proxy does NOT call this: it composes in-process while building
+ * each request's server (see `McpService.createRequestServer`).
+ * `Cache-Control: no-store`
+ * because the text is privileged: it is read with platform rights and may
+ * name folders the caller cannot open. A reader throw is a 500, never an
+ * empty preamble, so the caller's own fallback decides what to send.
+ */
+export declare function createAgentInstructionsRoutes(manualAuth: RequestHandler, readPreamble: AgentPreambleReader): express.Router;
+//# sourceMappingURL=agent-instructions.routes.d.ts.map

package/dist/modules/agent-instructions/agent-instructions.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-instructions.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/agent-instructions/agent-instructions.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAKvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAgB3H"}

package/dist/modules/agent-instructions/agent-instructions.routes.js

@@ -0,0 +1,38 @@
+import express from 'express';
+import { logger } from '../../shared/logging.js';
+const log = logger('agent-instructions');
+import { composeAgentInstructions } from './compose.js';
+/**
+ * The agent-facing instructions route, mounted on the tools router beside
+ * `GET /agent/all-tools` and behind the same `manualAuth` (a connection key,
+ * an internal token or a browser JWT):
+ *
+ *   GET /agent/instructions   the composed text both channels are built from,
+ *                             as the composer returns it. The local `hexis-mcp`
+ *                             bridge reads it at startup; the External agent
+ *                             access card reads it to show what agents get.
+ *
+ * The hosted proxy does NOT call this: it composes in-process while building
+ * each request's server (see `McpService.createRequestServer`).
+ * `Cache-Control: no-store`
+ * because the text is privileged: it is read with platform rights and may
+ * name folders the caller cannot open. A reader throw is a 500, never an
+ * empty preamble, so the caller's own fallback decides what to send.
+ */
+export function createAgentInstructionsRoutes(manualAuth, readPreamble) {
+    const router = express.Router();
+    router.get('/agent/instructions', manualAuth, async (_req, res) => {
+        // Set before the read, so a failure answer is no more cacheable than a
+        // successful one: the contract is on the route, not on the happy path.
+        res.setHeader('Cache-Control', 'no-store');
+        try {
+            res.json(composeAgentInstructions(await readPreamble()));
+        }
+        catch (err) {
+            log.error('reading mcp-description.md failed:', { err });
+            res.status(500).json({ error: 'Failed to read the agent instructions' });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=agent-instructions.routes.js.map

package/dist/modules/agent-instructions/agent-instructions.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-instructions.routes.js","sourceRoot":"","sources":["../../../src/modules/agent-instructions/agent-instructions.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAgC,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAGxD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAA0B,EAAE,YAAiC;IACzG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAChE,uEAAuE;QACvE,uEAAuE;QACvE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/agent-instructions/compose.d.ts

@@ -0,0 +1,71 @@
+/**
+ * What a connected agent is told at the start of an MCP session, composed
+ * from two layers: a platform header the code owns, and the deployment
+ * preamble an admin writes in `mcp-description.md` at the repository root.
+ *
+ * Two channels carry the result. The full text goes out as `instructions` on
+ * the initialize handshake, which Claude Code, Claude Desktop and Cursor place
+ * in the model's system prompt. claude.ai on the web, the Agent SDK and Cline
+ * drop that field, so a short prefix is also prepended to the descriptions of
+ * the four knowledge-base tools (the one pre-call channel every client shows
+ * the model). Both are capped, because both land in every conversation.
+ *
+ * Pure: no IO, no clock. The reader beside it (`read-preamble.ts`) does the
+ * file access; the hosted proxy, the agent-facing route and the local bridge
+ * all read this one composer's output.
+ */
+import { PREAMBLE_CAP, PREAMBLE_FILE, TOOL_PREFIX_CAP } from '@bevel-software/platform-shared';
+export { PREAMBLE_CAP, PREAMBLE_FILE, TOOL_PREFIX_CAP };
+/** The tools whose descriptions carry the prefix. Every other tool is untouched. */
+export declare const PREFIXED_TOOLS: ReadonlySet<string>;
+/**
+ * The platform header, owned by the code. What Hexis is, that its content is
+ * not in the model's training data, the order in which to search it, and that
+ * skills are reachable as prompts and through the two skill tools.
+ */
+export declare const PLATFORM_HEADER: string;
+/**
+ * The fixed first line of the tool prefix. It always leads, so an admin's
+ * first edit never removes the instruction from the clients that only see
+ * tool descriptions, and a preamble that opens with a heading still yields a
+ * sensible purpose line.
+ */
+export declare const TOOL_PREFIX_LINE = "This organisation's knowledge base. Search it before answering from memory.";
+/** The one-line marker that replaces everything past the preamble cap. */
+export declare const PREAMBLE_TRUNCATION_MARKER: string;
+export interface ComposedAgentInstructions {
+    /** The header, then the preamble body when there is one. Sent on the initialize handshake. */
+    instructions: string;
+    /** The platform header alone, so a card can show the fixed part apart from the admin's. */
+    header: string;
+    /** The preamble body as sent (cut and marked when over the cap); empty when there is none. */
+    preamble: string;
+    /** The fixed first line of the prefix, so a card can show which part of it the admin owns. */
+    toolPrefixLine: string;
+    /** The fixed line, then the preamble's first non-heading paragraph. Prepended to the four tools' descriptions. */
+    toolPrefix: string;
+    /** The preamble exceeded {@link PREAMBLE_CAP} and was cut, marker appended. */
+    truncated: boolean;
+    /** Length of the stripped preamble BEFORE the cut, so a card can show `N / 6,000`. */
+    preambleChars: number;
+    /** The prefix exceeded {@link TOOL_PREFIX_CAP} and was cut. */
+    toolPrefixTruncated: boolean;
+    /** Length of the prefix BEFORE the cut, so a card can show `N / 300`. */
+    toolPrefixChars: number;
+    /** The file has a `<!--` with no `-->`: everything from it to the end was withheld. */
+    unterminatedComment: boolean;
+}
+/**
+ * Compose the two texts from the raw file content (`null` when the file is
+ * absent). HTML comments are private notes and never leave the file; an
+ * unterminated `<!--` strips everything after it, so the most likely editing
+ * slip withholds text rather than leaking it.
+ */
+export declare function composeAgentInstructions(preamble: string | null): ComposedAgentInstructions;
+/**
+ * A tool description with the prefix ahead of it: the prefix, a blank line,
+ * then the original. Purpose line first, because claude.ai cuts descriptions
+ * near 500 characters.
+ */
+export declare function prefixToolDescription(toolPrefix: string, description: string | undefined): string;
+//# sourceMappingURL=compose.d.ts.map

package/dist/modules/agent-instructions/compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../../src/modules/agent-instructions/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,eAAe,EAEhB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AAExD,oFAAoF;AACpF,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAAiE,CAAC;AAEjH;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAMkD,CAAC;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,gFAAgF,CAAC;AAE9G,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,QAAyG,CAAC;AAEjJ,MAAM,WAAW,yBAAyB;IACxC,8FAA8F;IAC9F,YAAY,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,cAAc,EAAE,MAAM,CAAC;IACvB,kHAAkH;IAClH,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,SAAS,EAAE,OAAO,CAAC;IACnB,sFAAsF;IACtF,aAAa,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,mBAAmB,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAC;IACxB,uFAAuF;IACvF,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,yBAAyB,CA8B3F;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAEjG"}

package/dist/modules/agent-instructions/compose.js

@@ -0,0 +1,234 @@
+/**
+ * What a connected agent is told at the start of an MCP session, composed
+ * from two layers: a platform header the code owns, and the deployment
+ * preamble an admin writes in `mcp-description.md` at the repository root.
+ *
+ * Two channels carry the result. The full text goes out as `instructions` on
+ * the initialize handshake, which Claude Code, Claude Desktop and Cursor place
+ * in the model's system prompt. claude.ai on the web, the Agent SDK and Cline
+ * drop that field, so a short prefix is also prepended to the descriptions of
+ * the four knowledge-base tools (the one pre-call channel every client shows
+ * the model). Both are capped, because both land in every conversation.
+ *
+ * Pure: no IO, no clock. The reader beside it (`read-preamble.ts`) does the
+ * file access; the hosted proxy, the agent-facing route and the local bridge
+ * all read this one composer's output.
+ */
+// The file, the caps and the comment rule are shared with the frontend
+// editor: it shows what these strip and writes back what they allow, so a
+// hand-mirrored copy would let the admin's view and the agent's text drift
+// apart. Re-exported here because this module is where the backend reads them
+// from.
+import { PREAMBLE_CAP, PREAMBLE_FILE, TOOL_PREFIX_CAP, stripHtmlComments, } from '@bevel-software/platform-shared';
+export { PREAMBLE_CAP, PREAMBLE_FILE, TOOL_PREFIX_CAP };
+/** The tools whose descriptions carry the prefix. Every other tool is untouched. */
+export const PREFIXED_TOOLS = new Set(['start_session', 'grep', 'list_files', 'read_file']);
+/**
+ * The platform header, owned by the code. What Hexis is, that its content is
+ * not in the model's training data, the order in which to search it, and that
+ * skills are reachable as prompts and through the two skill tools.
+ */
+export const PLATFORM_HEADER = "Hexis is this organisation's knowledge base, together with the skills and tools its teams have approved. " +
+    'Its content is specific to the organisation and is not in your training data. ' +
+    'Before answering a question about the organisation, its people, customers, products, processes, projects or internal terms, ' +
+    'search the knowledge base: call `start_session` once, then `grep` for the key terms, `list_files` to orient, and `read_file` what matches. ' +
+    'Prefer what you find there over memory or the web, and say so when the knowledge base is silent on something the organisation should have documented. ' +
+    'Skills are available as prompts and through `list_skills` and `get_skill`.';
+/**
+ * The fixed first line of the tool prefix. It always leads, so an admin's
+ * first edit never removes the instruction from the clients that only see
+ * tool descriptions, and a preamble that opens with a heading still yields a
+ * sensible purpose line.
+ */
+export const TOOL_PREFIX_LINE = "This organisation's knowledge base. Search it before answering from memory.";
+/** The one-line marker that replaces everything past the preamble cap. */
+export const PREAMBLE_TRUNCATION_MARKER = `[preamble truncated at ${PREAMBLE_CAP.toLocaleString('en-US')} characters; shorten ${PREAMBLE_FILE}]`;
+/**
+ * Compose the two texts from the raw file content (`null` when the file is
+ * absent). HTML comments are private notes and never leave the file; an
+ * unterminated `<!--` strips everything after it, so the most likely editing
+ * slip withholds text rather than leaking it.
+ */
+export function composeAgentInstructions(preamble) {
+    const { text, unterminated } = stripHtmlComments(preamble ?? '');
+    const normalized = text.replace(/\r\n?/g, '\n');
+    const stripped = normalized.trim();
+    const preambleChars = stripped.length;
+    const truncated = preambleChars > PREAMBLE_CAP;
+    const body = truncated ? `${cutAtCodePoint(stripped, PREAMBLE_CAP)}\n${PREAMBLE_TRUNCATION_MARKER}` : stripped;
+    const instructions = body ? `${PLATFORM_HEADER}\n\n${body}` : PLATFORM_HEADER;
+    // Classified UNTRIMMED: the leading indentation of a first line is what
+    // makes it an indented code block, and the trim above would turn that
+    // code into prose. The paragraph itself comes back trimmed.
+    const paragraph = firstNonHeadingParagraph(normalized);
+    const fullPrefix = paragraph ? `${TOOL_PREFIX_LINE} ${paragraph}` : TOOL_PREFIX_LINE;
+    const toolPrefixChars = fullPrefix.length;
+    const toolPrefixTruncated = toolPrefixChars > TOOL_PREFIX_CAP;
+    const toolPrefix = toolPrefixTruncated ? cutAtCodePoint(fullPrefix, TOOL_PREFIX_CAP) : fullPrefix;
+    return {
+        instructions,
+        header: PLATFORM_HEADER,
+        preamble: body,
+        toolPrefix,
+        toolPrefixLine: TOOL_PREFIX_LINE,
+        truncated,
+        preambleChars,
+        toolPrefixTruncated,
+        toolPrefixChars,
+        unterminatedComment: unterminated,
+    };
+}
+/**
+ * A tool description with the prefix ahead of it: the prefix, a blank line,
+ * then the original. Purpose line first, because claude.ai cuts descriptions
+ * near 500 characters.
+ */
+export function prefixToolDescription(toolPrefix, description) {
+    return description ? `${toolPrefix}\n\n${description}` : toolPrefix;
+}
+/** An ATX heading line: `#` to `######`, then a space or the end. */
+const ATX_HEADING = /^#{1,6}(\s|$)/;
+/** The underline of a setext heading: a run of `=` or `-` on its own line. */
+const SETEXT_UNDERLINE = /^(=+|-+)$/;
+/** A thematic break: three or more `-`, `*` or `_`, optionally spaced. */
+const THEMATIC_BREAK = /^([-*_])(\s*\1){2,}$/;
+/** The opener of a fenced code block: three or more backticks or tildes, then an optional info string. */
+const CODE_FENCE = /^(`{3,}|~{3,})/;
+/** A list item or a blockquote line: a setext underline cannot be a lazy continuation of either. */
+const LIST_ITEM_OR_QUOTE = /^([-*+]|\d{1,9}[.)])(\s|$)|^>/;
+/**
+ * The first paragraph that is not a markdown heading, collapsed to one line.
+ * Blocks are separated by blank lines and by code, fenced or indented; code
+ * is never a paragraph, so a fence and everything inside it (blank lines
+ * and rules included) are skipped, a fence that never closes runs to the
+ * end of the text, and an indented block is skipped line by line — all as
+ * in CommonMark (see `paragraphBlocks`). Inside a block, ATX heading lines and
+ * rules (a thematic break, or a bare `===` or `---` line) are never content,
+ * and a setext heading (paragraph text with a `===` or `---` underline
+ * directly beneath it) is dropped together with its underline, so
+ * `Title\n===\nText` and `## Title\nText` both yield `Text`. A rule beneath
+ * a list item or a blockquote, or beneath the lines that continue one, is
+ * not an underline (it cannot lazily continue either), so `- Item\n---`
+ * keeps the item and drops the rule. Empty when the text has no such
+ * paragraph (absent, empty, code-only or heading-only preamble).
+ */
+function firstNonHeadingParagraph(text) {
+    for (const block of paragraphBlocks(text)) {
+        const kinds = block.map((l) => l.kind);
+        // A list item or blockquote owns every line beneath it until the block
+        // ends (a lazy continuation is trimmed to look like paragraph text), so
+        // once one opens, no rule further down the block is an underline.
+        let container = false;
+        let underline = -1;
+        kinds.forEach((kind, i) => {
+            if (kind === 'container')
+                container = true;
+            else if (kind === 'rule' && i > 0 && !container && kinds[i - 1] === 'text' && SETEXT_UNDERLINE.test(block[i].text))
+                underline = i;
+        });
+        const content = block.filter((l, i) => i > underline && (l.kind === 'text' || l.kind === 'container'));
+        if (content.length > 0)
+            return content.map((l) => l.text).join(' ').replace(/\s+/g, ' ');
+    }
+    return '';
+}
+/**
+ * What a line is on its own, in CommonMark's order of precedence: a rule is
+ * tested before a list item because `- - -` and `* * *` are breaks, not
+ * items. Whether a rule underlines the text above it depends on its
+ * neighbours and is decided by the caller.
+ */
+function lineKind(line) {
+    if (ATX_HEADING.test(line))
+        return 'heading';
+    if (THEMATIC_BREAK.test(line) || SETEXT_UNDERLINE.test(line))
+        return 'rule';
+    if (LIST_ITEM_OR_QUOTE.test(line))
+        return 'container';
+    return 'text';
+}
+/**
+ * The text's blocks outside code, each a list of trimmed non-blank lines.
+ *
+ * Indentation decides what is code, as in CommonMark: a fence opens or
+ * closes only when indented at most three columns, and a line indented
+ * four or more where no paragraph is open — at the start of a block, or
+ * right after a heading or a rule, which end whatever came before them —
+ * is an indented code block: literal text, so a ``` in it is content, not
+ * a fence that would swallow the rest of the file. Under paragraph text
+ * (a list item or blockquote included) the same indentation is a
+ * continuation, since indented code cannot interrupt a paragraph — and a
+ * continuation is paragraph TEXT whatever it says once trimmed: `    # x`
+ * under a line of prose is not a heading and `    ---` is not a rule, so
+ * each line's kind is decided here, with its indentation in hand, and
+ * carried with it.
+ */
+function paragraphBlocks(text) {
+    const blocks = [];
+    let block = [];
+    let fence = null; // the opener of the fenced code block being skipped
+    const flush = () => {
+        if (block.length > 0)
+            blocks.push(block);
+        block = [];
+    };
+    const paragraphOpen = () => {
+        const last = block[block.length - 1];
+        return last !== undefined && (last.kind === 'text' || last.kind === 'container');
+    };
+    for (const raw of text.split('\n')) {
+        const line = raw.trim();
+        const indent = indentColumns(raw);
+        if (fence !== null) {
+            // The closer: the opener's character only, at least as many of it, nothing else.
+            if (indent <= 3 && line.startsWith(fence) && /^(`+|~+)$/.test(line))
+                fence = null;
+            continue;
+        }
+        const opener = indent <= 3 ? CODE_FENCE.exec(line) : null;
+        if (opener) {
+            flush();
+            fence = opener[1];
+        }
+        else if (line.length === 0) {
+            flush();
+        }
+        else if (indent >= 4) {
+            // Indented code, skipped line by line (blank lines between flush
+            // nothing) — or, under an open paragraph, a continuation of it.
+            if (paragraphOpen())
+                block.push({ text: line, kind: 'text' });
+        }
+        else {
+            block.push({ text: line, kind: lineKind(line) });
+        }
+    }
+    flush();
+    return blocks;
+}
+/** Leading indentation in columns, a tab reaching the next multiple of four. */
+function indentColumns(raw) {
+    let columns = 0;
+    for (const ch of raw) {
+        if (ch === ' ')
+            columns += 1;
+        else if (ch === '\t')
+            columns += 4 - (columns % 4);
+        else
+            break;
+    }
+    return columns;
+}
+/**
+ * `text` cut to at most `max` UTF-16 units, never inside a surrogate pair: a
+ * high surrogate at the cut moves the cut before it, so no broken character
+ * is ever sent and the count in the card matches what the server sends.
+ */
+function cutAtCodePoint(text, max) {
+    if (text.length <= max)
+        return text;
+    const last = text.charCodeAt(max - 1);
+    const end = last >= 0xd800 && last <= 0xdbff ? max - 1 : max;
+    return text.slice(0, end);
+}
+//# sourceMappingURL=compose.js.map

package/dist/modules/agent-instructions/compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../../src/modules/agent-instructions/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,uEAAuE;AACvE,0EAA0E;AAC1E,2EAA2E;AAC3E,8EAA8E;AAC9E,QAAQ;AACR,OAAO,EACL,YAAY,EACZ,aAAa,EACb,eAAe,EACf,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AAExD,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjH;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,2GAA2G;IAC3G,gFAAgF;IAChF,8HAA8H;IAC9H,6IAA6I;IAC7I,wJAAwJ;IACxJ,4EAA4E,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,6EAA6E,CAAC;AAE9G,0EAA0E;AAC1E,MAAM,CAAC,MAAM,0BAA0B,GAAG,0BAA0B,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,wBAAwB,aAAa,GAAG,CAAC;AAyBjJ;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAuB;IAC9D,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC;IACtC,MAAM,SAAS,GAAG,aAAa,GAAG,YAAY,CAAC;IAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,QAAQ,EAAE,YAAY,CAAC,KAAK,0BAA0B,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/G,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAE9E,wEAAwE;IACxE,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,gBAAgB,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACrF,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC;IAC1C,MAAM,mBAAmB,GAAG,eAAe,GAAG,eAAe,CAAC;IAC9D,MAAM,UAAU,GAAG,mBAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAElG,OAAO;QACL,YAAY;QACZ,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,IAAI;QACd,UAAU;QACV,cAAc,EAAE,gBAAgB;QAChC,SAAS;QACT,aAAa;QACb,mBAAmB;QACnB,eAAe;QACf,mBAAmB,EAAE,YAAY;KAClC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,WAA+B;IACvF,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,UAAU,OAAO,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AACtE,CAAC;AAED,qEAAqE;AACrE,MAAM,WAAW,GAAG,eAAe,CAAC;AACpC,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,WAAW,CAAC;AACrC,0EAA0E;AAC1E,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAC9C,0GAA0G;AAC1G,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,oGAAoG;AACpG,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAE3D;;;;;;;;;;;;;;;GAeG;AACH,SAAS,wBAAwB,CAAC,IAAY;IAC5C,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvC,uEAAuE;QACvE,wEAAwE;QACxE,kEAAkE;QAClE,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;QACnB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YACxB,IAAI,IAAI,KAAK,WAAW;gBAAE,SAAS,GAAG,IAAI,CAAC;iBACtC,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAChH,SAAS,GAAG,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC;QACvG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAUD;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5E,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,IAAI,KAAK,GAAgB,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAkB,IAAI,CAAC,CAAC,oDAAoD;IACrF,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,KAAK,GAAG,EAAE,CAAC;IACb,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,GAAG,EAAE;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IACnF,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,iFAAiF;YACjF,IAAI,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,GAAG,IAAI,CAAC;YAClF,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,EAAE,CAAC;YACR,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YACvB,iEAAiE;YACjE,gEAAgE;YAChE,IAAI,aAAa,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC;aACxB,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;;YAC9C,MAAM;IACb,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,GAAW;IAC/C,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC"}

package/dist/modules/agent-instructions/index.d.ts

@@ -0,0 +1,4 @@
+export { composeAgentInstructions, prefixToolDescription, PLATFORM_HEADER, TOOL_PREFIX_LINE, PREAMBLE_CAP, TOOL_PREFIX_CAP, PREAMBLE_FILE, PREFIXED_TOOLS, PREAMBLE_TRUNCATION_MARKER, type ComposedAgentInstructions, } from './compose.js';
+export { readAgentPreamble, type AgentPreambleReader, type PreambleWorkspace } from './read-preamble.js';
+export { createAgentInstructionsRoutes } from './agent-instructions.routes.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/agent-instructions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/agent-instructions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,cAAc,EACd,0BAA0B,EAC1B,KAAK,yBAAyB,GAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC"}