@bevel-software/platform-core-backend 0.15.1 → 0.19.0

package/dist/core/create-core-server.js

@@ -1,8 +1,14 @@
 import express from 'express';
+import { logger } from '../shared/logging.js';
+const startupLog = logger('kb-startup');
+const crLog = logger('cr');
 import cors from 'cors';
 import path from 'node:path';
 import { createAuthRoutes } from '../modules/auth/auth.routes.js';
 import { createWorkspaceRoutes } from '../modules/workspace/workspace.routes.js';
+import { createGitInternalsRouteGuard } from '../modules/workspace/git-internals.middleware.js';
+import { noteBesideCheckout } from '../modules/workspace/startup/beside-checkout.js';
+import { printable } from '../shared/printable.js';
 import { createDiffRoutes } from '../modules/diff/diff.routes.js';
 import { createWorkflowRoutes } from '../modules/workflow/workflow.routes.js';
 import { createEventsRoutes } from '../modules/workflow/events.routes.js';
@@ -11,24 +17,33 @@ import { createMcpRoutes } from '../modules/mcp/mcp.routes.js';
 import { createOAuthConsentRoutes } from '../modules/mcp/oauth/oauth-consent.routes.js';
 import { mcpAuthRouter } from '@modelcontextprotocol/sdk/server/auth/router.js';
 import { createManualRoutes } from '../modules/tool-registry/manual.routes.js';
+import { createCatalogRevisionRoutes } from './catalog-revision.js';
 import { createToolManualsAgentRoutes, createToolManualsBrowserRoutes, registerToolManualsTools, } from '../modules/tool-manuals/index.js';
 import { registerWorkflowTools } from '../modules/workflow/agent-tools/workflow.tools.js';
 import { registerWorkspaceTools } from '../modules/workspace/workspace.tools.js';
 import { RECOVERY_BOT_EMAIL } from '../modules/workflow/recovery-bot.js';
-import { registerSkillsTools, createSkillsRoutes, createSkillAccessRequestRoutes } from '../modules/skills/index.js';
-import { createPluginsRoutes } from '../modules/plugins/index.js';
+import { registerSkillsTools, createSkillsRoutes, createSkillAccessRequestRoutes, AllowedToolsChecker, } from '../modules/skills/index.js';
+import { createPluginCreationRoutes, createPluginsRoutes, createTeamsRoutes, registerPluginsTools, } from '../modules/plugins/index.js';
+import { keyOrSessionAuth } from '../modules/tool-auth/key-or-session.middleware.js';
 import { createSecretsVaultRoutes, createSecretsVaultPublicRoutes, } from '../modules/secrets-vault/index.js';
 import { createDeclaredVariableRoutes } from '../modules/declared-variables/index.js';
 import { createAdminAccessRoutes } from '../modules/admin/admin-access.routes.js';
 import { createGroupsAdminRoutes } from '../modules/access/groups-admin.routes.js';
 import { createUpdateCheckRoutes } from '../modules/update-check/update-check.routes.js';
 import { createAccountRoutes } from '../modules/auth/account.routes.js';
+import { createConnectionKeysAdminRoutes } from '../modules/tool-auth/connection-keys-admin.routes.js';
 import { createSetupRoutes } from '../modules/settings/setup.routes.js';
+import { oidcRedirectUri } from '../modules/auth/oidc-auth-provider.js';
+import { repositoryConnectionCheck } from '../modules/settings/connection-check.js';
+import { rootFolderListerFor } from '../modules/settings/git-root-folders.js';
 import { createKbSyncRoutes, isSyncRawBodyPath, SYNC_RESPONSE_HEADER, } from '../modules/kb-sync/kb-sync.routes.js';
 import { createMarketplaceGitRoutes } from '../modules/marketplace/index.js';
 import { createGitHubFacadeAdminRoutes, createGitHubFacadeRoutes, } from '../modules/marketplace/github-facade/index.js';
-import { DEFAULT_BRANCH, PROTECTED_BRANCHES, currentKbLayout } from '@bevel-software/platform-shared';
 import { GIT_SHA } from '../version.js';
+import { publicConfig } from './public-config.js';
+import { createReadiness } from './readiness.js';
+import { KbRemoteUnreachableError } from '../modules/workspace/startup/kb-startup-runner.js';
+import { createAgentInstructionsRoutes } from '../modules/agent-instructions/index.js';
 export async function createCoreServer(core, ext = {}, opts = {}) {
     const app = express();
     // Honor forwarded client addresses ONLY when the deployment declares its
@@ -50,12 +65,9 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     // page still can't read events on the user's behalf.
     //
     // `exposedHeaders` lets a BROWSER-based MCP client (e.g. MCP Inspector) read
-    // the Streamable-HTTP session header off the `initialize` response — custom
-    // response headers are hidden from browser JS unless exposed, so without this
-    // the client can't send `Mcp-Session-Id` back at all, and every follow-up
-    // 400s with "Bad Request: Mcp-Session-Id header is required" — the
-    // missing-header case, not the unknown-session one (that answers 404
-    // "Session not found"). `WWW-Authenticate` is
+    // custom response headers, which are hidden from browser JS unless exposed.
+    // The MCP endpoint is stateless and never sends `Mcp-Session-Id`, so only
+    // `Mcp-Protocol-Version` is exposed for it. `WWW-Authenticate` is
     // exposed so a browser client can read the 401 challenge and start the OAuth
     // discovery flow. (Native clients like Claude Code aren't subject to CORS.)
     app.use(cors({
@@ -63,7 +75,7 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
         credentials: true,
         // `SYNC_RESPONSE_HEADER` is how the browser tells the sync endpoint's
         // own 503 from a reverse proxy's — see `kb-sync.routes.ts`.
-        exposedHeaders: ['Mcp-Session-Id', 'Mcp-Protocol-Version', 'WWW-Authenticate', SYNC_RESPONSE_HEADER],
+        exposedHeaders: ['Mcp-Protocol-Version', 'WWW-Authenticate', SYNC_RESPONSE_HEADER],
     }));
     // Global JSON body parser. Some overlay routes carry a whole document dump
     // (e.g. the onboarding import), so their routers install their own larger
@@ -76,6 +88,14 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     // which a parsed-and-reserialised body cannot reproduce.
     const jsonExemptPaths = new Set(ext.jsonParserExemptPaths ?? []);
     const globalJson = express.json({ limit: '10mb' });
+    // The git folder is refused BEFORE the body parser: a request naming it in
+    // the query with a malformed body would otherwise be answered 400 by the
+    // parser, and the promise is one sanitized 403 for such a path whatever else
+    // is wrong with the request. Only the query can be judged this early — a
+    // body that does not parse names nothing anyone can read — so the same guard
+    // is mounted again below, once the body is parsed and once the caller is
+    // known (see the two mounts under `/api/workspace/:id`).
+    app.use('/api/workspace/:id', createGitInternalsRouteGuard(core.workspaceService));
     app.use((req, res, next) => {
         if (jsonExemptPaths.has(req.path) || isSyncRawBodyPath(req.path))
             return next();
@@ -87,6 +107,30 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     app.get('/api/health', (_req, res) => {
         res.json({ status: 'ok', sha: GIT_SHA, timestamp: Date.now() });
     });
+    // Readiness: the facts `/api/health` never carried — is the database
+    // reachable, is the commit queue draining and how far behind is it, did the
+    // last attempt to reach the git remote succeed, how much disk is left.
+    // Computed per request, never stored; 503 only when the database is gone,
+    // because a restart cures none of the other conditions and costs every
+    // in-flight request. See `core/readiness.ts`.
+    const readiness = createReadiness({
+        db: core.db,
+        oldestQueuedAt: () => core.pendingCommitsService.oldestQueuedAt(),
+        drains: () => core.commitWorker.held,
+        // Whichever of the two layers reached the remote most recently: the
+        // workspace layer's fetches once the deployment is open, the startup
+        // phase's `ls-remote` at boot — which on a gated deployment is the only
+        // contact there is, and the one that says why it is gated.
+        lastRemoteContact: () => {
+            const contacts = [core.gitService.lastRemoteContact(), core.kbStartupRunner.lastRemoteContact()];
+            return contacts.reduce((latest, c) => (c !== null && (latest === null || c.at > latest.at) ? c : latest), null);
+        },
+        freeBytes: () => core.disk.freeBytes(core.config.workspacesRoot),
+    });
+    app.get('/api/ready', async (_req, res) => {
+        const report = await readiness();
+        res.status(report.status === 'unavailable' ? 503 : 200).json(report);
+    });
     /**
      * This deployment's MCP endpoint, derived ONCE.
      *
@@ -118,53 +162,12 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     marketplaceGitUrl.username = '';
     marketplaceGitUrl.password = '';
     /**
-     * The handful of facts the browser needs BEFORE it can render anything, and
-     * therefore before it can authenticate: the branch model.
-     *
-     * Unauthenticated on purpose. The login screen, the router and every module
-     * that reads `DEFAULT_BRANCH` are loaded before a session exists, so a gated
-     * endpoint could not answer in time. What it discloses is two branch names —
-     * which every change request and every URL already shows to anyone who does
-     * get in — and nothing about the repository they live in.
-     *
-     * This replaces baking the values into the frontend bundle at build time.
-     * One artifact now serves any deployment, and renaming a branch no longer
-     * means a rebuild.
+     * The facts the browser needs before it can render anything, and what a
+     * local bridge learns about this deployment in one request. Unauthenticated
+     * on purpose; see `publicConfig` for what it discloses and why.
      */
     app.get('/api/config', (_req, res) => {
-        res.json({
-            branchModel: {
-                defaultBranch: DEFAULT_BRANCH,
-                protectedBranches: [...PROTECTED_BRANCHES],
-            },
-            /**
-             * The three renameable KB roots, for the same reason as the branch
-             * model: the file tree, the library router and every path rule read
-             * them, and they used to be compile-time constants.
-             */
-            kbLayout: currentKbLayout(),
-            /**
-             * The per-user marketplace git remote (see modules/marketplace). Same
-             * derivation as `mcpUrl`: our address, userinfo stripped — the caller
-             * adds their own connection key.
-             */
-            marketplaceGitUrl: marketplaceGitUrl.toString(),
-            /**
-             * The same value the OAuth metadata publishes (see `mcpResourceUrl`).
-             *
-             * The frontend used to build this from `window.location.origin`, which
-             * is the browser's idea of our address rather than ours. The two agree
-             * on a simple deployment and disagree behind a proxy, on a second
-             * domain, or on an internal hostname — and the one that decides whether
-             * a connection works is this one.
-             *
-             * That was survivable while every surface was copy-paste: a human sees
-             * the host before pasting it. It stops being survivable the moment we
-             * hand the URL to a third party (a connector install link), where
-             * nobody reads it and the failure surfaces inside someone else's UI.
-             */
-            mcpUrl: mcpResourceUrl.toString(),
-        });
+        res.json(publicConfig({ marketplaceGitUrl: marketplaceGitUrl.toString(), mcpUrl: mcpResourceUrl.toString() }));
     });
     // The per-user marketplace as a git remote. Outside `/api` and ahead of
     // every JWT mount: it authenticates with a connection key in HTTP Basic
@@ -191,12 +194,52 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     }));
     // Overlay boot-time side effects (startup reconciles, periodic sweeps).
     await ext.onBoot?.(core);
+    // What is already sitting beside a checkout, named once per boot and touched
+    // by nothing. Outside the KB startup phase below on purpose: that phase is
+    // gated on the branch model and the repository URL, and a deployment whose
+    // setup never finished — or whose remote is down — is exactly one whose
+    // strays would otherwise go unmentioned. A diagnostic never stops a boot, so
+    // an unreadable workspaces root is logged and the boot carries on.
+    try {
+        await noteBesideCheckout(core.config.workspacesRoot, core.kbDirName);
+    }
+    catch (err) {
+        // `printable`, because the message quotes a path off the disk (an ENOENT
+        // or EACCES names the file it failed on) and a name carrying a control
+        // character would forge a second line of the operator's log.
+        startupLog.warn('could not look for content beside the checkouts:', {
+            detail: printable(err instanceof Error ? err.message : String(err)),
+        });
+    }
     // The KB startup phase — AFTER the distribution's onBoot, because a FATAL
     // template finding raised there must stop the boot before anything seeds
     // from that template; the runner then brings every branch up to this build
     // before any route can serve KB content. Throws to stop the boot (the
     // container's restart policy is the retry) — see kb-startup-runner.ts.
-    await core.kbStartupRunner.runAll();
+    //
+    // Runs in the booting process whether or not it holds the commit-worker
+    // lease, so on a redeploy it overlaps the outgoing holder's commits for the
+    // seconds it takes — the documented window at `holdCommitWorkerLease`.
+    try {
+        await core.kbStartupRunner.runAll();
+    }
+    catch (err) {
+        // The one failure a boot survives: the remote cannot be reached. That
+        // says nothing about the knowledge base — what we would write is not
+        // known to be wrong, we cannot get there — so refusing to boot only took
+        // away the login and setup screens an operator needs to fix it (a
+        // rotated token, say). The deployment comes up GATED: the setup routes
+        // read the runner's standing failure and keep the app shut, the setup
+        // screen shows why, saving it retries, and the runner keeps trying on
+        // its own. Every other failure still stops the boot, because it means
+        // the template or a step would write something wrong.
+        if (!(err instanceof KbRemoteUnreachableError))
+            throw err;
+        startupLog.error('booting UNMAINTAINED and gated — the knowledge-base remote could not be reached:', {
+            detail: err.message,
+        });
+        core.kbStartupRunner.retryUntilMaintained();
+    }
     // Close change requests whose source branch has been deleted. SEQUENCED
     // AFTER the startup phase above, for two reasons: the sweep's fresh fetch
     // lazily bootstraps and fetches the same default-branch clone the runner
@@ -213,10 +256,28 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
         .closeChangeRequestsWithDeletedBranches()
         .then((n) => {
         if (n > 0) {
-            console.log(`[cr] closed ${n} change request${n === 1 ? '' : 's'} with a deleted branch`);
+            crLog.info(`closed ${n} change request${n === 1 ? '' : 's'} with a deleted branch`);
         }
     })
-        .catch((err) => console.warn('[cr] deleted-branch sweep failed:', err));
+        .catch((err) => crLog.warn('deleted-branch sweep failed:', { err }));
+    // Recorded join requests that are still owed, resumed — now, and then on a
+    // timer. SEQUENCED AFTER the startup phase for the same reason as the sweep
+    // above: the work needs the default-branch clone the runner maintains and
+    // the plugin catalog read from it, and a sweep that ran first would refuse
+    // every row for a knowledge base that simply was not ready — telling people
+    // their request could not be sent when nothing had gone wrong with it.
+    //
+    // ON A TIMER rather than at boot alone, because boot cannot cover the
+    // redeploy: this process sweeps while the outgoing one still holds a
+    // record, skips it (correctly — two servers must not do git on one branch),
+    // and the outgoing process then exits mid-work. Nothing else would look at
+    // that row again. The requester cannot prompt it either: a pending record
+    // shows them the "Requested" card, not a button.
+    //
+    // Not awaited, and nothing to report here but the failure to read the table
+    // at all: a first request from a person is a full clone, nothing else at
+    // boot depends on it, and each row records its own outcome.
+    core.pluginJoinRequestJobs.startSweeping();
     // Auth routes (unprotected — login endpoint must be accessible)
     app.use('/api', createAuthRoutes(core.authService, core.authMiddleware, core.authProviders, core.config.loginPasswordEnabled));
     // MCP routes must mount BEFORE every `app.use('/api', authMiddleware, …)`
@@ -291,9 +352,16 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
         recoveryBotEmail: RECOVERY_BOT_EMAIL,
         hooks: core.workflowService.hooks,
     };
+    // A skill's `allowed-tools`, checked against what the caller can see — on
+    // every save surface (agent write tools, the app's PUT /file) and on
+    // `get_skill`. Warnings only; it never refuses a save.
+    const allowedToolsChecker = new AllowedToolsChecker(core.toolRegistry, core.toolManualService, core.kbDirName);
     registerWorkflowTools(core.toolRegistry, toolsRouter, ta, th, core.kbDirName);
-    registerWorkspaceTools(core.toolRegistry, toolsRouter, ta, th, core.spillStore, core.docExtractService, core.accessControl, core.kbDirName, sessionOntologyGate, core.routineWritePolicy, core.sessionSink);
-    registerSkillsTools(core.toolRegistry, toolsRouter, ta, th, core.skillService);
+    registerWorkspaceTools(core.toolRegistry, toolsRouter, ta, th, core.spillStore, core.docExtractService, core.accessControl, core.kbDirName, sessionOntologyGate, core.routineWritePolicy, core.sessionSink, allowedToolsChecker, core.changeGate);
+    registerSkillsTools(core.toolRegistry, toolsRouter, ta, th, core.skillService, allowedToolsChecker);
+    // Definitions only: the endpoints they describe are the app's own plugin
+    // creation routes, mounted below behind the key-or-session gate.
+    registerPluginsTools(core.toolRegistry);
     registerToolManualsTools(core.toolRegistry, toolsRouter, ta, th, core.toolManualService, {
         accessControl: core.accessControl,
         // The vault satisfies the module's local VariableStatusPort — `list_tool_setup`
@@ -313,7 +381,27 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     // The aggregated manual list (KB + the caller's accessible `.tool`s) + inline
     // `.tool` sub-manuals. Mounted on the tools router so they share `manualAuth`
     // and sit before the JWT `/api` mounts.
-    toolsRouter.use(createToolManualsAgentRoutes(core.toolManualService, core.manualAuthMiddleware, async (userId) => (await core.authService.getUserById(userId))?.email, { workspaceService: core.workspaceService, accessControl: core.accessControl, kbDirName: core.kbDirName }));
+    toolsRouter.use(createToolManualsAgentRoutes(core.toolManualService, core.manualAuthMiddleware, async (userId) => (await core.authService.getUserById(userId))?.email, {
+        workspaceService: core.workspaceService,
+        accessControl: core.accessControl,
+        kbDirName: core.kbDirName,
+        disk: core.disk,
+        pluginIndex: core.pluginIndexService,
+    }));
+    // What every connected agent is told at session start, as the hosted proxy
+    // composes it: read by the local `hexis-mcp` bridge at startup and by the
+    // External agent access card. Same `manualAuth`, same router, as `all-tools`.
+    toolsRouter.use(createAgentInstructionsRoutes(core.manualAuthMiddleware, core.readAgentPreamble));
+    // The fingerprint of the caller's released catalog. The local `hexis-mcp`
+    // server polls it to learn that a manual or a skill changed under a
+    // connection it cannot be pushed to; nothing else consults it. Same
+    // `manualAuth`, same router, as `all-tools`.
+    toolsRouter.use(createCatalogRevisionRoutes({
+        toolManuals: core.toolManualService,
+        skills: core.skillService,
+        manualAuth: core.manualAuthMiddleware,
+        resolveUserEmail: async (userId) => (await core.authService.getUserById(userId))?.email,
+    }));
     // The only core route that returns secret VALUES: a local `.tool`'s declared
     // variables, for the local MCP server that will execute it. It re-reads the
     // declaring knowledge-base file server-side, so the file is the allowlist and
@@ -321,12 +409,37 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     // surface.
     toolsRouter.use(createDeclaredVariableRoutes(core.toolManualService, core.secretsVaultService, core.manualAuthMiddleware, async (userId) => (await core.authService.getUserById(userId))?.email));
     app.use('/api', toolsRouter);
+    // The same guard on the PARSED body, for the WHOLE `/workspace/:id` prefix
+    // and ahead of EVERY router under it — the file routes, the review, workflow
+    // and access ones, and whatever an extension mounts below. Mounted here,
+    // before the extension phase, so an overlay surface added there is covered
+    // by its prefix rather than by remembering this. No auth in front of it: the
+    // lexical rule reads the caller's own string and touches no disk, so it
+    // answers nothing; the resolved half waits for the JWT check below.
+    app.use('/api/workspace/:id', createGitInternalsRouteGuard(core.workspaceService));
     // Non-JWT overlay surfaces that sit between the tools router and the
     // JWT-protected `/api` routes (LLM proxy, embed, upload — see the phase
     // doc on ServerExtensions.postTools).
     ext.postTools?.(app, core);
+    // The plugin creation doors — `POST /api/plugins`, `POST /api/plugins/personal`
+    // — take an agent's connection key as well as a session, because the
+    // `create_plugin` and `my_plugin` tools describe these very endpoints.
+    // Mounted HERE, before the first `app.use('/api', authMiddleware, …)`
+    // below: every one of those runs the JWT check for EVERY `/api` request
+    // that reaches it, whether or not its router matches, so a connection key
+    // sent to these paths would be refused before the gate saw it.
+    app.use('/api', keyOrSessionAuth({
+        sessionAuth: core.authMiddleware,
+        toolAuth: core.toolAuthMiddleware,
+        isToolCredential: (token) => core.internalTokenService.looksLikeInternalToken(token) ||
+            core.externalApiKeyService.looksLikeExternalApiKey(token),
+    }), createPluginCreationRoutes(core.pluginProvisionService, async (req) => (req.userId ? ((await core.authService.getUserById(req.userId)) ?? null) : null)));
     // Protected routes
-    app.use('/api', core.authMiddleware, createWorkspaceRoutes(core.workspaceService, core.authService, core.workflowService, core.eventBus, core.accessControl, core.kbDirName, core.creatorAccess, core.adminAccess));
+    // The same guard again, now BEHIND the JWT check, so an authenticated
+    // request also gets the resolved form judged — a link in the repository that
+    // points into the git folder — before any read gate or lock.
+    app.use('/api/workspace/:id', core.authMiddleware, createGitInternalsRouteGuard(core.workspaceService));
+    app.use('/api', core.authMiddleware, createWorkspaceRoutes(core.workspaceService, core.authService, core.workflowService, core.eventBus, core.accessControl, core.kbDirName, core.creatorAccess, core.adminAccess, core.disk, allowedToolsChecker, core.changeGate));
     // Workflow is the only branches / changes / change-request surface. The
     // former /git/*, /pr/*, /pr/:n/* routes are gone — every consumer goes
     // through /workflow/* now.
@@ -339,7 +452,7 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     app.use('/api', createEventsRoutes(core.eventBus, core.authMiddleware));
     app.use('/api', core.authMiddleware, createDiffRoutes(core.diffService, core.authService, core.workflowService, core.accessControl, core.kbDirName));
     app.use('/api', core.authMiddleware, createAccessRoutes(core.accessControl, core.workspaceService, core.authService, core.workflowService, core.eventBus, core.db, core.kbDirName, [core.config.adminEmail]));
-    app.use('/api', core.authMiddleware, createSkillsRoutes(core.skillService, core.pendingSkillsService, core.pluginLinkIndex, core.accessControl));
+    app.use('/api', core.authMiddleware, createSkillsRoutes(core.skillService, core.pendingSkillsService, core.pluginLinkIndex, core.accessControl, allowedToolsChecker));
     // Asking for write on a shared skill — the join-request machinery pointed
     // at a skill folder. Same JWT gate, same fail-closed shape.
     app.use('/api', core.authMiddleware, createSkillAccessRequestRoutes({
@@ -354,8 +467,14 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     // Plugin enumeration + join requests. Browser-only (JWT), and fail-closed
     // like every other read surface: plugins the caller cannot access (member,
     // manager, or discoverable via the access.md file's own read grant) are
-    // absent from the list. A join request is a plain change request.
-    app.use('/api', core.authMiddleware, createPluginsRoutes(core.pluginIndexService, core.accessControl, core.workflowService, core.workspaceService, core.joinRequestsService, core.pluginProvisionService, core.kbDirName, async (req) => (req.userId ? ((await core.authService.getUserById(req.userId)) ?? null) : null), core.pluginLinksService, core.pluginRenameService));
+    // absent from the list. A join request is a plain change request. (The
+    // creation doors are mounted above, before the first JWT-only `/api`
+    // mount — see there.)
+    app.use('/api', core.authMiddleware, createPluginsRoutes(core.pluginIndexService, core.accessControl, core.workflowService, core.joinRequestsService, core.pluginJoinRequestJobs, core.pluginProvisionService, async (req) => (req.userId ? ((await core.authService.getUserById(req.userId)) ?? null) : null), core.pluginLinksService, core.pluginRenameService));
+    // The Library's "Your teams" lens: what each group can use, sliced from
+    // the catalogs the caller already sees. Same JWT gate, same fail-closed
+    // shape as the plugin index.
+    app.use('/api', core.authMiddleware, createTeamsRoutes(core.accessControl, core.pluginIndexService, core.skillService, core.toolManualService));
     // Admin-status resolver (CORE — see the note in admin-access.routes.ts;
     // the full admin router is an enterprise `ext.authed` extension).
     app.use('/api', core.authMiddleware, createAdminAccessRoutes(core.adminAccess));
@@ -371,7 +490,10 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     app.use('/api', core.authMiddleware, createUpdateCheckRoutes(core.updateCheckService, core.adminAccess));
     // Account management (list/create password accounts, GDPR erasure) —
     // admin-gated inside.
-    app.use('/api', core.authMiddleware, createAccountRoutes(core.authService, core.adminAccess, core.accountErasureService));
+    app.use('/api', core.authMiddleware, createAccountRoutes(core.authService, core.adminAccess, core.accountErasureService, core.userAccessRemovalService));
+    // Connection keys across the deployment (list per account, revoke any) —
+    // admin-gated inside. The per-user key surface stays on /api/mcp/…
+    app.use('/api', core.authMiddleware, createConnectionKeysAdminRoutes(core.externalApiKeyService, core.adminAccess));
     // First-run setup. Mounted with the other authed routes but touching NO
     // workspace — it has to work on a deployment that has no knowledge base yet,
     // which is the whole reason it exists. The startup runner rides along for
@@ -381,14 +503,15 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
         // the same reason: this string is handed to admins to paste elsewhere.
         url: syncUrl.toString(),
         lastSync: () => core.kbSyncService.lastSync(),
-    }));
-    app.use('/api', core.authMiddleware, createToolManualsBrowserRoutes(core.toolManualService, {
-        service: core.mcpServerEditService,
-        getUser: async (userId) => {
-            const u = await core.authService.getUserById(userId);
-            return u ? { id: u.id, email: u.email, name: u.name } : undefined;
-        },
-    }));
+    }, 
+    // The connection probe's git — and the root-folder listing's — runs
+    // through the deployment's one runner.
+    repositoryConnectionCheck(core.gitRunner), rootFolderListerFor(core.gitRunner), oidcRedirectUri(core.config.publicBackendUrl)));
+    const toolPageUser = async (userId) => {
+        const u = await core.authService.getUserById(userId);
+        return u ? { id: u.id, email: u.email, name: u.name } : undefined;
+    };
+    app.use('/api', core.authMiddleware, createToolManualsBrowserRoutes(core.toolManualService, { service: core.mcpServerEditService, getUser: toolPageUser }, { service: core.toolDeleteService, getUser: toolPageUser }, core.pendingToolsService));
     app.use('/api', core.authMiddleware, createSecretsVaultRoutes(secretsVaultRoutesDeps));
     // The authed tail of the MCP OAuth flow: /connect calls these to describe
     // the pending authorization and, on Finish, to mint the one-time code. The
@@ -404,7 +527,8 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
         },
     }));
     // What an Owner pastes into Claude's admin settings to register this
-    // deployment as a GitHub Enterprise Server — admins only.
+    // deployment as a GitHub Enterprise Server — admins only — plus whether it
+    // is registered, a boolean every signed-in person may read.
     app.use('/api', core.authMiddleware, createGitHubFacadeAdminRoutes({
         credentials: core.githubFacadeCredentials,
         isAdmin: (email) => core.adminAccess.isAdmin(email),

package/dist/core/create-core-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-core-server.js","sourceRoot":"","sources":["../../src/core/create-core-server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AACrH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAiB,MAAM,iCAAiC,CAAC;AACrH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA2DxC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAkB,EAClB,MAAwB,EAAE,EAC1B,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,sDAAsD;IACtD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,yEAAyE;IACzE,iEAAiE;IACjE,uEAAuE;IACvE,sEAAsE;IACtE,iEAAiE;IACjE,yEAAyE;IACzE,qDAAqD;IACrD,EAAE;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,mEAAmE;IACnE,qEAAqE;IACrE,8CAA8C;IAC9C,6EAA6E;IAC7E,4EAA4E;IAC5E,GAAG,CAAC,GAAG,CACL,IAAI,CAAC;QACH,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,IAAI;QACjB,sEAAsE;QACtE,4DAA4D;QAC5D,cAAc,EAAE,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC;KACrG,CAAC,CACH,CAAC;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,2BAA2B;IAC3B,4EAA4E;IAC5E,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAChF,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,2EAA2E;IAC3E,6DAA6D;IAC7D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzE,cAAc,CAAC,QAAQ,GAAG,EAAE,CAAC;IAC7B,cAAc,CAAC,QAAQ,GAAG,EAAE,CAAC;IAC7B,0FAA0F;IAC1F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACnE,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;IACtB,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;IACtB,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzG,iBAAiB,CAAC,QAAQ,GAAG,EAAE,CAAC;IAChC,iBAAiB,CAAC,QAAQ,GAAG,EAAE,CAAC;IAEhC;;;;;;;;;;;;;OAaG;IACH,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnC,GAAG,CAAC,IAAI,CAAC;YACP,WAAW,EAAE;gBACX,aAAa,EAAE,cAAc;gBAC7B,iBAAiB,EAAE,CAAC,GAAG,kBAAkB,CAAC;aAC3C;YACD;;;;eAIG;YACH,QAAQ,EAAE,eAAe,EAAE;YAC3B;;;;eAIG;YACH,iBAAiB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;YAC/C;;;;;;;;;;;;;eAaG;YACH,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,gDAAgD;IAChD,GAAG,CAAC,GAAG,CACL,MAAM,EACN,0BAA0B,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,eAAe;QAC1B,IAAI,EAAE,IAAI,CAAC,qBAAqB;QAChC,SAAS,EAAE,MAAM;KAClB,CAAC,CACH,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,uEAAuE;IACvE,wBAAwB;IACxB,GAAG,CAAC,GAAG,CACL,wBAAwB,CAAC;QACvB,MAAM,EAAE,IAAI,CAAC,YAAY;QACzB,IAAI,EAAE,IAAI,CAAC,qBAAqB;QAChC,IAAI,EAAE,IAAI,CAAC,eAAe;QAC1B,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7D,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;KACxC,CAAC,CACH,CAAC;IAEF,wEAAwE;IACxE,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAEzB,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,uEAAuE;IACvE,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;IAEpC,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,iCAAiC;IACjC,KAAK,IAAI,CAAC,eAAe;SACtB,sCAAsC,EAAE;SACxC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACV,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,wBAAwB,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC,CAAC;IAE1E,gEAAgE;IAChE,GAAG,CAAC,GAAG,CACL,MAAM,EACN,gBAAgB,CACd,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,CAAC,oBAAoB,CACjC,CACF,CAAC;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,kDAAkD;IAClD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAC7B,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,qBAAqB,EAC1B,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,UAAU;IACf,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,CAAC,oBAAoB,EACzB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,sBAAsB,CAC5B,CAAC,CAAC;IAEH,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,yBAAyB;IACzB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC;QACjC,MAAM,EAAE,IAAI,CAAC,aAAa;QAC1B,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC;QACvD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC,CAAC;IAEJ,qEAAqE;IACrE,qEAAqE;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,0DAA0D;IAC1D,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;QACpB,QAAQ,EAAE,IAAI,CAAC,gBAAgB;QAC/B,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAChD,iBAAiB,EAAE,cAAc;QACjC,eAAe,EAAE,CAAC,KAAK,CAAC;QACxB,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAC,CAAC;IAEJ,sEAAsE;IACtE,6DAA6D;IAC7D,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEzB,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,sBAAsB,GAAG;QAC7B,YAAY,EAAE,IAAI,CAAC,mBAAmB;QACtC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,eAAe,EAAE,IAAI,CAAC,sBAAsB;QAC5C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;QAClC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAC9C,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;KACjD,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,8BAA8B,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAExE,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,iBAAiB;IACjB,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACnC,uEAAuE;IACvE,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,uDAAuD;IACvD,MAAM,mBAAmB,GAAG;QAC1B,OAAO,EAAE,IAAI,CAAC,sBAAsB;QACpC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;QACzC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,gBAAgB,EAAE,kBAAkB;QACpC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK;KAClC,CAAC;IACF,qBAAqB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9E,sBAAsB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,mBAAmB,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5M,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/E,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,iBAAiB,EAAE;QACvF,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gFAAgF;QAChF,+EAA+E;QAC/E,cAAc,EAAE,IAAI,CAAC,mBAAmB;KACzC,CAAC,CAAC;IACH,+DAA+D;IAC/D,GAAG,CAAC,KAAK,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI,CAAC,YAAY;QAC3B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,EAAE;QACf,mBAAmB;QACnB,IAAI;KACL,CAAC,CAAC;IACH,WAAW,CAAC,GAAG,CAAC,kBAAkB,CAChC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,oBAAoB,EACzB,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CACtE,CAAC,CAAC;IACH,8EAA8E;IAC9E,8EAA8E;IAC9E,wCAAwC;IACxC,WAAW,CAAC,GAAG,CAAC,4BAA4B,CAC1C,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,oBAAoB,EACzB,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EACrE,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAC1G,CAAC,CAAC;IACH,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,yEAAyE;IACzE,WAAW;IACX,WAAW,CAAC,GAAG,CAAC,4BAA4B,CAC1C,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,mBAAmB,EACxB,IAAI,CAAC,oBAAoB,EACzB,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CACtE,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE7B,qEAAqE;IACrE,wEAAwE;IACxE,sCAAsC;IACtC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3B,mBAAmB;IACnB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,qBAAqB,CACxD,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,WAAW,CACjB,CAAC,CAAC;IACH,wEAAwE;IACxE,uEAAuE;IACvE,2BAA2B;IAC3B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,oBAAoB,CACvD,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,SAAS,CACf,CAAC,CAAC;IACH,oEAAoE;IACpE,uEAAuE;IACvE,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACxE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CACnD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,SAAS,CACf,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,CACrD,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,SAAS,EACd,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CACzB,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAI,CAAC,cAAc,EACnB,kBAAkB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC,CAC3G,CAAC;IACF,0EAA0E;IAC1E,4DAA4D;IAC5D,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAI,CAAC,cAAc,EACnB,8BAA8B,CAAC;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,QAAQ,EAAE,IAAI,CAAC,eAAe;QAC9B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,YAAY,EAAE,IAAI,CAAC,mBAAmB;QACtC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACzB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KACjF,CAAC,CACH,CAAC;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,mBAAmB,CACtD,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,mBAAmB,EACxB,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,SAAS,EACd,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAC/F,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,mBAAmB,CACzB,CAAC,CAAC;IACH,wEAAwE;IACxE,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,gEAAgE;IAChE,sBAAsB;IACtB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,kBAAkB;QACpC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI;KAC5E,CAAC,CAAC,CAAC;IACJ,wEAAwE;IACxE,qEAAqE;IACrE,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAI,CAAC,cAAc,EACnB,uBAAuB,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,CACnE,CAAC;IACF,qEAAqE;IACrE,sBAAsB;IACtB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,mBAAmB,CACtD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,qBAAqB,CAC3B,CAAC,CAAC;IACH,wEAAwE;IACxE,6EAA6E;IAC7E,0EAA0E;IAC1E,kEAAkE;IAClE,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAI,CAAC,cAAc,EACnB,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,EAAE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE;QACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE;KAC9C,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,8BAA8B,CAAC,IAAI,CAAC,iBAAiB,EAAE;QAC1F,OAAO,EAAE,IAAI,CAAC,oBAAoB;QAClC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACrD,OAAO,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,CAAC;KACF,CAAC,CAAC,CAAC;IACJ,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACvF,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC;QAC5D,QAAQ,EAAE,IAAI,CAAC,gBAAgB;QAC/B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;QAClC,MAAM,EAAE;YACN,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9D,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1D,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;SAC/E;KACF,CAAC,CAAC,CAAC;IAEJ,qEAAqE;IACrE,0DAA0D;IAC1D,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,6BAA6B,CAAC;QACjE,WAAW,EAAE,IAAI,CAAC,uBAAuB;QACzC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;QACnD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;QACvC,cAAc,EAAE,iBAAiB,CAAC,QAAQ,EAAE;KAC7C,CAAC,CAAC,CAAC;IAEJ,gCAAgC;IAChC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAExB,iDAAiD;IACjD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9B,uEAAuE;YACvE,2EAA2E;YAC3E,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,yEAAyE;YACzE,mEAAmE;YACnE,IACE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBACpC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC5B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EACpC,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"create-core-server.js","sourceRoot":"","sources":["../../src/core/create-core-server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;AACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;AAC3B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mDAAmD,CAAC;AAErF,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,+BAA+B,EAAE,MAAM,sDAAsD,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,+CAA+C,CAAC;AAEvD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mDAAmD,CAAC;AAC7F,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAkEvF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAkB,EAClB,MAAwB,EAAE,EAC1B,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,sDAAsD;IACtD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,yEAAyE;IACzE,iEAAiE;IACjE,uEAAuE;IACvE,sEAAsE;IACtE,iEAAiE;IACjE,yEAAyE;IACzE,qDAAqD;IACrD,EAAE;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,kEAAkE;IAClE,6EAA6E;IAC7E,4EAA4E;IAC5E,GAAG,CAAC,GAAG,CACL,IAAI,CAAC;QACH,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,IAAI;QACjB,sEAAsE;QACtE,4DAA4D;QAC5D,cAAc,EAAE,CAAC,sBAAsB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC;KACnF,CAAC,CACH,CAAC;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,2BAA2B;IAC3B,4EAA4E;IAC5E,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,2EAA2E;IAC3E,yEAAyE;IACzE,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,yEAAyE;IACzE,yDAAyD;IACzD,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACnF,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAChF,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,2EAA2E;IAC3E,6DAA6D;IAC7D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,4EAA4E;IAC5E,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,8CAA8C;IAC9C,MAAM,SAAS,GAAG,eAAe,CAAC;QAChC,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE;QACjE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI;QACpC,oEAAoE;QACpE,qEAAqE;QACrE,wEAAwE;QACxE,2DAA2D;QAC3D,iBAAiB,EAAE,GAAG,EAAE;YACtB,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,CAAC,CAAC;YACjG,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EACjF,IAAI,CACL,CAAC;QACJ,CAAC;QACD,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;KACjE,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzE,cAAc,CAAC,QAAQ,GAAG,EAAE,CAAC;IAC7B,cAAc,CAAC,QAAQ,GAAG,EAAE,CAAC;IAC7B,0FAA0F;IAC1F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACnE,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;IACtB,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;IACtB,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzG,iBAAiB,CAAC,QAAQ,GAAG,EAAE,CAAC;IAChC,iBAAiB,CAAC,QAAQ,GAAG,EAAE,CAAC;IAEhC;;;;OAIG;IACH,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;IACjH,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,gDAAgD;IAChD,GAAG,CAAC,GAAG,CACL,MAAM,EACN,0BAA0B,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,eAAe;QAC1B,IAAI,EAAE,IAAI,CAAC,qBAAqB;QAChC,SAAS,EAAE,MAAM;KAClB,CAAC,CACH,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,uEAAuE;IACvE,wBAAwB;IACxB,GAAG,CAAC,GAAG,CACL,wBAAwB,CAAC;QACvB,MAAM,EAAE,IAAI,CAAC,YAAY;QACzB,IAAI,EAAE,IAAI,CAAC,qBAAqB;QAChC,IAAI,EAAE,IAAI,CAAC,eAAe;QAC1B,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7D,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;KACxC,CAAC,CACH,CAAC;IAEF,wEAAwE;IACxE,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAEzB,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,6EAA6E;IAC7E,mEAAmE;IACnE,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,uEAAuE;QACvE,6DAA6D;QAC7D,UAAU,CAAC,IAAI,CAAC,kDAAkD,EAAE;YAClE,MAAM,EAAE,SAAS,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,uEAAuE;IACvE,EAAE;IACF,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,qEAAqE;QACrE,yEAAyE;QACzE,kEAAkE;QAClE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,sDAAsD;QACtD,IAAI,CAAC,CAAC,GAAG,YAAY,wBAAwB,CAAC;YAAE,MAAM,GAAG,CAAC;QAC1D,UAAU,CAAC,KAAK,CAAC,kFAAkF,EAAE;YACnG,MAAM,EAAE,GAAG,CAAC,OAAO;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,CAAC,oBAAoB,EAAE,CAAC;IAC9C,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,iCAAiC;IACjC,KAAK,IAAI,CAAC,eAAe;SACtB,sCAAsC,EAAE;SACxC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACV,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,wBAAwB,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAEvE,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,EAAE;IACF,sEAAsE;IACtE,qEAAqE;IACrE,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,iDAAiD;IACjD,EAAE;IACF,4EAA4E;IAC5E,yEAAyE;IACzE,4DAA4D;IAC5D,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,CAAC;IAE3C,gEAAgE;IAChE,GAAG,CAAC,GAAG,CACL,MAAM,EACN,gBAAgB,CACd,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,CAAC,oBAAoB,CACjC,CACF,CAAC;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,kDAAkD;IAClD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAC7B,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,qBAAqB,EAC1B,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,UAAU;IACf,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,CAAC,oBAAoB,EACzB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,sBAAsB,CAC5B,CAAC,CAAC;IAEH,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,yBAAyB;IACzB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC;QACjC,MAAM,EAAE,IAAI,CAAC,aAAa;QAC1B,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC;QACvD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC,CAAC;IAEJ,qEAAqE;IACrE,qEAAqE;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,0DAA0D;IAC1D,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;QACpB,QAAQ,EAAE,IAAI,CAAC,gBAAgB;QAC/B,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAChD,iBAAiB,EAAE,cAAc;QACjC,eAAe,EAAE,CAAC,KAAK,CAAC;QACxB,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAC,CAAC;IAEJ,sEAAsE;IACtE,6DAA6D;IAC7D,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEzB,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,sBAAsB,GAAG;QAC7B,YAAY,EAAE,IAAI,CAAC,mBAAmB;QACtC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,eAAe,EAAE,IAAI,CAAC,sBAAsB;QAC5C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;QAClC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAC9C,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;KACjD,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,8BAA8B,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAExE,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,iBAAiB;IACjB,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACnC,uEAAuE;IACvE,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,uDAAuD;IACvD,MAAM,mBAAmB,GAAG;QAC1B,OAAO,EAAE,IAAI,CAAC,sBAAsB;QACpC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;QACzC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,gBAAgB,EAAE,kBAAkB;QACpC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK;KAClC,CAAC;IACF,0EAA0E;IAC1E,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/G,qBAAqB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9E,sBAAsB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,mBAAmB,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,WAAW,EAAE,mBAAmB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAClP,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;IACpG,yEAAyE;IACzE,iEAAiE;IACjE,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxC,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,iBAAiB,EAAE;QACvF,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gFAAgF;QAChF,+EAA+E;QAC/E,cAAc,EAAE,IAAI,CAAC,mBAAmB;KACzC,CAAC,CAAC;IACH,+DAA+D;IAC/D,GAAG,CAAC,KAAK,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI,CAAC,YAAY;QAC3B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,EAAE;QACf,mBAAmB;QACnB,IAAI;KACL,CAAC,CAAC;IACH,WAAW,CAAC,GAAG,CAAC,kBAAkB,CAChC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,oBAAoB,EACzB,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CACtE,CAAC,CAAC;IACH,8EAA8E;IAC9E,8EAA8E;IAC9E,wCAAwC;IACxC,WAAW,CAAC,GAAG,CAAC,4BAA4B,CAC1C,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,oBAAoB,EACzB,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EACrE;QACE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,kBAAkB;KACrC,CACF,CAAC,CAAC;IACH,2EAA2E;IAC3E,0EAA0E;IAC1E,8EAA8E;IAC9E,WAAW,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAClG,0EAA0E;IAC1E,oEAAoE;IACpE,oEAAoE;IACpE,6CAA6C;IAC7C,WAAW,CAAC,GAAG,CAAC,2BAA2B,CAAC;QAC1C,WAAW,EAAE,IAAI,CAAC,iBAAiB;QACnC,MAAM,EAAE,IAAI,CAAC,YAAY;QACzB,UAAU,EAAE,IAAI,CAAC,oBAAoB;QACrC,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK;KACxF,CAAC,CAAC,CAAC;IACJ,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,yEAAyE;IACzE,WAAW;IACX,WAAW,CAAC,GAAG,CAAC,4BAA4B,CAC1C,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,mBAAmB,EACxB,IAAI,CAAC,oBAAoB,EACzB,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CACtE,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE7B,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,oEAAoE;IACpE,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAEnF,qEAAqE;IACrE,wEAAwE;IACxE,sCAAsC;IACtC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3B,gFAAgF;IAChF,qEAAqE;IACrE,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,0EAA0E;IAC1E,+DAA+D;IAC/D,GAAG,CAAC,GAAG,CACL,MAAM,EACN,gBAAgB,CAAC;QACf,WAAW,EAAE,IAAI,CAAC,cAAc;QAChC,QAAQ,EAAE,IAAI,CAAC,kBAAkB;QACjC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1B,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC;YACvD,IAAI,CAAC,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC;KAC5D,CAAC,EACF,0BAA0B,CACxB,IAAI,CAAC,sBAAsB,EAC3B,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAChG,CACF,CAAC;IAEF,mBAAmB;IACnB,sEAAsE;IACtE,6EAA6E;IAC7E,6DAA6D;IAC7D,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,cAAc,EAAE,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACxG,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,qBAAqB,CACxD,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,IAAI,EACT,mBAAmB,EACnB,IAAI,CAAC,UAAU,CAChB,CAAC,CAAC;IACH,wEAAwE;IACxE,uEAAuE;IACvE,2BAA2B;IAC3B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,oBAAoB,CACvD,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,SAAS,CACf,CAAC,CAAC;IACH,oEAAoE;IACpE,uEAAuE;IACvE,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACxE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CACnD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,SAAS,CACf,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,CACrD,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,SAAS,EACd,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CACzB,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAI,CAAC,cAAc,EACnB,kBAAkB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAChI,CAAC;IACF,0EAA0E;IAC1E,4DAA4D;IAC5D,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAI,CAAC,cAAc,EACnB,8BAA8B,CAAC;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,QAAQ,EAAE,IAAI,CAAC,eAAe;QAC9B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,YAAY,EAAE,IAAI,CAAC,mBAAmB;QACtC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACzB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KACjF,CAAC,CACH,CAAC;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,sBAAsB;IACtB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,mBAAmB,CACtD,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,mBAAmB,EACxB,IAAI,CAAC,qBAAqB,EAC1B,IAAI,CAAC,sBAAsB,EAC3B,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAC/F,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,mBAAmB,CACzB,CAAC,CAAC;IACH,wEAAwE;IACxE,wEAAwE;IACxE,6BAA6B;IAC7B,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAI,CAAC,cAAc,EACnB,iBAAiB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAC1G,CAAC;IACF,wEAAwE;IACxE,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,gEAAgE;IAChE,sBAAsB;IACtB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,kBAAkB;QACpC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI;KAC5E,CAAC,CAAC,CAAC;IACJ,wEAAwE;IACxE,qEAAqE;IACrE,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAI,CAAC,cAAc,EACnB,uBAAuB,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,CACnE,CAAC;IACF,qEAAqE;IACrE,sBAAsB;IACtB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,mBAAmB,CACtD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,qBAAqB,EAC1B,IAAI,CAAC,wBAAwB,CAC9B,CAAC,CAAC;IACH,yEAAyE;IACzE,mEAAmE;IACnE,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAI,CAAC,cAAc,EACnB,+BAA+B,CAAC,IAAI,CAAC,qBAAqB,EAAE,IAAI,CAAC,WAAW,CAAC,CAC9E,CAAC;IACF,wEAAwE;IACxE,6EAA6E;IAC7E,0EAA0E;IAC1E,kEAAkE;IAClE,GAAG,CAAC,GAAG,CACL,MAAM,EACN,IAAI,CAAC,cAAc,EACnB,iBAAiB,CACf,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,eAAe,EACpB;QACE,uEAAuE;QACvE,uEAAuE;QACvE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE;QACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE;KAC9C;IACD,oEAAoE;IACpE,uCAAuC;IACvC,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,EACzC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EACnC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAC9C,CACF,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,EAAE,MAAc,EAAiC,EAAE;QAC3E,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,CAAC,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,8BAA8B,CACjE,IAAI,CAAC,iBAAiB,EACtB,EAAE,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,OAAO,EAAE,YAAY,EAAE,EAC7D,EAAE,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,EAC1D,IAAI,CAAC,mBAAmB,CACzB,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACvF,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC;QAC5D,QAAQ,EAAE,IAAI,CAAC,gBAAgB;QAC/B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;QAClC,MAAM,EAAE;YACN,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9D,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1D,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;SAC/E;KACF,CAAC,CAAC,CAAC;IAEJ,qEAAqE;IACrE,2EAA2E;IAC3E,4DAA4D;IAC5D,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,6BAA6B,CAAC;QACjE,WAAW,EAAE,IAAI,CAAC,uBAAuB;QACzC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;QACnD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;QACvC,cAAc,EAAE,iBAAiB,CAAC,QAAQ,EAAE;KAC7C,CAAC,CAAC,CAAC;IAEJ,gCAAgC;IAChC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAExB,iDAAiD;IACjD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9B,uEAAuE;YACvE,2EAA2E;YAC3E,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,yEAAyE;YACzE,mEAAmE;YACnE,IACE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBACpC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC5B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EACpC,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/create-core-services.d.ts

@@ -7,6 +7,9 @@ import { RoutineWritePolicyService } from '../modules/workspace/routine-write-po
 import { KbStartupRunner } from '../modules/workspace/startup/kb-startup-runner.js';
 import { DeploymentSettingsService } from '../modules/settings/deployment-settings.service.js';
 import { KbSyncService } from '../modules/kb-sync/kb-sync.service.js';
+import type { IFsProbe, ITreeWalker } from '../shared/fs.contract.js';
+import type { IGitRunner } from '../shared/git.contract.js';
+import { type LeaseLoopHandle } from './lifecycle.js';
 import { SpillStore } from '../modules/workspace/spill-store.js';
 import { DocExtractService } from '../modules/workspace/file-readers/doc-extract.service.js';
 import { type ISessionSink } from '../modules/workspace/session-sink.js';
@@ -15,11 +18,14 @@ import { AccountErasureService } from '../modules/auth/account-erasure.service.j
 import { createAuthMiddleware } from '../modules/auth/auth.middleware.js';
 import { AccessControlService } from '../modules/access/access-control.service.js';
 import { CreatorAccessService } from '../modules/access/creator-access.js';
+import { ChangeReadGate } from '../modules/access/change-read-gate.js';
 import { GroupsAdminService } from '../modules/access/groups-admin.service.js';
+import { UserAccessRemovalService } from '../modules/access/user-access-removal.service.js';
 import { PendingSkillsService, SkillService } from '../modules/skills/index.js';
-import { ToolManualService } from '../modules/tool-manuals/index.js';
+import { PendingToolsService, ToolManualService } from '../modules/tool-manuals/index.js';
 import { McpServerEditService } from '../modules/tool-manuals/mcp-server-edit.service.js';
-import { PluginIndexService, PluginProvisionService, JoinRequestsService, PluginLinkIndex, PluginLinksService, PluginRenameService, MarketplaceCompilerService } from '../modules/plugins/index.js';
+import { ToolDeleteService } from '../modules/tool-manuals/tool-delete.service.js';
+import { PluginIndexService, PluginProvisionService, JoinRequestsService, PluginJoinRequestJobs, PluginLinkIndex, PluginLinksService, PluginRenameService, MarketplaceCompilerService } from '../modules/plugins/index.js';
 import { MarketplaceRepoService } from '../modules/marketplace/index.js';
 import { GitHubFacadeCredentialsService, GitHubFacade } from '../modules/marketplace/github-facade/index.js';
 import { DbSecretsVaultService } from '../modules/secrets-vault/index.js';
@@ -42,6 +48,7 @@ import { InternalTokenService } from '../modules/tool-auth/internal-token.servic
 import { createToolAuthMiddleware, createManualAuthMiddleware } from '../modules/tool-auth/tool-auth.middleware.js';
 import { type ILlmUsageMeter } from '../modules/tool-auth/llm-usage-meter.js';
 import { McpService } from '../modules/mcp/mcp.service.js';
+import { type AgentPreambleReader } from '../modules/agent-instructions/index.js';
 import { createMcpAuthMiddleware } from '../modules/mcp/mcp-auth.middleware.js';
 import { BevelOAuthProvider } from '../modules/mcp/oauth/bevel-oauth-provider.js';
 import { ToolRegistry } from '../modules/tool-registry/tool-registry.js';
@@ -61,6 +68,26 @@ import { type CorePorts } from './core-ports.js';
 export interface CoreServices {
     config: CoreConfig;
     db: Database;
+    /**
+     * Reading the disk without locks — the one tree walk and the one path
+     * probe (see `shared/fs.contract.ts`). Every core module that reads a
+     * checkout is handed this; an overlay's own readers take it too, rather
+     * than carrying a `readdir` loop or an errno check of their own.
+     */
+    disk: ITreeWalker & IFsProbe;
+    /**
+     * Running git — the one runner every module shells out through, carrying
+     * the deployment's deadline. Exposed like `disk` so an overlay's own git
+     * callers run under the same ceiling rather than spawning their own.
+     */
+    gitRunner: IGitRunner;
+    /**
+     * The commit-worker lease loop (see `core/lifecycle.ts`). `held` says
+     * whether THIS process is the one draining the queue; `stop()` is the
+     * shutdown sequence's way of finishing the in-flight commit and handing the
+     * lease to the replacement.
+     */
+    commitWorker: LeaseLoopHandle;
     workspaceService: WorkspaceService;
     /**
      * The KB startup phase (see `startup/on-server-start.ts`): run at the
@@ -72,15 +99,33 @@ export interface CoreServices {
     docExtractService: DocExtractService;
     accessControl: AccessControlService;
     creatorAccess: CreatorAccessService;
+    /** Read-before-write, for the surfaces that ask ahead of the lock (see `access-model/change-gate.ts`). */
+    changeGate: ChangeReadGate;
     sessionOntologyService: SessionOntologyService;
     routineWritePolicy: RoutineWritePolicyService;
     skillService: SkillService;
     pendingSkillsService: PendingSkillsService;
     toolManualService: ToolManualService;
+    pendingToolsService: PendingToolsService;
+    /**
+     * Reads the admin's `mcp-description.md` on the default branch with
+     * platform rights: the one reader behind every MCP session's instructions
+     * and `GET /api/agent/instructions`. See modules/agent-instructions.
+     */
+    readAgentPreamble: AgentPreambleReader;
     mcpServerEditService: McpServerEditService;
+    /** Deleting one tool — the owner's verb (see ToolDeleteService). */
+    toolDeleteService: ToolDeleteService;
     pluginIndexService: PluginIndexService;
     pluginProvisionService: PluginProvisionService;
     joinRequestsService: JoinRequestsService;
+    /**
+     * Records a join request and finishes it in the background. Its `sweep()`
+     * runs once at boot — see `createCoreServer`, after the knowledge-base
+     * startup phase — so a request recorded before a restart is completed or
+     * marked failed after it rather than lost.
+     */
+    pluginJoinRequestJobs: PluginJoinRequestJobs;
     /** Which plugins hold which skills (inline or linked) — see `PluginLinkIndex`. */
     pluginLinkIndex: PluginLinkIndex;
     /** Link / unlink / repair shared skills into plugins. */
@@ -112,6 +157,8 @@ export interface CoreServices {
     adminAccess: AdminAccessService;
     /** Manual-mode groups CRUD + the manual→IdP retirement half. */
     groupsAdminService: GroupsAdminService;
+    /** Removes a deleted account's address from roles, groups and access rules. */
+    userAccessRemovalService: UserAccessRemovalService;
     /**
      * Build the debounced directory → `synced-groups.yaml` materializer for a
      * directory source an OVERLAY provides (e.g. a SCIM mirror fed by the IdP's