@bevel-software/platform-core-backend 0.19.0 → 0.20.0

package/dist/modules/access/group-files.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"group-files.js","sourceRoot":"","sources":["../../../src/modules/access/group-files.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AACzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,YAAY,CAAC;IAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,gCAAgC,CAAC;IACpE,4CAA4C;IAC5C,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,6BAA6B,CAAC;IACtE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACtD,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7D,OAAO,6BAA6B,iBAAiB,sDAAsD,CAAC;IAC9G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAuBD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,QAAgB;IAEhB,oEAAoE;IACpE,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;IAE/E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;IAC1B,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,+BAA+B,CAAC,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,UAAU,GAAI,IAAgC,CAAC,MAAM,CAAC;IAC5D,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,UAAU,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7E,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,8BAA8B,CAAC,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAgB,IAAI,GAAG,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAqC,CAAC,EAAE,CAAC;QACzF,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,8BAA8B,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,+BAA+B;QAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,WAAW,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,MAAM,YAAY,CACxE,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,YAAY,WAAW,yBAAyB,SAAS,aAAa,CAClF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,YAAY,WAAW,uBAAuB,SAAS,2BAA2B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,WAAW,aAAa,CAC7I,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,YAAY,WAAW,sCAAsC,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,YAAY,WAAW,0CAA0C,CAAC,CAAC;gBAC5F,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAClC,0DAA0D;YAC1D,mEAAmE;YACnE,uEAAuE;YACvE,uEAAuE;YACvE,4DAA4D;YAC5D,IAAI,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,YAAY,WAAW,YAAY,gBAAgB,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,+DAA+D,CACrK,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,YAAY,WAAW,0BAA0B,GAAG,mBAAmB,CACnF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,QAAgB;IAEhB,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC9E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/modules/access/kb-read-filter.d.ts

@@ -1,41 +0,0 @@
-/**
- * Shared read-filter primitive.
- *
- * One place that knows how to turn workspace-relative paths into read verdicts,
- * reused by every surface that must hide nodes a user can't read: the agent
- * tools (`read_file`/`list_files`/`grep`), the file-explorer tree, the content
- * routes, the diff/review routes, and the KB graph.
- *
- * It deliberately shares only the PRIMITIVE — the path mapping and the batched
- * verdict map — NOT the inclusion policy. Callers differ on that: the agent's
- * `list_files` keeps directory entries visible (a restricted child is filtered
- * when read), whereas the explorer tree hides a restricted directory's whole
- * subtree. Each caller applies the verdict to its own policy.
- *
- * It is parameterized by the access method to call (`ReadBatchFn`); every
- * caller — the tree, the agent tools, and the graph — now uses the full
- * `canReadBatch` (folder chain + per-node frontmatter `read:` rules), with the
- * per-file frontmatter reads memoized inside the access service.
- */
-/**
- * A batched read check over KB-repo-relative paths. Returns a map keyed by the
- * input paths. `IAccessControl.canReadBatch` satisfies this shape.
- */
-export type ReadBatchFn = (workspaceId: string, userEmail: string, kbRelPaths: string[]) => Promise<Map<string, boolean>>;
-/**
- * Map a workspace-relative path to its KB-repo-relative form (what the access
- * tree is keyed on), or null when the path is outside the KB repo — reserved
- * workspace files and the KB dir itself carry no `read:` rules and are never
- * gated. Tolerates a leading `./` or `/` and a trailing `/`.
- */
-export declare function toKbRelative(p: string, kbDirName: string): string | null;
-/**
- * Resolve read verdicts for a set of workspace-relative paths in ONE batched
- * access call. Non-KB paths (outside `kbDirName`) are always readable — they
- * carry no `read:` rules. KB paths are checked via `batchFn`. Returns a map
- * keyed by the original `wsPaths` (so callers can look up by the entry path
- * they passed). A path absent from the access verdict resolves to `false`
- * (fail-closed) — never silently readable.
- */
-export declare function resolveReadableMap(batchFn: ReadBatchFn, workspaceId: string, userEmail: string, kbDirName: string, wsPaths: string[]): Promise<Map<string, boolean>>;
-//# sourceMappingURL=kb-read-filter.d.ts.map

package/dist/modules/access/kb-read-filter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"kb-read-filter.d.ts","sourceRoot":"","sources":["../../../src/modules/access/kb-read-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAAE,KACjB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnC;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMxE;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,WAAW,EACpB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAiB/B"}

package/dist/modules/access/kb-read-filter.js

@@ -1,60 +0,0 @@
-/**
- * Shared read-filter primitive.
- *
- * One place that knows how to turn workspace-relative paths into read verdicts,
- * reused by every surface that must hide nodes a user can't read: the agent
- * tools (`read_file`/`list_files`/`grep`), the file-explorer tree, the content
- * routes, the diff/review routes, and the KB graph.
- *
- * It deliberately shares only the PRIMITIVE — the path mapping and the batched
- * verdict map — NOT the inclusion policy. Callers differ on that: the agent's
- * `list_files` keeps directory entries visible (a restricted child is filtered
- * when read), whereas the explorer tree hides a restricted directory's whole
- * subtree. Each caller applies the verdict to its own policy.
- *
- * It is parameterized by the access method to call (`ReadBatchFn`); every
- * caller — the tree, the agent tools, and the graph — now uses the full
- * `canReadBatch` (folder chain + per-node frontmatter `read:` rules), with the
- * per-file frontmatter reads memoized inside the access service.
- */
-/**
- * Map a workspace-relative path to its KB-repo-relative form (what the access
- * tree is keyed on), or null when the path is outside the KB repo — reserved
- * workspace files and the KB dir itself carry no `read:` rules and are never
- * gated. Tolerates a leading `./` or `/` and a trailing `/`.
- */
-export function toKbRelative(p, kbDirName) {
-    const norm = p.replace(/^\.?\/+/, '').replace(/\/+$/, '');
-    const prefix = `${kbDirName}/`;
-    if (!norm.startsWith(prefix))
-        return null;
-    const rel = norm.slice(prefix.length);
-    return rel.length > 0 ? rel : null;
-}
-/**
- * Resolve read verdicts for a set of workspace-relative paths in ONE batched
- * access call. Non-KB paths (outside `kbDirName`) are always readable — they
- * carry no `read:` rules. KB paths are checked via `batchFn`. Returns a map
- * keyed by the original `wsPaths` (so callers can look up by the entry path
- * they passed). A path absent from the access verdict resolves to `false`
- * (fail-closed) — never silently readable.
- */
-export async function resolveReadableMap(batchFn, workspaceId, userEmail, kbDirName, wsPaths) {
-    const relByWsPath = new Map();
-    for (const wp of wsPaths) {
-        const rel = toKbRelative(wp, kbDirName);
-        if (rel !== null)
-            relByWsPath.set(wp, rel);
-    }
-    const verdict = relByWsPath.size > 0
-        ? await batchFn(workspaceId, userEmail, [...new Set(relByWsPath.values())])
-        : new Map();
-    const out = new Map();
-    for (const wp of wsPaths) {
-        const rel = relByWsPath.get(wp);
-        // Non-KB path → always readable. KB path → the verdict, fail-closed if absent.
-        out.set(wp, rel === undefined ? true : verdict.get(rel) === true);
-    }
-    return out;
-}
-//# sourceMappingURL=kb-read-filter.js.map

package/dist/modules/access/kb-read-filter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"kb-read-filter.js","sourceRoot":"","sources":["../../../src/modules/access/kb-read-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAYH;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,SAAiB;IACvD,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,GAAG,SAAS,GAAG,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAoB,EACpB,WAAmB,EACnB,SAAiB,EACjB,SAAiB,EACjB,OAAiB;IAEjB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI;YAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,OAAO,GACX,WAAW,CAAC,IAAI,GAAG,CAAC;QAClB,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,+EAA+E;QAC/E,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/modules/access/render-roles-yaml.d.ts

@@ -1,22 +0,0 @@
-/**
- * Render a `roles.yaml` granting Admin to each email — the ONE renderer every
- * generated roles.yaml goes through (empty-remote seeding, the startup
- * top-up, and the break-glass recovery), so none of them can drift on
- * validation and each fails with the same actionable message.
- *
- * Each email is validated first, because a malformed one renders a file with
- * no working Admin — SILENTLY: a leading `#` turns the entry into a YAML
- * comment, an embedded newline breaks the list, an all-whitespace value
- * renders an empty entry. A bad ADMIN_EMAIL is operator error, and the
- * callers' fail-closed contracts want a message naming the fix instead of an
- * un-administrable knowledge base (or a write-validator rejection deep in the
- * recovery path).
- */
-export declare function renderRolesYaml(adminEmails: readonly string[], 
-/**
- * Provenance comment appended to the header. The seed/top-up default names
- * where the file came from; recovery passes `null` — claiming "generated at
- * KB-seed time" on a recovery-restored file would mislead whoever reads it.
- */
-provenance?: string | null): string;
-//# sourceMappingURL=render-roles-yaml.d.ts.map

package/dist/modules/access/render-roles-yaml.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"render-roles-yaml.d.ts","sourceRoot":"","sources":["../../../src/modules/access/render-roles-yaml.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,SAAS,MAAM,EAAE;AAC9B;;;;GAIG;AACH,UAAU,GAAE,MAAM,GAAG,IAA0E,GAC9F,MAAM,CAwCR"}

package/dist/modules/access/render-roles-yaml.js

@@ -1,56 +0,0 @@
-import { parseRolesYaml } from './access-control.service.js';
-/**
- * Render a `roles.yaml` granting Admin to each email — the ONE renderer every
- * generated roles.yaml goes through (empty-remote seeding, the startup
- * top-up, and the break-glass recovery), so none of them can drift on
- * validation and each fails with the same actionable message.
- *
- * Each email is validated first, because a malformed one renders a file with
- * no working Admin — SILENTLY: a leading `#` turns the entry into a YAML
- * comment, an embedded newline breaks the list, an all-whitespace value
- * renders an empty entry. A bad ADMIN_EMAIL is operator error, and the
- * callers' fail-closed contracts want a message naming the fix instead of an
- * un-administrable knowledge base (or a write-validator rejection deep in the
- * recovery path).
- */
-export function renderRolesYaml(adminEmails, 
-/**
- * Provenance comment appended to the header. The seed/top-up default names
- * where the file came from; recovery passes `null` — claiming "generated at
- * KB-seed time" on a recovery-restored file would mislead whoever reads it.
- */
-provenance = 'Generated by the Bevel platform at KB-seed time from ADMIN_EMAIL.') {
-    const emails = adminEmails.map((raw) => {
-        const email = raw.trim();
-        if (email === '') {
-            throw new Error('Seed admin email is empty — set ADMIN_EMAIL to a real address.');
-        }
-        if (email.startsWith('#')) {
-            throw new Error(`Seed admin email ${JSON.stringify(raw)} starts with "#", which YAML reads as a comment — fix ADMIN_EMAIL.`);
-        }
-        if (/\s/.test(email)) {
-            throw new Error(`Seed admin email ${JSON.stringify(raw)} contains whitespace, which would corrupt roles.yaml — fix ADMIN_EMAIL.`);
-        }
-        return email;
-    });
-    const lines = emails.map((e) => `    - ${e}`).join('\n');
-    const text = '# Identity → role mapping for access control.\n' +
-        '# Role names are case- and whitespace-insensitive. The `Admin` role is special:\n' +
-        '# only Admins may edit this file, and at least one Admin must always exist.\n' +
-        (provenance !== null ? `#\n# ${provenance}\n` : '') +
-        'roles:\n' +
-        '  Admin:\n' +
-        `${lines}\n`;
-    // Validate by PARSING with the real access parser, not by re-implementing
-    // its email grammar: whatever the parser would reject (a `<Name <email>`
-    // shape, a non-email string, tomorrow's new rule) must fail here, before an
-    // un-administrable roles.yaml gets committed. The checks above exist only
-    // to give the common mistakes sharper messages.
-    const parsed = parseRolesYaml(text);
-    if (!parsed.ok) {
-        throw new Error(`Generated roles.yaml from ADMIN_EMAIL would not parse — fix the configured address(es). ` +
-            parsed.errors.join('; '));
-    }
-    return text;
-}
-//# sourceMappingURL=render-roles-yaml.js.map

package/dist/modules/access/render-roles-yaml.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"render-roles-yaml.js","sourceRoot":"","sources":["../../../src/modules/access/render-roles-yaml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,WAA8B;AAC9B;;;;GAIG;AACH,aAA4B,mEAAmE;IAE/F,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,oEAAoE,CAC5G,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yEAAyE,CACjH,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,GACR,iDAAiD;QACjD,mFAAmF;QACnF,+EAA+E;QAC/E,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,UAAU;QACV,YAAY;QACZ,GAAG,KAAK,IAAI,CAAC;IACf,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,gDAAgD;IAChD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,0FAA0F;YACxF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/modules/access/roles-yaml-guard.d.ts

@@ -1,56 +0,0 @@
-/**
- * Pre-disk validity gate for `roles.yaml`.
- *
- * WHY this exists: `roles.yaml` is the single point of failure for the whole
- * app. The runtime resolver's `loadModel` HARD-THROWS `AccessConfigError` on a
- * parse failure, and `isAdmin` swallows that into `false` for EVERYONE — so a
- * single malformed `roles.yaml` is an app-wide, in-app-unrecoverable admin
- * lockout. The dedicated Roles & Members service already validates every
- * candidate before writing (`assertLoadable`), but the two RAW write paths do
- * not:
- *   - the human editor save  (`PUT /workspace/:id/file`)
- *   - the agent's file tools (`LockingFilesystem.writeFile` / `writeFiles`)
- *
- * Both of those let an admin (or an admin-driven agent) commit a broken file.
- * This guard plugs them: it runs the resolver's OWN parser on the candidate
- * BEFORE a byte hits disk, and refuses the write with a 422 on any error. A
- * write that passes here is loadable by `loadModel`, so the lockout becomes
- * structurally unreachable through normal edits.
- *
- * The break-glass recovery path (for a file that got broken some OTHER way —
- * a direct git push, a pre-guard commit) lives in `roles-admin.service.ts`.
- */
-import type { FileContent } from '@mastra/core/workspace';
-import { WorkflowDomainError } from '../workflow/workflow.errors.js';
-/** Repo-relative basename of the roles file (it lives at the KB repo root). */
-export declare const ROLES_YAML_BASENAME = "roles.yaml";
-/**
- * A raw write whose candidate `roles.yaml` would not parse. 422 (bad input) —
- * the edit is refused and nothing is written. Carries the parser errors so the
- * editor / agent can show exactly what's wrong.
- */
-export declare class RolesYamlInvalidError extends WorkflowDomainError {
-    readonly errors: string[];
-    constructor(errors: string[]);
-}
-/**
- * True iff `workspaceRelPath` targets the KB's `roles.yaml` (the file at
- * `<kbDirName>/roles.yaml`). Both the human save route and the agent's
- * `LockingFilesystem` speak workspace-relative paths, so this is the form we
- * key on. A bare `roles.yaml` (no KB prefix) is also accepted defensively.
- */
-export declare function isRolesYamlPath(workspaceRelPath: string, kbDirName: string): boolean;
-/**
- * Throw {@link RolesYamlInvalidError} if `content` does not parse as a valid
- * `roles.yaml` per the resolver's own parser. No-op on valid content.
- */
-export declare function assertRolesYamlParsable(content: string): void;
-/**
- * A `LockingFilesystem` write-validator scoped to a KB dir: refuses a raw write
- * that would leave `roles.yaml` unparseable. Pass the returned closure as the
- * filesystem's `validateWrite` hook. Only string writes are checked — every
- * code path that writes `roles.yaml` writes it as text; a binary write to that
- * path is nonsensical and left alone.
- */
-export declare function makeRolesYamlWriteValidator(kbDirName: string): (path: string, content: FileContent) => void;
-//# sourceMappingURL=roles-yaml-guard.d.ts.map

package/dist/modules/access/roles-yaml-guard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"roles-yaml-guard.d.ts","sourceRoot":"","sources":["../../../src/modules/access/roles-yaml-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACd,MAAM,EAAE,MAAM,EAAE;CAS7B;AAOD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAGpF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAG7D;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,GAChB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,IAAI,CAM9C"}

package/dist/modules/access/roles-yaml-guard.js

@@ -1,79 +0,0 @@
-/**
- * Pre-disk validity gate for `roles.yaml`.
- *
- * WHY this exists: `roles.yaml` is the single point of failure for the whole
- * app. The runtime resolver's `loadModel` HARD-THROWS `AccessConfigError` on a
- * parse failure, and `isAdmin` swallows that into `false` for EVERYONE — so a
- * single malformed `roles.yaml` is an app-wide, in-app-unrecoverable admin
- * lockout. The dedicated Roles & Members service already validates every
- * candidate before writing (`assertLoadable`), but the two RAW write paths do
- * not:
- *   - the human editor save  (`PUT /workspace/:id/file`)
- *   - the agent's file tools (`LockingFilesystem.writeFile` / `writeFiles`)
- *
- * Both of those let an admin (or an admin-driven agent) commit a broken file.
- * This guard plugs them: it runs the resolver's OWN parser on the candidate
- * BEFORE a byte hits disk, and refuses the write with a 422 on any error. A
- * write that passes here is loadable by `loadModel`, so the lockout becomes
- * structurally unreachable through normal edits.
- *
- * The break-glass recovery path (for a file that got broken some OTHER way —
- * a direct git push, a pre-guard commit) lives in `roles-admin.service.ts`.
- */
-import { parseRolesYaml } from './access-control.service.js';
-import { WorkflowDomainError } from '../workflow/workflow.errors.js';
-/** Repo-relative basename of the roles file (it lives at the KB repo root). */
-export const ROLES_YAML_BASENAME = 'roles.yaml';
-/**
- * A raw write whose candidate `roles.yaml` would not parse. 422 (bad input) —
- * the edit is refused and nothing is written. Carries the parser errors so the
- * editor / agent can show exactly what's wrong.
- */
-export class RolesYamlInvalidError extends WorkflowDomainError {
-    errors;
-    constructor(errors) {
-        super(`roles.yaml would be invalid and was not saved: ${errors.join('; ')}`, 422, { kind: 'roles-yaml-invalid', rolesYamlErrors: errors });
-        this.name = 'RolesYamlInvalidError';
-        this.errors = errors;
-    }
-}
-/** Normalise a workspace-relative path: backslashes → `/`, strip a leading `./`. */
-function normalizeWsPath(p) {
-    return p.replace(/\\/g, '/').replace(/^\.\//, '');
-}
-/**
- * True iff `workspaceRelPath` targets the KB's `roles.yaml` (the file at
- * `<kbDirName>/roles.yaml`). Both the human save route and the agent's
- * `LockingFilesystem` speak workspace-relative paths, so this is the form we
- * key on. A bare `roles.yaml` (no KB prefix) is also accepted defensively.
- */
-export function isRolesYamlPath(workspaceRelPath, kbDirName) {
-    const norm = normalizeWsPath(workspaceRelPath);
-    return norm === `${kbDirName}/${ROLES_YAML_BASENAME}` || norm === ROLES_YAML_BASENAME;
-}
-/**
- * Throw {@link RolesYamlInvalidError} if `content` does not parse as a valid
- * `roles.yaml` per the resolver's own parser. No-op on valid content.
- */
-export function assertRolesYamlParsable(content) {
-    const parsed = parseRolesYaml(content);
-    if (!parsed.ok)
-        throw new RolesYamlInvalidError(parsed.errors);
-}
-/**
- * A `LockingFilesystem` write-validator scoped to a KB dir: refuses a raw write
- * that would leave `roles.yaml` unparseable. Pass the returned closure as the
- * filesystem's `validateWrite` hook. Only string writes are checked — every
- * code path that writes `roles.yaml` writes it as text; a binary write to that
- * path is nonsensical and left alone.
- */
-export function makeRolesYamlWriteValidator(kbDirName) {
-    return (path, content) => {
-        if (typeof content !== 'string')
-            return;
-        if (!isRolesYamlPath(path, kbDirName))
-            return;
-        assertRolesYamlParsable(content);
-    };
-}
-//# sourceMappingURL=roles-yaml-guard.js.map

package/dist/modules/access/roles-yaml-guard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"roles-yaml-guard.js","sourceRoot":"","sources":["../../../src/modules/access/roles-yaml-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEhD;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,MAAM,CAAW;IAC1B,YAAY,MAAgB;QAC1B,KAAK,CACH,kDAAkD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACrE,GAAG,EACH,EAAE,IAAI,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,EAAE,CACxD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,gBAAwB,EAAE,SAAiB;IACzE,MAAM,IAAI,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAC/C,OAAO,IAAI,KAAK,GAAG,SAAS,IAAI,mBAAmB,EAAE,IAAI,IAAI,KAAK,mBAAmB,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB;IAEjB,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO;QACxC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;YAAE,OAAO;QAC9C,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/diff/diff-paths.d.ts

@@ -1,2 +0,0 @@
-export declare function assertWithinDirectory(absolutePath: string, dir: string): void;
-//# sourceMappingURL=diff-paths.d.ts.map

package/dist/modules/diff/diff-paths.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"diff-paths.d.ts","sourceRoot":"","sources":["../../../src/modules/diff/diff-paths.ts"],"names":[],"mappings":"AAEA,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAM7E"}

package/dist/modules/diff/diff-paths.js

@@ -1,9 +0,0 @@
-import path from 'node:path';
-export function assertWithinDirectory(absolutePath, dir) {
-    const resolved = path.resolve(absolutePath);
-    const root = path.resolve(dir);
-    if (!resolved.startsWith(root + path.sep) && resolved !== root) {
-        throw new Error('Path traversal detected');
-    }
-}
-//# sourceMappingURL=diff-paths.js.map

package/dist/modules/diff/diff-paths.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"diff-paths.js","sourceRoot":"","sources":["../../../src/modules/diff/diff-paths.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,GAAW;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC"}

package/dist/modules/groups/group-provision.service.d.ts

@@ -1,130 +0,0 @@
-/**
- * Group provisioning — the ONE privileged door for bringing a `Groups/<name>/`
- * folder into existence, and (via {@link GroupProvisionService.deleteGroup})
- * for taking one back out of it.
- *
- * Creating a group is the single operation the access model cannot govern
- * from inside: the folder that will carry the rules does not exist yet, and
- * the root's own rule (`write: Admin`) says no. The old answer was a
- * carve-out inside the generic write gate — every write path could claim an
- * unused name under `Groups/`, and the gate had to re-derive "is this that
- * one blessed case?" on every check. This service replaces that: the generic
- * gate is uniformly strict again, and the privilege lives here, named,
- * behind its own endpoint.
- *
- * What a provision IS: one exclusive write of the new folder's `access.md`
- * (flag `wx`, so two concurrent creators race for the fs, not for the
- * overwrite), then one SYNCHRONOUS commit+push. Synchronous on purpose — the
- * write gate reads rules at HEAD, so a creation whose access.md were still
- * sitting in the async commit queue would 403 the very next thing its
- * creator does (writing the first skill into it).
- *
- * Two shapes, two templates:
- *
- *   - A NAMED group: discoverable by design. The access.md's own frontmatter
- *     reads `everyone` — anyone may open the FILE, see the group listed, and
- *     ask to join — while the BODY (the folder's actual rules) names only
- *     the creator under read, write and owner.
- *   - A PERSONAL folder (`personal-<user-id>`): private by design. No
- *     frontmatter grant at all, so nobody else can even see it exists; the
- *     body names its owner. Created lazily (ensure semantics) on the first
- *     personal skill.
- */
-import { type AuthUser } from '@bevel-software/platform-shared';
-import type { WorkspaceService } from '../workspace/workspace.service.js';
-import type { IAccessControl } from '../access/access-control.interface.js';
-/** Commit machinery the provision rides — the pending-commit pipeline, run inline. */
-export interface ProvisionCommitDriver {
-    runPendingCommit(workspaceId: string, branch: string, targetPath: string, user: AuthUser, opts?: {
-        systemAuthorized?: boolean;
-    }): Promise<void>;
-}
-export interface ProvisionedGroup {
-    /** The folder name under `Groups/` (not the full path). */
-    folder: string;
-    /** False when an ensure found the folder already there. */
-    created: boolean;
-}
-/** A refusal the route can pass through: message + HTTP status. */
-export declare class GroupProvisionError extends Error {
-    readonly status: number;
-    constructor(message: string, status: number);
-}
-export declare class GroupProvisionService {
-    private readonly workspaceService;
-    private readonly commits;
-    private readonly accessControl;
-    private readonly kbDirName;
-    private readonly events?;
-    /**
-     * Serialises creations by NORMALIZED (lowercased) folder name. The wx write
-     * arbitrates same-path races, but on a case-sensitive filesystem `GTM` and
-     * `gtm` are different paths — without this lock two concurrent requests
-     * could both pass the collision check and both land, breaking the
-     * case-insensitive uniqueness the check promises.
-     */
-    private readonly creations;
-    constructor(workspaceService: WorkspaceService, commits: ProvisionCommitDriver, accessControl: IAccessControl, kbDirName: string, events?: {
-        emit(event: {
-            kind: "fs-tree-changed";
-            workspaceId: string;
-            branch: string;
-        }): void;
-    } | undefined);
-    /**
-     * Create `Groups/<name>/` for `user`. Throws `GroupProvisionError` 422 on a
-     * name the filesystem or the model cannot carry, 409 when the name is taken
-     * (case-insensitively — the workspaces live on case-insensitive
-     * filesystems too, where `GTM` and `gtm` are one folder).
-     */
-    createGroup(user: AuthUser, rawName: string): Promise<ProvisionedGroup>;
-    /**
-     * Ensure the caller's personal folder exists — idempotent, keyed to the
-     * stable user id. Returns `created: false` when it is already there.
-     */
-    ensurePersonalGroup(user: AuthUser): Promise<ProvisionedGroup>;
-    /**
-     * Delete `Groups/<name>/` — the whole folder, its skills and tools
-     * included, in ONE commit. MECHANISM only: the route owns the
-     * authorization (the caller must hold the `owner` verb on the folder;
-     * this service never re-derives it), exactly as `createGroup` leaves
-     * "any signed-in user" to its endpoint.
-     *
-     * Shape mirrors a provision run in reverse, with the same failure
-     * contract: the folder is PARKED (renamed to a dot-prefixed sibling the
-     * scanners ignore) rather than removed, the deletion is committed
-     * synchronously, and only a landed commit lets the parked bytes go. A
-     * refused commit renames the folder back, so a failed delete leaves the
-     * group exactly as it was — never half-gone on disk while origin still
-     * carries it.
-     *
-     * Serialised on the same per-name lock creations use, so a delete can
-     * never interleave with a re-creation of the same name.
-     */
-    deleteGroup(user: AuthUser, rawName: string): Promise<void>;
-    /** The taken name (in its on-disk casing) colliding with `name`, or null. */
-    private existingFolder;
-    private provision;
-    private readyWorkspaceId;
-}
-/**
- * A named group's access.md: discoverable file (frontmatter `read: everyone`
- * — anyone may see the group listed and ask to join), creator-run folder
- * (body read/write/owner name the creator). The `read: []` placeholder makes
- * the body parse as rules from the first byte, so every later splice targets
- * the body rather than the frontmatter.
- */
-export declare function groupAccessMd(creator: {
-    name: string;
-    email: string;
-}): string;
-/**
- * A personal folder's access.md: PRIVATE — no frontmatter grant, so the
- * folder is invisible to everyone but its owner; the body names the owner
- * under read, write and owner.
- */
-export declare function personalAccessMd(creator: {
-    name: string;
-    email: string;
-}): string;
-//# sourceMappingURL=group-provision.service.d.ts.map

package/dist/modules/groups/group-provision.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"group-provision.service.d.ts","sourceRoot":"","sources":["../../../src/modules/groups/group-provision.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAML,KAAK,QAAQ,EACd,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAK5E,sFAAsF;AACtF,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,QAAQ,EACd,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAAE,GACpC,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,mEAAmE;AACnE,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADvB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;CAK1B;AAED,qBAAa,qBAAqB;IAW9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAd1B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;gBAG/B,gBAAgB,EAAE,gBAAgB,EAClC,OAAO,EAAE,qBAAqB,EAC9B,aAAa,EAAE,cAAc,EAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,iBAAiB,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,YAAA;IAGnH;;;;;OAKG;IACG,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA8B7E;;;OAGG;IACG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAqBpE;;;;;;;;;;;;;;;;;OAiBG;IACG,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyDjE,6EAA6E;YAC/D,cAAc;YAad,SAAS;YA+CT,gBAAgB;CAI/B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE9E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEjF"}