npm - @bevel-software/platform-core-backend - Versions diffs - 0.22.0 → 0.24.0 - Mend

@bevel-software/platform-core-backend 0.22.0 → 0.24.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (466) hide show

package/dist/shared/column-crypto.js ADDED Viewed

@@ -0,0 +1,144 @@
+import { createHmac, hkdfSync } from 'node:crypto';
+import { customType } from 'drizzle-orm/pg-core';
+import { TokenCrypto, assertKeyDecodesTo32Bytes } from './token-crypto.js';
+/** Derive the personal-data keys from a deployment's (or a tenant's) `SECRETS_ENC_KEY`. */
+export function derivePiiKeys(secretsEncKey) {
+    const ikm = assertKeyDecodesTo32Bytes(secretsEncKey, 'SECRETS_ENC_KEY');
+    const columnKey = Buffer.from(hkdfSync('sha256', ikm, Buffer.alloc(0), 'bevel-pii-column-v1', 32));
+    const bidxKey = Buffer.from(hkdfSync('sha256', ikm, Buffer.alloc(0), 'bevel-pii-bidx-v1', 32));
+    const crypto = new TokenCrypto(columnKey.toString('base64'));
+    const open = (value) => {
+        if (!isEncryptedBlob(value))
+            return { ok: true, plain: value };
+        try {
+            return { ok: true, plain: crypto.decrypt(value.slice(PII_CIPHERTEXT_PREFIX.length)) };
+        }
+        catch {
+            return { ok: false };
+        }
+    };
+    return {
+        seal: (plain) => (plain === '' ? '' : PII_CIPHERTEXT_PREFIX + crypto.encrypt(plain)),
+        open,
+        read: (value) => {
+            const opened = open(value);
+            return opened.ok ? opened.plain : value;
+        },
+        index: (value) => createHmac('sha256', bidxKey).update(value.trim().toLowerCase()).digest('hex'),
+    };
+}
+/**
+ * Every PII ciphertext starts with this marker. An explicit prefix — rather
+ * than recognising ciphertext by its `iv:tag:ct` shape — means legacy
+ * plaintext can never be mistaken for ciphertext (and silently skipped by the
+ * backfill), and lets the backfill find unsealed rows with a plain SQL
+ * predicate instead of scanning every row in the app. Bump the version
+ * segment if the format ever changes.
+ */
+export const PII_CIPHERTEXT_PREFIX = 'pii:v1:';
+/**
+ * The shape of a PII ciphertext blob, as ONE pattern both Postgres and this
+ * process read: the version prefix followed by base64 segments of the exact
+ * widths GCM produces (12-byte IV → 16 chars, 16-byte tag → 22 chars + `==`).
+ * Lets the backfill find unsealed rows with a `!~` predicate instead of
+ * scanning every row in the app.
+ *
+ * {@link isEncryptedBlob} is built FROM it rather than written beside it. The
+ * two used to be separate spellings of one idea, and they disagreed: the
+ * JavaScript one decoded each part and so took an unpadded tag for a 16-byte
+ * one, which this pattern does not. A value the two disagreed about was
+ * selected by the backfill's SQL as unsealed and then skipped by its
+ * JavaScript as sealed, on every start, and stayed in clear for good. The
+ * pattern uses nothing POSIX and JavaScript read differently.
+ */
+export const PII_SEALED_SHAPE_SQL_REGEX = `^${PII_CIPHERTEXT_PREFIX}[A-Za-z0-9+/]{16}:[A-Za-z0-9+/]{22}==:[A-Za-z0-9+/]+={0,2}$`;
+const PII_SEALED_SHAPE = new RegExp(PII_SEALED_SHAPE_SQL_REGEX);
+/**
+ * Whether `value` has the shape of a PII ciphertext blob — exactly the values
+ * {@link PII_SEALED_SHAPE_SQL_REGEX} matches in the database, no more and no
+ * fewer. Shape only: whether the configured key OPENS it is `PiiKeys.open`'s
+ * answer, and a plaintext somebody typed in this shape passes here.
+ */
+export function isEncryptedBlob(value) {
+    return PII_SEALED_SHAPE.test(value);
+}
+/**
+ * A value on its way to the database that the handle's connection still has
+ * to turn into what is stored. It is never a storable value itself: `pg`
+ * asks an object how to serialise itself through `toPostgres`, and this one
+ * refuses, so a statement that reaches a connection which did not replace it
+ * — a pool built without `createDb`, or a handle built without a key — fails
+ * instead of writing the plaintext.
+ */
+export class PiiParam {
+    plain;
+    constructor(plain) {
+        this.plain = plain;
+    }
+    toPostgres() {
+        throw new Error('A personal-data value reached a database connection that holds no key for it. ' +
+            'Build the handle with createDb/getDb and its piiKey (createCoreServices does).');
+    }
+}
+/** Plaintext of an {@link encryptedText} column: stored as ciphertext. */
+export class SealOnWrite extends PiiParam {
+    stored(keys) {
+        return keys.seal(this.plain);
+    }
+}
+/** The address a {@link blindIndexText} column is written or compared with: stored as its blind index. */
+export class IndexOnWrite extends PiiParam {
+    stored(keys) {
+        return keys.index(this.plain);
+    }
+}
+/**
+ * Drizzle column type for encrypted PII text: services read and write
+ * plaintext, the database only ever sees ciphertext. NEVER use an
+ * `encryptedText` column in a WHERE clause or conflict target — the fresh IV
+ * per write means `eq(column, plaintext)` silently matches nothing. Equality
+ * goes through the column's `*_bidx` companion ({@link blindIndexText}).
+ */
+export const encryptedText = customType({
+    dataType() {
+        return 'text';
+    },
+    toDriver(value) {
+        // The mark, typed as the text it becomes on the handle's connection.
+        return (value === '' ? '' : new SealOnWrite(value));
+    },
+    fromDriver(value) {
+        // Already opened: the handle's connection opens every sealed value of a
+        // result before drizzle maps it.
+        return value;
+    },
+});
+const STORED_INDEX = /^[0-9a-f]{64}$/;
+/**
+ * Drizzle column type for the blind index beside an encrypted column. WRITE
+ * AND COMPARE IT WITH THE VALUE ITSELF — `emailBidx: email`,
+ * `eq(users.emailBidx, email)`, `inArray(users.emailBidx, emails)` — and the
+ * handle's connection stores or binds its index. Reading the column gives the
+ * stored index, which is good for nothing but SQL: writing it back would
+ * index the index, so that is refused. A row copied from another carries the
+ * value its index was made from, not the index.
+ *
+ * Only through drizzle's operators, which bind through the column: a value
+ * interpolated into a raw `sql` template is compared as it is and matches
+ * nothing.
+ */
+export const blindIndexText = customType({
+    dataType() {
+        return 'text';
+    },
+    toDriver(value) {
+        if (STORED_INDEX.test(value)) {
+            throw new Error('A blind-index column was written with a stored index. Write it with the value the index is of (the address).');
+        }
+        return new IndexOnWrite(value);
+    },
+    fromDriver(value) {
+        return value;
+    },
+});
+//# sourceMappingURL=column-crypto.js.map

package/dist/shared/column-crypto.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"column-crypto.js","sourceRoot":"","sources":["../../src/shared/column-crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AA+D3E,2FAA2F;AAC3F,MAAM,UAAU,aAAa,CAAC,aAAqB;IACjD,MAAM,GAAG,GAAG,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAoB,CAAC,KAAK,EAAE,EAAE;QACtC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACxF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpF,IAAI;QACJ,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;YACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1C,CAAC;QACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KACjG,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,qBAAqB,6DAA6D,CAAC;AAEjI,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAgB,QAAQ;IACP;IAArB,YAAqB,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAKtC,UAAU;QACR,MAAM,IAAI,KAAK,CACb,gFAAgF;YAC9E,gFAAgF,CACnF,CAAC;IACJ,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,WAAY,SAAQ,QAAQ;IACvC,MAAM,CAAC,IAAa;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,0GAA0G;AAC1G,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACxC,MAAM,CAAC,IAAa;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAuC;IAC5E,QAAQ;QACN,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,QAAQ,CAAC,KAAa;QACpB,qEAAqE;QACrE,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,CAAW,CAAC;IAChE,CAAC;IACD,UAAU,CAAC,KAAa;QACtB,wEAAwE;QACxE,iCAAiC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAuC;IAC7E,QAAQ;QACN,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,QAAQ,CAAC,KAAa;QACpB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,KAAK,CAAsB,CAAC;IACtD,CAAC;IACD,UAAU,CAAC,KAAa;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAC,CAAC"}

package/dist/shared/domain-errors.d.ts CHANGED Viewed

@@ -259,6 +259,31 @@ export declare class PathNotFoundError extends WorkflowDomainError {
     readonly path: string;
     constructor(path: string);
 }
+/**
+ * The one sentence every read of a past save answers when that save is not in
+ * the history of the branch being viewed.
+ *
+ * Written once, here, because four surfaces have to give the same answer: the
+ * bytes route (`?ref=`), the patch route (`show-file`), the before/after
+ * contents route (`file-at-change`), and anything later that serves a file at
+ * a commit. A save the history panel listed came off `git log` on this
+ * workspace's own branch, so it can never be refused this way — what this
+ * refuses is a sha from someone else's branch, or one that was invented.
+ */
+export declare const VERSION_NOT_ON_BRANCH_MESSAGE = "This version is not in this file's history on this branch.";
+/**
+ * The caller named a save that is not an ancestor of the branch this
+ * workspace has checked out.
+ *
+ * 404, and DELIBERATELY the same 404 for a sha that exists on another branch
+ * as for one that exists nowhere: telling the two apart would turn the route
+ * into an oracle for "does this commit exist in the repository", which is
+ * exactly the reading a branch-scoped rule exists to prevent.
+ */
+export declare class VersionNotOnBranchError extends WorkflowDomainError {
+    readonly kind: "version-not-on-branch";
+    constructor();
+}
 /**
  * An archive the caller uploaded that the zip reader cannot open. 422, not
  * 400: the request is well-formed and the path is fine — the BYTES are not a

package/dist/shared/domain-errors.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"domain-errors.d.ts","sourceRoot":"","sources":["../../src/shared/domain-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGxE,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAM/E;AAED,qBAAa,eAAgB,SAAQ,mBAAmB;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM;gBAA3C,MAAM,EAAE,MAAM,EAAW,UAAU,EAAE,MAAM;CAIxD;AAED,qBAAa,oBAAqB,SAAQ,mBAAmB;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAA3C,UAAU,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM;CAIjE;AAED;;;;;;;;;;GAUG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAEhD,QAAQ,CAAC,UAAU,EAAE,MAAM;IADvC,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;gBACxB,UAAU,EAAE,MAAM;CAQxC;AASD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,6BAA8B,SAAQ,mBAAmB;IAGlE,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,cAAc,EAAE,MAAM;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM;IALjC,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;gBAEtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM;CAiBlC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,uBAAwB,SAAQ,mBAAmB;IAG5D,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;gBAErC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EAAE,EACzB,MAAM,EAAE,MAAM;CAe1B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,sEACiC,CAAC;AAEtE;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,mBAAoB,SAAQ,mBAAmB;IAC1D,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;;CAK5C;AAWD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAG9E;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,mBAAmB;IAE9C,QAAQ,CAAC,MAAM,EAAE,MAAM;IADnC,QAAQ,CAAC,IAAI,EAAG,kBAAkB,CAAU;gBACvB,MAAM,EAAE,MAAM;CAOpC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAEhD,QAAQ,CAAC,MAAM,EAAE,MAAM;IADnC,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;gBACzB,MAAM,EAAE,MAAM;CAOpC;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAmB,SAAQ,mBAAmB;IACzD,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;;CAK3C;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,iFAAiF,CAAC;AAEpH,qBAAa,iBAAkB,SAAQ,mBAAmB;IACxD,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAU;;CAK1C;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,mBAAmB;gBAClD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,iBAAkB,SAAQ,mBAAmB;IACxD,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAU;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM;CAUzB;AAED;;;;;;;;GAQG;AACH,qBAAa,sBAAuB,SAAQ,mBAAmB;gBACjD,MAAM,EAAE,MAAM;CAI3B;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,mBAAmB;IAE/C,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IADxD,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;gBACxB,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM;CASzD;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;gBAC1B,MAAM,EAAE,gBAAgB;CAerC;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,mBAAmB;IAEtD,QAAQ,CAAC,OAAO,EAAE,MAAM;IADpC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;gBACtB,OAAO,EAAE,MAAM;CAQrC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,2BAA4B,SAAQ,mBAAmB;IAGhE,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE;IAJpC,QAAQ,CAAC,IAAI,EAAG,0BAA0B,CAAU;gBAEzC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,EAAE;CAgBrC;AAED;;;;GAIG;AACH,qBAAa,iCAAkC,SAAQ,mBAAmB;IAGtE,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,QAAQ,CAAC,IAAI,EAAG,kCAAkC,CAAU;gBAEjD,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM;CAU1B;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,mBAAmB;IAGhE,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM;IAJjC,QAAQ,CAAC,IAAI,EAAG,0BAA0B,CAAU;gBAEzC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM;CAclC;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,mBAAmB;IACjE,QAAQ,CAAC,IAAI,EAAG,gCAAgC,CAAU;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM;CAS3B"}
1	+ {"version":3,"file":"domain-errors.d.ts","sourceRoot":"","sources":["../../src/shared/domain-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGxE,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAM/E;AAED,qBAAa,eAAgB,SAAQ,mBAAmB;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM;gBAA3C,MAAM,EAAE,MAAM,EAAW,UAAU,EAAE,MAAM;CAIxD;AAED,qBAAa,oBAAqB,SAAQ,mBAAmB;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAA3C,UAAU,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM;CAIjE;AAED;;;;;;;;;;GAUG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAEhD,QAAQ,CAAC,UAAU,EAAE,MAAM;IADvC,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;gBACxB,UAAU,EAAE,MAAM;CAQxC;AASD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,6BAA8B,SAAQ,mBAAmB;IAGlE,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,cAAc,EAAE,MAAM;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM;IALjC,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;gBAEtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM;CAiBlC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,uBAAwB,SAAQ,mBAAmB;IAG5D,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;gBAErC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EAAE,EACzB,MAAM,EAAE,MAAM;CAe1B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,sEACiC,CAAC;AAEtE;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,mBAAoB,SAAQ,mBAAmB;IAC1D,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;;CAK5C;AAWD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAG9E;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,mBAAmB;IAE9C,QAAQ,CAAC,MAAM,EAAE,MAAM;IADnC,QAAQ,CAAC,IAAI,EAAG,kBAAkB,CAAU;gBACvB,MAAM,EAAE,MAAM;CAOpC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAEhD,QAAQ,CAAC,MAAM,EAAE,MAAM;IADnC,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;gBACzB,MAAM,EAAE,MAAM;CAOpC;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAmB,SAAQ,mBAAmB;IACzD,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;;CAK3C;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,iFAAiF,CAAC;AAEpH,qBAAa,iBAAkB,SAAQ,mBAAmB;IACxD,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAU;;CAK1C;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,mBAAmB;gBAClD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,iBAAkB,SAAQ,mBAAmB;IACxD,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAU;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM;CAUzB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,+DACoB,CAAC;AAE/D;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,SAAQ,mBAAmB;IAC9D,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;;CAKlD;AAED;;;;;;;;GAQG;AACH,qBAAa,sBAAuB,SAAQ,mBAAmB;gBACjD,MAAM,EAAE,MAAM;CAI3B;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,mBAAmB;IAE/C,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IADxD,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;gBACxB,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM;CASzD;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;gBAC1B,MAAM,EAAE,gBAAgB;CAerC;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,mBAAmB;IAEtD,QAAQ,CAAC,OAAO,EAAE,MAAM;IADpC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;gBACtB,OAAO,EAAE,MAAM;CAQrC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,2BAA4B,SAAQ,mBAAmB;IAGhE,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE;IAJpC,QAAQ,CAAC,IAAI,EAAG,0BAA0B,CAAU;gBAEzC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,EAAE;CAgBrC;AAED;;;;GAIG;AACH,qBAAa,iCAAkC,SAAQ,mBAAmB;IAGtE,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,QAAQ,CAAC,IAAI,EAAG,kCAAkC,CAAU;gBAEjD,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM;CAU1B;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,mBAAmB;IAGhE,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM;IAJjC,QAAQ,CAAC,IAAI,EAAG,0BAA0B,CAAU;gBAEzC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM;CAclC;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,mBAAmB;IACjE,QAAQ,CAAC,IAAI,EAAG,gCAAgC,CAAU;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM;CAS3B"}

package/dist/shared/domain-errors.js CHANGED Viewed

@@ -356,6 +356,34 @@ export class PathNotFoundError extends WorkflowDomainError {
         this.path = safe;
     }
 }
+/**
+ * The one sentence every read of a past save answers when that save is not in
+ * the history of the branch being viewed.
+ *
+ * Written once, here, because four surfaces have to give the same answer: the
+ * bytes route (`?ref=`), the patch route (`show-file`), the before/after
+ * contents route (`file-at-change`), and anything later that serves a file at
+ * a commit. A save the history panel listed came off `git log` on this
+ * workspace's own branch, so it can never be refused this way — what this
+ * refuses is a sha from someone else's branch, or one that was invented.
+ */
+export const VERSION_NOT_ON_BRANCH_MESSAGE = "This version is not in this file's history on this branch.";
+/**
+ * The caller named a save that is not an ancestor of the branch this
+ * workspace has checked out.
+ *
+ * 404, and DELIBERATELY the same 404 for a sha that exists on another branch
+ * as for one that exists nowhere: telling the two apart would turn the route
+ * into an oracle for "does this commit exist in the repository", which is
+ * exactly the reading a branch-scoped rule exists to prevent.
+ */
+export class VersionNotOnBranchError extends WorkflowDomainError {
+    kind = 'version-not-on-branch';
+    constructor() {
+        super(VERSION_NOT_ON_BRANCH_MESSAGE, 404, { kind: 'version-not-on-branch' });
+        this.name = 'VersionNotOnBranchError';
+    }
+}
 /**
  * An archive the caller uploaded that the zip reader cannot open. 422, not
  * 400: the request is well-formed and the path is fine — the BYTES are not a

package/dist/shared/domain-errors.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"domain-errors.js","sourceRoot":"","sources":["../../src/shared/domain-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,OAAO,CAA2B;IAC3C,YAAY,OAAe,EAAE,MAAc,EAAE,OAAiC;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,mBAAmB;IACjB;IAArC,YAAY,MAAc,EAAW,UAAkB;QACrD,KAAK,CAAC,wBAAwB,UAAU,MAAM,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAD1B,eAAU,GAAV,UAAU,CAAQ;QAErD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IACtC;IAA6B;IAAlD,YAAqB,UAAkB,EAAW,MAAc;QAC9D,KAAK,CAAC,WAAW,UAAU,oBAAoB,MAAM,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAD3D,eAAU,GAAV,UAAU,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAQ;QAE9D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IAEvC;IADZ,IAAI,GAAG,mBAA4B,CAAC;IAC7C,YAAqB,UAAkB;QACrC,KAAK,CACH,uBAAuB,UAAU,kBAAkB,EACnD,GAAG,EACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAC1C,CAAC;QALiB,eAAU,GAAV,UAAU,CAAQ;QAMrC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,6BAA8B,SAAQ,mBAAmB;IAGzD;IACA;IACA;IACA;IALF,IAAI,GAAG,uBAAgC,CAAC;IACjD,YACW,MAAc,EACd,IAAY,EACZ,cAAsB,EACtB,cAAsB;QAE/B,KAAK,CACH,qBAAqB,MAAM,qDAAqD;YAC9E,2BAA2B,IAAI,mDAAmD;YAClF,8BAA8B,EAChC,GAAG,EACH;YACE,IAAI,EAAE,uBAAuB;YAC7B,MAAM;YACN,IAAI;YACJ,cAAc;YACd,cAAc;SACf,CACF,CAAC;QAjBO,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QACZ,mBAAc,GAAd,cAAc,CAAQ;QACtB,mBAAc,GAAd,cAAc,CAAQ;QAe/B,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,uBAAwB,SAAQ,mBAAmB;IAGnD;IACA;IACA;IAJF,IAAI,GAAG,sBAA+B,CAAC;IAChD,YACW,MAAc,EACd,eAAyB,EACzB,MAAc;QAEvB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK,CACH,aAAa,MAAM,kCAAkC,eAAe,CAAC,MAAM,aAAa,IAAI,IAAI;YAC9F,gDAAgD,EAClD,GAAG,EACH;YACE,IAAI,EAAE,sBAAsB;YAC5B,MAAM;YACN,eAAe;SAChB,CACF,CAAC;QAdO,WAAM,GAAN,MAAM,CAAQ;QACd,oBAAe,GAAf,eAAe,CAAU;QACzB,WAAM,GAAN,MAAM,CAAQ;QAavB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,mEAAmE,CAAC;AAEtE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,mBAAoB,SAAQ,mBAAmB;IACjD,IAAI,GAAG,iBAA0B,CAAC;IAC3C;QACE,KAAK,CAAC,uBAAuB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;IACvF,IAAI,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAoB,SAAQ,mBAAmB;IAErC;IADZ,IAAI,GAAG,kBAA2B,CAAC;IAC5C,YAAqB,MAAc;QACjC,KAAK,CAAC,4BAA4B,MAAM,GAAG,EAAE,GAAG,EAAE;YAChD,IAAI,EAAE,kBAAkB;YACxB,MAAM;SACP,CAAC,CAAC;QAJgB,WAAM,GAAN,MAAM,CAAQ;QAKjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IAEvC;IADZ,IAAI,GAAG,oBAA6B,CAAC;IAC9C,YAAqB,MAAc;QACjC,KAAK,CAAC,WAAW,MAAM,mCAAmC,EAAE,GAAG,EAAE;YAC/D,IAAI,EAAE,oBAAoB;YAC1B,MAAM;SACP,CAAC,CAAC;QAJgB,WAAM,GAAN,MAAM,CAAQ;QAKjC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,OAAO,kEAAkE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAmB,SAAQ,mBAAmB;IAChD,IAAI,GAAG,gBAAyB,CAAC;IAC1C;QACE,KAAK,CAAC,yBAAyB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,8EAA8E,CAAC;AAEpH,MAAM,OAAO,iBAAkB,SAAQ,mBAAmB;IAC/C,IAAI,GAAG,eAAwB,CAAC;IACzC;QACE,KAAK,CAAC,qBAAqB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,mBAAmB;IAC9D,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,iBAAkB,SAAQ,mBAAmB;IAC/C,IAAI,GAAG,WAAoB,CAAC;IACrC,8DAA8D;IACrD,IAAI,CAAS;IACtB,YAAY,IAAY;QACtB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,CACH,qCAAqC,IAAI,wBAAwB,mBAAmB,EAAE,EACtF,GAAG,EACH,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAClC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAuB,SAAQ,mBAAmB;IAC7D,YAAY,MAAc;QACxB,KAAK,CAAC,4BAA4B,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IAEtC;IAAuB;IADnC,IAAI,GAAG,mBAA4B,CAAC;IAC7C,YAAqB,IAAY,EAAW,IAAY;QACtD,KAAK,CACH,cAAc,IAAI,iCAAiC,IAAI,KAAK;YAC1D,mEAAmE,EACrE,GAAG,EACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,CAC1C,CAAC;QANiB,SAAI,GAAJ,IAAI,CAAQ;QAAW,SAAI,GAAJ,IAAI,CAAQ;QAOtD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,UAAU,CAAmB;IACtC,YAAY,MAAwB;QAClC,KAAK,CACH,uCAAuC,MAAM,CAAC,OAAO,CAAC,MAAM,uBAAuB,EACnF,GAAG,EACH;YACE,UAAU,EAAE;gBACV,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B;SACF,CACF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;IAC3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAE7C;IADZ,IAAI,GAAG,iBAA0B,CAAC;IAC3C,YAAqB,OAAe;QAClC,KAAK,CACH,qBAAqB,OAAO,yCAAyC,EACrE,GAAG,EACH,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CACrC,CAAC;QALiB,YAAO,GAAP,OAAO,CAAQ;QAMlC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAGvD;IACA;IACA;IAJF,IAAI,GAAG,0BAAmC,CAAC;IACpD,YACW,YAAoB,EACpB,YAAoB,EACpB,eAAyB;QAElC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK,CACH,sBAAsB,YAAY,WAAW,YAAY,KAAK;YAC5D,GAAG,eAAe,CAAC,MAAM,aAAa,IAAI,iBAAiB,YAAY,kBAAkB,EAC3F,GAAG,EACH;YACE,IAAI,EAAE,0BAA0B;YAChC,YAAY;YACZ,YAAY;YACZ,eAAe;SAChB,CACF,CAAC;QAfO,iBAAY,GAAZ,YAAY,CAAQ;QACpB,iBAAY,GAAZ,YAAY,CAAQ;QACpB,oBAAe,GAAf,eAAe,CAAU;QAclC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iCAAkC,SAAQ,mBAAmB;IAG7D;IACA;IACA;IAJF,IAAI,GAAG,kCAA2C,CAAC;IAC5D,YACW,YAAoB,EACpB,YAAoB,EACpB,MAAc;QAEvB,KAAK,CACH,mBAAmB,MAAM,sBAAsB,YAAY,WAAW,YAAY,uBAAuB;YACvG,mEAAmE,MAAM,cAAc,EACzF,GAAG,EACH,EAAE,IAAI,EAAE,kCAAkC,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,CACjF,CAAC;QATO,iBAAY,GAAZ,YAAY,CAAQ;QACpB,iBAAY,GAAZ,YAAY,CAAQ;QACpB,WAAM,GAAN,MAAM,CAAQ;QAQvB,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAGvD;IACA;IACA;IAJF,IAAI,GAAG,0BAAmC,CAAC;IACpD,YACW,YAAoB,EACpB,YAAoB,EACpB,cAAsB;QAE/B,KAAK,CACH,+CAA+C,YAAY,SAAS,YAAY,OAAO,cAAc,IAAI,EACzG,GAAG,EACH;YACE,IAAI,EAAE,0BAA0B;YAChC,YAAY;YACZ,YAAY;YACZ,cAAc;SACf,CACF,CAAC;QAbO,iBAAY,GAAZ,YAAY,CAAQ;QACpB,iBAAY,GAAZ,YAAY,CAAQ;QACpB,mBAAc,GAAd,cAAc,CAAQ;QAY/B,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,mBAAmB;IACxD,IAAI,GAAG,gCAAyC,CAAC;IAC1D;;;;OAIG;IACM,MAAM,CAAS;IACxB,YAAY,MAAc;QACxB,KAAK,CACH,+GAA+G,EAC/G,GAAG,EACH,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAC3C,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}
1	+ {"version":3,"file":"domain-errors.js","sourceRoot":"","sources":["../../src/shared/domain-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,OAAO,CAA2B;IAC3C,YAAY,OAAe,EAAE,MAAc,EAAE,OAAiC;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,mBAAmB;IACjB;IAArC,YAAY,MAAc,EAAW,UAAkB;QACrD,KAAK,CAAC,wBAAwB,UAAU,MAAM,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAD1B,eAAU,GAAV,UAAU,CAAQ;QAErD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IACtC;IAA6B;IAAlD,YAAqB,UAAkB,EAAW,MAAc;QAC9D,KAAK,CAAC,WAAW,UAAU,oBAAoB,MAAM,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAD3D,eAAU,GAAV,UAAU,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAQ;QAE9D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IAEvC;IADZ,IAAI,GAAG,mBAA4B,CAAC;IAC7C,YAAqB,UAAkB;QACrC,KAAK,CACH,uBAAuB,UAAU,kBAAkB,EACnD,GAAG,EACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAC1C,CAAC;QALiB,eAAU,GAAV,UAAU,CAAQ;QAMrC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,6BAA8B,SAAQ,mBAAmB;IAGzD;IACA;IACA;IACA;IALF,IAAI,GAAG,uBAAgC,CAAC;IACjD,YACW,MAAc,EACd,IAAY,EACZ,cAAsB,EACtB,cAAsB;QAE/B,KAAK,CACH,qBAAqB,MAAM,qDAAqD;YAC9E,2BAA2B,IAAI,mDAAmD;YAClF,8BAA8B,EAChC,GAAG,EACH;YACE,IAAI,EAAE,uBAAuB;YAC7B,MAAM;YACN,IAAI;YACJ,cAAc;YACd,cAAc;SACf,CACF,CAAC;QAjBO,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QACZ,mBAAc,GAAd,cAAc,CAAQ;QACtB,mBAAc,GAAd,cAAc,CAAQ;QAe/B,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,uBAAwB,SAAQ,mBAAmB;IAGnD;IACA;IACA;IAJF,IAAI,GAAG,sBAA+B,CAAC;IAChD,YACW,MAAc,EACd,eAAyB,EACzB,MAAc;QAEvB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK,CACH,aAAa,MAAM,kCAAkC,eAAe,CAAC,MAAM,aAAa,IAAI,IAAI;YAC9F,gDAAgD,EAClD,GAAG,EACH;YACE,IAAI,EAAE,sBAAsB;YAC5B,MAAM;YACN,eAAe;SAChB,CACF,CAAC;QAdO,WAAM,GAAN,MAAM,CAAQ;QACd,oBAAe,GAAf,eAAe,CAAU;QACzB,WAAM,GAAN,MAAM,CAAQ;QAavB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,mEAAmE,CAAC;AAEtE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,mBAAoB,SAAQ,mBAAmB;IACjD,IAAI,GAAG,iBAA0B,CAAC;IAC3C;QACE,KAAK,CAAC,uBAAuB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;IACvF,IAAI,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAoB,SAAQ,mBAAmB;IAErC;IADZ,IAAI,GAAG,kBAA2B,CAAC;IAC5C,YAAqB,MAAc;QACjC,KAAK,CAAC,4BAA4B,MAAM,GAAG,EAAE,GAAG,EAAE;YAChD,IAAI,EAAE,kBAAkB;YACxB,MAAM;SACP,CAAC,CAAC;QAJgB,WAAM,GAAN,MAAM,CAAQ;QAKjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IAEvC;IADZ,IAAI,GAAG,oBAA6B,CAAC;IAC9C,YAAqB,MAAc;QACjC,KAAK,CAAC,WAAW,MAAM,mCAAmC,EAAE,GAAG,EAAE;YAC/D,IAAI,EAAE,oBAAoB;YAC1B,MAAM;SACP,CAAC,CAAC;QAJgB,WAAM,GAAN,MAAM,CAAQ;QAKjC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,OAAO,kEAAkE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAmB,SAAQ,mBAAmB;IAChD,IAAI,GAAG,gBAAyB,CAAC;IAC1C;QACE,KAAK,CAAC,yBAAyB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,8EAA8E,CAAC;AAEpH,MAAM,OAAO,iBAAkB,SAAQ,mBAAmB;IAC/C,IAAI,GAAG,eAAwB,CAAC;IACzC;QACE,KAAK,CAAC,qBAAqB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,mBAAmB;IAC9D,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,iBAAkB,SAAQ,mBAAmB;IAC/C,IAAI,GAAG,WAAoB,CAAC;IACrC,8DAA8D;IACrD,IAAI,CAAS;IACtB,YAAY,IAAY;QACtB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,CACH,qCAAqC,IAAI,wBAAwB,mBAAmB,EAAE,EACtF,GAAG,EACH,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAClC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GACxC,4DAA4D,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,OAAO,uBAAwB,SAAQ,mBAAmB;IACrD,IAAI,GAAG,uBAAgC,CAAC;IACjD;QACE,KAAK,CAAC,6BAA6B,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAuB,SAAQ,mBAAmB;IAC7D,YAAY,MAAc;QACxB,KAAK,CAAC,4BAA4B,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IAEtC;IAAuB;IADnC,IAAI,GAAG,mBAA4B,CAAC;IAC7C,YAAqB,IAAY,EAAW,IAAY;QACtD,KAAK,CACH,cAAc,IAAI,iCAAiC,IAAI,KAAK;YAC1D,mEAAmE,EACrE,GAAG,EACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,CAC1C,CAAC;QANiB,SAAI,GAAJ,IAAI,CAAQ;QAAW,SAAI,GAAJ,IAAI,CAAQ;QAOtD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,UAAU,CAAmB;IACtC,YAAY,MAAwB;QAClC,KAAK,CACH,uCAAuC,MAAM,CAAC,OAAO,CAAC,MAAM,uBAAuB,EACnF,GAAG,EACH;YACE,UAAU,EAAE;gBACV,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B;SACF,CACF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;IAC3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAE7C;IADZ,IAAI,GAAG,iBAA0B,CAAC;IAC3C,YAAqB,OAAe;QAClC,KAAK,CACH,qBAAqB,OAAO,yCAAyC,EACrE,GAAG,EACH,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CACrC,CAAC;QALiB,YAAO,GAAP,OAAO,CAAQ;QAMlC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAGvD;IACA;IACA;IAJF,IAAI,GAAG,0BAAmC,CAAC;IACpD,YACW,YAAoB,EACpB,YAAoB,EACpB,eAAyB;QAElC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK,CACH,sBAAsB,YAAY,WAAW,YAAY,KAAK;YAC5D,GAAG,eAAe,CAAC,MAAM,aAAa,IAAI,iBAAiB,YAAY,kBAAkB,EAC3F,GAAG,EACH;YACE,IAAI,EAAE,0BAA0B;YAChC,YAAY;YACZ,YAAY;YACZ,eAAe;SAChB,CACF,CAAC;QAfO,iBAAY,GAAZ,YAAY,CAAQ;QACpB,iBAAY,GAAZ,YAAY,CAAQ;QACpB,oBAAe,GAAf,eAAe,CAAU;QAclC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iCAAkC,SAAQ,mBAAmB;IAG7D;IACA;IACA;IAJF,IAAI,GAAG,kCAA2C,CAAC;IAC5D,YACW,YAAoB,EACpB,YAAoB,EACpB,MAAc;QAEvB,KAAK,CACH,mBAAmB,MAAM,sBAAsB,YAAY,WAAW,YAAY,uBAAuB;YACvG,mEAAmE,MAAM,cAAc,EACzF,GAAG,EACH,EAAE,IAAI,EAAE,kCAAkC,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,CACjF,CAAC;QATO,iBAAY,GAAZ,YAAY,CAAQ;QACpB,iBAAY,GAAZ,YAAY,CAAQ;QACpB,WAAM,GAAN,MAAM,CAAQ;QAQvB,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAGvD;IACA;IACA;IAJF,IAAI,GAAG,0BAAmC,CAAC;IACpD,YACW,YAAoB,EACpB,YAAoB,EACpB,cAAsB;QAE/B,KAAK,CACH,+CAA+C,YAAY,SAAS,YAAY,OAAO,cAAc,IAAI,EACzG,GAAG,EACH;YACE,IAAI,EAAE,0BAA0B;YAChC,YAAY;YACZ,YAAY;YACZ,cAAc;SACf,CACF,CAAC;QAbO,iBAAY,GAAZ,YAAY,CAAQ;QACpB,iBAAY,GAAZ,YAAY,CAAQ;QACpB,mBAAc,GAAd,cAAc,CAAQ;QAY/B,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,mBAAmB;IACxD,IAAI,GAAG,gCAAyC,CAAC;IAC1D;;;;OAIG;IACM,MAAM,CAAS;IACxB,YAAY,MAAc;QACxB,KAAK,CACH,+GAA+G,EAC/G,GAAG,EACH,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAC3C,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}

package/dist/shared/git.contract.d.ts CHANGED Viewed

@@ -177,6 +177,26 @@ export declare class GitRunError extends Error {
         timedOut?: boolean;
     });
 }
+/**
+ * Refuse a `cat-file --batch` spec that is not ONE line.
+ *
+ * `--batch` reads one object name per LINE, so a spec carrying a `\n` is two
+ * requests. For a single-spec read that means git answers about the part
+ * before the break — bytes the caller then presents as the whole path's,
+ * having had its access gates answered about a string that names nothing. For
+ * a batch it is worse: the extra answer shifts every result after it, and a
+ * walk that steps one header at a time hands each caller the object that
+ * belonged to the next one.
+ *
+ * A path is refused a control character long before this — by
+ * `assertValidRelativePath` and by `normalizeWorkspacePath`, which is where
+ * the rule belongs because it protects every route and tool at once. This is
+ * the fence AT the protocol, for a spec assembled from somewhere neither of
+ * those covers (a ref, a branch name, a path from a future caller). Nothing
+ * should ever trip it, so it throws rather than filtering: a request that
+ * cannot be expressed in this protocol has no correct truncation.
+ */
+export declare function assertOneSpecPerLine(specs: readonly string[]): void;
 /** Whether a failure came from the deadline rather than from git's own answer. */
 export declare function isGitTimeout(err: unknown): boolean;
 /**

package/dist/shared/git.contract.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"git.contract.d.ts","sourceRoot":"","sources":["../../src/shared/git.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,QAAQ,IAAI,MAAM,CAAC;IACnB,4EAA4E;IAC5E,KAAK,IAAI,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;;;;OAQG;IACH,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAE5C,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,EAAE,cAG/B,CAAC;AAEH,0EAA0E;AAC1E,wBAAgB,cAAc,CAC5B,QAAQ,GAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAwB,EACxD,KAAK,GAAE,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAQ,GAClD,cAAc,CAOhB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAMrF;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY,CAAC,IAAI,GAAG,MAAM;IACzC,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACpC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B;;;;;OAKG;gBACS,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO;CAOnG;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAElD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9G,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACvG"}
1	+ {"version":3,"file":"git.contract.d.ts","sourceRoot":"","sources":["../../src/shared/git.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,QAAQ,IAAI,MAAM,CAAC;IACnB,4EAA4E;IAC5E,KAAK,IAAI,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;;;;OAQG;IACH,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAE5C,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,EAAE,cAG/B,CAAC;AAEH,0EAA0E;AAC1E,wBAAgB,cAAc,CAC5B,QAAQ,GAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAwB,EACxD,KAAK,GAAE,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAQ,GAClD,cAAc,CAOhB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAMrF;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY,CAAC,IAAI,GAAG,MAAM;IACzC,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACpC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B;;;;;OAKG;gBACS,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO;CAOnG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAMnE;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAElD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9G,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACvG"}

package/dist/shared/git.contract.js CHANGED Viewed

@@ -118,6 +118,32 @@ export class GitRunError extends Error {
         this.timedOut = opts.timedOut ?? false;
     }
 }
+/**
+ * Refuse a `cat-file --batch` spec that is not ONE line.
+ *
+ * `--batch` reads one object name per LINE, so a spec carrying a `\n` is two
+ * requests. For a single-spec read that means git answers about the part
+ * before the break — bytes the caller then presents as the whole path's,
+ * having had its access gates answered about a string that names nothing. For
+ * a batch it is worse: the extra answer shifts every result after it, and a
+ * walk that steps one header at a time hands each caller the object that
+ * belonged to the next one.
+ *
+ * A path is refused a control character long before this — by
+ * `assertValidRelativePath` and by `normalizeWorkspacePath`, which is where
+ * the rule belongs because it protects every route and tool at once. This is
+ * the fence AT the protocol, for a spec assembled from somewhere neither of
+ * those covers (a ref, a branch name, a path from a future caller). Nothing
+ * should ever trip it, so it throws rather than filtering: a request that
+ * cannot be expressed in this protocol has no correct truncation.
+ */
+export function assertOneSpecPerLine(specs) {
+    for (const spec of specs) {
+        if (/[\r\n]/.test(spec)) {
+            throw new Error('git cat-file --batch spec contains a line break');
+        }
+    }
+}
 /** Whether a failure came from the deadline rather than from git's own answer. */
 export function isGitTimeout(err) {
     return err instanceof GitRunError && err.timedOut;

package/dist/shared/git.contract.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"git.contract.js","sourceRoot":"","sources":["../../src/shared/git.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAsCH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAE5C,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAmB,MAAM,CAAC,MAAM,CAAC;IAC9D,QAAQ,EAAE,GAAG,EAAE,CAAC,oBAAoB;IACpC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI;CAClB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAC5B,WAAoC,oBAAoB,EACxD,QAA+C,IAAI;IAEnD,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC;IACxE,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;IACjE,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,oBAAoB;QAC9C,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAgC;IAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,wEAAwE;IACxE,2EAA2E;IAC3E,wCAAwC;IACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AA8CD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,0DAA0D;IACjD,QAAQ,CAAU;IAC3B,+DAA+D;IACtD,MAAM,CAAU;IACzB,+DAA+D;IACtD,QAAQ,CAAU;IAE3B;;;;;OAKG;IACH,YAAY,OAAe,EAAE,OAAmE,EAAE;QAChG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;IACzC,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,GAAG,YAAY,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC;AACpD,CAAC"}
1	+ {"version":3,"file":"git.contract.js","sourceRoot":"","sources":["../../src/shared/git.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAsCH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAE5C,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAmB,MAAM,CAAC,MAAM,CAAC;IAC9D,QAAQ,EAAE,GAAG,EAAE,CAAC,oBAAoB;IACpC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI;CAClB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAC5B,WAAoC,oBAAoB,EACxD,QAA+C,IAAI;IAEnD,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC;IACxE,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;IACjE,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,oBAAoB;QAC9C,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAgC;IAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,wEAAwE;IACxE,2EAA2E;IAC3E,wCAAwC;IACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AA8CD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,0DAA0D;IACjD,QAAQ,CAAU;IAC3B,+DAA+D;IACtD,MAAM,CAAU;IACzB,+DAA+D;IACtD,QAAQ,CAAU;IAE3B;;;;;OAKG;IACH,YAAY,OAAe,EAAE,OAAmE,EAAE;QAChG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;IACzC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,GAAG,YAAY,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC;AACpD,CAAC"}

package/dist/shared/token-crypto.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"token-crypto.d.ts","sourceRoot":"","sources":["../../src/shared/token-crypto.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B;;;;;;;OAOG;gBACS,MAAM,EAAE,MAAM,EAAE,UAAU,SAAoB;IAI1D,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAQlC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAa9B;AASD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,~~CASpF~~"}
1	+ {"version":3,"file":"token-crypto.d.ts","sourceRoot":"","sources":["../../src/shared/token-crypto.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B;;;;;;;OAOG;gBACS,MAAM,EAAE,MAAM,EAAE,UAAU,SAAoB;IAI1D,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAQlC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAa9B;AASD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CA4BpF"}

package/dist/shared/token-crypto.js CHANGED Viewed

@@ -56,11 +56,35 @@ function decodeKey(raw) {
  * is then safe, because a bad key never gets that far.
  */
 export function assertKeyDecodesTo32Bytes(rawKey, envVarName) {
-    const key = decodeKey(rawKey);
+    // Whitespace around it is the environment's, not the key's.
+    const written = rawKey.trim();
+    const key = decodeKey(written);
     if (key.length !== 32) {
         throw new Error(`${envVarName} must decode to 32 bytes (got ${key.length}). ` +
             'Generate one with: `node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'base64\'))"`.');
     }
+    // WHAT IS WRITTEN MUST BE A SPELLING OF WHAT IT DECODES TO. Node's decoder is
+    // forgiving in ways a key must not be: it skips a character it does not know,
+    // it stops at padding wherever padding stands, and it ignores bits a final
+    // character should not carry. Each of those turns a mistyped key into 32
+    // bytes — a DIFFERENT key, sealing data that the value an operator wrote
+    // down will never open. Asking which characters and which padding are
+    // acceptable is a list that is always one case short, so the question is put
+    // the other way round: encode the bytes again, and accept the value only
+    // when it is one of the ways those bytes are written.
+    if (!spellingsOf(key).includes(/^[0-9a-fA-F]{64}$/.test(written) ? written.toLowerCase() : written)) {
+        throw new Error(`${envVarName} is not a clean hex or base64 spelling of a 32-byte key: it holds a character, a padding ` +
+            'or trailing bits the encoding does not have, which the decoder skipped. The key in use so far is what ' +
+            'it decoded to; print that key spelled properly with ' +
+            `\`node -e "console.log(Buffer.from(process.env.${envVarName}, 'base64').toString('base64'))"\` and set that.`);
+    }
     return key;
 }
+/** Every way 32 bytes are written as a key: hex, and base64 in either alphabet, padded or not. */
+function spellingsOf(key) {
+    const standard = key.toString('base64');
+    const urlSafe = key.toString('base64url');
+    const padding = standard.slice(standard.replace(/=+$/, '').length);
+    return [key.toString('hex'), standard, standard.replace(/=+$/, ''), urlSafe, urlSafe + padding];
+}
 //# sourceMappingURL=token-crypto.js.map

package/dist/shared/token-crypto.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"token-crypto.js","sourceRoot":"","sources":["../../src/shared/token-crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IACL,GAAG,CAAS;IAE7B;;;;;;;OAOG;IACH,YAAY,MAAc,EAAE,UAAU,GAAG,iBAAiB;QACxD,IAAI,CAAC,GAAG,GAAG,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvF,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3G,CAAC;CACF;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,8EAA8E;IAC9E,sCAAsC;IACtC,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,UAAkB;IAC1E,MAAM,GAAG,GAAG,SAAS,CAAC,~~MAAM~~,CAAC,CAAC;~~IAC9B~~,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,iCAAiC,GAAG,CAAC,MAAM,KAAK;YAC3D,uGAAuG,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
1	+ {"version":3,"file":"token-crypto.js","sourceRoot":"","sources":["../../src/shared/token-crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IACL,GAAG,CAAS;IAE7B;;;;;;;OAOG;IACH,YAAY,MAAc,EAAE,UAAU,GAAG,iBAAiB;QACxD,IAAI,CAAC,GAAG,GAAG,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvF,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3G,CAAC;CACF;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,8EAA8E;IAC9E,sCAAsC;IACtC,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,UAAkB;IAC1E,4DAA4D;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,iCAAiC,GAAG,CAAC,MAAM,KAAK;YAC3D,uGAAuG,CAC1G,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,6EAA6E;IAC7E,yEAAyE;IACzE,sDAAsD;IACtD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACpG,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,2FAA2F;YACtG,wGAAwG;YACxG,sDAAsD;YACtD,kDAAkD,UAAU,kDAAkD,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kGAAkG;AAClG,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC;AAClG,CAAC"}

package/dist/tenancy/static-tenant-source.d.ts CHANGED Viewed

@@ -14,7 +14,6 @@ export interface TenantHostSettings {
     readonly workspacesRoot: string;
     readonly kbTemplateDir: string;
     readonly gitTimeoutMs: number;
-    readonly ontologySessionBlock: boolean;
     readonly updateCheckEnabled: boolean;
     /** See `tenant-secrets.ts`. */
     readonly masterKey: string;

package/dist/tenancy/static-tenant-source.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"static-tenant-source.d.ts","sourceRoot":"","sources":["../../src/tenancy/static-tenant-source.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAO1E,OAAO,EAAmC,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAExH;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iHAAiH;IACjH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,~~oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,~~kBAAkB,EAAE,OAAO,CAAC;IACrC,+BAA+B;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAKD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,GAAG,YAAY,CAiHjG;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;gBAElD,OAAO,EAAE,SAAS,YAAY,EAAE,EAAE,QAAQ,EAAE,kBAAkB;WAkB7D,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAa9F,IAAI,KAAK,IAAI,SAAS,MAAM,EAAE,CAE7B;IAEK,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAI7D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAG/D;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAID;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,~~CA4BjF~~"}
1	+ {"version":3,"file":"static-tenant-source.d.ts","sourceRoot":"","sources":["../../src/tenancy/static-tenant-source.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAO1E,OAAO,EAAmC,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAExH;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iHAAiH;IACjH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,+BAA+B;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAKD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,GAAG,YAAY,CAiHjG;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;gBAElD,OAAO,EAAE,SAAS,YAAY,EAAE,EAAE,QAAQ,EAAE,kBAAkB;WAkB7D,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAa9F,IAAI,KAAK,IAAI,SAAS,MAAM,EAAE,CAE7B;IAEK,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAI7D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAG/D;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAID;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CA2BjF"}

package/dist/tenancy/static-tenant-source.js CHANGED Viewed

@@ -103,6 +103,7 @@ export function tenantConfigFrom(record, settings) {
         workspacesRoot: path.resolve(settings.workspacesRoot, slug),
         backupsRoot: besideWorkspaces('backups'),
         spillRoot: besideWorkspaces('tool-chain-spills'),
+        agentUploadsRoot: besideWorkspaces('agent-uploads'),
         docExtractCacheRoot: besideWorkspaces('doc-extract-cache'),
         jwtSecret: secrets.jwtSecret,
         secretsEncKey: secrets.secretsEncKey,
@@ -120,7 +121,6 @@ export function tenantConfigFrom(record, settings) {
         gitUsername,
         gitToken: (record.gitToken ?? '').trim(),
         kbTemplateDir: settings.kbTemplateDir,
-        ontologySessionBlock: settings.ontologySessionBlock,
         updateCheckEnabled: settings.updateCheckEnabled,
         allowedEmailDomains,
         trustProxy: settings.trustProxy,
@@ -212,7 +212,6 @@ export function tenantHostEnv(env = process.env) {
         workspacesRoot,
         kbTemplateDir: env.KB_TEMPLATE_DIR || defaultKbTemplateDir(),
         gitTimeoutMs: Number.isFinite(gitTimeout) && gitTimeout > 0 && gitTimeout <= MAX_TIMER_MS ? gitTimeout : DEFAULT_GIT_TIMEOUT_MS,
-        ontologySessionBlock: (env.ONTOLOGY_SESSION_BLOCK ?? 'true').trim().toLowerCase() !== 'false',
         updateCheckEnabled: (env.UPDATE_CHECK ?? 'true').trim().toLowerCase() !== 'false',
         idleMinutes: Number.isFinite(idle) && idle > 0 ? idle : 30,
     };

package/dist/tenancy/static-tenant-source.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"static-tenant-source.js","sourceRoot":"","sources":["../../src/tenancy/static-tenant-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAqB,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAA4C,MAAM,6BAA6B,CAAC;~~AAgExH~~,MAAM,aAAa,GAAG,4BAA4B,CAAC;AACnD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAoB,EAAE,QAA4B;IACjF,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,iBAAiB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,wCAAwC,MAAM,CAAC,UAAU,IAAI,EAAE,GAAG,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,mDAAmD,WAAW,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,oDAAoD,QAAQ,GAAG,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,qEAAqE;IACrE,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,4BAA4B,iBAAiB,uCAAuC,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;IACjD,MAAM,oBAAoB,GAAG,MAAM,CAAC,aAAa,IAAI,aAAa,KAAK,EAAE,CAAC;IAC1E,IAAI,oBAAoB,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,oDAAoD,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,WAAW,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvG,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QACtC,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;KAChC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,MAAM,IAAI,yBAAyB,KAAK,GAAG,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnG,MAAM,mBAAmB,GAAG,CAAC,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC;SAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACxD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC/D,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QACpC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACrC,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC;QACjC,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC9B,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC;QACpC,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC;QACjC,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC;QACxC,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;QACzC,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,CAAC;QACvC,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC;QAC3C,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzC,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC;QACjD,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QACpC,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC;QACnD,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KAChD,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IAC3C,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ;QACR,oBAAoB,EAAE,GAAG,QAAQ,GAAG;QACpC,mBAAmB,EAAE,GAAG,QAAQ,OAAO;QACvC,iBAAiB,EAAE,GAAG,QAAQ,MAAM;QACpC,mBAAmB,EAAE,GAAG,QAAQ,OAAO;QACvC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC;QAC3D,WAAW,EAAE,gBAAgB,CAAC,SAAS,CAAC;QACxC,SAAS,EAAE,gBAAgB,CAAC,mBAAmB,CAAC;QAChD,mBAAmB,EAAE,gBAAgB,CAAC,mBAAmB,CAAC;QAC1D,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,UAAU;QACV,aAAa;QACb,oBAAoB;QACpB,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACxE,YAAY,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAClD,gBAAgB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC1D,UAAU,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,sBAAsB,CAAC,CAAC,IAAI,EAAE;QAClE,iBAAiB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE;QAC1E,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC1C,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC1C,WAAW;QACX,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACxC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,~~oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,~~kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,mBAAmB;QACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,gBAAgB;QAChB,iBAAiB;QACjB,2BAA2B,EAAE,iBAAiB;QAC9C,eAAe,EAAE,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAC3D,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACZ,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC7C,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE9D,YAAY,OAAgC,EAAE,QAA4B;QACxE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClD,MAAM,UAAU,GAAqB;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;gBACtC,MAAM;aACP,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,UAAU,CAAC,IAAI,mBAAmB,CAAC,CAAC;YACrG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC7C,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,yBAAyB,KAAK,CAAC,IAAI,UAAU,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;gBACzG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,QAA4B;QAC9D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,OAAO,GAAI,MAAsC,EAAE,OAAO,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2CAA2C,CAAC,CAAC;QACjG,OAAO,IAAI,kBAAkB,CAAC,OAAyB,EAAE,QAAQ,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,KAAK;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACvC,CAAC;CACF;AAUD,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,+GAA+G;YAC7G,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;IACxF,OAAO;QACL,WAAW;QACX,SAAS;QACT,WAAW,EAAE,kBAAkB,CAAC,GAAG,CAAC;QACpC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC;QACtC,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,aAAa;QACtC,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAC3D,cAAc;QACd,aAAa,EAAE,GAAG,CAAC,eAAe,IAAI,oBAAoB,EAAE;QAC5D,YAAY,EACV,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,sBAAsB;QACnH,~~oBAAoB,EAAE,CAAC,GAAG,CAAC,sBAAsB,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;QAC7F,~~kBAAkB,EAAE,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;QACjF,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;KAC3D,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"static-tenant-source.js","sourceRoot":"","sources":["../../src/tenancy/static-tenant-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAqB,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAA4C,MAAM,6BAA6B,CAAC;AA+DxH,MAAM,aAAa,GAAG,4BAA4B,CAAC;AACnD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAoB,EAAE,QAA4B;IACjF,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,iBAAiB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,wCAAwC,MAAM,CAAC,UAAU,IAAI,EAAE,GAAG,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,mDAAmD,WAAW,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,oDAAoD,QAAQ,GAAG,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,qEAAqE;IACrE,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,4BAA4B,iBAAiB,uCAAuC,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;IACjD,MAAM,oBAAoB,GAAG,MAAM,CAAC,aAAa,IAAI,aAAa,KAAK,EAAE,CAAC;IAC1E,IAAI,oBAAoB,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,oDAAoD,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,WAAW,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvG,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QACtC,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;KAChC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,MAAM,IAAI,yBAAyB,KAAK,GAAG,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnG,MAAM,mBAAmB,GAAG,CAAC,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC;SAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACxD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC/D,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QACpC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACrC,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC;QACjC,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC9B,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC;QACpC,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC;QACjC,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC;QACxC,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;QACzC,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,CAAC;QACvC,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC;QAC3C,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzC,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC;QACjD,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QACpC,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC;QACnD,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KAChD,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IAC3C,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ;QACR,oBAAoB,EAAE,GAAG,QAAQ,GAAG;QACpC,mBAAmB,EAAE,GAAG,QAAQ,OAAO;QACvC,iBAAiB,EAAE,GAAG,QAAQ,MAAM;QACpC,mBAAmB,EAAE,GAAG,QAAQ,OAAO;QACvC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC;QAC3D,WAAW,EAAE,gBAAgB,CAAC,SAAS,CAAC;QACxC,SAAS,EAAE,gBAAgB,CAAC,mBAAmB,CAAC;QAChD,gBAAgB,EAAE,gBAAgB,CAAC,eAAe,CAAC;QACnD,mBAAmB,EAAE,gBAAgB,CAAC,mBAAmB,CAAC;QAC1D,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,UAAU;QACV,aAAa;QACb,oBAAoB;QACpB,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACxE,YAAY,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAClD,gBAAgB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC1D,UAAU,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,sBAAsB,CAAC,CAAC,IAAI,EAAE;QAClE,iBAAiB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE;QAC1E,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC1C,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC1C,WAAW;QACX,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACxC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,mBAAmB;QACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,gBAAgB;QAChB,iBAAiB;QACjB,2BAA2B,EAAE,iBAAiB;QAC9C,eAAe,EAAE,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAC3D,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACZ,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC7C,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE9D,YAAY,OAAgC,EAAE,QAA4B;QACxE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClD,MAAM,UAAU,GAAqB;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;gBACtC,MAAM;aACP,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,UAAU,CAAC,IAAI,mBAAmB,CAAC,CAAC;YACrG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC7C,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,yBAAyB,KAAK,CAAC,IAAI,UAAU,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;gBACzG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,QAA4B;QAC9D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,OAAO,GAAI,MAAsC,EAAE,OAAO,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2CAA2C,CAAC,CAAC;QACjG,OAAO,IAAI,kBAAkB,CAAC,OAAyB,EAAE,QAAQ,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,KAAK;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACvC,CAAC;CACF;AAUD,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,+GAA+G;YAC7G,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;IACxF,OAAO;QACL,WAAW;QACX,SAAS;QACT,WAAW,EAAE,kBAAkB,CAAC,GAAG,CAAC;QACpC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC;QACtC,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,aAAa;QACtC,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAC3D,cAAc;QACd,aAAa,EAAE,GAAG,CAAC,eAAe,IAAI,oBAAoB,EAAE;QAC5D,YAAY,EACV,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,sBAAsB;QACnH,kBAAkB,EAAE,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;QACjF,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;KAC3D,CAAC;AACJ,CAAC"}

package/dist/tenancy/tenant-secrets.d.ts CHANGED Viewed

@@ -2,7 +2,7 @@
 export interface TenantSecrets {
     /** Signs the tenant's login sessions and OAuth state. */
     jwtSecret: string;
-    /** 32 bytes, base64: encrypts the tenant's vault values, MCP OAuth tokens and stored git credential. */
+    /** 32 bytes, base64: encrypts the tenant's vault values, MCP OAuth tokens, stored git credential and personal-data columns. */
     secretsEncKey: string;
     /** HMAC key for the tenant's internal (loopback) tool tokens. */
     internalTokenSecret: string;
@@ -19,6 +19,10 @@ export interface TenantSecrets {
  * export, and nothing per tenant has to be kept safe in the meantime. The
  * cloud app's registry calls this with the same inputs and gets the same
  * answer.
+ *
+ * The personal-data columns are sealed under `secretsEncKey` too (each
+ * tenant's database handle is built with it), so the same one key opens the
+ * whole of a tenant's dump.
  */
 export declare function deriveTenantSecrets(masterKey: string, slug: string): TenantSecrets;
 //# sourceMappingURL=tenant-secrets.d.ts.map

package/dist/tenancy/tenant-secrets.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tenant-secrets.d.ts","sourceRoot":"","sources":["../../src/tenancy/tenant-secrets.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB~~,wGAAwG~~;~~IACxG~~,aAAa,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAKD~~;;;;;;;;;;;;GAYG~~;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAYlF"}
1	+ {"version":3,"file":"tenant-secrets.d.ts","sourceRoot":"","sources":["../../src/tenancy/tenant-secrets.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,+HAA+H;IAC/H,aAAa,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAYlF"}

package/dist/tenancy/tenant-secrets.js CHANGED Viewed

@@ -13,6 +13,10 @@ const MIN_MASTER_KEY_LENGTH = 32;
  * export, and nothing per tenant has to be kept safe in the meantime. The
  * cloud app's registry calls this with the same inputs and gets the same
  * answer.
+ *
+ * The personal-data columns are sealed under `secretsEncKey` too (each
+ * tenant's database handle is built with it), so the same one key opens the
+ * whole of a tenant's dump.
  */
 export function deriveTenantSecrets(masterKey, slug) {
     if (masterKey.length < MIN_MASTER_KEY_LENGTH) {

package/dist/tenancy/tenant-secrets.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tenant-secrets.js","sourceRoot":"","sources":["../../src/tenancy/tenant-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAYvC,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC~~;;;;;;;;;;;;GAYG~~;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IACjE,IAAI,SAAS,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,qBAAqB,4BAA4B,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CACtC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClG,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACxC,mBAAmB,EAAE,MAAM,CAAC,uBAAuB,CAAC;KACrD,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"tenant-secrets.js","sourceRoot":"","sources":["../../src/tenancy/tenant-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAYvC,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IACjE,IAAI,SAAS,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,qBAAqB,4BAA4B,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CACtC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClG,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACxC,mBAAmB,EAAE,MAAM,CAAC,uBAAuB,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/kb-template/AGENTS.md CHANGED Viewed

@@ -198,6 +198,8 @@ Write access is not evidence that a file belongs somewhere.
   folder you happen to be able to write to; a wrong guess is discovered much
   later than a question.
+{{sharedFileRules}}
 ## Access control
 Access to any path — reading it as much as writing it — is governed by

package/migrations/0014_change_request_closed_reason.sql ADDED Viewed

	@@ -0,0 +1 @@
1	+ ALTER TABLE "change_requests" ADD COLUMN "closed_reason" text;

package/migrations/0015_account_deactivation.sql ADDED Viewed

@@ -0,0 +1,3 @@
+-- An account an admin switched off keeps its row; NULL is "on". Guarded so a
+-- database that already has the column no-ops instead of failing.
+ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "deactivated_at" timestamp;

package/migrations/0016_pii_encryption.sql ADDED Viewed

@@ -0,0 +1,20 @@
+-- PII column encryption: add the blind-index companion columns, NULLABLE and
+-- unconstrained. The columns are populated — and existing plaintext PII rows
+-- rewritten to AES-256-GCM ciphertext — by the programmatic backfill that runs
+-- right after the SQL history on every start, under the same lock
+-- (`runPiiEncryptionBackfill` in migrate.ts). That same step then applies SET
+-- NOT NULL and swaps the unique constraints (`users_email_unique` →
+-- `users_email_bidx_unq`, `pr_file_approvals_unq` → `pr_file_approvals_bidx_unq`,
+-- `plugin_join_requests_requester_plugin_unq` →
+-- `plugin_join_requests_requester_bidx_plugin_unq`), because a unique index on
+-- a blind-index column can only go up once every row has one. The snapshot
+-- beside this file describes the END state, which is what the next migration
+-- is generated against.
+ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "email_bidx" text;--> statement-breakpoint
+ALTER TABLE "pr_file_approvals" ADD COLUMN IF NOT EXISTS "approver_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "pr_merge_log" ADD COLUMN IF NOT EXISTS "triggered_by_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "pr_comments" ADD COLUMN IF NOT EXISTS "author_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "change_requests" ADD COLUMN IF NOT EXISTS "author_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "change_requests" ADD COLUMN IF NOT EXISTS "apply_failed_by_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "pending_commits" ADD COLUMN IF NOT EXISTS "author_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "plugin_join_requests" ADD COLUMN IF NOT EXISTS "requester_email_bidx" text;