@bevel-software/platform-core-backend 0.4.1 → 0.5.1

package/dist/modules/workspace/kb-seed.service.js

@@ -3,7 +3,8 @@ import os from 'node:os';
 import path from 'node:path';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { AGENTS_DIR, DATA_DIR, KNOWLEDGE_BASE_DIR, PIPELINES_DIR, SKILLS_DIR, TOOLS_DIR, } from '@bevel-software/platform-shared';
+import { KNOWLEDGE_BASE_DIR, GROUPS_DIR } from '@bevel-software/platform-shared';
+import { IGNORE_FILENAME } from './bevel-ignore.js';
 const execFileAsync = promisify(execFile);
 /**
  * Fallback committer identity for seed commits. Mirrors the workspace clone's
@@ -18,24 +19,51 @@ const BOT_EMAIL = 'bevel-workflow@bevel.software';
  *
  * Two kinds:
  *  - {@link REQUIRED_FILES}: repo-root files added when the file is missing.
- *  - {@link REQUIRED_DIRS}: well-known root dirs the app expects to exist; when a
- *    dir is entirely absent it's created by adding its `<dir>/.gitkeep`. Keyed on
- *    the *directory's* existence, not the `.gitkeep` file — so a branch that
- *    already has content under `KnowledgeBase/` never gets a pointless placeholder.
+ *  - {@link CORE_REQUIRED_DIRS} (plus any `extraDirs`): well-known root dirs the
+ *    app expects to exist; when a dir is entirely absent it's created by adding
+ *    its `<dir>/.gitkeep`. Keyed on the *directory's* existence, not the
+ *    `.gitkeep` file — so a branch that already has content under
+ *    `KnowledgeBase/` never gets a pointless placeholder.
  *
  * `roles.yaml` is in neither, and is not part of the template at all: it is
- * generated from `SEED_ADMIN_EMAILS` (see {@link renderRolesYaml}) and written
+ * generated from `ADMIN_EMAIL` (see {@link renderRolesYaml}) and written
  * directly, so a repo can't be seeded with a stale hard-coded Admin list.
  */
-const REQUIRED_FILES = ['access.md', 'CLAUDE.md', '.bevelignore', '.gitignore'];
-const REQUIRED_DIRS = [
-    KNOWLEDGE_BASE_DIR,
-    DATA_DIR,
-    AGENTS_DIR,
-    PIPELINES_DIR,
-    SKILLS_DIR,
-    TOOLS_DIR,
-];
+const REQUIRED_FILES = ['access.md', 'AGENTS.md', '.bevelignore', '.gitignore'];
+/**
+ * The two roots CORE gives a knowledge base: the ontologies, and the groups
+ * that hold skills and tools.
+ *
+ * `Data/`, `Agents/` and `Pipelines/` are deliberately absent. They scaffold
+ * the agentic execution layer, which is not part of this platform — a core
+ * deployment that created them would be handing every operator three empty
+ * folders it has no feature to fill. A distribution that DOES own that layer
+ * passes them as `extraDirs` (and ships a template carrying their READMEs);
+ * the names stay reserved in `kb-layout.ts` either way, so a KB that has them
+ * still renders them as roots rather than folding them into Knowledge.
+ */
+export const CORE_REQUIRED_DIRS = [KNOWLEDGE_BASE_DIR, GROUPS_DIR];
+/**
+ * A reserved root must be ONE path segment — `Data`, not `Data/x`, `../x` or
+ * `/x`. The name is joined onto the repo root, so anything else writes outside
+ * the repo being seeded.
+ *
+ * Deliberately NOT a check against the reserved-root set in `kb-layout.ts`:
+ * `Data`, `Agents` and `Pipelines` are all in that set, and they are precisely
+ * what a distribution passes here. Being reserved is what makes a name worth
+ * claiming — the file tree renders it as its own root instead of folding it
+ * into Knowledge — so rejecting reserved names would reject the only real use.
+ */
+function assertRootSegment(dir) {
+    if (!dir ||
+        dir === '.' ||
+        dir === '..' ||
+        dir.includes('/') ||
+        dir.includes('\\') ||
+        path.isAbsolute(dir)) {
+        throw new Error(`Reserved KB root must be a single path segment (no separators, no ".."); got "${dir}"`);
+    }
+}
 /** Redact the token from any string that might surface in a log or error. */
 function redact(s) {
     const token = process.env.GITHUB_TOKEN;
@@ -48,7 +76,7 @@ function renderRolesYaml(adminEmails) {
         '# Role names are case- and whitespace-insensitive. The `Admin` role is special:\n' +
         '# only Admins may edit this file, and at least one Admin must always exist.\n' +
         '#\n' +
-        '# Generated by the Bevel platform at KB-seed time from SEED_ADMIN_EMAILS.\n' +
+        '# Generated by the Bevel platform at KB-seed time from ADMIN_EMAIL.\n' +
         'roles:\n' +
         '  Admin:\n' +
         `${lines}\n`);
@@ -68,12 +96,8 @@ function renderRolesYaml(adminEmails) {
  *    branch a user loads: it fills in any missing base files on that branch.
  */
 export class KbSeedService {
-    kbRepoUrl;
     kbTemplateDir;
-    protectedBranches;
-    defaultBranch;
     seedAdminEmails;
-    gitUsername;
     /** Single-flight: the first caller runs the remote pass; the rest await its result. */
     inFlight = null;
     /**
@@ -85,15 +109,49 @@ export class KbSeedService {
      *                         base when creating a missing protected branch.
      * @param seedAdminEmails  Admins written into the generated `roles.yaml`.
      * @param gitUsername      Basic-auth username for git-over-HTTPS (provider-specific).
+     * @param extraDirs        Additional root folders this distribution reserves,
+     *                         on top of {@link CORE_REQUIRED_DIRS}. Their
+     *                         `.gitkeep` is written directly rather than copied,
+     *                         so a distribution can claim a root without also
+     *                         shipping a template entry for it.
      */
-    constructor(kbRepoUrl, kbTemplateDir, protectedBranches, defaultBranch, seedAdminEmails, gitUsername = 'x-access-token') {
-        this.kbRepoUrl = kbRepoUrl;
+    constructor(kbRepoUrl, kbTemplateDir, protectedBranches, defaultBranch, seedAdminEmails, gitUsername = 'x-access-token', extraDirs = []) {
         this.kbTemplateDir = kbTemplateDir;
-        this.protectedBranches = protectedBranches;
-        this.defaultBranch = defaultBranch;
         this.seedAdminEmails = seedAdminEmails;
-        this.gitUsername = gitUsername;
+        // A getter is read per-operation, so a remote supplied through the setup
+        // screen is seeded against without restarting; a string is still accepted.
+        this.kbRepoUrl = typeof kbRepoUrl === 'function' ? kbRepoUrl : () => kbRepoUrl;
+        // Read when seeding, not at construction: the branch model can be supplied
+        // through the setup screen, which happens after this object exists.
+        this.protectedBranches =
+            typeof protectedBranches === 'function' ? protectedBranches : () => protectedBranches;
+        this.defaultBranch = typeof defaultBranch === 'function' ? defaultBranch : () => defaultBranch;
+        this.gitUsername = typeof gitUsername === 'function' ? gitUsername : () => gitUsername;
+        // NOT a getter, unlike its neighbours above: the reserved roots are named
+        // by the composition root in code, not collected on the setup screen, so
+        // there is nothing to re-read. Validated once, here — every entry is joined
+        // onto the repo root and onto `<dir>/.gitkeep`, so a separator or a `..`
+        // would write outside the repo being seeded, and a bad value should fail at
+        // boot beside the rest of the wiring rather than part-way through seeding
+        // somebody's knowledge base. Same contract as `KB_DIR_NAME` in `CoreConfig`.
+        for (const dir of extraDirs) {
+            assertRootSegment(dir);
+            // A root named after a required FILE is a typo with a silent outcome:
+            // the file is laid down first in both seed paths, so `ensureRequiredDirs`
+            // finds the path taken and skips it, and the directory the caller asked
+            // for never appears with nothing said about why.
+            if (REQUIRED_FILES.includes(dir)) {
+                throw new Error(`Reserved KB root "${dir}" collides with a required file of the same name`);
+            }
+        }
+        this.requiredDirs = [...CORE_REQUIRED_DIRS, ...extraDirs];
     }
+    kbRepoUrl;
+    protectedBranches;
+    defaultBranch;
+    gitUsername;
+    /** Root folders this deployment guarantees — core's two plus any extras. */
+    requiredDirs;
     ensureRemoteSeeded() {
         // Cache the promise, not just a boolean, so concurrent first-callers share
         // one run. On failure we clear it so a later call can retry (a transient
@@ -110,9 +168,11 @@ export class KbSeedService {
         const heads = await this.lsRemoteHeads();
         if (heads.size === 0) {
             if (this.seedAdminEmails.length === 0) {
-                throw new Error(`KB remote ${redact(this.kbRepoUrl)} is empty and cannot be seeded: ` +
-                    'set SEED_ADMIN_EMAILS to the initial Admin email(s). A seeded KB with ' +
-                    'no Admin is unusable (access resolution requires at least one Admin).');
+                throw new Error(`KB remote ${redact(this.kbRepoUrl())} is empty and cannot be seeded: ` +
+                    'no initial Admin was supplied. A seeded KB with no Admin is unusable ' +
+                    '(access resolution requires at least one Admin). Unreachable in ' +
+                    'normal operation — ADMIN_EMAIL is required at boot — so this guards ' +
+                    'a caller that constructed the seeder with an empty list.');
             }
             await this.seedEmptyRemote();
             return;
@@ -121,7 +181,7 @@ export class KbSeedService {
         // later `clone -b <branch>` succeeds. This creates the branch pointer only;
         // per-branch file top-up happens in `topUpWorkspace` when the branch loads.
         const base = this.pickBase(heads);
-        for (const branch of this.protectedBranches) {
+        for (const branch of this.protectedBranches()) {
             if (!heads.has(branch)) {
                 await this.createBranchOnRemote(branch, base);
             }
@@ -137,30 +197,51 @@ export class KbSeedService {
      * stays consistent with origin, and the top-up is retried on a future clone.
      */
     async topUpWorkspace(repoDir, branch) {
+        // Scaffolding lands on PROTECTED branches only. A draft or suggestions
+        // branch is somebody's change-in-waiting, and a seeder commit there
+        // surfaces as noise in their change request's diff against the default
+        // branch (a stray scaffolding file riding along in a skill proposal was
+        // exactly this). Whatever the protected branches are missing, they get
+        // when THEY load — and drafts fork from them.
+        if (!this.protectedBranches().includes(branch))
+            return;
         try {
             const added = [];
             for (const rel of REQUIRED_FILES) {
                 if (!(await this.exists(path.join(repoDir, rel)))) {
                     await this.copyTemplateFile(rel, repoDir);
                     added.push(rel);
+                    // Adding AGENTS.md to a knowledge base seeded before the rename
+                    // leaves it VISIBLE: that repo's `.bevelignore` lists CLAUDE.md and
+                    // knows nothing of the new name, so the conventions doc starts
+                    // showing up in the file tree and the agent view. We created the
+                    // mismatch by adding the file, so we close it here.
+                    if (rel === 'AGENTS.md')
+                        added.push(...(await this.mergeIgnorePattern(repoDir, rel)));
                 }
             }
-            for (const rootDir of REQUIRED_DIRS) {
-                if (!(await this.exists(path.join(repoDir, rootDir)))) {
-                    const keep = `${rootDir}/.gitkeep`;
-                    await this.copyTemplateFile(keep, repoDir);
-                    added.push(keep);
-                }
+            // AGENTS.md is MANAGED, not merely seeded: the platform owns its
+            // content, and a stale copy is replaced with the packaged template's on
+            // every top-up (each fresh clone of a protected branch — in practice,
+            // every server restart). The file's own header says so, which is what
+            // makes overwriting edits a stated contract instead of a surprise.
+            let agentsRefreshed = false;
+            if (!added.includes('AGENTS.md') &&
+                (await this.templateDiffers(repoDir, 'AGENTS.md'))) {
+                await this.copyTemplateFile('AGENTS.md', repoDir);
+                added.push('AGENTS.md');
+                agentsRefreshed = true;
             }
+            added.push(...(await this.ensureRequiredDirs(repoDir)));
             if (!(await this.exists(path.join(repoDir, 'roles.yaml')))) {
                 if (this.seedAdminEmails.length > 0) {
                     await fs.writeFile(path.join(repoDir, 'roles.yaml'), renderRolesYaml(this.seedAdminEmails), 'utf8');
                     added.push('roles.yaml');
                 }
                 else {
-                    console.warn(`[kb-seed] Branch "${branch}" is missing roles.yaml but SEED_ADMIN_EMAILS ` +
-                        'is unset — leaving it absent. Access resolution will fail until an ' +
-                        'Admin roles.yaml exists; set SEED_ADMIN_EMAILS or add roles.yaml manually.');
+                    console.warn(`[kb-seed] Branch "${branch}" is missing roles.yaml and ADMIN_EMAIL is ` +
+                        'unset — leaving it absent. Access resolution will fail until an ' +
+                        'Admin roles.yaml exists; set ADMIN_EMAIL or add roles.yaml manually.');
                 }
             }
             if (added.length === 0)
@@ -170,7 +251,10 @@ export class KbSeedService {
             // values, so this is a harmless no-op there).
             await this.stampIdentity(repoDir);
             await this.git(repoDir, ['add', '--', ...added]);
-            await this.git(repoDir, ['commit', '-m', `Add missing KB scaffolding: ${added.join(', ')}`]);
+            const message = agentsRefreshed && added.length === 1
+                ? 'Update AGENTS.md to the current platform template'
+                : `Add missing KB scaffolding: ${added.join(', ')}`;
+            await this.git(repoDir, ['commit', '-m', message]);
             try {
                 await this.git(repoDir, ['push', 'origin', `HEAD:refs/heads/${branch}`]);
                 console.log(`[kb-seed] Topped up "${branch}" with: ${added.join(', ')}`);
@@ -191,9 +275,9 @@ export class KbSeedService {
     }
     /** Prefer the default branch as a base, else the first protected branch present, else any head. */
     pickBase(heads) {
-        if (heads.has(this.defaultBranch))
-            return this.defaultBranch;
-        const protectedPresent = this.protectedBranches.find((b) => heads.has(b));
+        if (heads.has(this.defaultBranch()))
+            return this.defaultBranch();
+        const protectedPresent = this.protectedBranches().find((b) => heads.has(b));
         if (protectedPresent)
             return protectedPresent;
         // Deterministic pick so repeated runs behave identically.
@@ -206,7 +290,7 @@ export class KbSeedService {
         if (token) {
             // The helper reads GITHUB_TOKEN at runtime, so the value never appears in argv.
             // Username is provider-specific; the token is always the Basic-auth password.
-            args.push('-c', `credential.helper=!f() { echo "username=${this.gitUsername}"; echo "password=$GITHUB_TOKEN"; }; f`);
+            args.push('-c', `credential.helper=!f() { echo "username=${this.gitUsername()}"; echo "password=$GITHUB_TOKEN"; }; f`);
         }
         return args;
     }
@@ -229,7 +313,7 @@ export class KbSeedService {
     }
     /** Set of branch names on the remote (empty ⇒ uninitialised repo). */
     async lsRemoteHeads() {
-        const out = await this.git(null, [...this.credArgs(), 'ls-remote', '--heads', this.kbRepoUrl]);
+        const out = await this.git(null, [...this.credArgs(), 'ls-remote', '--heads', this.kbRepoUrl()]);
         const heads = new Set();
         for (const line of out.split('\n')) {
             const m = line.match(/\srefs\/heads\/(.+)$/);
@@ -270,17 +354,110 @@ export class KbSeedService {
         await walk('');
     }
     /** Copy one template file (by repo-relative path) into `dest`, creating parents. */
+    /**
+     * Whether the repo's copy of `relPath` differs from the template's, modulo
+     * line endings — a CRLF checkout of identical content must read as "same",
+     * or the managed-file refresh would commit churn on every boot forever.
+     */
+    async templateDiffers(repoDir, relPath) {
+        const norm = (text) => text.replace(/\r\n?/g, '\n');
+        const [current, template] = await Promise.all([
+            fs.readFile(path.join(repoDir, relPath), 'utf8'),
+            fs.readFile(path.join(this.kbTemplateDir, relPath), 'utf8'),
+        ]);
+        return norm(current) !== norm(template);
+    }
     async copyTemplateFile(relPath, dest) {
         const from = path.join(this.kbTemplateDir, relPath);
         const to = path.join(dest, relPath);
         await fs.mkdir(path.dirname(to), { recursive: true });
         await fs.copyFile(from, to);
     }
+    /**
+     * Ensure `.bevelignore` carries `pattern`, appending it when absent. Returns
+     * the paths changed, for the commit.
+     *
+     * APPENDS — never rewrites. The file is the operator's, and every rule
+     * already in it is theirs to keep; this adds one line under a comment saying
+     * where it came from. Absent file, or a file that already lists the pattern,
+     * is a no-op, so running it on every clone changes nothing after the first.
+     *
+     * Matched line-wise rather than by substring: a rule for `Groups/AGENTS.md`
+     * is not a rule for the root `AGENTS.md`, and treating it as one would leave
+     * the mismatch this exists to close.
+     */
+    async mergeIgnorePattern(repoDir, pattern) {
+        const ignorePath = path.join(repoDir, IGNORE_FILENAME);
+        let current;
+        try {
+            current = await fs.readFile(ignorePath, 'utf8');
+        }
+        catch {
+            return []; // No ignore file — the template's copy arrives with the pattern in it.
+        }
+        const lines = current.split('\n').map((l) => l.trim());
+        if (lines.includes(pattern))
+            return [];
+        const separator = current.endsWith('\n') ? '' : '\n';
+        await fs.appendFile(ignorePath, `${separator}\n# Added by the platform: the conventions doc is not node content.\n${pattern}\n`, 'utf8');
+        return [IGNORE_FILENAME];
+    }
+    /**
+     * Create any reserved root folder this repo is missing, as an empty
+     * `<dir>/.gitkeep`. Returns the paths added, for the commit message.
+     *
+     * WRITTEN, not copied from the template. A `.gitkeep` is empty by definition,
+     * and requiring a template entry per root would mean a distribution could not
+     * reserve one without forking the packaged template.
+     *
+     * Keyed on the DIRECTORY's existence, not the `.gitkeep` file — a branch that
+     * already has content under `KnowledgeBase/` never gets a pointless
+     * placeholder alongside it.
+     */
+    async ensureRequiredDirs(repoDir) {
+        const added = [];
+        for (const rootDir of this.requiredDirs) {
+            const abs = path.join(repoDir, rootDir);
+            // `lstat`, not `exists`: `fs.access` answers "is there something here?",
+            // which is true of a FILE named `Groups` — and the old skip-if-present
+            // check then did nothing and reported success, leaving a knowledge base
+            // permanently missing a root it claims to guarantee. `lstat` rather than
+            // `stat` so a SYMLINK is rejected too: a link named `Groups` is not a KB
+            // layout, and one pointing outside the repo would make every later write
+            // into it land somewhere nobody asked for.
+            const found = await this.lstatOrNull(abs);
+            if (found) {
+                if (found.isDirectory())
+                    continue;
+                throw new Error(`KB root "${rootDir}" exists but is not a directory ` +
+                    `(${found.isSymbolicLink() ? 'symlink' : 'file'}). Remove or rename it — ` +
+                    'the platform requires this name to be a folder.');
+            }
+            await fs.mkdir(abs, { recursive: true });
+            await fs.writeFile(path.join(abs, '.gitkeep'), '', 'utf8');
+            added.push(`${rootDir}/.gitkeep`);
+        }
+        return added;
+    }
+    /** `lstat` without the throw — null when nothing is at `p`. */
+    async lstatOrNull(p) {
+        try {
+            return await fs.lstat(p);
+        }
+        catch {
+            return null;
+        }
+    }
     /** `git init` a temp repo, lay down the full template + generated roles.yaml, commit. */
     async buildSeedCommit(dir) {
-        await this.git(dir, ['init', '-b', this.defaultBranch]);
+        await this.git(dir, ['init', '-b', this.defaultBranch()]);
         await this.stampIdentity(dir);
         await this.copyTemplateTree(dir);
+        // Reserved roots the template does not carry. Without this the seed commit
+        // would hold only what the template has, and a distribution's own roots
+        // would appear a step later, when the first clone gets topped up — the same
+        // folders, arriving in a second commit for no reason.
+        await this.ensureRequiredDirs(dir);
         await fs.writeFile(path.join(dir, 'roles.yaml'), renderRolesYaml(this.seedAdminEmails), 'utf8');
         await this.git(dir, ['add', '-A']);
         await this.git(dir, ['commit', '-m', 'Seed knowledge base from Bevel template']);
@@ -291,22 +468,22 @@ export class KbSeedService {
             await this.buildSeedCommit(dir);
             // Point every protected branch at the seed commit. The init branch is
             // already `defaultBranch`; create the rest as refs to HEAD.
-            for (const branch of this.protectedBranches) {
-                if (branch !== this.defaultBranch) {
+            for (const branch of this.protectedBranches()) {
+                if (branch !== this.defaultBranch()) {
                     await this.git(dir, ['branch', branch]);
                 }
             }
-            await this.git(dir, ['remote', 'add', 'origin', this.kbRepoUrl]);
+            await this.git(dir, ['remote', 'add', 'origin', this.kbRepoUrl()]);
             // Push only the protected branches — never the stray init branch if it
             // isn't itself protected.
-            await this.git(dir, [...this.credArgs(), 'push', '-u', 'origin', ...this.protectedBranches]);
-            console.log(`[kb-seed] Seeded empty KB remote with branches: ${this.protectedBranches.join(', ')}`);
+            await this.git(dir, [...this.credArgs(), 'push', '-u', 'origin', ...this.protectedBranches()]);
+            console.log(`[kb-seed] Seeded empty KB remote with branches: ${this.protectedBranches().join(', ')}`);
         });
     }
     /** Create a missing protected branch on the remote, pointed at `base`'s tip. */
     async createBranchOnRemote(branch, base) {
         await this.withTempDir(async (dir) => {
-            await this.git(dir, [...this.credArgs(), 'clone', '--depth', '1', '-b', base, this.kbRepoUrl, dir]);
+            await this.git(dir, [...this.credArgs(), 'clone', '--depth', '1', '-b', base, this.kbRepoUrl(), dir]);
             // Push base's fetched tip up under the new branch name.
             await this.git(dir, [...this.credArgs(), 'push', 'origin', `HEAD:refs/heads/${branch}`]);
             console.log(`[kb-seed] Created missing protected branch "${branch}" from "${base}"`);

package/dist/modules/workspace/kb-seed.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"kb-seed.service.js","sourceRoot":"","sources":["../../../src/modules/workspace/kb-seed.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,iCAAiC,CAAC;AAGzC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C;;;GAGG;AACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAClC,MAAM,SAAS,GAAG,+BAA+B,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,cAAc,GAAsB,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;AACnG,MAAM,aAAa,GAAsB;IACvC,kBAAkB;IAClB,QAAQ;IACR,UAAU;IACV,aAAa;IACb,UAAU;IACV,SAAS;CACV,CAAC;AAEF,6EAA6E;AAC7E,SAAS,MAAM,CAAC,CAAS;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACvC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,+DAA+D;AAC/D,SAAS,eAAe,CAAC,WAA8B;IACrD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,CACL,iDAAiD;QACjD,mFAAmF;QACnF,+EAA+E;QAC/E,KAAK;QACL,6EAA6E;QAC7E,UAAU;QACV,YAAY;QACZ,GAAG,KAAK,IAAI,CACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,aAAa;IAeL;IACA;IACA;IACA;IACA;IACA;IAnBnB,uFAAuF;IAC/E,QAAQ,GAAyB,IAAI,CAAC;IAE9C;;;;;;;;;OASG;IACH,YACmB,SAAiB,EACjB,aAAqB,EACrB,iBAAoC,EACpC,aAAqB,EACrB,eAAkC,EAClC,cAAsB,gBAAgB;QALtC,cAAS,GAAT,SAAS,CAAQ;QACjB,kBAAa,GAAb,aAAa,CAAQ;QACrB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,kBAAa,GAAb,aAAa,CAAQ;QACrB,oBAAe,GAAf,eAAe,CAAmB;QAClC,gBAAW,GAAX,WAAW,CAA2B;IACtD,CAAC;IAEJ,kBAAkB;QAChB,2EAA2E;QAC3E,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACvC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,GAAG;QACf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAEzC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACb,aAAa,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,kCAAkC;oBACnE,wEAAwE;oBACxE,uEAAuE,CAC1E,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,MAAc;QAClD,IAAI,CAAC;YACH,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;gBACjC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;gBACpC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,GAAG,GAAG,OAAO,WAAW,CAAC;oBACnC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAC3C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpC,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAChC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,EACrC,MAAM,CACP,CAAC;oBACF,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CACV,qBAAqB,MAAM,gDAAgD;wBACzE,qEAAqE;wBACrE,4EAA4E,CAC/E,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,mCAAmC;YAEnE,uEAAuE;YACvE,wEAAwE;YACxE,8CAA8C;YAC9C,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;YACjD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7F,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,mBAAmB,MAAM,EAAE,CAAC,CAAC,CAAC;gBACzE,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,yEAAyE;gBACzE,wEAAwE;gBACxE,mEAAmE;gBACnE,OAAO,CAAC,IAAI,CACV,4CAA4C,MAAM,+BAA+B,EACjF,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACzD,CAAC;gBACF,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,gCAAgC;YAChC,OAAO,CAAC,IAAI,CACV,qCAAqC,MAAM,uBAAuB,EAClE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mGAAmG;IAC3F,QAAQ,CAAC,KAAkB;QACjC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAC7D,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,gBAAgB;YAAE,OAAO,gBAAgB,CAAC;QAC9C,0DAA0D;QAC1D,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oFAAoF;IAC5E,QAAQ;QACd,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,gFAAgF;YAChF,8EAA8E;YAC9E,IAAI,CAAC,IAAI,CACP,IAAI,EACJ,2CAA2C,IAAI,CAAC,WAAW,wCAAwC,CACpG,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,GAAkB,EAAE,IAAc;QAClD,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;gBAClD,GAAG,EAAE,GAAG,IAAI,SAAS;gBACrB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE;gBAC/C,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;aAC5B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC7C,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mEAAmE;IAC3D,KAAK,CAAC,WAAW,CAAI,EAA+B;QAC1D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAY;QACtC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,2FAA2F;IACnF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;YACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBAChE,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,oFAAoF;IAC5E,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,IAAY;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,yFAAyF;IACjF,KAAK,CAAC,eAAe,CAAC,GAAW;QACvC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;QAChG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,yCAAyC,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,uEAAuE;IAC/D,KAAK,CAAC,eAAe;QAC3B,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAChC,sEAAsE;YACtE,4DAA4D;YAC5D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC5C,IAAI,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YACjE,uEAAuE;YACvE,0BAA0B;YAC1B,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC7F,OAAO,CAAC,GAAG,CACT,mDAAmD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,IAAY;QAC7D,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;YACpG,wDAAwD;YACxD,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,MAAM,EAAE,CAAC,CAAC,CAAC;YACzF,OAAO,CAAC,GAAG,CAAC,+CAA+C,MAAM,WAAW,IAAI,GAAG,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,CAAS;QAC5B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"kb-seed.service.js","sourceRoot":"","sources":["../../../src/modules/workspace/kb-seed.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGpD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C;;;GAGG;AACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAClC,MAAM,SAAS,GAAG,+BAA+B,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,cAAc,GAAsB,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;AAEnG;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;AAEtF;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,IACE,CAAC,GAAG;QACJ,GAAG,KAAK,GAAG;QACX,GAAG,KAAK,IAAI;QACZ,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QACjB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EACpB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iFAAiF,GAAG,GAAG,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,MAAM,CAAC,CAAS;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACvC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,+DAA+D;AAC/D,SAAS,eAAe,CAAC,WAA8B;IACrD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,CACL,iDAAiD;QACjD,mFAAmF;QACnF,+EAA+E;QAC/E,KAAK;QACL,uEAAuE;QACvE,UAAU;QACV,YAAY;QACZ,GAAG,KAAK,IAAI,CACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,aAAa;IAqBL;IAGA;IAvBnB,uFAAuF;IAC/E,QAAQ,GAAyB,IAAI,CAAC;IAE9C;;;;;;;;;;;;;;OAcG;IACH,YACE,SAAkC,EACjB,aAAqB,EACtC,iBAAgE,EAChE,aAAsC,EACrB,eAAkC,EACnD,cAAuC,gBAAgB,EACvD,YAA+B,EAAE;QALhB,kBAAa,GAAb,aAAa,CAAQ;QAGrB,oBAAe,GAAf,eAAe,CAAmB;QAInD,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,CAAC,SAAS,GAAG,OAAO,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QAC/E,2EAA2E;QAC3E,oEAAoE;QACpE,IAAI,CAAC,iBAAiB;YACpB,OAAO,iBAAiB,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC;QACxF,IAAI,CAAC,aAAa,GAAG,OAAO,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC;QAC/F,IAAI,CAAC,WAAW,GAAG,OAAO,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC;QACvF,0EAA0E;QAC1E,yEAAyE;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,4EAA4E;QAC5E,0EAA0E;QAC1E,6EAA6E;QAC7E,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACvB,sEAAsE;YACtE,0EAA0E;YAC1E,wEAAwE;YACxE,iDAAiD;YACjD,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,kDAAkD,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,CAAC,GAAG,kBAAkB,EAAE,GAAG,SAAS,CAAC,CAAC;IAC5D,CAAC;IAEgB,SAAS,CAAe;IACxB,iBAAiB,CAA0B;IAC3C,aAAa,CAAe;IAC5B,WAAW,CAAe;IAC3C,4EAA4E;IAC3D,YAAY,CAAoB;IAEjD,kBAAkB;QAChB,2EAA2E;QAC3E,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACvC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,GAAG;QACf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAEzC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACb,aAAa,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,kCAAkC;oBACrE,uEAAuE;oBACvE,kEAAkE;oBAClE,sEAAsE;oBACtE,0DAA0D,CAC7D,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,MAAc;QAClD,uEAAuE;QACvE,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO;QACvD,IAAI,CAAC;YACH,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;gBACjC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAChB,gEAAgE;oBAChE,oEAAoE;oBACpE,+DAA+D;oBAC/D,iEAAiE;oBACjE,oDAAoD;oBACpD,IAAI,GAAG,KAAK,WAAW;wBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;gBACxF,CAAC;YACH,CAAC;YACD,iEAAiE;YACjE,wEAAwE;YACxE,sEAAsE;YACtE,sEAAsE;YACtE,mEAAmE;YACnE,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC5B,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,EAClD,CAAC;gBACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAClD,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACxB,eAAe,GAAG,IAAI,CAAC;YACzB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACxD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpC,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAChC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,EACrC,MAAM,CACP,CAAC;oBACF,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CACV,qBAAqB,MAAM,6CAA6C;wBACtE,kEAAkE;wBAClE,sEAAsE,CACzE,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,mCAAmC;YAEnE,uEAAuE;YACvE,wEAAwE;YACxE,8CAA8C;YAC9C,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;YACjD,MAAM,OAAO,GACX,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBACnC,CAAC,CAAC,mDAAmD;gBACrD,CAAC,CAAC,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,mBAAmB,MAAM,EAAE,CAAC,CAAC,CAAC;gBACzE,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,yEAAyE;gBACzE,wEAAwE;gBACxE,mEAAmE;gBACnE,OAAO,CAAC,IAAI,CACV,4CAA4C,MAAM,+BAA+B,EACjF,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACzD,CAAC;gBACF,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,gCAAgC;YAChC,OAAO,CAAC,IAAI,CACV,qCAAqC,MAAM,uBAAuB,EAClE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mGAAmG;IAC3F,QAAQ,CAAC,KAAkB;QACjC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;QACjE,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,gBAAgB;YAAE,OAAO,gBAAgB,CAAC;QAC9C,0DAA0D;QAC1D,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oFAAoF;IAC5E,QAAQ;QACd,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,gFAAgF;YAChF,8EAA8E;YAC9E,IAAI,CAAC,IAAI,CACP,IAAI,EACJ,2CAA2C,IAAI,CAAC,WAAW,EAAE,wCAAwC,CACtG,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,GAAkB,EAAE,IAAc;QAClD,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;gBAClD,GAAG,EAAE,GAAG,IAAI,SAAS;gBACrB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE;gBAC/C,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;aAC5B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC7C,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mEAAmE;IAC3D,KAAK,CAAC,WAAW,CAAI,EAA+B;QAC1D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAY;QACtC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,2FAA2F;IACnF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;YACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBAChE,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,oFAAoF;IACpF;;;;OAIG;IACK,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,OAAe;QAC5D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5C,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC;YAChD,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC;SAC5D,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,IAAY;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,OAAe;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACvD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC,CAAC,uEAAuE;QACpF,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,MAAM,EAAE,CAAC,UAAU,CACjB,UAAU,EACV,GAAG,SAAS,wEAAwE,OAAO,IAAI,EAC/F,MAAM,CACP,CAAC;QACF,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,kBAAkB,CAAC,OAAe;QAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,yEAAyE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,2CAA2C;YAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,KAAK,CAAC,WAAW,EAAE;oBAAE,SAAS;gBAClC,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,kCAAkC;oBACnD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,2BAA2B;oBAC1E,iDAAiD,CACpD,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,WAAW,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+DAA+D;IACvD,KAAK,CAAC,WAAW,CAAC,CAAS;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,yFAAyF;IACjF,KAAK,CAAC,eAAe,CAAC,GAAW;QACvC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjC,2EAA2E;QAC3E,wEAAwE;QACxE,4EAA4E;QAC5E,sDAAsD;QACtD,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;QAChG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,yCAAyC,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,uEAAuE;IAC/D,KAAK,CAAC,eAAe;QAC3B,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAChC,sEAAsE;YACtE,4DAA4D;YAC5D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC9C,IAAI,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;oBACpC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACnE,uEAAuE;YACvE,0BAA0B;YAC1B,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;YAC/F,OAAO,CAAC,GAAG,CACT,mDAAmD,IAAI,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,IAAY;QAC7D,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YACtG,wDAAwD;YACxD,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,MAAM,EAAE,CAAC,CAAC,CAAC;YACzF,OAAO,CAAC,GAAG,CAAC,+CAA+C,MAAM,WAAW,IAAI,GAAG,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,CAAS;QAC5B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/modules/workspace/workspace.routes.d.ts

@@ -1,3 +1,4 @@
+import type { IAdminAccessService } from '../admin/admin.interface.js';
 import express from 'express';
 import type { IWorkflowService } from '@bevel-software/platform-shared';
 import type { WorkspaceService } from './workspace.service.js';
@@ -21,5 +22,5 @@ import '../auth/auth.middleware.js';
  * exactly like the lock-aware filesystem the agent writes through. There
  * is no separate "share" step; save and share are fused.
  */
-export declare function createWorkspaceRoutes(workspaceService: WorkspaceService, authService: AuthService, workflowService: IWorkflowService, eventBus: WorkflowEventBus, accessControl: IAccessControl, kbDirName: string, creatorAccess: ICreatorAccess): express.Router;
+export declare function createWorkspaceRoutes(workspaceService: WorkspaceService, authService: AuthService, workflowService: IWorkflowService, eventBus: WorkflowEventBus, accessControl: IAccessControl, kbDirName: string, creatorAccess: ICreatorAccess, adminAccess: IAdminAccessService): express.Router;
 //# sourceMappingURL=workspace.routes.d.ts.map

package/dist/modules/workspace/workspace.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/workspace.routes.ts"],"names":[],"mappings":"AAEA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAY,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAYlF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,4BAA4B,CAAC;AAIpC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,gBAAgB,EAAE,gBAAgB,EAClC,WAAW,EAAE,WAAW,EACxB,eAAe,EAAE,gBAAgB,EACjC,QAAQ,EAAE,gBAAgB,EAC1B,aAAa,EAAE,cAAc,EAC7B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,cAAc,GAC5B,OAAO,CAAC,MAAM,CAq+BhB"}
+{"version":3,"file":"workspace.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/workspace.routes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAY,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAWlF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,4BAA4B,CAAC;AAIpC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,gBAAgB,EAAE,gBAAgB,EAClC,WAAW,EAAE,WAAW,EACxB,eAAe,EAAE,gBAAgB,EACjC,QAAQ,EAAE,gBAAgB,EAC1B,aAAa,EAAE,cAAc,EAC7B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,cAAc,EAC7B,WAAW,EAAE,mBAAmB,GAC/B,OAAO,CAAC,MAAM,CAugChB"}

package/dist/modules/workspace/workspace.routes.js

@@ -1,7 +1,8 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { IGNORE_FILENAME } from './bevel-ignore.js';
 import express from 'express';
-import { AGENTS_DIR, DATA_DIR, DEFAULT_BRANCH, KNOWLEDGE_BASE_DIR, KNOWLEDGE_DIR, PIPELINES_DIR, SKILLS_DIR, TOOLS_DIR, } from '@bevel-software/platform-shared';
+import { AGENTS_DIR, DATA_DIR, DEFAULT_BRANCH, KNOWLEDGE_BASE_DIR, KNOWLEDGE_DIR, PIPELINES_DIR, GROUPS_DIR, } from '@bevel-software/platform-shared';
 import { branchForWorkspaceId, FolderTooLargeError } from './workspace.service.js';
 import { resolveReadableMap, toKbRelative } from '../access/kb-read-filter.js';
 import { isRolesYamlPath, assertRolesYamlParsable } from '../access/roles-yaml-guard.js';
@@ -23,7 +24,7 @@ const MAX_UPLOAD_BYTES = 50 * 1024 * 1024; // 50 MB
  * exactly like the lock-aware filesystem the agent writes through. There
  * is no separate "share" step; save and share are fused.
  */
-export function createWorkspaceRoutes(workspaceService, authService, workflowService, eventBus, accessControl, kbDirName, creatorAccess) {
+export function createWorkspaceRoutes(workspaceService, authService, workflowService, eventBus, accessControl, kbDirName, creatorAccess, adminAccess) {
     const router = express.Router();
     function authenticated(req, res) {
         if (!req.userId) {
@@ -406,20 +407,18 @@ export function createWorkspaceRoutes(workspaceService, authService, workflowSer
             // The structural top-level folders are always shown as folders, even to
             // a user who can't read into them. Their existence isn't sensitive
             // (every KB has them), and keeping them visible lets the explorer render
-            // its Knowledge/Skills section view instead of collapsing to an empty
-            // flat tree. `KnowledgeBase/`, `Data/`, `Agents/`, `Pipelines/`,
-            // `Skills/` + `Tools/` are the current layout; a ROOT-LEVEL `Knowledge/`
-            // is the legacy pre-split layout's knowledge root (kb-layout.ts calls it
-            // the neutral bucket) and gets the same treatment so legacy clones don't
-            // collapse. Only the folders themselves are forced visible — their
-            // contents stay gated by the verdict above.
+            // its Knowledge/Groups section view instead of collapsing to an empty
+            // flat tree. A ROOT-LEVEL `Knowledge/` is the legacy pre-split layout's
+            // knowledge root (kb-layout.ts calls it the neutral bucket) and gets the
+            // same treatment so legacy clones don't collapse. Only the folders
+            // themselves are forced visible — their contents stay gated by the
+            // verdict above.
             const structuralRoots = new Set([
                 KNOWLEDGE_BASE_DIR,
                 DATA_DIR,
                 AGENTS_DIR,
                 PIPELINES_DIR,
-                SKILLS_DIR,
-                TOOLS_DIR,
+                GROUPS_DIR,
                 KNOWLEDGE_DIR,
             ]);
             for (const wp of wsRelPaths) {
@@ -427,6 +426,27 @@ export function createWorkspaceRoutes(workspaceService, authService, workflowSer
                 if (rel !== null && structuralRoots.has(rel))
                     verdict.set(wp, true);
             }
+            // `.bevelignore` is ADMIN-ONLY. It is the file that decides what the file
+            // tree and the agent view show at all, so it is deployment configuration
+            // rather than knowledge — and it sits alone in being visible: its
+            // siblings (`.gitignore`, `roles.yaml`, `access.md`, `AGENTS.md`) are
+            // already hidden from every reader by the shipped ignore rules. Somebody
+            // who cannot act on it gains a puzzle; somebody who can needs to reach it.
+            //
+            // Read permission is deliberately NOT the lever. Everyone can read it —
+            // it has to be readable to be applied — so hiding it is a listing
+            // decision, made here, rather than an ACL fiction maintained in a file.
+            //
+            // Resolved through `AdminAccessService` rather than by asking whether
+            // this caller can write `roles.yaml` in THIS workspace: admin is settled
+            // on the default branch precisely so that editing `roles.yaml` on your
+            // own branch cannot promote you, and the same reasoning applies to
+            // anything gated on being an admin.
+            const ignoreFiles = wsRelPaths.filter((wp) => path.basename(wp) === IGNORE_FILENAME);
+            if (ignoreFiles.length > 0 && !(await adminAccess.isAdmin(userEmail))) {
+                for (const wp of ignoreFiles)
+                    verdict.set(wp, false);
+            }
             return verdict;
         };
     }
@@ -503,16 +523,25 @@ export function createWorkspaceRoutes(workspaceService, authService, workflowSer
                 '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
                 '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
             };
-            // SVG is active web content (it can carry <script>). Inline view
-            // already trusts the source (the workspace owns its bytes), but a
-            // saved-to-disk SVG that's later re-opened in a browser tab would
-            // execute its scripts under the file:// origin — so when the user
-            // explicitly downloads, force octet-stream to defang it.
+            // SVG is active web content (it can carry <script>), and it is active in
+            // BOTH directions: a saved-to-disk SVG re-opened later runs its scripts
+            // under the file:// origin, so a download is forced to octet-stream.
             const downloadMime = ext === '.svg' ? 'application/octet-stream' : (mimeTypes[ext] || 'application/octet-stream');
             res.setHeader('Content-Type', wantsDownload ? downloadMime : (mimeTypes[ext] || 'application/octet-stream'));
             // Block MIME-sniffing so a misdeclared file can't be promoted to
             // active content by the browser.
             res.setHeader('X-Content-Type-Options', 'nosniff');
+            // …and inline is a DOCUMENT the moment somebody opens this URL in a tab
+            // directly, where those scripts would run under THIS
+            // origin with this user's session — stored XSS for anyone who can write
+            // a file into the workspace. `sandbox` drops the document into a unique
+            // origin with scripting off. It applies to documents only, so the
+            // renderers' fetch → blob → <img> path is untouched, and that path is
+            // why the type stays `image/svg+xml`: browsers do not sniff SVG, and an
+            // octet-stream blob would simply not render.
+            if (!wantsDownload && ext === '.svg') {
+                res.setHeader('Content-Security-Policy', 'sandbox');
+            }
             if (wantsDownload) {
                 // RFC 5987 UTF-8 filename encoding so unicode + spaces round-trip;
                 // CR/LF stripped to block header injection via a crafted path.
@@ -770,7 +799,7 @@ export function createWorkspaceRoutes(workspaceService, authService, workflowSer
             res.status(400).json({ error: 'path query parameter is required' });
             return;
         }
-        const { content } = req.body;
+        const { content, ifAbsent } = req.body;
         if (content === undefined) {
             res.status(400).json({ error: 'content is required in body' });
             return;
@@ -794,7 +823,11 @@ export function createWorkspaceRoutes(workspaceService, authService, workflowSer
             if (plan?.kind === 'seed-access-md')
                 await seedCreatorAccessMd(id, user, plan);
             const toWrite = plan?.kind === 'frontmatter' ? plan.apply(content) : content;
-            await withLock(id, user, filePath, () => workspaceService.writeFile(id, filePath, toWrite));
+            // `ifAbsent` = exclusive create: the service's `wx` write turns a
+            // concurrent or stale create against an existing file into a 409
+            // instead of a silent replace. `withLock`'s failure arm releases
+            // without committing, so the refusal leaves no trace.
+            await withLock(id, user, filePath, () => workspaceService.writeFile(id, filePath, toWrite, { failIfExists: ifAbsent === true }));
             res.json({ status: 'written' });
         }
         catch (err) {