@cat-factory/node-server 0.107.10 → 0.107.12

package/dist/container-realtime-deps.js

@@ -0,0 +1,112 @@
+import {} from '@cat-factory/agents';
+import { ConsensusAgentExecutor, registerConsensusTraits } from '@cat-factory/consensus';
+import { SLACK_CIPHER_INFO, SlackNotificationChannel } from '@cat-factory/integrations';
+import { CompositeNotificationChannel, } from '@cat-factory/kernel';
+import { FanOutEventPublisher, InAppNotificationChannel, WebCryptoSecretCipher, logger, } from '@cat-factory/server';
+import { NodeEventPublisher } from './realtime.js';
+import { DrizzleSlackConnectionRepository, DrizzleSlackMemberMappingRepository, DrizzleSlackSettingsRepository, } from './repositories/slack.js';
+/** Truthy env flag (`true`/`1`/`yes`). */
+function isTruthy(value) {
+    return value === 'true' || value === '1' || value === 'yes';
+}
+/**
+ * Wire the Slack integration when enabled: the notification *channel* (an extra
+ * delivery transport composed onto the notification mechanism — Node has no in-app
+ * channel, so this is its only one) plus the management repositories (per-account
+ * connect + per-workspace routing + member map) and the bot-token cipher. The
+ * per-account bot token is sealed with the shared ENCRYPTION_KEY under a
+ * slack-scoped HKDF info, mirroring the Worker. OAuth credentials are optional.
+ */
+function selectNodeSlackDeps(config, repos, 
+// The remote-source seam (mothership mode): `sourced('name', build)` returns the remote registry
+// entry when there's no `db`, else builds the Drizzle repo. Routing the three Slack repos through
+// it makes the connect / route / member-map management surface functional in mothership mode —
+// AND keeps the `SlackNotificationChannel` (which captures these repos directly) reading the SAME
+// remote-backed repos, so it can't drift to the broken db-less Drizzle instances. The bot token
+// rides a SEALED `tokenCipher` (sealed/decrypted under the LOCAL key), so the sealed blob — never
+// plaintext — crosses the machine API; the settings + member-mapping rows carry no secrets. The
+// RPC allow-list gates each method by its account/workspace scope. (Mothership-SIDE delivery for a
+// hosted teammate's notification — the mothership decrypting a laptop-sealed token — is the later
+// secrets-delegation slice; local delivery, where the run's own node holds the key, works.)
+sourced) {
+    if (!config.slack.enabled || !config.slack.encryptionKey)
+        return {};
+    const secretCipher = new WebCryptoSecretCipher({
+        masterKeyBase64: config.slack.encryptionKey,
+        info: SLACK_CIPHER_INFO,
+    });
+    const slackConnectionRepository = sourced('slackConnectionRepository', (d) => new DrizzleSlackConnectionRepository(d));
+    const slackSettingsRepository = sourced('slackSettingsRepository', (d) => new DrizzleSlackSettingsRepository(d));
+    const slackMemberMappingRepository = sourced('slackMemberMappingRepository', (d) => new DrizzleSlackMemberMappingRepository(d));
+    return {
+        notificationChannel: new SlackNotificationChannel({
+            workspaceRepository: repos.workspaceRepository,
+            slackConnectionRepository,
+            slackSettingsRepository,
+            slackMemberMappingRepository,
+            blockRepository: repos.blockRepository,
+            secretCipher,
+            // Best-effort delivery still surfaces failures (revoked token, missing channel
+            // invite) through the structured logger so a broken route is diagnosable.
+            onError: (error, ctx) => logger.warn({ err: error instanceof Error ? error.message : String(error), ...ctx }, 'slack notification delivery failed'),
+        }),
+        slackConnectionRepository,
+        slackSettingsRepository,
+        slackMemberMappingRepository,
+        slackSecretCipher: secretCipher,
+    };
+}
+/**
+ * The real-time event-publisher + notification-channel + optional consensus wrap of the Node
+ * composition root, lifted out of `buildNodeContainer` so that root stays within the file-size
+ * budget. Builds the Slack deps, the fan-out event publisher (when a realtime hub is wired),
+ * the (optionally consensus-wrapped) agent executor, and the composite notification channel.
+ */
+export function buildNodeRealtimeDeps(input) {
+    const { env, config, repos, sourced, realtimeSink, standardAgentExecutor, modelProviderResolver, resolveWorkspaceModelDefault, agentKindRegistry, } = input;
+    // Real-time push + notification delivery. When a realtime hub is wired (start()), the
+    // engine pushes execution/board/notification events to subscribed browsers via the
+    // NodeEventPublisher, decorated with FanOutEventPublisher so a shared service's live
+    // events reach EVERY board that mounts it (parity with the Worker's selectEventPublisher).
+    // The in-app push is also a notification channel, composed alongside Slack (when
+    // enabled) so a raised notification both lands in the inbox live AND fans to Slack.
+    const slackDeps = selectNodeSlackDeps(config, repos, sourced);
+    const executionEventPublisher = realtimeSink
+        ? new FanOutEventPublisher(new NodeEventPublisher(realtimeSink), {
+            workspaceMountRepository: repos.workspaceMountRepository,
+        })
+        : undefined;
+    // Optionally wrap the executor with the consensus mechanism (CONSENSUS_ENABLED). Off ⇒
+    // the standard composite, unchanged. Registers the capability traits + routes
+    // consensus-enabled steps through a multi-model process, persisting + pushing the
+    // transcript (same hub as run/board events).
+    const agentExecutor = isTruthy(env.CONSENSUS_ENABLED)
+        ? (registerConsensusTraits(agentKindRegistry),
+            new ConsensusAgentExecutor({
+                standard: standardAgentExecutor,
+                modelProviderResolver,
+                agentRouting: config.agents.routing,
+                resolveBlockModel: config.agents.resolveBlockModel,
+                resolveWorkspaceModelDefault,
+                // Consensus runs its participants INLINE, so in local mode keep an ambient-eligible
+                // subscription harness ref (served via the CLI) instead of degrading it; undefined on
+                // stock Node/Worker, where such a ref degrades to the routing default as before.
+                ...(config.agents.inlineHarnessRef ? { runsInline: config.agents.inlineHarnessRef } : {}),
+                sessionRepository: repos.consensusSessionRepository,
+                ...(executionEventPublisher ? { eventPublisher: executionEventPublisher } : {}),
+                agentKindRegistry,
+            }))
+        : standardAgentExecutor;
+    const notificationChannels = [];
+    if (executionEventPublisher)
+        notificationChannels.push(new InAppNotificationChannel(executionEventPublisher));
+    if (slackDeps.notificationChannel)
+        notificationChannels.push(slackDeps.notificationChannel);
+    const notificationChannel = notificationChannels.length === 0
+        ? undefined
+        : notificationChannels.length === 1
+            ? notificationChannels[0]
+            : new CompositeNotificationChannel(notificationChannels);
+    return { slackDeps, executionEventPublisher, agentExecutor, notificationChannel };
+}
+//# sourceMappingURL=container-realtime-deps.js.map

package/dist/container-realtime-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-realtime-deps.js","sourceRoot":"","sources":["../src/container-realtime-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AACxF,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAA;AACvF,OAAO,EAEL,4BAA4B,GAG7B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAGL,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,MAAM,GACP,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAuB,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAEvE,OAAO,EACL,gCAAgC,EAChC,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,yBAAyB,CAAA;AAIhC,0CAA0C;AAC1C,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,KAAK,CAAA;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,MAAiB,EACjB,KAAuB;AACvB,iGAAiG;AACjG,kGAAkG;AAClG,+FAA+F;AAC/F,kGAAkG;AAClG,gGAAgG;AAChG,kGAAkG;AAClG,gGAAgG;AAChG,mGAAmG;AACnG,kGAAkG;AAClG,4FAA4F;AAC5F,OAA2D;IAE3D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa;QAAE,OAAO,EAAE,CAAA;IACnE,MAAM,YAAY,GAAG,IAAI,qBAAqB,CAAC;QAC7C,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;QAC3C,IAAI,EAAE,iBAAiB;KACxB,CAAC,CAAA;IACF,MAAM,yBAAyB,GAAG,OAAO,CACvC,2BAA2B,EAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,gCAAgC,CAAC,CAAC,CAAC,CAC/C,CAAA;IACD,MAAM,uBAAuB,GAAG,OAAO,CACrC,yBAAyB,EACzB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,8BAA8B,CAAC,CAAC,CAAC,CAC7C,CAAA;IACD,MAAM,4BAA4B,GAAG,OAAO,CAC1C,8BAA8B,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,mCAAmC,CAAC,CAAC,CAAC,CAClD,CAAA;IACD,OAAO;QACL,mBAAmB,EAAE,IAAI,wBAAwB,CAAC;YAChD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,yBAAyB;YACzB,uBAAuB;YACvB,4BAA4B;YAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,YAAY;YACZ,+EAA+E;YAC/E,0EAA0E;YAC1E,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACtB,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,EAAE,EACvE,oCAAoC,CACrC;SACJ,CAAC;QACF,yBAAyB;QACzB,uBAAuB;QACvB,4BAA4B;QAC5B,iBAAiB,EAAE,YAAY;KAChC,CAAA;AACH,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA4B;IAChE,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,OAAO,EACP,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EACrB,4BAA4B,EAC5B,iBAAiB,GAClB,GAAG,KAAK,CAAA;IAET,sFAAsF;IACtF,mFAAmF;IACnF,qFAAqF;IACrF,2FAA2F;IAC3F,iFAAiF;IACjF,oFAAoF;IACpF,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IAC7D,MAAM,uBAAuB,GAAG,YAAY;QAC1C,CAAC,CAAC,IAAI,oBAAoB,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,EAAE;YAC7D,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;SACzD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IACb,uFAAuF;IACvF,8EAA8E;IAC9E,kFAAkF;IAClF,6CAA6C;IAC7C,MAAM,aAAa,GAAkB,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAClE,CAAC,CAAC,CAAC,uBAAuB,CAAC,iBAAiB,CAAC;YAC3C,IAAI,sBAAsB,CAAC;gBACzB,QAAQ,EAAE,qBAAqB;gBAC/B,qBAAqB;gBACrB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;gBACnC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB;gBAClD,4BAA4B;gBAC5B,oFAAoF;gBACpF,sFAAsF;gBACtF,iFAAiF;gBACjF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzF,iBAAiB,EAAE,KAAK,CAAC,0BAA0B;gBACnD,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,iBAAiB;aAClB,CAAC,CAAC;QACL,CAAC,CAAC,qBAAqB,CAAA;IAEzB,MAAM,oBAAoB,GAA0B,EAAE,CAAA;IACtD,IAAI,uBAAuB;QACzB,oBAAoB,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,uBAAuB,CAAC,CAAC,CAAA;IAClF,IAAI,SAAS,CAAC,mBAAmB;QAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAA;IAC3F,MAAM,mBAAmB,GACvB,oBAAoB,CAAC,MAAM,KAAK,CAAC;QAC/B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC;YACjC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;YACzB,CAAC,CAAC,IAAI,4BAA4B,CAAC,oBAAoB,CAAC,CAAA;IAE9D,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAA;AACnF,CAAC"}

package/dist/container-run-services-deps.d.ts

@@ -0,0 +1,44 @@
+import { RegistrySubscriptionQuotaProvider, TestSecretsService } from '@cat-factory/integrations';
+import type { AppCaches, Clock, IdGenerator, WebSearchAvailability } from '@cat-factory/kernel';
+import { AgentContextObservabilityService, SearchQueryObservabilityService } from '@cat-factory/orchestration';
+import { type AppConfig, WebCryptoSecretCipher } from '@cat-factory/server';
+import type { createDrizzleRepositories } from './repositories/drizzle.js';
+type NodeRepositories = ReturnType<typeof createDrizzleRepositories>;
+/** Inputs {@link buildNodeRunServices} needs from the composition root. */
+export interface NodeRunServicesInput {
+    env: NodeJS.ProcessEnv;
+    config: AppConfig;
+    repos: NodeRepositories;
+    idGenerator: IdGenerator;
+    clock: Clock;
+    caches?: AppCaches;
+}
+/**
+ * The per-run agent-observability + web-search + sealed-secret services of the Node
+ * composition root, lifted out of `buildNodeContainer` so that root stays within the
+ * file-size budget. Builds the agent-context / search-query / harness-call telemetry sinks,
+ * the deployment-wide web-search upstream + availability resolver, the package-registry +
+ * test-secret dispatch resolvers, and the modeled subscription-quota provider.
+ */
+export declare function buildNodeRunServices(input: NodeRunServicesInput): {
+    agentContextObservability: AgentContextObservabilityService;
+    searchQueryObservability: SearchQueryObservabilityService;
+    recordHarnessCalls: (input: import("@cat-factory/orchestration").HarnessCallsRecordInput) => Promise<void>;
+    defaultWebSearchUpstream: import("@cat-factory/server").WebSearchUpstream | undefined;
+    resolveWebSearchAvailability: ((workspaceId: string) => Promise<WebSearchAvailability>) | undefined;
+    packageRegistrySecretCipher: WebCryptoSecretCipher | undefined;
+    resolvePackageRegistries: ((workspaceId: string) => Promise<import("@cat-factory/orchestration").DispatchPackageRegistry[]>) | undefined;
+    testSecretsService: TestSecretsService | undefined;
+    resolveTestSecrets: ((workspaceId: string, blockId: string) => Promise<{
+        key: string;
+        description: string;
+        value: string;
+    }[]>) | undefined;
+    resolveTestSecretRefs: ((workspaceId: string, blockId: string) => Promise<{
+        key: string;
+        description: string;
+    }[]>) | undefined;
+    subscriptionQuotaProvider: RegistrySubscriptionQuotaProvider;
+};
+export {};
+//# sourceMappingURL=container-run-services-deps.d.ts.map

package/dist/container-run-services-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-run-services-deps.d.ts","sourceRoot":"","sources":["../src/container-run-services-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,iCAAiC,EAEjC,kBAAkB,EAEnB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EACL,gCAAgC,EAGhC,+BAA+B,EAGhC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,KAAK,SAAS,EACd,qBAAqB,EAGtB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AAE1E,KAAK,gBAAgB,GAAG,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEpE,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;IACtB,MAAM,EAAE,SAAS,CAAA;IACjB,KAAK,EAAE,gBAAgB,CAAA;IACvB,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,MAAM,CAAC,EAAE,SAAS,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB;;;;;iDAkEpC,MAAM,KAAG,OAAO,CAAC,qBAAqB,CAAC;;6CA8B/C,MAAM;;uCAuBN,MAAM,WAAW,MAAM;;;;;0CAIvB,MAAM,WAAW,MAAM;;;;;EA0B1C"}

package/dist/container-run-services-deps.js

@@ -0,0 +1,148 @@
+import { ACCOUNT_SETTINGS_CIPHER_INFO, AccountSettingsService, RegistrySubscriptionQuotaProvider, TEST_SECRETS_CIPHER_INFO, TestSecretsService, defaultSubscriptionQuotaRegistry, } from '@cat-factory/integrations';
+import { AgentContextObservabilityService, LlmObservabilityService, PACKAGE_REGISTRY_CIPHER_INFO, SearchQueryObservabilityService, makeHarnessCallRecorder, resolvePackageRegistriesForDispatch, } from '@cat-factory/orchestration';
+import { WebCryptoSecretCipher, createDefaultWebSearchUpstream, createWebSearchUpstream, } from '@cat-factory/server';
+/**
+ * The per-run agent-observability + web-search + sealed-secret services of the Node
+ * composition root, lifted out of `buildNodeContainer` so that root stays within the
+ * file-size budget. Builds the agent-context / search-query / harness-call telemetry sinks,
+ * the deployment-wide web-search upstream + availability resolver, the package-registry +
+ * test-secret dispatch resolvers, and the modeled subscription-quota provider.
+ */
+export function buildNodeRunServices(input) {
+    const { env, config, repos, idGenerator, clock, caches } = input;
+    // Agent-context observability sink: records the complete, redacted context provided
+    // to each container agent (composed prompts + folded-in fragments + injected files).
+    // Gated by the deployment prompt-recording switch + the workspace storeAgentContext
+    // setting. Wired into the executor (write) AND createCore (read). The telemetry rows
+    // live in the `telemetry` Postgres schema (see schema.ts).
+    const agentContextObservability = new AgentContextObservabilityService({
+        agentContextSnapshotRepository: repos.agentContextSnapshotRepository,
+        workspaceSettingsRepository: repos.workspaceSettingsRepository,
+        idGenerator,
+        clock,
+        recordPrompts: config.observability.recordPrompts,
+    });
+    // Agent-search-query observability sink: records each web search a container agent
+    // performed through the search proxy. Same double gate + retention window as the
+    // agent-context sink. Wired into the search proxy (write, via the container) AND
+    // createCore (read). Telemetry rows live in the `telemetry` Postgres schema.
+    const searchQueryObservability = new SearchQueryObservabilityService({
+        agentSearchQueryRepository: repos.agentSearchQueryRepository,
+        workspaceSettingsRepository: repos.workspaceSettingsRepository,
+        idGenerator,
+        clock,
+        recordPrompts: config.observability.recordPrompts,
+    });
+    // Record a subscription harness's (Claude Code / Codex) per-call telemetry into the
+    // SAME `llm_call_metrics` store the LLM proxy writes for Pi — those harnesses bypass
+    // the proxy, so the executor lifts the metrics off the CLI stream and feeds them here.
+    const recordHarnessCalls = makeHarnessCallRecorder(new LlmObservabilityService({
+        llmCallMetricRepository: repos.llmCallMetricRepository,
+        idGenerator,
+        clock,
+        recordPrompts: config.observability.recordPrompts,
+    }));
+    // A deployment-wide trusted web-search upstream, built from this facade's own `WEB_SEARCH_*`
+    // env, used by the search proxy as a fallback when a run's account has no web-search config
+    // (local mode defaults `WEB_SEARCH_SEARXNG_URL` to its self-hosted SearXNG). Distinct from the
+    // harness's own `SEARXNG_URL`/`BRAVE_SEARCH_API_KEY` runner-pool autodetect — those are for
+    // self-hosted pool containers; these keys stay on the backend. Surfaced on the ServerContainer
+    // below and read by `WebSearchProxyController`.
+    const defaultWebSearchUpstream = createDefaultWebSearchUpstream({
+        braveApiKey: env.WEB_SEARCH_BRAVE_API_KEY,
+        searxngUrl: env.WEB_SEARCH_SEARXNG_URL,
+        searxngApiKey: env.WEB_SEARCH_SEARXNG_API_KEY,
+    });
+    // Web-search keys live per-account; advertise Pi's `web_search` tool to a run only when a
+    // usable upstream exists — either the deployment default above (⇒ always on) or the run's
+    // account has its own keys (else the tool would just fail/return nothing). The per-account
+    // check runs off a dedicated account-settings instance (short-TTL cache).
+    const webSearchAccountKey = env.ENCRYPTION_KEY?.trim();
+    const webSearchAccountSettings = webSearchAccountKey
+        ? new AccountSettingsService({
+            accountSettingsRepository: repos.accountSettingsRepository,
+            secretCipher: new WebCryptoSecretCipher({
+                masterKeyBase64: webSearchAccountKey,
+                info: ACCOUNT_SETTINGS_CIPHER_INFO,
+            }),
+            clock,
+            ...(caches ? { settingsCache: caches.accountSettings } : {}),
+        })
+        : undefined;
+    const resolveWebSearchAvailability = defaultWebSearchUpstream || webSearchAccountSettings
+        ? async (workspaceId) => {
+            // Mirror the proxy's own resolution (`accountUpstream ?? defaultWebSearchUpstream`):
+            // the run's account keys WIN and the deployment default is only the fallback, so the
+            // surfaced provider matches the one that will actually serve the run's searches. Build
+            // the account upstream the SAME way the proxy does before falling back to the default.
+            if (webSearchAccountSettings) {
+                const accountId = await repos.workspaceRepository.accountOf(workspaceId);
+                if (accountId) {
+                    const accountUpstream = createWebSearchUpstream((await webSearchAccountSettings.resolve(accountId)).webSearch ?? {});
+                    if (accountUpstream)
+                        return { available: true, provider: accountUpstream.provider };
+                }
+            }
+            if (defaultWebSearchUpstream)
+                return { available: true, provider: defaultWebSearchUpstream.provider };
+            return { available: false, provider: null };
+        }
+        : undefined;
+    // Private package registries (npm private orgs, GitHub Packages): sealed per-workspace
+    // entries decrypted only at container dispatch, rendered by the harness into ~/.npmrc.
+    // The cipher is shared by the dispatch resolver here and the management service below.
+    const packageRegistryEncryptionKey = env.ENCRYPTION_KEY?.trim();
+    const packageRegistrySecretCipher = packageRegistryEncryptionKey
+        ? new WebCryptoSecretCipher({
+            masterKeyBase64: packageRegistryEncryptionKey,
+            info: PACKAGE_REGISTRY_CIPHER_INFO,
+        })
+        : undefined;
+    const resolvePackageRegistries = packageRegistrySecretCipher
+        ? (workspaceId) => resolvePackageRegistriesForDispatch(repos.packageRegistryConnectionRepository, packageRegistrySecretCipher, workspaceId)
+        : undefined;
+    // Sensitive per-service test credentials (sealed): the service backs the CRUD controller, the
+    // engine's prompt refs (via `resolveTestSecretRefs`) and the executor's out-of-band value
+    // injection (via `resolveTestSecrets`). Guarded by ENCRYPTION_KEY like the other sealed stores.
+    const testSecretsEncryptionKey = env.ENCRYPTION_KEY?.trim();
+    const testSecretsService = testSecretsEncryptionKey
+        ? new TestSecretsService({
+            testSecretsRepository: repos.testSecretsRepository,
+            secretCipher: new WebCryptoSecretCipher({
+                masterKeyBase64: testSecretsEncryptionKey,
+                info: TEST_SECRETS_CIPHER_INFO,
+            }),
+            blockRepository: repos.blockRepository,
+            clock,
+        })
+        : undefined;
+    const resolveTestSecrets = testSecretsService
+        ? (workspaceId, blockId) => testSecretsService.resolveValuesForBlock(workspaceId, blockId)
+        : undefined;
+    const resolveTestSecretRefs = testSecretsService
+        ? (workspaceId, blockId) => testSecretsService.resolveRefsForBlock(workspaceId, blockId)
+        : undefined;
+    // Modeled subscription quota-cycle provider (usage-and-quota-tracking, Part B): folds a
+    // finished subscription run's tokens into rolling windows (real reads land in B2). The
+    // registry of REAL vendor adapters is empty today, so every vendor reports modeled.
+    const subscriptionQuotaProvider = new RegistrySubscriptionQuotaProvider({
+        subscriptionQuotaCycleRepository: repos.subscriptionQuotaCycleRepository,
+        idGenerator,
+        clock,
+        registry: defaultSubscriptionQuotaRegistry,
+    });
+    return {
+        agentContextObservability,
+        searchQueryObservability,
+        recordHarnessCalls,
+        defaultWebSearchUpstream,
+        resolveWebSearchAvailability,
+        packageRegistrySecretCipher,
+        resolvePackageRegistries,
+        testSecretsService,
+        resolveTestSecrets,
+        resolveTestSecretRefs,
+        subscriptionQuotaProvider,
+    };
+}
+//# sourceMappingURL=container-run-services-deps.js.map

package/dist/container-run-services-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-run-services-deps.js","sourceRoot":"","sources":["../src/container-run-services-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,iCAAiC,EACjC,wBAAwB,EACxB,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,gCAAgC,EAChC,uBAAuB,EACvB,4BAA4B,EAC5B,+BAA+B,EAC/B,uBAAuB,EACvB,mCAAmC,GACpC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAEL,qBAAqB,EACrB,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,qBAAqB,CAAA;AAe5B;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA2B;IAC9D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;IAEhE,oFAAoF;IACpF,qFAAqF;IACrF,oFAAoF;IACpF,qFAAqF;IACrF,2DAA2D;IAC3D,MAAM,yBAAyB,GAAG,IAAI,gCAAgC,CAAC;QACrE,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,WAAW;QACX,KAAK;QACL,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,aAAa;KAClD,CAAC,CAAA;IACF,mFAAmF;IACnF,iFAAiF;IACjF,iFAAiF;IACjF,6EAA6E;IAC7E,MAAM,wBAAwB,GAAG,IAAI,+BAA+B,CAAC;QACnE,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,WAAW;QACX,KAAK;QACL,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,aAAa;KAClD,CAAC,CAAA;IACF,oFAAoF;IACpF,qFAAqF;IACrF,uFAAuF;IACvF,MAAM,kBAAkB,GAAG,uBAAuB,CAChD,IAAI,uBAAuB,CAAC;QAC1B,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,WAAW;QACX,KAAK;QACL,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,aAAa;KAClD,CAAC,CACH,CAAA;IACD,6FAA6F;IAC7F,4FAA4F;IAC5F,+FAA+F;IAC/F,4FAA4F;IAC5F,+FAA+F;IAC/F,gDAAgD;IAChD,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;QAC9D,WAAW,EAAE,GAAG,CAAC,wBAAwB;QACzC,UAAU,EAAE,GAAG,CAAC,sBAAsB;QACtC,aAAa,EAAE,GAAG,CAAC,0BAA0B;KAC9C,CAAC,CAAA;IACF,0FAA0F;IAC1F,0FAA0F;IAC1F,2FAA2F;IAC3F,0EAA0E;IAC1E,MAAM,mBAAmB,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAA;IACtD,MAAM,wBAAwB,GAAG,mBAAmB;QAClD,CAAC,CAAC,IAAI,sBAAsB,CAAC;YACzB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,YAAY,EAAE,IAAI,qBAAqB,CAAC;gBACtC,eAAe,EAAE,mBAAmB;gBACpC,IAAI,EAAE,4BAA4B;aACnC,CAAC;YACF,KAAK;YACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,4BAA4B,GAChC,wBAAwB,IAAI,wBAAwB;QAClD,CAAC,CAAC,KAAK,EAAE,WAAmB,EAAkC,EAAE;YAC5D,qFAAqF;YACrF,qFAAqF;YACrF,uFAAuF;YACvF,uFAAuF;YACvF,IAAI,wBAAwB,EAAE,CAAC;gBAC7B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;gBACxE,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,eAAe,GAAG,uBAAuB,CAC7C,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CACpE,CAAA;oBACD,IAAI,eAAe;wBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAA;gBACrF,CAAC;YACH,CAAC;YACD,IAAI,wBAAwB;gBAC1B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,wBAAwB,CAAC,QAAQ,EAAE,CAAA;YACzE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC7C,CAAC;QACH,CAAC,CAAC,SAAS,CAAA;IACf,uFAAuF;IACvF,uFAAuF;IACvF,uFAAuF;IACvF,MAAM,4BAA4B,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAA;IAC/D,MAAM,2BAA2B,GAAG,4BAA4B;QAC9D,CAAC,CAAC,IAAI,qBAAqB,CAAC;YACxB,eAAe,EAAE,4BAA4B;YAC7C,IAAI,EAAE,4BAA4B;SACnC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,wBAAwB,GAAG,2BAA2B;QAC1D,CAAC,CAAC,CAAC,WAAmB,EAAE,EAAE,CACtB,mCAAmC,CACjC,KAAK,CAAC,mCAAmC,EACzC,2BAA2B,EAC3B,WAAW,CACZ;QACL,CAAC,CAAC,SAAS,CAAA;IACb,8FAA8F;IAC9F,0FAA0F;IAC1F,gGAAgG;IAChG,MAAM,wBAAwB,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAA;IAC3D,MAAM,kBAAkB,GAAG,wBAAwB;QACjD,CAAC,CAAC,IAAI,kBAAkB,CAAC;YACrB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,YAAY,EAAE,IAAI,qBAAqB,CAAC;gBACtC,eAAe,EAAE,wBAAwB;gBACzC,IAAI,EAAE,wBAAwB;aAC/B,CAAC;YACF,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,KAAK;SACN,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,kBAAkB,GAAG,kBAAkB;QAC3C,CAAC,CAAC,CAAC,WAAmB,EAAE,OAAe,EAAE,EAAE,CACvC,kBAAkB,CAAC,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC;QAClE,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,qBAAqB,GAAG,kBAAkB;QAC9C,CAAC,CAAC,CAAC,WAAmB,EAAE,OAAe,EAAE,EAAE,CACvC,kBAAkB,CAAC,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC;QAChE,CAAC,CAAC,SAAS,CAAA;IACb,wFAAwF;IACxF,uFAAuF;IACvF,oFAAoF;IACpF,MAAM,yBAAyB,GAAG,IAAI,iCAAiC,CAAC;QACtE,gCAAgC,EAAE,KAAK,CAAC,gCAAgC;QACxE,WAAW;QACX,KAAK;QACL,QAAQ,EAAE,gCAAgC;KAC3C,CAAC,CAAA;IAEF,OAAO;QACL,yBAAyB;QACzB,wBAAwB;QACxB,kBAAkB;QAClB,wBAAwB;QACxB,4BAA4B;QAC5B,2BAA2B;QAC3B,wBAAwB;QACxB,kBAAkB;QAClB,kBAAkB;QAClB,qBAAqB;QACrB,yBAAyB;KAC1B,CAAA;AACH,CAAC"}

package/dist/container-transport-deps.d.ts

@@ -0,0 +1,72 @@
+import { type DeployJobClient, type RunnerBackendRegistry } from '@cat-factory/integrations';
+import type { AppCaches, Clock, DeployCloneTarget, GitHubClient, GitHubInstallationRepository, IdGenerator, RepoProjectionRepository, WorkspaceRepository } from '@cat-factory/kernel';
+import { type AppConfig, type GitHubAppRegistry, type JobPackageRegistrySpec, type ResolveRepoOrigin, type ResolveRepoTarget, type ResolveRunnerTransport } from '@cat-factory/server';
+import type { CoreDependencies } from '@cat-factory/orchestration';
+import { buildNodeResolveTransport } from './container-executor-deps.js';
+import type { DrizzleDb } from './db/client.js';
+import { DrizzleBootstrapJobRepository } from './repositories/bootstrap.js';
+import type { DrizzleRunnerPoolConnectionRepository } from './repositories/containerExecution.js';
+import type { createDrizzleRepositories } from './repositories/drizzle.js';
+type NodeRepositories = ReturnType<typeof createDrizzleRepositories>;
+/** Inputs {@link buildNodeTransportDeploy} needs from the composition root. */
+export interface NodeTransportDeployInput {
+    config: AppConfig;
+    repos: NodeRepositories;
+    idGenerator: IdGenerator;
+    clock: Clock;
+    runnerPoolConnectionRepository: DrizzleRunnerPoolConnectionRepository;
+    runnerBackendRegistry: RunnerBackendRegistry;
+    appRegistry: GitHubAppRegistry | undefined;
+    resolveRepoTarget: ResolveRepoTarget;
+    workspaceRepository: WorkspaceRepository;
+    /** Facade overrides (`resolveTransport`, the deploy seams) threaded from `NodeContainerOptions`. */
+    resolveTransportOverride?: ResolveRunnerTransport | null;
+    runnerPoolProvider?: Parameters<typeof buildNodeResolveTransport>[5];
+    skipProvisioningLogWrap?: boolean;
+    mintInstallationToken?: (installationId: number) => Promise<string>;
+    deployJobClientOverride?: DeployJobClient;
+    disableDefaultDeployJobClient?: boolean;
+    resolveDeployCloneTargetOverride?: (workspaceId: string, blockId: string, ref?: string) => Promise<DeployCloneTarget | null>;
+    resolveRepoOrigin?: ResolveRepoOrigin;
+}
+/**
+ * The runner-transport resolver + the container-backed deploy lifecycle seams of the Node
+ * composition root, lifted out of `buildNodeContainer` so that root stays within the file-size
+ * budget. Resolves the workspace's runner transport (a sibling facade's injected one wins, else
+ * the self-hosted pool), wraps it with the provisioning-log decorator, and builds the deploy job
+ * client + clone-target resolver (default: the pool-backed client + an App-token github.com origin).
+ */
+export declare function buildNodeTransportDeploy(input: NodeTransportDeployInput): {
+    resolveTransport: ResolveRunnerTransport | null;
+    baseDeployMint: ((installationId: number) => Promise<string>) | undefined;
+    deployDeps: Partial<CoreDependencies>;
+};
+/** Inputs {@link buildNodeBootstrapper} needs from the composition root. */
+export interface NodeBootstrapperInput {
+    env: NodeJS.ProcessEnv;
+    config: AppConfig;
+    sourced: <T>(name: string, build: (d: DrizzleDb) => T) => T;
+    resolveTransport: ResolveRunnerTransport | null;
+    githubInstallationRepository: GitHubInstallationRepository;
+    repoProjectionRepository: RepoProjectionRepository;
+    appRegistry: GitHubAppRegistry | undefined;
+    githubClient: GitHubClient | undefined;
+    mintInstallationToken?: (installationId: number) => Promise<string>;
+    resolvePackageRegistries?: (workspaceId: string) => Promise<JobPackageRegistrySpec[]>;
+    caches?: AppCaches;
+}
+/**
+ * The repo-bootstrap slice of the Node composition root (the reference-architecture library +
+ * the container-dispatching `repoBootstrapper`), lifted out of `buildNodeContainer` so that root
+ * stays within the file-size budget. The bootstrap-job repo is wired unconditionally (the module
+ * + ref-arch CRUD then work like the Worker); the `repoBootstrapper` wires only when its
+ * prerequisites are met (transport + proxy + token + GitHub client) — the same token source the
+ * container executor uses.
+ */
+export declare function buildNodeBootstrapper(input: NodeBootstrapperInput): {
+    bootstrapJobRepository: DrizzleBootstrapJobRepository;
+    bootstrapMintInstallationToken: ((installationId: number) => Promise<string>) | undefined;
+    repoBootstrapper: import("@cat-factory/server").ContainerRepoBootstrapper | undefined;
+};
+export {};
+//# sourceMappingURL=container-transport-deps.d.ts.map

package/dist/container-transport-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-transport-deps.d.ts","sourceRoot":"","sources":["../src/container-transport-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EACV,SAAS,EACT,KAAK,EACL,iBAAiB,EACjB,YAAY,EACZ,4BAA4B,EAC5B,WAAW,EACX,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAG5B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EACL,yBAAyB,EAG1B,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAA;AAC3E,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAA;AACjG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AAE1E,KAAK,gBAAgB,GAAG,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEpE,+EAA+E;AAC/E,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,SAAS,CAAA;IACjB,KAAK,EAAE,gBAAgB,CAAA;IACvB,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,8BAA8B,EAAE,qCAAqC,CAAA;IACrE,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C,WAAW,EAAE,iBAAiB,GAAG,SAAS,CAAA;IAC1C,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,oGAAoG;IACpG,wBAAwB,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAA;IACxD,kBAAkB,CAAC,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAA;IACpE,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,qBAAqB,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IACnE,uBAAuB,CAAC,EAAE,eAAe,CAAA;IACzC,6BAA6B,CAAC,EAAE,OAAO,CAAA;IACvC,gCAAgC,CAAC,EAAE,CACjC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,KACT,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACtC,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,wBAAwB;;sCAlB7B,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;;EA2GpE;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;IACtB,MAAM,EAAE,SAAS,CAAA;IACjB,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,CAAC,KAAK,CAAC,CAAA;IAC3D,gBAAgB,EAAE,sBAAsB,GAAG,IAAI,CAAA;IAC/C,4BAA4B,EAAE,4BAA4B,CAAA;IAC1D,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,WAAW,EAAE,iBAAiB,GAAG,SAAS,CAAA;IAC1C,YAAY,EAAE,YAAY,GAAG,SAAS,CAAA;IACtC,qBAAqB,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IACnE,wBAAwB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAA;IACrF,MAAM,CAAC,EAAE,SAAS,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,qBAAqB;;sDAbvB,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;;EAiDpE"}

package/dist/container-transport-deps.js

@@ -0,0 +1,88 @@
+import { ProvisioningLogRecorder, } from '@cat-factory/integrations';
+import { RunnerJobClient, makeResolveDeployCloneTarget, } from '@cat-factory/server';
+import { buildNodeResolveTransport, selectNodeRepoBootstrapper, withProvisioningLog, } from './container-executor-deps.js';
+import { DrizzleBootstrapJobRepository } from './repositories/bootstrap.js';
+/**
+ * The runner-transport resolver + the container-backed deploy lifecycle seams of the Node
+ * composition root, lifted out of `buildNodeContainer` so that root stays within the file-size
+ * budget. Resolves the workspace's runner transport (a sibling facade's injected one wins, else
+ * the self-hosted pool), wraps it with the provisioning-log decorator, and builds the deploy job
+ * client + clone-target resolver (default: the pool-backed client + an App-token github.com origin).
+ */
+export function buildNodeTransportDeploy(input) {
+    const { config, repos, idGenerator, clock, runnerPoolConnectionRepository, runnerBackendRegistry, appRegistry, resolveRepoTarget, workspaceRepository, resolveTransportOverride, runnerPoolProvider, skipProvisioningLogWrap, mintInstallationToken, deployJobClientOverride, disableDefaultDeployJobClient, resolveDeployCloneTargetOverride, resolveRepoOrigin, } = input;
+    // Best-effort recorder for the provisioning event log (its own Postgres schema).
+    // Shared by the env services (via createCore) and the runner/container transport
+    // decorator below, so every spin-up/down attempt is logged.
+    const provisioningLogRecorder = new ProvisioningLogRecorder({
+        repository: repos.provisioningLogRepository,
+        idGenerator,
+        clock,
+    });
+    // A sibling facade (local mode) may inject its own transport — even `null` — which
+    // replaces the default self-hosted-pool resolution; undefined keeps Node's default
+    // (a self-hosted pool, optionally driven by an injected native `runnerPoolProvider`).
+    // The injected transport is a per-run container (local mode), the default is a
+    // self-hosted pool — tag each accordingly so the logs drawer can filter by subsystem.
+    // A facade that pre-wraps its branches with their own subsystem tags (local mode) sets
+    // `skipProvisioningLogWrap` so we don't double-wrap.
+    const baseResolveTransport = resolveTransportOverride !== undefined
+        ? resolveTransportOverride
+        : buildNodeResolveTransport(config, runnerPoolConnectionRepository, workspaceRepository, clock, runnerBackendRegistry, runnerPoolProvider);
+    const resolveTransport = skipProvisioningLogWrap
+        ? baseResolveTransport
+        : withProvisioningLog(baseResolveTransport, provisioningLogRecorder, resolveTransportOverride !== undefined ? 'container' : 'runner-pool');
+    // The async, container-backed Kubernetes deploy lifecycle (slice 9's `deployJobClient` +
+    // `resolveDeployCloneTarget` seams). Node deploys on the workspace's self-hosted runner pool
+    // (which pulls the `imageDeploy` variant), so the default deploy client wraps the SAME
+    // `resolveTransport` the agent executor uses — the pool is Node's analogue of the Worker's
+    // DeployContainer. The clone-target resolver mints a short-lived install token + a github.com
+    // origin from the App registry. The local facade injects BOTH (a deploy-dedicated native/
+    // container transport + a PAT/GitLab clone target) via `options`, which win here. Absent any
+    // backend ⇒ unwired, so a render-needing config fails loudly (the raw REST path is unaffected).
+    const baseDeployMint = mintInstallationToken ??
+        (appRegistry ? (id) => appRegistry.installationToken(id) : undefined);
+    const deployJobClient = deployJobClientOverride ??
+        (disableDefaultDeployJobClient || !resolveTransport
+            ? undefined
+            : new RunnerJobClient(resolveTransport));
+    const resolveDeployCloneTarget = resolveDeployCloneTargetOverride ??
+        (baseDeployMint
+            ? makeResolveDeployCloneTarget(resolveRepoTarget, (id) => baseDeployMint(id), resolveRepoOrigin ? { resolveCloneUrl: (t) => resolveRepoOrigin(t).cloneUrl } : {})
+            : undefined);
+    const deployDeps = config.environments.encryptionKey
+        ? {
+            ...(deployJobClient ? { deployJobClient } : {}),
+            ...(resolveDeployCloneTarget ? { resolveDeployCloneTarget } : {}),
+        }
+        : {};
+    return { resolveTransport, baseDeployMint, deployDeps };
+}
+/**
+ * The repo-bootstrap slice of the Node composition root (the reference-architecture library +
+ * the container-dispatching `repoBootstrapper`), lifted out of `buildNodeContainer` so that root
+ * stays within the file-size budget. The bootstrap-job repo is wired unconditionally (the module
+ * + ref-arch CRUD then work like the Worker); the `repoBootstrapper` wires only when its
+ * prerequisites are met (transport + proxy + token + GitHub client) — the same token source the
+ * container executor uses.
+ */
+export function buildNodeBootstrapper(input) {
+    const { env, config, sourced, resolveTransport, githubInstallationRepository, repoProjectionRepository, appRegistry, githubClient, mintInstallationToken, resolvePackageRegistries, caches, } = input;
+    const bootstrapJobRepository = sourced('bootstrapJobRepository', (d) => new DrizzleBootstrapJobRepository(d));
+    const bootstrapMintInstallationToken = mintInstallationToken ??
+        (appRegistry ? (id) => appRegistry.installationToken(id) : undefined);
+    const repoBootstrapper = selectNodeRepoBootstrapper({
+        env,
+        config,
+        resolveTransport,
+        installationRepository: githubInstallationRepository,
+        bootstrapJobRepository,
+        repoRepository: repoProjectionRepository,
+        ...(caches?.repoProjection ? { repoProjectionCache: caches.repoProjection } : {}),
+        githubClient,
+        mintInstallationToken: bootstrapMintInstallationToken,
+        ...(resolvePackageRegistries ? { resolvePackageRegistries } : {}),
+    });
+    return { bootstrapJobRepository, bootstrapMintInstallationToken, repoBootstrapper };
+}
+//# sourceMappingURL=container-transport-deps.js.map

package/dist/container-transport-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-transport-deps.js","sourceRoot":"","sources":["../src/container-transport-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,2BAA2B,CAAA;AAWlC,OAAO,EAOL,eAAe,EACf,4BAA4B,GAC7B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAA;AAgC3E;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA+B;IACtE,MAAM,EACJ,MAAM,EACN,KAAK,EACL,WAAW,EACX,KAAK,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,6BAA6B,EAC7B,gCAAgC,EAChC,iBAAiB,GAClB,GAAG,KAAK,CAAA;IAET,iFAAiF;IACjF,iFAAiF;IACjF,4DAA4D;IAC5D,MAAM,uBAAuB,GAAG,IAAI,uBAAuB,CAAC;QAC1D,UAAU,EAAE,KAAK,CAAC,yBAAyB;QAC3C,WAAW;QACX,KAAK;KACN,CAAC,CAAA;IAEF,mFAAmF;IACnF,mFAAmF;IACnF,sFAAsF;IACtF,+EAA+E;IAC/E,sFAAsF;IACtF,uFAAuF;IACvF,qDAAqD;IACrD,MAAM,oBAAoB,GACxB,wBAAwB,KAAK,SAAS;QACpC,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,yBAAyB,CACvB,MAAM,EACN,8BAA8B,EAC9B,mBAAmB,EACnB,KAAK,EACL,qBAAqB,EACrB,kBAAkB,CACnB,CAAA;IACP,MAAM,gBAAgB,GAAG,uBAAuB;QAC9C,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,mBAAmB,CACjB,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CACrE,CAAA;IAEL,yFAAyF;IACzF,6FAA6F;IAC7F,uFAAuF;IACvF,2FAA2F;IAC3F,8FAA8F;IAC9F,0FAA0F;IAC1F,6FAA6F;IAC7F,gGAAgG;IAChG,MAAM,cAAc,GAClB,qBAAqB;QACrB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC/E,MAAM,eAAe,GACnB,uBAAuB;QACvB,CAAC,6BAA6B,IAAI,CAAC,gBAAgB;YACjD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAC5C,MAAM,wBAAwB,GAC5B,gCAAgC;QAChC,CAAC,cAAc;YACb,CAAC,CAAC,4BAA4B,CAC1B,iBAAiB,EACjB,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,EAC1B,iBAAiB,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CACnF;YACH,CAAC,CAAC,SAAS,CAAC,CAAA;IAChB,MAAM,UAAU,GAA8B,MAAM,CAAC,YAAY,CAAC,aAAa;QAC7E,CAAC,CAAC;YACE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE;QACH,CAAC,CAAC,EAAE,CAAA;IAEN,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,CAAA;AACzD,CAAC;AAiBD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA4B;IAChE,MAAM,EACJ,GAAG,EACH,MAAM,EACN,OAAO,EACP,gBAAgB,EAChB,4BAA4B,EAC5B,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,qBAAqB,EACrB,wBAAwB,EACxB,MAAM,GACP,GAAG,KAAK,CAAA;IAET,MAAM,sBAAsB,GAAG,OAAO,CACpC,wBAAwB,EACxB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,6BAA6B,CAAC,CAAC,CAAC,CAC5C,CAAA;IACD,MAAM,8BAA8B,GAClC,qBAAqB;QACrB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC/E,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;QAClD,GAAG;QACH,MAAM;QACN,gBAAgB;QAChB,sBAAsB,EAAE,4BAA4B;QACpD,sBAAsB;QACtB,cAAc,EAAE,wBAAwB;QACxC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,YAAY;QACZ,qBAAqB,EAAE,8BAA8B;QACrD,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAA;IAEF,OAAO,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,gBAAgB,EAAE,CAAA;AACrF,CAAC"}

package/dist/container.d.ts

@@ -7,7 +7,7 @@ import { type GateProviderOverrides } from '@cat-factory/gates';
 import type { AppCaches, InitiativePresetRegistry, PipelineRegistry, PreviewTransport, ProviderRegistry, VcsProviderRegistry } from '@cat-factory/kernel';
 import type { PgBoss } from 'pg-boss';
 import type { DrizzleDb } from './db/client.js';
-import { type LocalEventSink } from './realtime.js';
+import type { LocalEventSink } from './realtime.js';
 import { createDrizzleRepositories } from './repositories/drizzle.js';
 import type { ContentStorageBackend } from '@cat-factory/contracts';
 export { buildNodeResolveTransport, missingContainerExecutorPrereqs, withProvisioningLog, } from './container-executor-deps.js';
@@ -32,7 +32,7 @@ export declare function pickRepoSource<T>(remote: Record<string, unknown> | unde
  * warm container — the personal per-run activation for an individual vendor, the pooled token
  * otherwise — mirroring `ContainerAgentExecutor.resolveAuth`.
  */
-interface ModelProviderResolverWrapDeps {
+export interface ModelProviderResolverWrapDeps {
     leasePersonalSubscriptionToken?: (executionId: string, userId: string, vendor: SubscriptionVendor) => Promise<{
         secret: string;
     }>;

package/dist/container.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../src/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,iBAAiB,EAKvB,MAAM,qBAAqB,CAAA;AAO5B,OAAO,EAUL,KAAK,iBAAiB,EAwBtB,KAAK,eAAe,EACrB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAE1B,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,mCAAmC,EAIxC,KAAK,kBAAkB,EACvB,KAAK,gCAAgC,EAQtC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAGL,KAAK,gBAAgB,EAGrB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EAM1B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EAuCrB,MAAM,qBAAqB,CAAA;AAI5B,OAAO,EACL,KAAK,qBAAqB,EAU3B,MAAM,oBAAoB,CAAA;AAO3B,OAAO,KAAK,EACV,SAAS,EACT,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAEhB,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAErC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAc/C,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,eAAe,CAAA;AAevE,OAAO,EAAE,yBAAyB,EAA4B,MAAM,2BAA2B,CAAA;AAI/F,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,wBAAwB,CAAA;AAwD7F,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,GACb,CAAC,CAEH;AAoOD;;;;;;;GAOG;AACH,UAAU,6BAA6B;IACrC,8BAA8B,CAAC,EAAE,CAC/B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,KACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChC,sBAAsB,CAAC,EAAE,CACvB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,kBAAkB,KACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,EAAE,CAAC,EAAE,SAAS,CAAA;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAA;IACpD;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;IACnD;;;;OAIG;IACH,4BAA4B,CAAC,EAAE,4BAA4B,CAAA;IAC3D;;;;;;OAMG;IACH,mCAAmC,CAAC,EAAE,mCAAmC,CAAA;IACzE;;;;;OAKG;IACH,8BAA8B,CAAC,EAAE,8BAA8B,CAAA;IAC/D;;;;;;;OAOG;IACH,gCAAgC,CAAC,EAAE,gCAAgC,CAAA;IACnE;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8DAA8D;IAC9D,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACrC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAA;IAChD;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;;;OAOG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;IACvC;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,CACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,KACT,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACtC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IACnE;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,yBAAyB,CAAC,EAAE,CAC1B,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,6BAA6B,KAChC,qBAAqB,CAAA;IAC1B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,4BAA4B,CAAA;IAC3D;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAA;IACrC;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,cAAc,CAAA;IAC7B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;IACnD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,qBAAqB,CAAA;CACrD;AAED;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,CA8kDjF"}
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../src/container.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,iBAAiB,EAGvB,MAAM,qBAAqB,CAAA;AAO5B,OAAO,EAOL,KAAK,iBAAiB,EAMtB,KAAK,eAAe,EACrB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,mCAAmC,EACxC,KAAK,kBAAkB,EACvB,KAAK,gCAAgC,EAItC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,KAAK,gBAAgB,EAGrB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EAE1B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EAkBrB,MAAM,qBAAqB,CAAA;AAI5B,OAAO,EACL,KAAK,qBAAqB,EAI3B,MAAM,oBAAoB,CAAA;AAO3B,OAAO,KAAK,EACV,SAAS,EACT,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAEhB,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAQrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAS/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAQnD,OAAO,EAAE,yBAAyB,EAA4B,MAAM,2BAA2B,CAAA;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAiCnE,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,GACb,CAAC,CAEH;AA6HD;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,8BAA8B,CAAC,EAAE,CAC/B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,KACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChC,sBAAsB,CAAC,EAAE,CACvB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,kBAAkB,KACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,EAAE,CAAC,EAAE,SAAS,CAAA;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAA;IACpD;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;IACnD;;;;OAIG;IACH,4BAA4B,CAAC,EAAE,4BAA4B,CAAA;IAC3D;;;;;;OAMG;IACH,mCAAmC,CAAC,EAAE,mCAAmC,CAAA;IACzE;;;;;OAKG;IACH,8BAA8B,CAAC,EAAE,8BAA8B,CAAA;IAC/D;;;;;;;OAOG;IACH,gCAAgC,CAAC,EAAE,gCAAgC,CAAA;IACnE;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8DAA8D;IAC9D,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACrC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAA;IAChD;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;;;OAOG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;IACvC;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,CACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,KACT,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACtC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IACnE;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,yBAAyB,CAAC,EAAE,CAC1B,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,6BAA6B,KAChC,qBAAqB,CAAA;IAC1B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,4BAA4B,CAAA;IAC3D;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAA;IACrC;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,cAAc,CAAA;IAC7B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;IACnD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,qBAAqB,CAAA;CACrD;AAED;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,CA89BjF"}