@cat-factory/node-server 0.107.6 → 0.107.8

package/dist/container-executor-deps.d.ts

@@ -0,0 +1,114 @@
+import type { AgentKindRegistry } from '@cat-factory/agents';
+import { PersonalSubscriptionService, ProviderSubscriptionService } from '@cat-factory/integrations';
+import type { EnvironmentBackendRegistry, ProvisioningLogRecorder, RunnerBackendRegistry } from '@cat-factory/integrations';
+import type { AgentExecutor, Clock, GitHubClient, GitHubInstallationRepository, ProvisioningSubsystem, ResolveUserGitHubToken, RunnerPoolConnectionRepository, RunnerPoolProvider, SubscriptionQuotaTarget, TestSecretEntry, WebSearchAvailability } from '@cat-factory/kernel';
+import { AgentContextObservabilityService, type CoreDependencies, type HarnessCallsRecordInput } from '@cat-factory/orchestration';
+import { type AppConfig, type JobPackageRegistrySpec, type ResolveRepoOrigin, type ResolveRepoTarget, type ResolveRepoTargets, type ResolveRunnerTransport, ContainerEnvConfigRepairer, ContainerRepoBootstrapper, GitHubAppRegistry } from '@cat-factory/server';
+export declare const RUNNERS_CIPHER_INFO = "cat-factory:runners";
+/**
+ * Build the opt-in external trace sink(s) — Langfuse and/or OpenTelemetry — composed into
+ * the single sink slot; the observability service then fans every recorded LLM call out to
+ * whichever are wired. Memoised per config so both wiring sites share one instance.
+ *
+ * Langfuse uses the fetch-based sink (identical to the Worker). OpenTelemetry uses the
+ * OFFICIAL `@opentelemetry/*` SDK exporter (`createNodeOtelSink`) — the Node counterpart of
+ * the Worker's fetch OTLP exporter, kept conformant by the shared mapping layer + tests.
+ */
+export declare function buildTraceSink(config: AppConfig): CoreDependencies['llmTraceSink'];
+export declare function buildNodeResolveTransport(config: AppConfig, runnerPoolConnectionRepository: RunnerPoolConnectionRepository, workspaceRepository: CoreDependencies['workspaceRepository'], clock: Clock, runnerBackendRegistry: RunnerBackendRegistry, injectedPoolProvider?: RunnerPoolProvider): ResolveRunnerTransport | null;
+/**
+ * Wrap a transport resolver so every dispatch/release/poll-failure appends a
+ * provisioning-log event. A no-op when there's no resolver. `subsystem` tags the
+ * rows (a self-hosted pool vs a per-run container) so the logs drawer can filter.
+ */
+export declare function withProvisioningLog(resolve: ResolveRunnerTransport | null, recorder: ProvisioningLogRecorder, subsystem: ProvisioningSubsystem): ResolveRunnerTransport | null;
+/**
+ * Which of the container-executor prerequisites are missing, as the human labels the boot
+ * warning names. Empty ⇒ all three are present. `PUBLIC_URL` is this service's externally
+ * reachable base backing the LLM proxy, `AUTH_SESSION_SECRET` signs the harness↔proxy tokens,
+ * and a runner backend is what a dispatch is handed to. Pure so the "name exactly what's
+ * missing" logic is unit-tested (error-message coverage A5).
+ */
+export declare function missingContainerExecutorPrereqs(input: {
+    publicUrl: string | undefined;
+    sessionSecret: string | undefined;
+    hasRunnerBackend: boolean;
+}): string[];
+/**
+ * Build the container agent executor (repo-operating steps: coder, mocker,
+ * playwright, blueprints, ci-fixer, conflict-resolver, merger) when its
+ * prerequisites are configured: a token source for the push/clone token, the public
+ * URL backing the LLM proxy, the session secret to sign proxy tokens, and a runner
+ * backend. Returns null when any is missing, so the composite fails those kinds
+ * loudly rather than running them as useless one-shot LLM calls.
+ *
+ * The token source is pluggable: a sibling facade may pass `mintInstallationToken`
+ * (e.g. a static PAT for local mode), otherwise it is minted via the GitHub App
+ * registry (which additionally requires the App private key + `github.enabled`).
+ */
+export declare function buildNodeContainerExecutor(env: NodeJS.ProcessEnv, config: AppConfig, appRegistry: GitHubAppRegistry | undefined, resolveRepoTarget: ResolveRepoTarget, resolveRepoTargets: ResolveRepoTargets, resolveTransport: ResolveRunnerTransport | null, resolveWorkspaceModelDefault: (workspaceId: string, agentKind: string, modelPresetId?: string) => Promise<string | undefined>, agentKindRegistry: AgentKindRegistry, mintInstallationTokenOverride?: (installationId: number) => Promise<string>, subscriptions?: ProviderSubscriptionService, personalSubscriptions?: PersonalSubscriptionService, resolveAccountId?: (workspaceId: string) => Promise<string | null | undefined>, resolveUserGitHubToken?: ResolveUserGitHubToken, agentContextObservability?: AgentContextObservabilityService, resolveWebSearchAvailability?: (workspaceId: string) => Promise<WebSearchAvailability>, resolveRepoOrigin?: ResolveRepoOrigin, resolvePackageRegistries?: (workspaceId: string) => Promise<JobPackageRegistrySpec[]>, resolveTestSecrets?: (workspaceId: string, blockId: string) => Promise<TestSecretEntry[]>, recordHarnessCalls?: (input: HarnessCallsRecordInput) => Promise<void>, recordSubscriptionQuotaUsage?: (target: SubscriptionQuotaTarget, usage: {
+    inputTokens: number;
+    outputTokens: number;
+}) => Promise<void>): AgentExecutor | null;
+/**
+ * Build the repo bootstrapper (the "bootstrap repo" container dispatch) when its
+ * prerequisites are configured — mirroring the Worker's `selectRepoBootstrapper` and
+ * the container-executor prerequisites: a resolvable runner transport, the public URL
+ * + session secret backing the LLM proxy, a token source, and a GitHub client.
+ * Returns undefined otherwise (the bootstrap module then has no runner and the service
+ * reports a clean dispatch failure). Bootstrap is an `architect`-kind run, so it
+ * follows that kind's routing. The promoted `ContainerRepoBootstrapper` dispatches
+ * through the same shared runner seam the container executor uses, so on Node it runs
+ * against the self-hosted pool and on local against the per-job Docker container.
+ */
+export declare function selectNodeRepoBootstrapper(deps: {
+    env: NodeJS.ProcessEnv;
+    config: AppConfig;
+    resolveTransport: ResolveRunnerTransport | null;
+    installationRepository: GitHubInstallationRepository;
+    bootstrapJobRepository: ConstructorParameters<typeof ContainerRepoBootstrapper>[0]['bootstrapJobRepository'];
+    repoRepository: ConstructorParameters<typeof ContainerRepoBootstrapper>[0]['repoRepository'];
+    repoProjectionCache?: ConstructorParameters<typeof ContainerRepoBootstrapper>[0]['repoProjectionCache'];
+    githubClient: GitHubClient | undefined;
+    mintInstallationToken: ((installationId: number) => Promise<string>) | undefined;
+    resolvePackageRegistries?: (workspaceId: string) => Promise<JobPackageRegistrySpec[]>;
+}): ContainerRepoBootstrapper | undefined;
+/**
+ * Build the live ENVIRONMENT-PROVIDER CONFIG REPAIR agent (PR #416 increment 2) when its
+ * prerequisites are met — the same container prerequisites as the bootstrapper PLUS a
+ * registered backend that supports agent repair (`describeRepairAgent`). The stock manifest
+ * provider has no repair support, so this stays undefined there; it wires only when a custom
+ * backend registered into the env-backend registry implements repair (so local inherits it
+ * too). NOT the repo bootstrapper: an ordinary clone→edit→push coding job, no history reset.
+ */
+export declare function selectNodeEnvConfigRepairer(deps: {
+    env: NodeJS.ProcessEnv;
+    config: AppConfig;
+    resolveTransport: ResolveRunnerTransport | null;
+    installationRepository: GitHubInstallationRepository;
+    mintInstallationToken: ((installationId: number) => Promise<string>) | undefined;
+    override: CoreDependencies['environmentProvider'];
+    environmentBackendRegistry: EnvironmentBackendRegistry;
+}): ContainerEnvConfigRepairer | undefined;
+/** Files a GitHub issue for a service frame, or null when none can be resolved. */
+type GitHubIssueFiler = (request: {
+    workspaceId: string;
+    frameId: string;
+    title: string;
+    body: string;
+}) => Promise<{
+    externalId: string;
+    url: string;
+} | null>;
+/**
+ * Build the GitHub-issue tracker filer for the tech-debt pipeline when the GitHub
+ * App is configured. It resolves the service's repo from the workspace's
+ * `github_repos` projection and mints a short-lived token from that workspace's OWN
+ * App installation (per-tenant) — the same infra the container executor uses — then
+ * files the issue via the token. Returns undefined when the App isn't configured (the
+ * GitHub tracker then passes through). A run whose service isn't linked to a repo
+ * resolves to null (a clean pass-through, not a run failure).
+ */
+export declare function buildNodeGitHubIssueFiler(config: AppConfig, registry: GitHubAppRegistry | undefined, resolveRepoTarget: ResolveRepoTarget): GitHubIssueFiler | undefined;
+export {};
+//# sourceMappingURL=container-executor-deps.d.ts.map

package/dist/container-executor-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-executor-deps.d.ts","sourceRoot":"","sources":["../src/container-executor-deps.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAIL,2BAA2B,EAC3B,2BAA2B,EAE5B,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,2BAA2B,CAAA;AAElC,OAAO,KAAK,EACV,aAAa,EACb,KAAK,EACL,YAAY,EACZ,4BAA4B,EAC5B,qBAAqB,EACrB,sBAAsB,EACtB,8BAA8B,EAC9B,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,qBAAqB,EACtB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,gCAAgC,EAChC,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC7B,MAAM,4BAA4B,CAAA;AAGnC,OAAO,EACL,KAAK,SAAS,EACd,KAAK,sBAAsB,EAE3B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAE3B,0BAA0B,EAC1B,yBAAyB,EAEzB,iBAAiB,EAQlB,MAAM,qBAAqB,CAAA;AAI5B,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AAOxD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAuBlF;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,SAAS,EAGjB,8BAA8B,EAAE,8BAA8B,EAC9D,mBAAmB,EAAE,gBAAgB,CAAC,qBAAqB,CAAC,EAC5D,KAAK,EAAE,KAAK,EAEZ,qBAAqB,EAAE,qBAAqB,EAI5C,oBAAoB,CAAC,EAAE,kBAAkB,GACxC,sBAAsB,GAAG,IAAI,CA4B/B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,sBAAsB,GAAG,IAAI,EACtC,QAAQ,EAAE,uBAAuB,EACjC,SAAS,EAAE,qBAAqB,GAC/B,sBAAsB,GAAG,IAAI,CAe/B;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,gBAAgB,EAAE,OAAO,CAAA;CAC1B,GAAG,MAAM,EAAE,CAMX;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,iBAAiB,GAAG,SAAS,EAC1C,iBAAiB,EAAE,iBAAiB,EACpC,kBAAkB,EAAE,kBAAkB,EACtC,gBAAgB,EAAE,sBAAsB,GAAG,IAAI,EAC/C,4BAA4B,EAAE,CAC5B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,KACnB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,EAChC,iBAAiB,EAAE,iBAAiB,EACpC,6BAA6B,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,EAC3E,aAAa,CAAC,EAAE,2BAA2B,EAC3C,qBAAqB,CAAC,EAAE,2BAA2B,EACnD,gBAAgB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAC9E,sBAAsB,CAAC,EAAE,sBAAsB,EAC/C,yBAAyB,CAAC,EAAE,gCAAgC,EAC5D,4BAA4B,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,EACtF,iBAAiB,CAAC,EAAE,iBAAiB,EACrC,wBAAwB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,EACrF,kBAAkB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC,EACzF,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,EACtE,4BAA4B,CAAC,EAAE,CAC7B,MAAM,EAAE,uBAAuB,EAC/B,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,KACjD,OAAO,CAAC,IAAI,CAAC,GACjB,aAAa,GAAG,IAAI,CAsJtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;IACtB,MAAM,EAAE,SAAS,CAAA;IACjB,gBAAgB,EAAE,sBAAsB,GAAG,IAAI,CAAA;IAC/C,sBAAsB,EAAE,4BAA4B,CAAA;IACpD,sBAAsB,EAAE,qBAAqB,CAC3C,OAAO,yBAAyB,CACjC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAA;IAC9B,cAAc,EAAE,qBAAqB,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAA;IAC5F,mBAAmB,CAAC,EAAE,qBAAqB,CACzC,OAAO,yBAAyB,CACjC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAA;IAC3B,YAAY,EAAE,YAAY,GAAG,SAAS,CAAA;IACtC,qBAAqB,EAAE,CAAC,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAChF,wBAAwB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAA;CACtF,GAAG,yBAAyB,GAAG,SAAS,CA8BxC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;IACtB,MAAM,EAAE,SAAS,CAAA;IACjB,gBAAgB,EAAE,sBAAsB,GAAG,IAAI,CAAA;IAC/C,sBAAsB,EAAE,4BAA4B,CAAA;IACpD,qBAAqB,EAAE,CAAC,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAChF,QAAQ,EAAE,gBAAgB,CAAC,qBAAqB,CAAC,CAAA;IACjD,0BAA0B,EAAE,0BAA0B,CAAA;CACvD,GAAG,0BAA0B,GAAG,SAAS,CAgDzC;AAED,mFAAmF;AACnF,KAAK,gBAAgB,GAAG,CAAC,OAAO,EAAE;IAChC,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb,KAAK,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAAA;AAEzD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EACvC,iBAAiB,EAAE,iBAAiB,GACnC,gBAAgB,GAAG,SAAS,CAwB9B"}

package/dist/container-executor-deps.js

@@ -0,0 +1,405 @@
+// Container-agent-executor wiring for the Node facade, extracted out of `container.ts` so the
+// composition root stays within the file-size budget. These are the seams `buildNodeContainer`
+// (and the local facade / tests) compose: the runner-pool transport resolver, the
+// provisioning-log wrapper, the container agent executor + repo bootstrapper + env-config
+// repairer, the GitHub-issue filer, and the shared external trace-sink builder. Pure functions
+// over explicit deps — no shared mutable state beyond the per-config trace-sink memo.
+import { resolveAgentConfig, isProxyableProvider } from '@cat-factory/agents';
+import { HttpRunnerPoolProvider, RunnerPoolConnectionService, LoggingRunnerTransport, PersonalSubscriptionService, ProviderSubscriptionService, createGitHubIssueViaToken, } from '@cat-factory/integrations';
+import { SUBSCRIPTION_VENDORS, composeTraceSinks, isAmbientNativeVendor } from '@cat-factory/kernel';
+import { AgentContextObservabilityService, } from '@cat-factory/orchestration';
+import { createLangfuseSink } from '@cat-factory/observability-langfuse';
+import { createNodeOtelSink } from '@cat-factory/observability-otel/node';
+import { ContainerAgentExecutor, ContainerEnvConfigRepairer, ContainerRepoBootstrapper, ContainerSessionService, GitHubAppRegistry, WebCryptoSecretCipher, DOCS, ENV_VARS_ANCHORS, ensureWorkBranchViaRest, logger, noRunnerBackendAvailableError, resolveUrlSafetyPolicy, } from '@cat-factory/server';
+// HKDF domain tag separating runner-pool scheduler secrets from any other use of
+// the same master key (mirrors the Worker's `cat-factory:runners`).
+export const RUNNERS_CIPHER_INFO = 'cat-factory:runners';
+// Memoised per config so both trace-sink wiring sites (the container executor here and the
+// core/inline sinks in `buildNodeContainer`) share ONE instance — the OTel SDK sink owns
+// batch processors/exporters, so it must be built once per config, not per wiring site.
+const traceSinkCache = new WeakMap();
+/**
+ * Build the opt-in external trace sink(s) — Langfuse and/or OpenTelemetry — composed into
+ * the single sink slot; the observability service then fans every recorded LLM call out to
+ * whichever are wired. Memoised per config so both wiring sites share one instance.
+ *
+ * Langfuse uses the fetch-based sink (identical to the Worker). OpenTelemetry uses the
+ * OFFICIAL `@opentelemetry/*` SDK exporter (`createNodeOtelSink`) — the Node counterpart of
+ * the Worker's fetch OTLP exporter, kept conformant by the shared mapping layer + tests.
+ */
+export function buildTraceSink(config) {
+    if (traceSinkCache.has(config))
+        return traceSinkCache.get(config);
+    const langfuse = !config.langfuse.enabled || !config.langfuse.publicKey || !config.langfuse.secretKey
+        ? undefined
+        : createLangfuseSink({
+            publicKey: config.langfuse.publicKey,
+            secretKey: config.langfuse.secretKey,
+            baseUrl: config.langfuse.baseUrl,
+            logger,
+        });
+    const otel = !config.otel.enabled || !config.otel.endpoint
+        ? undefined
+        : createNodeOtelSink({
+            endpoint: config.otel.endpoint,
+            headers: config.otel.headers,
+            serviceName: config.otel.serviceName,
+            logger,
+        });
+    const sink = composeTraceSinks([langfuse, otel]);
+    traceSinkCache.set(config, sink);
+    return sink;
+}
+export function buildNodeResolveTransport(config, 
+// The port, not the Drizzle concrete: in mothership mode the local facade passes a remote
+// (RPC-backed) connection repo, and the service layer only ever uses the port methods.
+runnerPoolConnectionRepository, workspaceRepository, clock, 
+// The app-owned runner-backend registry the service resolves a stored `kind` through.
+runnerBackendRegistry, 
+// The shared HTTP provider the built-in `manifest` backend reuses when supplied (e.g.
+// tests). NOT the custom-kind seam — a bespoke runner backend is registered by reference
+// into `runnerBackendRegistry`. Absent → the generic manifest-driven HTTP provider.
+injectedPoolProvider) {
+    if (!config.runners.enabled || !config.runners.encryptionKey)
+        return null;
+    const urlPolicy = resolveUrlSafetyPolicy(config.runners);
+    const runnerService = new RunnerPoolConnectionService({
+        runnerPoolConnectionRepository,
+        workspaceRepository,
+        secretCipher: new WebCryptoSecretCipher({
+            masterKeyBase64: config.runners.encryptionKey,
+            info: RUNNERS_CIPHER_INFO,
+        }),
+        clock,
+        runnerBackendRegistry,
+        ...(urlPolicy ? { urlPolicy } : {}),
+        runnerPoolProvider: injectedPoolProvider ?? new HttpRunnerPoolProvider(urlPolicy ? { urlPolicy } : {}),
+    });
+    return async (workspaceId) => {
+        if (workspaceId) {
+            const resolved = await runnerService.resolve(workspaceId);
+            if (resolved)
+                return resolved.transport;
+        }
+        // The shared factory throws a ConflictError carrying the machine reason (see its doc): a clean
+        // 409 synchronously, and classifyDispatchFailure lifts the reason onto the run's AgentFailure on
+        // the async dispatch path (SPA shows "Agent backend not configured", not "container failed to
+        // start"). The Node facade has no per-run container backend, so the remedy points only at the
+        // self-hosted runner pool / Kubernetes.
+        throw noRunnerBackendAvailableError(workspaceId);
+    };
+}
+/**
+ * Wrap a transport resolver so every dispatch/release/poll-failure appends a
+ * provisioning-log event. A no-op when there's no resolver. `subsystem` tags the
+ * rows (a self-hosted pool vs a per-run container) so the logs drawer can filter.
+ */
+export function withProvisioningLog(resolve, recorder, subsystem) {
+    if (!resolve)
+        return null;
+    // Closure-owned so it survives each (per-resolution) wrapper: a terminal `failed`
+    // job re-polled by a replay/re-drive logs its poll-failure only once.
+    const loggedPollFailures = new Set();
+    return async (workspaceId) => {
+        const inner = await resolve(workspaceId);
+        return new LoggingRunnerTransport({
+            inner,
+            recorder,
+            workspaceId: workspaceId ?? '',
+            subsystem,
+            loggedPollFailures,
+        });
+    };
+}
+/**
+ * Which of the container-executor prerequisites are missing, as the human labels the boot
+ * warning names. Empty ⇒ all three are present. `PUBLIC_URL` is this service's externally
+ * reachable base backing the LLM proxy, `AUTH_SESSION_SECRET` signs the harness↔proxy tokens,
+ * and a runner backend is what a dispatch is handed to. Pure so the "name exactly what's
+ * missing" logic is unit-tested (error-message coverage A5).
+ */
+export function missingContainerExecutorPrereqs(input) {
+    const missing = [];
+    if (!input.publicUrl)
+        missing.push('PUBLIC_URL');
+    if (!input.sessionSecret)
+        missing.push('AUTH_SESSION_SECRET (>= 32 chars)');
+    if (!input.hasRunnerBackend)
+        missing.push('a runner backend (self-hosted runner pool)');
+    return missing;
+}
+/**
+ * Build the container agent executor (repo-operating steps: coder, mocker,
+ * playwright, blueprints, ci-fixer, conflict-resolver, merger) when its
+ * prerequisites are configured: a token source for the push/clone token, the public
+ * URL backing the LLM proxy, the session secret to sign proxy tokens, and a runner
+ * backend. Returns null when any is missing, so the composite fails those kinds
+ * loudly rather than running them as useless one-shot LLM calls.
+ *
+ * The token source is pluggable: a sibling facade may pass `mintInstallationToken`
+ * (e.g. a static PAT for local mode), otherwise it is minted via the GitHub App
+ * registry (which additionally requires the App private key + `github.enabled`).
+ */
+export function buildNodeContainerExecutor(env, config, appRegistry, resolveRepoTarget, resolveRepoTargets, resolveTransport, resolveWorkspaceModelDefault, agentKindRegistry, mintInstallationTokenOverride, subscriptions, personalSubscriptions, resolveAccountId, resolveUserGitHubToken, agentContextObservability, resolveWebSearchAvailability, resolveRepoOrigin, resolvePackageRegistries, resolveTestSecrets, recordHarnessCalls, recordSubscriptionQuotaUsage) {
+    // The harness reaches models only through this service's LLM proxy; `PUBLIC_URL`
+    // is this service's externally reachable base (the runner pool / local container
+    // must be able to reach it). Pi posts to `${PUBLIC_URL}/v1/chat/completions`.
+    const publicUrl = env.PUBLIC_URL?.trim();
+    const sessionSecret = config.auth.sessionSecret;
+    if (!publicUrl || !sessionSecret || !resolveTransport) {
+        // The executor is disabled but the service still boots "healthy" — repo-operating steps
+        // (coder/mocker/tester/blueprints/ci-fixer/conflict-resolver/merger) then fail only at
+        // dispatch, deep in a request, with no boot signal. Emit a greppable line naming exactly
+        // which prerequisite is missing so the gap is visible up front (error-message coverage A5).
+        const missing = missingContainerExecutorPrereqs({
+            publicUrl,
+            sessionSecret,
+            hasRunnerBackend: !!resolveTransport,
+        });
+        logger.warn({ missing, docsUrl: DOCS.envVars(ENV_VARS_ANCHORS.coreServiceNetworking) }, `container agent steps are DISABLED: missing ${missing.join(', ')}. Repo-operating steps ` +
+            `(coder/mocker/tester/merger/…) will fail at dispatch until configured. See ` +
+            `${DOCS.envVars(ENV_VARS_ANCHORS.coreServiceNetworking)}.`);
+        return null;
+    }
+    // Token source: an explicit override (e.g. a static PAT in local mode) wins; else
+    // the GitHub App registry mints a per-installation token (when the App is configured).
+    const baseMint = mintInstallationTokenOverride ??
+        (appRegistry ? (id) => appRegistry.installationToken(id) : undefined);
+    if (!baseMint) {
+        // Every other prerequisite is set but there is no GitHub token source, so the harness
+        // could never clone/push. Name the fix (App creds) rather than disabling silently (A5).
+        logger.warn({ missing: ['GITHUB_APP_ID + GITHUB_APP_PRIVATE_KEY'], docsUrl: DOCS.githubOperations() }, `container agent steps are DISABLED: no GitHub token source — set GITHUB_APP_ID + ` +
+            `GITHUB_APP_PRIVATE_KEY so the harness can mint a push/clone token. Repo-operating steps ` +
+            `will fail at dispatch until configured. See ${DOCS.githubOperations()}.`);
+        return null;
+    }
+    // Prefer the run initiator's per-user PAT (when stored) over the App/env token, so
+    // pushes/PRs are attributed to them. Falls back to the base mint otherwise.
+    const mintInstallationToken = async (installationId, ctx) => {
+        if (resolveUserGitHubToken && ctx?.initiatedBy) {
+            const pat = await resolveUserGitHubToken(ctx.initiatedBy);
+            if (pat)
+                return pat;
+        }
+        return baseMint(installationId);
+    };
+    return new ContainerAgentExecutor({
+        resolveTransport,
+        agentRouting: config.agents.routing,
+        resolveBlockModel: config.agents.resolveBlockModel,
+        resolveWorkspaceModelDefault,
+        resolveRepoTarget,
+        // Multi-repo coding (service-connections phase 3): the implementer fans a cross-service
+        // change out across the task's own repo + each connected involved-service repo.
+        resolveRepoTargets,
+        ...(resolveAccountId ? { resolveAccountId } : {}),
+        mintInstallationToken,
+        // Ensure the shared per-task work branch up front so every agent (including the
+        // read-only architect) operates on the same branch — idempotent, best-effort. Writers
+        // create it from base; read-only agents only probe (`options.create`).
+        ensureWorkBranch: async (repo, branch, options) => ensureWorkBranchViaRest({
+            ...(config.github.apiBase ? { apiBase: config.github.apiBase } : {}),
+            token: await mintInstallationToken(repo.installationId),
+            owner: repo.owner,
+            name: repo.name,
+            baseBranch: repo.baseBranch,
+            branch,
+            create: options.create,
+        }),
+        sessionService: new ContainerSessionService({ secret: sessionSecret }),
+        // The subscription harnesses (Claude Code / Codex) lease a pooled token and
+        // attribute usage back for usage-aware rotation; absent ⇒ those harnesses are
+        // unavailable and a subscription-only model fails loudly at dispatch.
+        ...(subscriptions
+            ? {
+                leaseSubscriptionToken: (workspaceId, vendor) => subscriptions.leaseToken(workspaceId, vendor),
+                recordSubscriptionUsage: (workspaceId, tokenId, usage) => subscriptions.recordTokenUsage(workspaceId, tokenId, usage),
+                hasSubscriptionToken: (workspaceId, vendor) => subscriptions.hasToken(workspaceId, vendor),
+            }
+            : {}),
+        // Per-call telemetry for the subscription harnesses (proxy-bypassing), recorded
+        // into `llm_call_metrics` alongside the proxy-metered Pi rows.
+        ...(recordHarnessCalls ? { recordHarnessCalls } : {}),
+        // Modeled subscription quota-cycle tracking (Part B): fold a finished subscription
+        // run's tokens into the rolling windows, for BOTH pooled and personal runs.
+        ...(recordSubscriptionQuotaUsage ? { recordSubscriptionQuotaUsage } : {}),
+        // Individual-usage harnesses (Claude) lease the run-initiator's OWN activated
+        // personal credential; absent ⇒ such models fail loudly at dispatch.
+        ...(personalSubscriptions
+            ? {
+                leasePersonalSubscriptionToken: (executionId, userId, vendor) => personalSubscriptions.leaseForRun(executionId, userId, vendor),
+                // Route a dual-mode individual model (GLM) to the initiator's own subscription
+                // when they have one; otherwise dispatch keeps it on the Cloudflare base.
+                hasPersonalSubscription: (userId, vendor) => personalSubscriptions.has(userId, vendor),
+            }
+            : {}),
+        // Native local execution (local facade, opt-in): run subscription-harness agents with
+        // the developer's OWN installed CLI + ambient login instead of leasing a credential.
+        // Ambient auth applies ONLY when the resolved harness is in the allow-list AND the
+        // vendor is that CLI's NATIVE vendor (no Anthropic-compatible base URL of its own:
+        // `claude` / `codex`). A non-native vendor reusing the `claude-code` harness
+        // (GLM/Kimi/DeepSeek carries its own `baseUrl`) is leased normally — otherwise ambient
+        // auth would silently drop that base URL and run the step on the developer's own
+        // Anthropic login instead of the pinned vendor.
+        ...(config.nativeAmbientAuth && config.nativeAmbientAuth.length > 0
+            ? {
+                // The allow-list + no-`baseUrl` check is the shared `isAmbientNativeVendor`
+                // predicate (so this can't drift from the personal-credential gate); the extra
+                // `harness === h` guard ensures the RESOLVED harness matches the vendor's own.
+                nativeAmbientAuth: (h, vendor) => vendor !== undefined &&
+                    SUBSCRIPTION_VENDORS[vendor].harness === h &&
+                    isAmbientNativeVendor(config.nativeAmbientAuth, vendor),
+            }
+            : {}),
+        proxyBaseUrl: `${publicUrl.replace(/\/+$/, '')}/v1`,
+        // Point container agents' web search at the backend search proxy (no provider key in
+        // the sandbox), but only for a run whose account has keys (resolved per run — see the
+        // call site), so the tool is never advertised to a run where it would just fail.
+        ...(resolveWebSearchAvailability ? { resolveWebSearchAvailability } : {}),
+        // Decrypt the workspace's private-registry entries onto the job body (rendered by
+        // the harness into ~/.npmrc), so private dependencies resolve on install.
+        ...(resolvePackageRegistries ? { resolvePackageRegistries } : {}),
+        // Decrypt the service frame's SENSITIVE test credentials onto the tester job body (out of
+        // band — injected as container env vars by the harness, never in the prompt/telemetry).
+        ...(resolveTestSecrets ? { resolveTestSecrets } : {}),
+        githubApiBase: config.github.apiBase,
+        // Resolve the clone URL + provider per repo. The local GitLab facade injects a GitLab
+        // origin so containers clone gitlab.com (or a self-managed host) and open MRs; absent ⇒
+        // the default github.com origin.
+        ...(resolveRepoOrigin ? { resolveRepoOrigin } : {}),
+        // Forward container tool spans to the external trace sink(s) (Langfuse and/or OTLP)
+        // grouped under the run trace — the same sink the LLM proxy fans generations to.
+        // (Langfuse nests them as children; the OTLP exporter groups them by shared trace id.)
+        llmTraceSink: buildTraceSink(config),
+        // Record the complete provided context per dispatch (best-effort, gated in the sink).
+        ...(agentContextObservability ? { agentContextObservability } : {}),
+        agentKindRegistry,
+    });
+}
+/**
+ * Build the repo bootstrapper (the "bootstrap repo" container dispatch) when its
+ * prerequisites are configured — mirroring the Worker's `selectRepoBootstrapper` and
+ * the container-executor prerequisites: a resolvable runner transport, the public URL
+ * + session secret backing the LLM proxy, a token source, and a GitHub client.
+ * Returns undefined otherwise (the bootstrap module then has no runner and the service
+ * reports a clean dispatch failure). Bootstrap is an `architect`-kind run, so it
+ * follows that kind's routing. The promoted `ContainerRepoBootstrapper` dispatches
+ * through the same shared runner seam the container executor uses, so on Node it runs
+ * against the self-hosted pool and on local against the per-job Docker container.
+ */
+export function selectNodeRepoBootstrapper(deps) {
+    const publicUrl = deps.env.PUBLIC_URL?.trim();
+    const sessionSecret = deps.config.auth.sessionSecret;
+    if (!deps.resolveTransport ||
+        !publicUrl ||
+        !sessionSecret ||
+        !deps.githubClient ||
+        !deps.mintInstallationToken) {
+        return undefined;
+    }
+    return new ContainerRepoBootstrapper({
+        resolveTransport: deps.resolveTransport,
+        installationRepository: deps.installationRepository,
+        bootstrapJobRepository: deps.bootstrapJobRepository,
+        repoRepository: deps.repoRepository,
+        ...(deps.repoProjectionCache ? { repoProjectionCache: deps.repoProjectionCache } : {}),
+        githubClient: deps.githubClient,
+        mintInstallationToken: deps.mintInstallationToken,
+        sessionService: new ContainerSessionService({ secret: sessionSecret }),
+        model: resolveAgentConfig(deps.config.agents.routing, 'architect').ref,
+        proxyBaseUrl: `${publicUrl.replace(/\/+$/, '')}/v1`,
+        githubApiBase: deps.config.github.apiBase,
+        // The scaffolder installs dependencies too — forward the workspace's
+        // private-registry entries exactly as the implementation executor does.
+        ...(deps.resolvePackageRegistries
+            ? { resolvePackageRegistries: deps.resolvePackageRegistries }
+            : {}),
+    });
+}
+/**
+ * Build the live ENVIRONMENT-PROVIDER CONFIG REPAIR agent (PR #416 increment 2) when its
+ * prerequisites are met — the same container prerequisites as the bootstrapper PLUS a
+ * registered backend that supports agent repair (`describeRepairAgent`). The stock manifest
+ * provider has no repair support, so this stays undefined there; it wires only when a custom
+ * backend registered into the env-backend registry implements repair (so local inherits it
+ * too). NOT the repo bootstrapper: an ordinary clone→edit→push coding job, no history reset.
+ */
+export function selectNodeEnvConfigRepairer(deps) {
+    const publicUrl = deps.env.PUBLIC_URL?.trim();
+    const sessionSecret = deps.config.auth.sessionSecret;
+    // Prefer the internal override (the conformance suite's fake repair provider), else scan
+    // the env-backend registry for the first repair-capable backend. Built-ins don't support
+    // repair, so this is undefined on a stock deployment; a third-party backend wires it.
+    const repairUrlPolicy = resolveUrlSafetyPolicy(deps.config.environments);
+    const environmentProvider = !deps.resolveTransport
+        ? undefined
+        : (deps.override ??
+            deps.environmentBackendRegistry.findRepairCapable(repairUrlPolicy ? { urlPolicy: repairUrlPolicy } : {}));
+    if (!deps.resolveTransport ||
+        !publicUrl ||
+        !sessionSecret ||
+        !deps.mintInstallationToken ||
+        !environmentProvider ||
+        typeof environmentProvider.describeRepairAgent !== 'function') {
+        return undefined;
+    }
+    // A config fix is coding work, so it follows the `coder` kind's routing. The repair runs on
+    // the Pi harness over the LLM proxy, so the routed model MUST be proxyable. Surface a
+    // misconfiguration HERE (at wiring) rather than letting every repair dispatch throw deep in a
+    // request: if `coder` is routed to a non-proxyable model (e.g. an individual subscription
+    // vendor), leave the fallback unwired — bootstrap then returns the validation issues, exactly
+    // as it does when no provider supports repair.
+    const model = resolveAgentConfig(deps.config.agents.routing, 'coder').ref;
+    if (!isProxyableProvider(model.provider)) {
+        logger.warn({ provider: model.provider }, 'env-config repair: the coder routing model is not proxyable by the LLM proxy; ' +
+            'the agent config-repair fallback is disabled.');
+        return undefined;
+    }
+    return new ContainerEnvConfigRepairer({
+        resolveTransport: deps.resolveTransport,
+        installationRepository: deps.installationRepository,
+        mintInstallationToken: deps.mintInstallationToken,
+        sessionService: new ContainerSessionService({ secret: sessionSecret }),
+        environmentProvider,
+        model,
+        proxyBaseUrl: `${publicUrl.replace(/\/+$/, '')}/v1`,
+        githubApiBase: deps.config.github.apiBase,
+    });
+}
+/**
+ * Build the GitHub-issue tracker filer for the tech-debt pipeline when the GitHub
+ * App is configured. It resolves the service's repo from the workspace's
+ * `github_repos` projection and mints a short-lived token from that workspace's OWN
+ * App installation (per-tenant) — the same infra the container executor uses — then
+ * files the issue via the token. Returns undefined when the App isn't configured (the
+ * GitHub tracker then passes through). A run whose service isn't linked to a repo
+ * resolves to null (a clean pass-through, not a run failure).
+ */
+export function buildNodeGitHubIssueFiler(config, registry, resolveRepoTarget) {
+    if (!registry)
+        return undefined;
+    return async (request) => {
+        let repo;
+        try {
+            repo = await resolveRepoTarget(request.workspaceId, request.frameId);
+        }
+        catch {
+            // The service isn't linked to a repo — nothing to file against; pass through.
+            return null;
+        }
+        if (!repo)
+            return null;
+        const token = await registry.installationToken(repo.installationId);
+        const issue = await createGitHubIssueViaToken({
+            fetchImpl: fetch,
+            token,
+            owner: repo.owner,
+            repo: repo.name,
+            title: request.title,
+            body: request.body,
+            apiBase: config.github.apiBase,
+        });
+        return { externalId: `${repo.owner}/${repo.name}#${issue.number}`, url: issue.url };
+    };
+}
+//# sourceMappingURL=container-executor-deps.js.map

package/dist/container-executor-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-executor-deps.js","sourceRoot":"","sources":["../src/container-executor-deps.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,+FAA+F;AAC/F,kFAAkF;AAClF,0FAA0F;AAC1F,+FAA+F;AAC/F,sFAAsF;AACtF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE7E,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,2BAA2B,CAAA;AAMlC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAcpG,OAAO,EACL,gCAAgC,GAGjC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAA;AACzE,OAAO,EAQL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,EACrB,IAAI,EACJ,gBAAgB,EAChB,uBAAuB,EACvB,MAAM,EACN,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AAE5B,iFAAiF;AACjF,oEAAoE;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAExD,2FAA2F;AAC3F,yFAAyF;AACzF,wFAAwF;AACxF,MAAM,cAAc,GAAG,IAAI,OAAO,EAA+C,CAAA;AAEjF;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,MAAiB;IAC9C,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACjE,MAAM,QAAQ,GACZ,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS;QAClF,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,kBAAkB,CAAC;YACjB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;YACpC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;YACpC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;YAChC,MAAM;SACP,CAAC,CAAA;IACR,MAAM,IAAI,GACR,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ;QAC3C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,kBAAkB,CAAC;YACjB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;YAC9B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;YAC5B,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;YACpC,MAAM;SACP,CAAC,CAAA;IACR,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAA;IAChD,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAChC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAiB;AACjB,0FAA0F;AAC1F,uFAAuF;AACvF,8BAA8D,EAC9D,mBAA4D,EAC5D,KAAY;AACZ,sFAAsF;AACtF,qBAA4C;AAC5C,sFAAsF;AACtF,yFAAyF;AACzF,oFAAoF;AACpF,oBAAyC;IAEzC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IACzE,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACxD,MAAM,aAAa,GAAG,IAAI,2BAA2B,CAAC;QACpD,8BAA8B;QAC9B,mBAAmB;QACnB,YAAY,EAAE,IAAI,qBAAqB,CAAC;YACtC,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;YAC7C,IAAI,EAAE,mBAAmB;SAC1B,CAAC;QACF,KAAK;QACL,qBAAqB;QACrB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,kBAAkB,EAChB,oBAAoB,IAAI,IAAI,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC,CAAA;IACF,OAAO,KAAK,EAAE,WAAW,EAAE,EAAE;QAC3B,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;YACzD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC,SAAS,CAAA;QACzC,CAAC;QACD,+FAA+F;QAC/F,iGAAiG;QACjG,8FAA8F;QAC9F,8FAA8F;QAC9F,wCAAwC;QACxC,MAAM,6BAA6B,CAAC,WAAW,CAAC,CAAA;IAClD,CAAC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAsC,EACtC,QAAiC,EACjC,SAAgC;IAEhC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,kFAAkF;IAClF,sEAAsE;IACtE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAA;QACxC,OAAO,IAAI,sBAAsB,CAAC;YAChC,KAAK;YACL,QAAQ;YACR,WAAW,EAAE,WAAW,IAAI,EAAE;YAC9B,SAAS;YACT,kBAAkB;SACnB,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAI/C;IACC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAChD,IAAI,CAAC,KAAK,CAAC,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAA;IAC3E,IAAI,CAAC,KAAK,CAAC,gBAAgB;QAAE,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAA;IACvF,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAsB,EACtB,MAAiB,EACjB,WAA0C,EAC1C,iBAAoC,EACpC,kBAAsC,EACtC,gBAA+C,EAC/C,4BAIgC,EAChC,iBAAoC,EACpC,6BAA2E,EAC3E,aAA2C,EAC3C,qBAAmD,EACnD,gBAA8E,EAC9E,sBAA+C,EAC/C,yBAA4D,EAC5D,4BAAsF,EACtF,iBAAqC,EACrC,wBAAqF,EACrF,kBAAyF,EACzF,kBAAsE,EACtE,4BAGkB;IAElB,iFAAiF;IACjF,iFAAiF;IACjF,8EAA8E;IAC9E,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IACxC,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;IAE/C,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtD,wFAAwF;QACxF,uFAAuF;QACvF,yFAAyF;QACzF,4FAA4F;QAC5F,MAAM,OAAO,GAAG,+BAA+B,CAAC;YAC9C,SAAS;YACT,aAAa;YACb,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;SACrC,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CACT,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,EAC1E,+CAA+C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YACxF,6EAA6E;YAC7E,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,GAAG,CAC7D,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,kFAAkF;IAClF,uFAAuF;IACvF,MAAM,QAAQ,GACZ,6BAA6B;QAC7B,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC/E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,sFAAsF;QACtF,wFAAwF;QACxF,MAAM,CAAC,IAAI,CACT,EAAE,OAAO,EAAE,CAAC,wCAAwC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,EAAE,EACzF,mFAAmF;YACjF,0FAA0F;YAC1F,+CAA+C,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAC5E,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,mFAAmF;IACnF,4EAA4E;IAC5E,MAAM,qBAAqB,GAA0B,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE;QACjF,IAAI,sBAAsB,IAAI,GAAG,EAAE,WAAW,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACzD,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAA;QACrB,CAAC;QACD,OAAO,QAAQ,CAAC,cAAc,CAAC,CAAA;IACjC,CAAC,CAAA;IAED,OAAO,IAAI,sBAAsB,CAAC;QAChC,gBAAgB;QAChB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;QACnC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB;QAClD,4BAA4B;QAC5B,iBAAiB;QACjB,wFAAwF;QACxF,gFAAgF;QAChF,kBAAkB;QAClB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,qBAAqB;QACrB,gFAAgF;QAChF,sFAAsF;QACtF,uEAAuE;QACvE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAChD,uBAAuB,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,KAAK,EAAE,MAAM,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC;YACvD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM;YACN,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACJ,cAAc,EAAE,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,4EAA4E;QAC5E,8EAA8E;QAC9E,sEAAsE;QACtE,GAAG,CAAC,aAAa;YACf,CAAC,CAAC;gBACE,sBAAsB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAC9C,aAAa,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC;gBAC/C,uBAAuB,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CACvD,aAAa,CAAC,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC;gBAC7D,oBAAoB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAC5C,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;aAC9C;YACH,CAAC,CAAC,EAAE,CAAC;QACP,gFAAgF;QAChF,+DAA+D;QAC/D,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,mFAAmF;QACnF,4EAA4E;QAC5E,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,8EAA8E;QAC9E,qEAAqE;QACrE,GAAG,CAAC,qBAAqB;YACvB,CAAC,CAAC;gBACE,8BAA8B,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAC9D,qBAAqB,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC;gBAChE,+EAA+E;gBAC/E,0EAA0E;gBAC1E,uBAAuB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;aACvF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,sFAAsF;QACtF,qFAAqF;QACrF,mFAAmF;QACnF,mFAAmF;QACnF,6EAA6E;QAC7E,uFAAuF;QACvF,iFAAiF;QACjF,gDAAgD;QAChD,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;YACjE,CAAC,CAAC;gBACE,4EAA4E;gBAC5E,+EAA+E;gBAC/E,+EAA+E;gBAC/E,iBAAiB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,MAAM,KAAK,SAAS;oBACpB,oBAAoB,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC;oBAC1C,qBAAqB,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC;aAC1D;YACH,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK;QACnD,qFAAqF;QACrF,sFAAsF;QACtF,iFAAiF;QACjF,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,kFAAkF;QAClF,0EAA0E;QAC1E,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,0FAA0F;QAC1F,wFAAwF;QACxF,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;QACpC,sFAAsF;QACtF,wFAAwF;QACxF,iCAAiC;QACjC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,oFAAoF;QACpF,iFAAiF;QACjF,uFAAuF;QACvF,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC;QACpC,sFAAsF;QACtF,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,iBAAiB;KAClB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAe1C;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;IACpD,IACE,CAAC,IAAI,CAAC,gBAAgB;QACtB,CAAC,SAAS;QACV,CAAC,aAAa;QACd,CAAC,IAAI,CAAC,YAAY;QAClB,CAAC,IAAI,CAAC,qBAAqB,EAC3B,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,IAAI,yBAAyB,CAAC;QACnC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,cAAc,EAAE,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,GAAG;QACtE,YAAY,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK;QACnD,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO;QACzC,qEAAqE;QACrE,wEAAwE;QACxE,GAAG,CAAC,IAAI,CAAC,wBAAwB;YAC/B,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAQ3C;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;IACpD,yFAAyF;IACzF,yFAAyF;IACzF,sFAAsF;IACtF,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxE,MAAM,mBAAmB,GAAG,CAAC,IAAI,CAAC,gBAAgB;QAChD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;YACd,IAAI,CAAC,0BAA0B,CAAC,iBAAiB,CAC/C,eAAe,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CACtD,CAAC,CAAA;IACN,IACE,CAAC,IAAI,CAAC,gBAAgB;QACtB,CAAC,SAAS;QACV,CAAC,aAAa;QACd,CAAC,IAAI,CAAC,qBAAqB;QAC3B,CAAC,mBAAmB;QACpB,OAAO,mBAAmB,CAAC,mBAAmB,KAAK,UAAU,EAC7D,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,4FAA4F;IAC5F,sFAAsF;IACtF,8FAA8F;IAC9F,0FAA0F;IAC1F,8FAA8F;IAC9F,+CAA+C;IAC/C,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,GAAG,CAAA;IACzE,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAC5B,gFAAgF;YAC9E,+CAA+C,CAClD,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,IAAI,0BAA0B,CAAC;QACpC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,cAAc,EAAE,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,mBAAmB;QACnB,KAAK;QACL,YAAY,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK;QACnD,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO;KAC1C,CAAC,CAAA;AACJ,CAAC;AAUD;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAiB,EACjB,QAAuC,EACvC,iBAAoC;IAEpC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IAE/B,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,IAAmD,CAAA;QACvD,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;YAC9E,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACnE,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC;YAC5C,SAAS,EAAE,KAAK;YAChB,KAAK;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;SAC/B,CAAC,CAAA;QACF,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAA;IACrF,CAAC,CAAA;AACH,CAAC"}

package/dist/container.d.ts

@@ -1,6 +1,6 @@
 import { type AgentKindRegistry } from '@cat-factory/agents';
-import { type BackendRegistries, type RunnerBackendRegistry, ProvisioningLogRecorder, type DeployJobClient } from '@cat-factory/integrations';
-import { type Clock, type DeployCloneTarget, type GitHubClient, type GitHubInstallationRepository, type LocalModelEndpointRepository, type ModelProviderResolver, type PersonalSubscriptionRepository, type SubscriptionVendor, type ProviderApiKeyRepository, type ProviderSubscriptionTokenRepository, type ProvisioningSubsystem, type RunnerPoolConnectionRepository, type RunnerPoolProvider, type SubscriptionActivationRepository } from '@cat-factory/kernel';
+import { type BackendRegistries, type DeployJobClient } from '@cat-factory/integrations';
+import { type DeployCloneTarget, type GitHubClient, type GitHubInstallationRepository, type LocalModelEndpointRepository, type ModelProviderResolver, type PersonalSubscriptionRepository, type SubscriptionVendor, type ProviderApiKeyRepository, type ProviderSubscriptionTokenRepository, type RunnerPoolProvider, type SubscriptionActivationRepository } from '@cat-factory/kernel';
 import { type CoreDependencies, type GateRegistry, type StepResolverRegistry } from '@cat-factory/orchestration';
 import { type AppConfig, type ResolveRepoOrigin, type ResolveRunnerTransport, type ServerContainer } from '@cat-factory/server';
 import { type GateProviderOverrides } from '@cat-factory/gates';
@@ -10,6 +10,7 @@ import type { DrizzleDb } from './db/client.js';
 import { type LocalEventSink } from './realtime.js';
 import { createDrizzleRepositories } from './repositories/drizzle.js';
 import type { ContentStorageBackend } from '@cat-factory/contracts';
+export { buildNodeResolveTransport, missingContainerExecutorPrereqs, withProvisioningLog, } from './container-executor-deps.js';
 /**
  * Source one org/durable repository that a standard build constructs directly from the Drizzle
  * `db`. In mothership mode (no Postgres) `remote` is the full-surface remote registry — a
@@ -336,25 +337,6 @@ export interface NodeContainerOptions {
  * when runner pools are not enabled. Mirrors the Worker's `buildResolveTransport`,
  * minus the Cloudflare-container path.
  */
-export declare function buildNodeResolveTransport(config: AppConfig, runnerPoolConnectionRepository: RunnerPoolConnectionRepository, workspaceRepository: CoreDependencies['workspaceRepository'], clock: Clock, runnerBackendRegistry: RunnerBackendRegistry, injectedPoolProvider?: RunnerPoolProvider): ResolveRunnerTransport | null;
-/**
- * Wrap a transport resolver so every dispatch/release/poll-failure appends a
- * provisioning-log event. A no-op when there's no resolver. `subsystem` tags the
- * rows (a self-hosted pool vs a per-run container) so the logs drawer can filter.
- */
-export declare function withProvisioningLog(resolve: ResolveRunnerTransport | null, recorder: ProvisioningLogRecorder, subsystem: ProvisioningSubsystem): ResolveRunnerTransport | null;
-/**
- * Which of the container-executor prerequisites are missing, as the human labels the boot
- * warning names. Empty ⇒ all three are present. `PUBLIC_URL` is this service's externally
- * reachable base backing the LLM proxy, `AUTH_SESSION_SECRET` signs the harness↔proxy tokens,
- * and a runner backend is what a dispatch is handed to. Pure so the "name exactly what's
- * missing" logic is unit-tested (error-message coverage A5).
- */
-export declare function missingContainerExecutorPrereqs(input: {
-    publicUrl: string | undefined;
-    sessionSecret: string | undefined;
-    hasRunnerBackend: boolean;
-}): string[];
 /**
  * The Node composition root: assemble the framework-agnostic domain `Core` with
  * Drizzle/Postgres repositories + Node implementations of the runtime ports, then
@@ -369,5 +351,4 @@ export declare function missingContainerExecutorPrereqs(input: {
  * composite still serves inline kinds but fails container kinds loudly.
  */
 export declare function buildNodeContainer(options: NodeContainerOptions): ServerContainer;
-export {};
 //# sourceMappingURL=container.d.ts.map

package/dist/container.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../src/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,iBAAiB,EAOvB,MAAM,qBAAqB,CAAA;AAO5B,OAAO,EAUL,KAAK,iBAAiB,EAEtB,KAAK,qBAAqB,EAQ1B,uBAAuB,EAqBvB,KAAK,eAAe,EACrB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAEL,KAAK,KAAK,EAGV,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAE1B,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,mCAAmC,EACxC,KAAK,qBAAqB,EAI1B,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,gCAAgC,EAYtC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAGL,KAAK,gBAAgB,EAGrB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EAO1B,MAAM,4BAA4B,CAAA;AAGnC,OAAO,EACL,KAAK,SAAS,EAGd,KAAK,iBAAiB,EAGtB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EA8CrB,MAAM,qBAAqB,CAAA;AAI5B,OAAO,EACL,KAAK,qBAAqB,EAU3B,MAAM,oBAAoB,CAAA;AAO3B,OAAO,KAAK,EACV,SAAS,EACT,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAGhB,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAErC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAc/C,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,eAAe,CAAA;AAevE,OAAO,EAAE,yBAAyB,EAA4B,MAAM,2BAA2B,CAAA;AAI/F,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,wBAAwB,CAAA;AA8C7F;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,GACb,CAAC,CAEH;AAwQD;;;;;;;GAOG;AACH,UAAU,6BAA6B;IACrC,8BAA8B,CAAC,EAAE,CAC/B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,KACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChC,sBAAsB,CAAC,EAAE,CACvB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,kBAAkB,KACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,EAAE,CAAC,EAAE,SAAS,CAAA;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAA;IACpD;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;IACnD;;;;OAIG;IACH,4BAA4B,CAAC,EAAE,4BAA4B,CAAA;IAC3D;;;;;;OAMG;IACH,mCAAmC,CAAC,EAAE,mCAAmC,CAAA;IACzE;;;;;OAKG;IACH,8BAA8B,CAAC,EAAE,8BAA8B,CAAA;IAC/D;;;;;;;OAOG;IACH,gCAAgC,CAAC,EAAE,gCAAgC,CAAA;IACnE;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8DAA8D;IAC9D,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACrC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAA;IAChD;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;;;OAOG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;IACvC;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,CACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,KACT,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACtC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IACnE;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,yBAAyB,CAAC,EAAE,CAC1B,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,6BAA6B,KAChC,qBAAqB,CAAA;IAC1B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,4BAA4B,CAAA;IAC3D;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAA;IACrC;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,cAAc,CAAA;IAC7B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;IACnD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,qBAAqB,CAAA;CACrD;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,SAAS,EAGjB,8BAA8B,EAAE,8BAA8B,EAC9D,mBAAmB,EAAE,gBAAgB,CAAC,qBAAqB,CAAC,EAC5D,KAAK,EAAE,KAAK,EAEZ,qBAAqB,EAAE,qBAAqB,EAI5C,oBAAoB,CAAC,EAAE,kBAAkB,GACxC,sBAAsB,GAAG,IAAI,CA4B/B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,sBAAsB,GAAG,IAAI,EACtC,QAAQ,EAAE,uBAAuB,EACjC,SAAS,EAAE,qBAAqB,GAC/B,sBAAsB,GAAG,IAAI,CAe/B;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,gBAAgB,EAAE,OAAO,CAAA;CAC1B,GAAG,MAAM,EAAE,CAMX;AA6WD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,CA8kDjF"}
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../src/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,iBAAiB,EAKvB,MAAM,qBAAqB,CAAA;AAO5B,OAAO,EAUL,KAAK,iBAAiB,EAwBtB,KAAK,eAAe,EACrB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAE1B,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,mCAAmC,EAIxC,KAAK,kBAAkB,EACvB,KAAK,gCAAgC,EAQtC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAGL,KAAK,gBAAgB,EAGrB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EAM1B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EAuCrB,MAAM,qBAAqB,CAAA;AAI5B,OAAO,EACL,KAAK,qBAAqB,EAU3B,MAAM,oBAAoB,CAAA;AAO3B,OAAO,KAAK,EACV,SAAS,EACT,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAEhB,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAErC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAc/C,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,eAAe,CAAA;AAevE,OAAO,EAAE,yBAAyB,EAA4B,MAAM,2BAA2B,CAAA;AAI/F,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,wBAAwB,CAAA;AAwD7F,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,GACb,CAAC,CAEH;AAoOD;;;;;;;GAOG;AACH,UAAU,6BAA6B;IACrC,8BAA8B,CAAC,EAAE,CAC/B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,KACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChC,sBAAsB,CAAC,EAAE,CACvB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,kBAAkB,KACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,EAAE,CAAC,EAAE,SAAS,CAAA;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAA;IACpD;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;IACnD;;;;OAIG;IACH,4BAA4B,CAAC,EAAE,4BAA4B,CAAA;IAC3D;;;;;;OAMG;IACH,mCAAmC,CAAC,EAAE,mCAAmC,CAAA;IACzE;;;;;OAKG;IACH,8BAA8B,CAAC,EAAE,8BAA8B,CAAA;IAC/D;;;;;;;OAOG;IACH,gCAAgC,CAAC,EAAE,gCAAgC,CAAA;IACnE;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8DAA8D;IAC9D,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACrC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAA;IAChD;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;;;OAOG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;IACvC;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,CACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,KACT,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACtC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IACnE;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,yBAAyB,CAAC,EAAE,CAC1B,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,6BAA6B,KAChC,qBAAqB,CAAA;IAC1B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,4BAA4B,CAAA;IAC3D;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAA;IACrC;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,cAAc,CAAA;IAC7B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;IACnD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,qBAAqB,CAAA;CACrD;AAED;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,CA8kDjF"}