@cat-factory/server 0.220.0 → 0.222.0

package/dist/agents/repoTargeting.d.ts

@@ -23,21 +23,54 @@ export interface RepoTarget {
 }
 export type ResolveRepoTarget = (workspaceId: string, blockId: string) => Promise<RepoTarget | null>;
 /**
- * Mint a GitHub token for repo work. The optional run context lets a facade prefer
- * the run initiator's personal access token over the App/env default (see
- * `ResolveUserGitHubToken`). Optional ⇒ callers that don't know the run (the
- * bootstrapper, tests) call `mint(installationId)` unchanged.
+ * Mint a GitHub token for repo work.
+ *
+ * **Supplying the run context is what makes a mint a DISPATCH mint**, and the ctx is
+ * all-or-nothing on purpose. Passing one says two things at once: this token is going to a
+ * container, so a facade may prefer the run initiator's personal access token over the App/env
+ * default (see `ResolveUserGitHubToken`); and these are the repos it may reach. Omitting it says
+ * the opposite: an ENGINE call the platform makes on its own behalf (`RepoFiles` reads, the
+ * gate/merge clients), which is attributed to the deployment and stays installation-wide.
  *
  * `workspaceId` rides alongside `initiatedBy` because whether the initiator's own token may
  * be used is a per-WORKSPACE policy (`allowInitiatorPat`), and an installation id can serve
- * several workspaces — so it is supplied here rather than derived, where deriving it would
+ * several workspaces, so it is supplied here rather than derived, where deriving it would
  * mean guessing which workspace's policy governs the run.
+ *
+ * `repoIds` is the dispatch's TOKEN SCOPE: the repos this one job may reach, in the neutral
+ * `VcsRepoRef.repoId` vocabulary (see {@link jobTokenRepoIds}). It is REQUIRED rather than a
+ * hint, because a container dispatch that does not state its scope is not a special case worth
+ * having: it is the installation-wide token this seam exists to retire, and an optional field is
+ * how one comes back silently. A dispatch that genuinely could not resolve its repos passes an
+ * EMPTY array, which is a different fact from "reaches one repo" and is reported as such
+ * (`buildDispatchTokenMint` widens loudly). A facade whose credential is a PAT (local mode, a
+ * GitLab connection, the initiator's own token) cannot narrow anything and ignores the field.
  */
 export type MintInstallationToken = (installationId: number, ctx?: {
     executionId: string;
     workspaceId: string;
     initiatedBy?: string;
+    repoIds: string[];
 }) => Promise<string>;
+/**
+ * The repos ONE dispatch's job token must reach: the primary checkout plus every auxiliary leg
+ * the job body carries (multi-repo fan-out peers, the conflict-resolver's targeted peer, the
+ * merger's combined-diff siblings, read-only reference repos). Deduped, in the neutral
+ * `VcsRepoRef.repoId` vocabulary, so a facade can narrow the mint to exactly this set instead of
+ * handing the container an installation-wide credential (`backend/docs/security-model.md`,
+ * Layer 3).
+ *
+ * Legs on a DIFFERENT installation are dropped rather than added: one job carries one token,
+ * minted for `primary.installationId`, so a leg outside that installation is unreachable with or
+ * without scoping. Including it would only make GitHub reject the mint and turn a pre-existing
+ * (documented) limitation into a failed dispatch.
+ *
+ * The PRIMARY is always first and always present: a scope that omitted it would mint a token
+ * that cannot clone the repo the run is about, which is a broken dispatch rather than a narrow
+ * one. That is also why this returns the ids rather than a boolean "should we scope": the
+ * decision of what an id MEANS belongs to whichever facade mints, not here.
+ */
+export declare function jobTokenRepoIds(primary: RepoTarget, auxiliary: readonly RepoTarget[]): string[];
 /**
  * One private package-registry entry as it rides the harness job body: the decrypted
  * token plus the registry host (derived backend-side from the fixed vendor set — the

package/dist/agents/repoTargeting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repoTargeting.d.ts","sourceRoot":"","sources":["../../src/agents/repoTargeting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AActD,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,gGAAgG;IAChG,QAAQ,CAAC,EAAE,WAAW,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;AAEpG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,cAAc,EAAE,MAAM,EACtB,GAAG,CAAC,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,KACrE,OAAO,CAAC,MAAM,CAAC,CAAA;AAEpB;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,KAAK,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,KACzB,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,UAAU,KAAK,UAAU,CAAA"}
+{"version":3,"file":"repoTargeting.d.ts","sourceRoot":"","sources":["../../src/agents/repoTargeting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AActD,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,gGAAgG;IAChG,QAAQ,CAAC,EAAE,WAAW,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;AAEpG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,cAAc,EAAE,MAAM,EACtB,GAAG,CAAC,EAAE;IACJ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB,KACE,OAAO,CAAC,MAAM,CAAC,CAAA;AAEpB;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,EAAE,CAO/F;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,KAAK,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,KACzB,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,UAAU,KAAK,UAAU,CAAA"}

package/dist/agents/repoTargeting.js

@@ -1,2 +1,28 @@
-export {};
+/**
+ * The repos ONE dispatch's job token must reach: the primary checkout plus every auxiliary leg
+ * the job body carries (multi-repo fan-out peers, the conflict-resolver's targeted peer, the
+ * merger's combined-diff siblings, read-only reference repos). Deduped, in the neutral
+ * `VcsRepoRef.repoId` vocabulary, so a facade can narrow the mint to exactly this set instead of
+ * handing the container an installation-wide credential (`backend/docs/security-model.md`,
+ * Layer 3).
+ *
+ * Legs on a DIFFERENT installation are dropped rather than added: one job carries one token,
+ * minted for `primary.installationId`, so a leg outside that installation is unreachable with or
+ * without scoping. Including it would only make GitHub reject the mint and turn a pre-existing
+ * (documented) limitation into a failed dispatch.
+ *
+ * The PRIMARY is always first and always present: a scope that omitted it would mint a token
+ * that cannot clone the repo the run is about, which is a broken dispatch rather than a narrow
+ * one. That is also why this returns the ids rather than a boolean "should we scope": the
+ * decision of what an id MEANS belongs to whichever facade mints, not here.
+ */
+export function jobTokenRepoIds(primary, auxiliary) {
+    const ids = new Set([primary.repoId]);
+    for (const leg of auxiliary) {
+        if (leg.installationId !== primary.installationId)
+            continue;
+        ids.add(leg.repoId);
+    }
+    return [...ids];
+}
 //# sourceMappingURL=repoTargeting.js.map

package/dist/agents/repoTargeting.js.map

@@ -1 +1 @@
-{"version":3,"file":"repoTargeting.js","sourceRoot":"","sources":["../../src/agents/repoTargeting.ts"],"names":[],"mappings":""}
+{"version":3,"file":"repoTargeting.js","sourceRoot":"","sources":["../../src/agents/repoTargeting.ts"],"names":[],"mappings":"AAyEA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAAC,OAAmB,EAAE,SAAgC;IACnF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;YAAE,SAAQ;QAC3D,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACrB,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;AACjB,CAAC"}

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AA4G3C;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAI5E"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AA8G3C;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAI5E"}

package/dist/app.js

@@ -95,6 +95,8 @@ import { publicApiController } from './modules/publicApi/PublicApiController.js'
 import { publicApiKeyController } from './modules/publicApi/PublicApiKeyController.js';
 import { publicDecisionController } from './modules/publicApi/PublicDecisionController.js';
 import { publicDebugController } from './modules/publicApi/PublicDebugController.js';
+import { publicEvidenceController } from './modules/publicApi/PublicEvidenceController.js';
+import { publicKeyController } from './modules/publicApi/PublicKeyController.js';
 import { publicMcpController } from './modules/publicApi/PublicMcpController.js';
 import { publicNotificationWebhookController } from './modules/publicApi/PublicNotificationWebhookController.js';
 import { notificationWebhookController } from './modules/notificationWebhook/NotificationWebhookController.js';
@@ -196,6 +198,15 @@ function registerRootControllers(app) {
     // over a run's telemetry + provisioning log, sized so an LLM can walk them within a context
     // budget. See backend/docs/debug-api.md.
     app.route('/', publicDebugController());
+    // The public run-EVIDENCE surface (`/api/v1/runs/:runId/report`, `…/artifacts`, and the bytes
+    // at `/api/v1/artifacts/:id/blob`): read-scoped access to the engine's own verification report
+    // and the artifacts a run captured, for a consumer whose job is to JUDGE the run rather than
+    // debug it. See backend/docs/public-api.md.
+    app.route('/', publicEvidenceController());
+    // HEADLESS key provisioning (`/api/v1/keys`): the external counterpart of the session-authed
+    // key panel, `admin` scope, bounded so a minted key can never mint another and revoking a key
+    // revokes what it minted.
+    app.route('/', publicKeyController());
     // The public OUTBOUND-WEBHOOK management surface (`/api/v1/notification-webhook`): the enrolment
     // half of the push channel, so a deployment with no browser session can register the receiver
     // its notifications, run-lifecycle edges and health alerts are delivered to. `admin` scope; same

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAA;AAC3E,OAAO,EAAE,+BAA+B,EAAE,MAAM,4DAA4D,CAAA;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAA;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,4DAA4D,CAAA;AAC7G,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAA;AAClG,OAAO,EAAE,6BAA6B,EAAE,MAAM,iEAAiE,CAAA;AAC/G,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAA;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAA;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAA;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAA;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAA;AACpG,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAA;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,+BAA+B,EAAE,MAAM,oEAAoE,CAAA;AACpH,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAA;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,oDAAoD,CAAA;AAC/F,OAAO,EAAE,2BAA2B,EAAE,MAAM,4DAA4D,CAAA;AACxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,8DAA8D,CAAA;AAC3G,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAA;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,6DAA6D,CAAA;AAC9G,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAA;AACvF,OAAO,EAAE,iCAAiC,EAAE,MAAM,wEAAwE,CAAA;AAC1H,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mDAAmD,CAAA;AAC1F,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAA;AACpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAA;AAChG,OAAO,EAAE,2BAA2B,EAAE,MAAM,oDAAoD,CAAA;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAA;AACnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,yDAAyD,CAAA;AACtG,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAA;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAA;AACnG,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAA;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAA;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAA;AACtG,OAAO,EAAE,4BAA4B,EAAE,MAAM,uDAAuD,CAAA;AACpG,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAA;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAA;AACjG,OAAO,EACL,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAA;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAA;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAA;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qDAAqD,CAAA;AAChG,OAAO,EAAE,8BAA8B,EAAE,MAAM,kEAAkE,CAAA;AACjH,OAAO,EAAE,0BAA0B,EAAE,MAAM,0DAA0D,CAAA;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAA;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAA;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAA;AAChH,OAAO,EAAE,6BAA6B,EAAE,MAAM,gEAAgE,CAAA;AAE9G;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAmB,GAAY;IACpE,uBAAuB,CAAC,GAAG,CAAC,CAAA;IAC5B,4BAA4B,CAAC,GAAG,CAAC,CAAA;IACjC,0BAA0B,CAAC,GAAG,CAAC,CAAA;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAmB,GAAY;IAC7D,gFAAgF;IAChF,0FAA0F;IAC1F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACpC,wFAAwF;IACxF,yFAAyF;IACzF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAC3C,0EAA0E;IAC1E,mFAAmF;IACnF,kFAAkF;IAClF,uCAAuC;IACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC1C,2EAA2E;IAC3E,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAA;IACpC,2FAA2F;IAC3F,sFAAsF;IACtF,wFAAwF;IACxF,sFAAsF;IACtF,cAAc;IACd,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACvC,+FAA+F;IAC/F,6FAA6F;IAC7F,qFAAqF;IACrF,wFAAwF;IACxF,kFAAkF;IAClF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAA;IAC5C,8FAA8F;IAC9F,uCAAuC;IACvC,+FAA+F;IAC/F,gGAAgG;IAChG,gGAAgG;IAChG,8FAA8F;IAC9F,6FAA6F;IAC7F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,8BAA8B,EAAE,CAAC,CAAA;IAChD,8FAA8F;IAC9F,sFAAsF;IACtF,uFAAuF;IACvF,2FAA2F;IAC3F,+FAA+F;IAC/F,0FAA0F;IAC1F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAA;IAC5C,gGAAgG;IAChG,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,yDAAyD;IACzD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACvC,+FAA+F;IAC/F,0FAA0F;IAC1F,6FAA6F;IAC7F,mFAAmF;IACnF,4FAA4F;IAC5F,uCAAuC;IACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAA;IAC7C,gGAAgG;IAChG,iGAAiG;IACjG,gGAAgG;IAChG,iGAAiG;IACjG,sFAAsF;IACtF,uCAAuC;IACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAC3C,8FAA8F;IAC9F,8FAA8F;IAC9F,0FAA0F;IAC1F,6FAA6F;IAC7F,8FAA8F;IAC9F,4FAA4F;IAC5F,gEAAgE;IAChE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAA;IACzC,4FAA4F;IAC5F,+FAA+F;IAC/F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACrC,iGAAiG;IACjG,8FAA8F;IAC9F,8FAA8F;IAC9F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC1C,+FAA+F;IAC/F,4FAA4F;IAC5F,yCAAyC;IACzC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACvC,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,iFAAiF;IACjF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mCAAmC,EAAE,CAAC,CAAA;IACrD,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,oDAAoD;IACpD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACrD,wFAAwF;IACxF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC1C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC,CAAA;IACjC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACnC,yFAAyF;IACzF,oDAAoD;IACpD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,+BAA+B,EAAE,CAAC,CAAA;IACjD,qFAAqF;IACrF,8BAA8B;IAC9B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACnC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,8BAA8B,EAAE,CAAC,CAAA;IAChD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,EAAE,CAAC,CAAA;IAC9C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,EAAE,CAAC,CAAA;IACxC,yFAAyF;IACzF,+FAA+F;IAC/F,4FAA4F;IAC5F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACpC,oFAAoF;IACpF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gCAAgC,EAAE,CAAC,CAAA;IAClD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACtC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAA;IAC7C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACtC,0FAA0F;IAC1F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAA;IACzC,4FAA4F;IAC5F,+EAA+E;IAC/E,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAA;IAC7C,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAA;IACvE,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC,CAAA;IAC3E,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACrC,kFAAkF;IAClF,iGAAiG;IACjG,+FAA+F;IAC/F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAC3C,kFAAkF;IAClF,+EAA+E;IAC/E,6BAA6B;IAC7B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,4BAA4B,CAAmB,GAAY;IAClE,+BAA+B,CAAC,GAAG,CAAC,CAAA;IACpC,kCAAkC,CAAC,GAAG,CAAC,CAAA;AACzC,CAAC;AAED;;;GAGG;AACH,SAAS,+BAA+B,CAAmB,GAAY;IACrE,qBAAqB;IACrB,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,eAAe,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,CAAC,CAAA;IACjE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC1D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,CAAC,CAAA;IACnE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,gGAAgG;IAChG,4FAA4F;IAC5F,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,6BAA6B,EAAE,CAAC,CAAA;IACtE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,oFAAoF;IACpF,gDAAgD;IAChD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,eAAe,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,4BAA4B,EAAE,CAAC,CAAA;IACrE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,CAAC,CAAA;IACjE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAChE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,kCAAkC,CAAmB,GAAY;IACxE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,CAAC,CAAA;IACnE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC1D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAChE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,+BAA+B,EAAE,CAAC,CAAA;IACxE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,CAAC,CAAA;IACnE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,4FAA4F;IAC5F,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC1D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,4BAA4B,EAAE,CAAC,CAAA;IACrE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,gCAAgC,EAAE,CAAC,CAAA;IACzE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iCAAiC,EAAE,CAAC,CAAA;IAC1E,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAA;IAC7E,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAA;IACjF,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,eAAe,EAAE,CAAC,CAAA;AAC1D,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CAAmB,GAAY;IAChE,mEAAmE;IACnE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAC/C,2FAA2F;IAC3F,sFAAsF;IACtF,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACzC,8FAA8F;IAC9F,+FAA+F;IAC/F,wEAAwE;IACxE,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC/C,wEAAwE;IACxE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC3C,yEAAyE;IACzE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAA;AAC9C,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAA;AAC3E,OAAO,EAAE,+BAA+B,EAAE,MAAM,4DAA4D,CAAA;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAA;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,4DAA4D,CAAA;AAC7G,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAA;AAClG,OAAO,EAAE,6BAA6B,EAAE,MAAM,iEAAiE,CAAA;AAC/G,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAA;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAA;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAA;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAA;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAA;AACpG,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAA;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,+BAA+B,EAAE,MAAM,oEAAoE,CAAA;AACpH,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAA;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,oDAAoD,CAAA;AAC/F,OAAO,EAAE,2BAA2B,EAAE,MAAM,4DAA4D,CAAA;AACxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,8DAA8D,CAAA;AAC3G,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAA;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,6DAA6D,CAAA;AAC9G,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAA;AACvF,OAAO,EAAE,iCAAiC,EAAE,MAAM,wEAAwE,CAAA;AAC1H,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mDAAmD,CAAA;AAC1F,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAA;AACpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAA;AAChG,OAAO,EAAE,2BAA2B,EAAE,MAAM,oDAAoD,CAAA;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAA;AACnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,yDAAyD,CAAA;AACtG,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAA;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAA;AACnG,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAA;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAA;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAA;AACtG,OAAO,EAAE,4BAA4B,EAAE,MAAM,uDAAuD,CAAA;AACpG,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAA;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAA;AACjG,OAAO,EACL,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAA;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAA;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAA;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qDAAqD,CAAA;AAChG,OAAO,EAAE,8BAA8B,EAAE,MAAM,kEAAkE,CAAA;AACjH,OAAO,EAAE,0BAA0B,EAAE,MAAM,0DAA0D,CAAA;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAA;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAA;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAA;AAChH,OAAO,EAAE,6BAA6B,EAAE,MAAM,gEAAgE,CAAA;AAE9G;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAmB,GAAY;IACpE,uBAAuB,CAAC,GAAG,CAAC,CAAA;IAC5B,4BAA4B,CAAC,GAAG,CAAC,CAAA;IACjC,0BAA0B,CAAC,GAAG,CAAC,CAAA;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAmB,GAAY;IAC7D,gFAAgF;IAChF,0FAA0F;IAC1F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACpC,wFAAwF;IACxF,yFAAyF;IACzF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAC3C,0EAA0E;IAC1E,mFAAmF;IACnF,kFAAkF;IAClF,uCAAuC;IACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC1C,2EAA2E;IAC3E,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAA;IACpC,2FAA2F;IAC3F,sFAAsF;IACtF,wFAAwF;IACxF,sFAAsF;IACtF,cAAc;IACd,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACvC,+FAA+F;IAC/F,6FAA6F;IAC7F,qFAAqF;IACrF,wFAAwF;IACxF,kFAAkF;IAClF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAA;IAC5C,8FAA8F;IAC9F,uCAAuC;IACvC,+FAA+F;IAC/F,gGAAgG;IAChG,gGAAgG;IAChG,8FAA8F;IAC9F,6FAA6F;IAC7F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,8BAA8B,EAAE,CAAC,CAAA;IAChD,8FAA8F;IAC9F,sFAAsF;IACtF,uFAAuF;IACvF,2FAA2F;IAC3F,+FAA+F;IAC/F,0FAA0F;IAC1F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAA;IAC5C,gGAAgG;IAChG,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,yDAAyD;IACzD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACvC,+FAA+F;IAC/F,0FAA0F;IAC1F,6FAA6F;IAC7F,mFAAmF;IACnF,4FAA4F;IAC5F,uCAAuC;IACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAA;IAC7C,gGAAgG;IAChG,iGAAiG;IACjG,gGAAgG;IAChG,iGAAiG;IACjG,sFAAsF;IACtF,uCAAuC;IACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAC3C,8FAA8F;IAC9F,8FAA8F;IAC9F,0FAA0F;IAC1F,6FAA6F;IAC7F,8FAA8F;IAC9F,4FAA4F;IAC5F,gEAAgE;IAChE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAA;IACzC,4FAA4F;IAC5F,+FAA+F;IAC/F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACrC,iGAAiG;IACjG,8FAA8F;IAC9F,8FAA8F;IAC9F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC1C,+FAA+F;IAC/F,4FAA4F;IAC5F,yCAAyC;IACzC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACvC,8FAA8F;IAC9F,+FAA+F;IAC/F,6FAA6F;IAC7F,4CAA4C;IAC5C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC1C,6FAA6F;IAC7F,8FAA8F;IAC9F,0BAA0B;IAC1B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACrC,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,iFAAiF;IACjF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mCAAmC,EAAE,CAAC,CAAA;IACrD,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,oDAAoD;IACpD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACrD,wFAAwF;IACxF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC1C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC,CAAA;IACjC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACnC,yFAAyF;IACzF,oDAAoD;IACpD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,+BAA+B,EAAE,CAAC,CAAA;IACjD,qFAAqF;IACrF,8BAA8B;IAC9B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACnC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,8BAA8B,EAAE,CAAC,CAAA;IAChD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,EAAE,CAAC,CAAA;IAC9C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,EAAE,CAAC,CAAA;IACxC,yFAAyF;IACzF,+FAA+F;IAC/F,4FAA4F;IAC5F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACpC,oFAAoF;IACpF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gCAAgC,EAAE,CAAC,CAAA;IAClD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACtC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAA;IAC7C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACtC,0FAA0F;IAC1F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAA;IACzC,4FAA4F;IAC5F,+EAA+E;IAC/E,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAA;IAC7C,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAA;IACvE,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC,CAAA;IAC3E,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACrC,kFAAkF;IAClF,iGAAiG;IACjG,+FAA+F;IAC/F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAC3C,kFAAkF;IAClF,+EAA+E;IAC/E,6BAA6B;IAC7B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,4BAA4B,CAAmB,GAAY;IAClE,+BAA+B,CAAC,GAAG,CAAC,CAAA;IACpC,kCAAkC,CAAC,GAAG,CAAC,CAAA;AACzC,CAAC;AAED;;;GAGG;AACH,SAAS,+BAA+B,CAAmB,GAAY;IACrE,qBAAqB;IACrB,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,eAAe,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,CAAC,CAAA;IACjE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC1D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,CAAC,CAAA;IACnE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,gGAAgG;IAChG,4FAA4F;IAC5F,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,6BAA6B,EAAE,CAAC,CAAA;IACtE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,oFAAoF;IACpF,gDAAgD;IAChD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,eAAe,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,4BAA4B,EAAE,CAAC,CAAA;IACrE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,CAAC,CAAA;IACjE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAChE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,kCAAkC,CAAmB,GAAY;IACxE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,CAAC,CAAA;IACnE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC1D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAChE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,+BAA+B,EAAE,CAAC,CAAA;IACxE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,CAAC,CAAA;IACnE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,4FAA4F;IAC5F,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC1D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,4BAA4B,EAAE,CAAC,CAAA;IACrE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,gCAAgC,EAAE,CAAC,CAAA;IACzE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iCAAiC,EAAE,CAAC,CAAA;IAC1E,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAA;IAC7E,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAA;IACjF,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,eAAe,EAAE,CAAC,CAAA;AAC1D,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CAAmB,GAAY;IAChE,mEAAmE;IACnE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAC/C,2FAA2F;IAC3F,sFAAsF;IACtF,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACzC,8FAA8F;IAC9F,+FAA+F;IAC/F,wEAAwE;IACxE,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC/C,wEAAwE;IACxE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC3C,yEAAyE;IACzE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAA;AAC9C,CAAC"}

package/dist/github/DelegatedAppTokenSource.d.ts

@@ -31,6 +31,7 @@ export declare class DelegatedAppTokenSource implements AppTokenSource {
     };
     installationToken(installationId: number, opts?: {
         forceRefresh?: boolean;
+        repositoryIds?: number[];
     }): Promise<string>;
     installationPermissions(): Promise<InstallationPermissions>;
     private mint;

package/dist/github/DelegatedAppTokenSource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DelegatedAppTokenSource.d.ts","sourceRoot":"","sources":["../../src/github/DelegatedAppTokenSource.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAyB5D,MAAM,WAAW,6BAA6B;IAC5C,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAA;IACrC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,cAAc;IAK1D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,QAAQ,CAAC,YAAY,MAAK;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA0D;IAE/E,YACmB,IAAI,EAAE,6BAA6B,EACnC,GAAG,GAAE,MAAM,MAAiB,EAC3C;IAEJ,IAAI,IAAI,SAAS;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAEnC;IAED,UAAU,IAAI;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAS1C;IAEK,iBAAiB,CACrB,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAChC,OAAO,CAAC,MAAM,CAAC,CAQjB;IAKD,uBAAuB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAE1D;YAEa,IAAI;CAyBnB"}
+{"version":3,"file":"DelegatedAppTokenSource.d.ts","sourceRoot":"","sources":["../../src/github/DelegatedAppTokenSource.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAwB5D,MAAM,WAAW,6BAA6B;IAC5C,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAA;IACrC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,cAAc;IAK1D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,QAAQ,CAAC,YAAY,MAAK;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuC;IAE5D,YACmB,IAAI,EAAE,6BAA6B,EACnC,GAAG,GAAE,MAAM,MAAiB,EAC3C;IAEJ,IAAI,IAAI,SAAS;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAEnC;IAED,UAAU,IAAI;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAS1C;IAEK,iBAAiB,CACrB,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAiBjB;IAKD,uBAAuB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAE1D;YAEa,IAAI;CAoCnB"}

package/dist/github/DelegatedAppTokenSource.js

@@ -1,3 +1,4 @@
+import { InstallationTokenCache, installationTokenKey } from './installationTokenCache.js';
 // The client side of mothership-mode GitHub token delegation. A mothership-mode local
 // node has no GitHub App key (product decision: the App private key never reaches the
 // laptop) and, without a PAT, no GitHub credential at all — yet its agent containers,
@@ -10,13 +11,11 @@
 // installation).
 /**
  * How long a delegated installation token is served from the in-process memo before the
- * mothership is asked again. Delegated tokens are REPO-SCOPED and minted fresh by the
- * mothership on every call (a scoped mint bypasses its unscoped engine cache — see
- * `GitHubAppAuth.installationToken`), so each response starts with the full ~1h GitHub
- * lifetime — the memo can never serve a lapsed token. It exists to collapse the
- * per-GitHub-call chatter into at most one machine-API hop (= one GitHub mint) a minute
- * per installation, which also keeps a legitimate node far under the mothership's
- * per-node mint rate limit.
+ * mothership is asked again. It is far shorter than the ~1h a GitHub token lives, so the memo
+ * can never serve a lapsed one even though this side never reads the real expiry: the
+ * mothership answers with a token whose remaining lifetime it alone knows. The window exists to
+ * collapse the per-GitHub-call chatter into at most one machine-API hop a minute per scope,
+ * which also keeps a legitimate node far under the mothership's per-node mint rate limit.
  */
 const DELEGATED_TOKEN_MEMO_MS = 60_000;
 /**
@@ -29,7 +28,7 @@ export class DelegatedAppTokenSource {
     opts;
     now;
     defaultAppId = '';
-    memo = new Map();
+    memo = new InstallationTokenCache();
     constructor(opts, now = Date.now) {
         this.opts = opts;
         this.now = now;
@@ -43,13 +42,22 @@ export class DelegatedAppTokenSource {
         };
     }
     async installationToken(installationId, opts) {
+        // The memo is keyed by the SCOPE, not the installation: a container dispatch asks for a token
+        // narrowed to the repos its run resolved, and serving that from an installation-keyed entry
+        // would hand one run another run's scope, too wide or too narrow and silently either way.
+        // A key per distinct scope keeps the mothership's per-node rate limit comfortable, because a
+        // pipeline's dispatches repeat the same handful of repo sets. Lapsed entries are evicted (see
+        // {@link InstallationTokenCache}), so keying by scope cannot turn a map bounded by
+        // installations into one that grows for the lifetime of a long-running node.
+        const key = installationTokenKey(installationId, opts?.repositoryIds);
+        const now = this.now();
         if (!opts?.forceRefresh) {
-            const cached = this.memo.get(installationId);
-            if (cached && this.now() - cached.fetchedAt < DELEGATED_TOKEN_MEMO_MS)
-                return cached.token;
+            const cached = this.memo.get(key, now);
+            if (cached)
+                return cached;
         }
-        const token = await this.mint(installationId, opts?.forceRefresh === true);
-        this.memo.set(installationId, { token, fetchedAt: this.now() });
+        const token = await this.mint(installationId, opts?.forceRefresh === true, opts?.repositoryIds);
+        this.memo.set(key, token, now + DELEGATED_TOKEN_MEMO_MS, now);
         return token;
     }
     // A delegated installation token carries no App-granted permissions map here (the
@@ -58,7 +66,7 @@ export class DelegatedAppTokenSource {
     installationPermissions() {
         return Promise.resolve({});
     }
-    async mint(installationId, forceRefresh) {
+    async mint(installationId, forceRefresh, repositoryIds) {
         const fetchImpl = this.opts.fetchImpl ?? fetch;
         const machineToken = typeof this.opts.token === 'function' ? this.opts.token() : this.opts.token;
         const res = await fetchImpl(`${this.opts.baseUrl.replace(/\/$/, '')}/internal/github/installation-token`, {
@@ -67,7 +75,14 @@ export class DelegatedAppTokenSource {
                 'content-type': 'application/json',
                 authorization: `Bearer ${machineToken ?? ''}`,
             },
-            body: JSON.stringify({ installationId, ...(forceRefresh ? { forceRefresh } : {}) }),
+            body: JSON.stringify({
+                installationId,
+                ...(forceRefresh ? { forceRefresh } : {}),
+                // The mothership INTERSECTS this with the repos it links for the installation, so
+                // asking narrows and can never widen. Omitted ⇒ the whole linked set, which is what
+                // the engine's own gate/merge calls want.
+                ...(repositoryIds?.length ? { repositoryIds } : {}),
+            }),
         });
         const body = (await res.json().catch(() => null));
         if (!res.ok || typeof body?.token !== 'string') {

package/dist/github/DelegatedAppTokenSource.js.map

@@ -1 +1 @@
-{"version":3,"file":"DelegatedAppTokenSource.js","sourceRoot":"","sources":["../../src/github/DelegatedAppTokenSource.ts"],"names":[],"mappings":"AAGA,sFAAsF;AACtF,sFAAsF;AACtF,sFAAsF;AACtF,sFAAsF;AACtF,kFAAkF;AAClF,wFAAwF;AACxF,sFAAsF;AACtF,wFAAwF;AACxF,sFAAsF;AACtF,iBAAiB;AAEjB;;;;;;;;;GASG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAA;AActC;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IAKf,IAAI;IACJ,GAAG;IALb,YAAY,GAAG,EAAE,CAAA;IACT,IAAI,GAAG,IAAI,GAAG,EAAgD,CAAA;IAE/E,YACmB,IAAmC,EACnC,GAAG,GAAiB,IAAI,CAAC,GAAG;oBAD5B,IAAI;mBACJ,GAAG;IACnB,CAAC;IAEJ,IAAI;QACF,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;IACxB,CAAC;IAED,UAAU;QACR,OAAO;YACL,MAAM,EAAE,GAAG,EAAE,CACX,OAAO,CAAC,MAAM,CACZ,IAAI,KAAK,CACP,6FAA6F,CAC9F,CACF;SACJ,CAAA;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,cAAsB,EACtB,IAAiC;QAEjC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;YAC5C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,uBAAuB;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAA;QAC5F,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC,CAAA;QAC1E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAC/D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kFAAkF;IAClF,iFAAiF;IACjF,sDAAsD;IACtD,uBAAuB;QACrB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,cAAsB,EAAE,YAAqB;QAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;QAC9C,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAA;QAChG,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qCAAqC,EAC5E;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,YAAY,IAAI,EAAE,EAAE;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;SACpF,CACF,CAAA;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAGxC,CAAA;QACR,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,mDAAmD,GAAG,CAAC,MAAM,GAAG,CACzF,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;CACF"}
+{"version":3,"file":"DelegatedAppTokenSource.js","sourceRoot":"","sources":["../../src/github/DelegatedAppTokenSource.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAE1F,sFAAsF;AACtF,sFAAsF;AACtF,sFAAsF;AACtF,sFAAsF;AACtF,kFAAkF;AAClF,wFAAwF;AACxF,sFAAsF;AACtF,wFAAwF;AACxF,sFAAsF;AACtF,iBAAiB;AAEjB;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAA;AActC;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IAKf,IAAI;IACJ,GAAG;IALb,YAAY,GAAG,EAAE,CAAA;IACT,IAAI,GAAG,IAAI,sBAAsB,EAAU,CAAA;IAE5D,YACmB,IAAmC,EACnC,GAAG,GAAiB,IAAI,CAAC,GAAG;oBAD5B,IAAI;mBACJ,GAAG;IACnB,CAAC;IAEJ,IAAI;QACF,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;IACxB,CAAC;IAED,UAAU;QACR,OAAO;YACL,MAAM,EAAE,GAAG,EAAE,CACX,OAAO,CAAC,MAAM,CACZ,IAAI,KAAK,CACP,6FAA6F,CAC9F,CACF;SACJ,CAAA;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,cAAsB,EACtB,IAA2D;QAE3D,8FAA8F;QAC9F,4FAA4F;QAC5F,0FAA0F;QAC1F,6FAA6F;QAC7F,8FAA8F;QAC9F,mFAAmF;QACnF,6EAA6E;QAC7E,MAAM,GAAG,GAAG,oBAAoB,CAAC,cAAc,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACtC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;QAC3B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;QAC/F,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,uBAAuB,EAAE,GAAG,CAAC,CAAA;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kFAAkF;IAClF,iFAAiF;IACjF,sDAAsD;IACtD,uBAAuB;QACrB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,cAAsB,EACtB,YAAqB,EACrB,aAAmC;QAEnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;QAC9C,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAA;QAChG,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qCAAqC,EAC5E;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,YAAY,IAAI,EAAE,EAAE;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,cAAc;gBACd,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,kFAAkF;gBAClF,oFAAoF;gBACpF,0CAA0C;gBAC1C,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC;SACH,CACF,CAAA;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAGxC,CAAA;QACR,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,mDAAmD,GAAG,CAAC,MAAM,GAAG,CACzF,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;CACF"}

package/dist/github/GitHubAppAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GitHubAppAuth.d.ts","sourceRoot":"","sources":["../../src/github/GitHubAppAuth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,qBAAqB,CAAA;AAoB5B;;;;;;;;;;GAUG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IAEjD,QAAQ,CAAC,cAAc,EAAE,MAAM;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IAFzB,YACW,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,EAIxB;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,GACb,MAAM,CA0BR;AAeD,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAA;IACb,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAA;IACrB,sBAAsB,EAAE,4BAA4B,CAAA;IACpD,KAAK,EAAE,KAAK,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AASD,qBAAa,aAAa;IAGZ,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,UAAU,CAAC,CAAoB;IAEvC,YAA6B,IAAI,EAAE,yBAAyB,EAAI;IAEhE,yDAAyD;IACnD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAa9B;IAED;;;;;;;OAOG;IACG,iBAAiB,CACrB,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAUjB;IAED;;;;;;OAMG;IACG,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAEtF;YAEa,WAAW;YAaX,qBAAqB;IAsCnC,OAAO,CAAC,SAAS;CA0BlB"}
+{"version":3,"file":"GitHubAppAuth.d.ts","sourceRoot":"","sources":["../../src/github/GitHubAppAuth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,qBAAqB,CAAA;AAqB5B;;;;;;;;;;GAUG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IAEjD,QAAQ,CAAC,cAAc,EAAE,MAAM;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IAFzB,YACW,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,EAIxB;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,GACb,MAAM,CA0BR;AAqBD,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAA;IACb,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAA;IACrB,sBAAsB,EAAE,4BAA4B,CAAA;IACpD,KAAK,EAAE,KAAK,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AASD,qBAAa,aAAa;IAGZ,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,UAAU,CAAC,CAAoB;IAEvC,YAA6B,IAAI,EAAE,yBAAyB,EAAI;IAEhE,yDAAyD;IACnD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAa9B;IAED;;;;;;;OAOG;IACG,iBAAiB,CACrB,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAOjB;IAED;;;;;;OAMG;IACG,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAEtF;YAEa,WAAW;YAeX,qBAAqB;IA0CnC,OAAO,CAAC,SAAS;CA0BlB"}

package/dist/github/GitHubAppAuth.js

@@ -1,5 +1,6 @@
 import { GITHUB_SETTINGS_URLS, VCS_DOC_URLS } from '@cat-factory/kernel';
 import { base64url, pkcs8PemToDer } from '../crypto/encoding.js';
+import { InstallationTokenCache, installationTokenKey } from './installationTokenCache.js';
 // GitHub App authentication, implemented entirely on Web Crypto (`crypto.subtle`)
 // so it runs in a plain Workers isolate without Node `crypto` — and identically
 // under Node, where `crypto.subtle` is a global too:
@@ -76,14 +77,19 @@ export function explainInstallationTokenMintFailure(installationId, status) {
     return base;
 }
 /**
- * Installation tokens (live ~1h repo read/write credentials) are cached IN
- * MEMORY, per isolate/process — never persisted. Persisting them put a plaintext
- * credential at rest (readable from any DB dump / console / SQLi elsewhere); an
- * in-memory cache keeps the hit rate high for a warm process while the token never
- * outlives it. A cache miss just re-mints cheaply from the app JWT. The
- * module-level map intentionally persists across requests within the same process.
+ * Installation tokens (live ~1h repo read/write credentials) are cached IN MEMORY, per
+ * isolate/process, never persisted. Persisting them put a plaintext credential at rest
+ * (readable from any DB dump / console / SQLi elsewhere); an in-memory cache keeps the hit
+ * rate high for a warm process while the token never outlives it. The module-level cache
+ * intentionally persists across requests within the same process.
+ *
+ * Keyed by installation AND repo scope ({@link installationTokenKey}), so a mint narrowed to
+ * one dispatch's repos is cached beside the unscoped engine token instead of bypassing the
+ * cache entirely. Bypassing was the honest reading while the key was an installation id alone,
+ * but it made the standard dispatch path pay a JWT signature plus a GitHub round trip on EVERY
+ * step and every re-dispatch epoch, where it used to pay one per installation per hour.
  */
-const tokenCache = new Map();
+const tokenCache = new InstallationTokenCache();
 export class GitHubAppAuth {
     deps;
     keyPromise;
@@ -110,15 +116,12 @@ export class GitHubAppAuth {
      * bootstrap push token, which reads the same cache) pick up the new grant too.
      */
     async installationToken(installationId, opts) {
-        // A repo-SCOPED mint (mothership GitHub delegation) never touches the unscoped
-        // engine cache: serving a cached unscoped token would over-grant past the caller's
-        // scope, and caching the scoped token would under-grant every subsequent engine
-        // call. Scoped tokens are minted fresh per request — the delegation client's own
-        // short memo collapses the chatter.
-        if (opts?.repositoryIds) {
-            return (await this.mintInstallationToken(installationId, opts.repositoryIds)).token;
-        }
-        return (await this.cachedToken(installationId, opts?.forceRefresh)).token;
+        // A repo-SCOPED mint (a container dispatch's job token, the mothership delegation path)
+        // shares the cache with the unscoped engine token but never its ENTRY: the key carries the
+        // scope, so a narrowed token can neither be served to a caller that asked for none nor
+        // poison the engine path with one. That is what makes caching it safe, and caching it is
+        // what keeps the standard dispatch off a JWT signature plus a GitHub round trip per step.
+        return (await this.cachedToken(installationId, opts?.forceRefresh, opts?.repositoryIds)).token;
     }
     /**
      * The permissions the installation token actually carries (App ∩ what the
@@ -130,14 +133,13 @@ export class GitHubAppAuth {
     async installationPermissions(installationId) {
         return (await this.cachedToken(installationId)).permissions;
     }
-    async cachedToken(installationId, forceRefresh = false) {
+    async cachedToken(installationId, forceRefresh = false, repositoryIds) {
         if (!forceRefresh) {
-            const cached = tokenCache.get(installationId);
-            if (cached && cached.expiresAt - TOKEN_SKEW_MS > this.deps.clock.now()) {
+            const cached = tokenCache.get(installationTokenKey(installationId, repositoryIds), this.deps.clock.now());
+            if (cached)
                 return cached;
-            }
         }
-        return this.mintInstallationToken(installationId);
+        return this.mintInstallationToken(installationId, repositoryIds);
     }
     async mintInstallationToken(installationId, repositoryIds) {
         const jwt = await this.appJwt();
@@ -164,11 +166,9 @@ export class GitHubAppAuth {
             permissions: body.permissions ?? {},
             expiresAt: Number.isNaN(expiresAt) ? this.deps.clock.now() + 30 * 60 * 1000 : expiresAt,
         };
-        // In-memory only (see tokenCache note) — never persisted. A repo-scoped mint is
-        // deliberately NOT cached: the cache is keyed by installation id alone, so a scoped
-        // entry would poison the unscoped engine path (and vice versa).
-        if (!repositoryIds)
-            tokenCache.set(installationId, entry);
+        // In-memory only (see the tokenCache note above), never persisted. The token is treated as
+        // lapsed a few minutes early so one is never picked up moments before it expires mid-request.
+        tokenCache.set(installationTokenKey(installationId, repositoryIds), entry, entry.expiresAt - TOKEN_SKEW_MS, this.deps.clock.now());
         return entry;
     }
     importKey() {

package/dist/github/GitHubAppAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"GitHubAppAuth.js","sourceRoot":"","sources":["../../src/github/GitHubAppAuth.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAEhE,kFAAkF;AAClF,gFAAgF;AAChF,qDAAqD;AACrD,iFAAiF;AACjF,sCAAsC;AACtC,0EAA0E;AAC1E,0EAA0E;AAC1E,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,mEAAmE;AAEnE,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AACnC,MAAM,UAAU,GAAG,aAAa,CAAA;AAChC,MAAM,WAAW,GAAG,YAAY,CAAA;AAEhC;;;;;;;;;;GAUG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAExC,cAAc;IACd,MAAM;IAFjB,YACW,cAAsB,EACtB,MAAc;QAEvB,KAAK,CAAC,mCAAmC,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAA;8BAHzD,cAAc;sBACd,MAAM;QAGf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,OAAO,KAAK,YAAY,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CACjD,cAAsB,EACtB,MAAc;IAEd,MAAM,IAAI,GAAG,yCAAyC,cAAc,UAAU,MAAM,GAAG,CAAA;IACvF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,CACL,GAAG,IAAI,uFAAuF;YAC9F,0FAA0F;YAC1F,6DAA6D,oBAAoB,CAAC,aAAa,IAAI;YACnG,OAAO,YAAY,CAAC,gBAAgB,GAAG,CACxC,CAAA;IACH,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO,CACL,GAAG,IAAI,yBAAyB,cAAc,yCAAyC;YACvF,wFAAwF;YACxF,uFAAuF;YACvF,oBAAoB,oBAAoB,CAAC,aAAa,SAAS,YAAY,CAAC,iBAAiB,GAAG,CACjG,CAAA;IACH,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,CACL,GAAG,IAAI,uFAAuF;YAC9F,4FAA4F;YAC5F,sBAAsB,YAAY,CAAC,gBAAgB,GAAG,CACvD,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAGvB,CAAA;AAkBH,MAAM,OAAO,aAAa;IAGK,IAAI;IAFzB,UAAU,CAAqB;IAEvC,YAA6B,IAA+B;oBAA/B,IAAI;IAA8B,CAAC;IAEhE,yDAAyD;IACzD,KAAK,CAAC,MAAM;QACV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACvD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;QAC3C,6EAA6E;QAC7E,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;QAChF,MAAM,YAAY,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAA;QACjG,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAC7B,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CACvC,CAAA;QACD,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAA;IAClD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CACrB,cAAsB,EACtB,IAA2D;QAE3D,+EAA+E;QAC/E,mFAAmF;QACnF,gFAAgF;QAChF,iFAAiF;QACjF,oCAAoC;QACpC,IAAI,IAAI,EAAE,aAAa,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAA;QACrF,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;IAC3E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,uBAAuB,CAAC,cAAsB;QAClD,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAA;IAC7D,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,cAAsB,EACtB,YAAY,GAAG,KAAK;QAEpB,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;YAC7C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;gBACvE,OAAO,MAAM,CAAA;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAA;IACnD,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,cAAsB,EACtB,aAAwB;QAExB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QAC/B,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,sBAAsB,cAAc,gBAAgB,EACxE;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,EAAE;gBAC9B,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,UAAU;gBACxB,sBAAsB,EAAE,WAAW;gBACnC,0EAA0E;gBAC1E,0EAA0E;gBAC1E,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE;YACD,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CACF,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,0BAA0B,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAA;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC7C,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;YACnC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACxF,CAAA;QACD,gFAAgF;QAChF,oFAAoF;QACpF,gEAAgE;QAChE,IAAI,CAAC,aAAa;YAAE,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;QACzD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,yFAAyF;YACzF,yFAAyF;YACzF,4FAA4F;YAC5F,0FAA0F;YAC1F,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM;iBAC5B,SAAS,CACR,OAAO,EACP,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EACtC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,CAAC,CACT;iBACA,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,MAAM,IAAI,KAAK,CACb,yFAAyF;oBACvF,wFAAwF;oBACxF,gEAAgE;oBAChE,OAAO,YAAY,CAAC,gBAAgB,GAAG,EACzC,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC,CAAC,CAAA;QACN,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;CACF"}
+{"version":3,"file":"GitHubAppAuth.js","sourceRoot":"","sources":["../../src/github/GitHubAppAuth.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAE1F,kFAAkF;AAClF,gFAAgF;AAChF,qDAAqD;AACrD,iFAAiF;AACjF,sCAAsC;AACtC,0EAA0E;AAC1E,0EAA0E;AAC1E,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,mEAAmE;AAEnE,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AACnC,MAAM,UAAU,GAAG,aAAa,CAAA;AAChC,MAAM,WAAW,GAAG,YAAY,CAAA;AAEhC;;;;;;;;;;GAUG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAExC,cAAc;IACd,MAAM;IAFjB,YACW,cAAsB,EACtB,MAAc;QAEvB,KAAK,CAAC,mCAAmC,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAA;8BAHzD,cAAc;sBACd,MAAM;QAGf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,OAAO,KAAK,YAAY,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CACjD,cAAsB,EACtB,MAAc;IAEd,MAAM,IAAI,GAAG,yCAAyC,cAAc,UAAU,MAAM,GAAG,CAAA;IACvF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,CACL,GAAG,IAAI,uFAAuF;YAC9F,0FAA0F;YAC1F,6DAA6D,oBAAoB,CAAC,aAAa,IAAI;YACnG,OAAO,YAAY,CAAC,gBAAgB,GAAG,CACxC,CAAA;IACH,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO,CACL,GAAG,IAAI,yBAAyB,cAAc,yCAAyC;YACvF,wFAAwF;YACxF,uFAAuF;YACvF,oBAAoB,oBAAoB,CAAC,aAAa,SAAS,YAAY,CAAC,iBAAiB,GAAG,CACjG,CAAA;IACH,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,CACL,GAAG,IAAI,uFAAuF;YAC9F,4FAA4F;YAC5F,sBAAsB,YAAY,CAAC,gBAAgB,GAAG,CACvD,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,GAAG,IAAI,sBAAsB,EAIzC,CAAA;AAkBJ,MAAM,OAAO,aAAa;IAGK,IAAI;IAFzB,UAAU,CAAqB;IAEvC,YAA6B,IAA+B;oBAA/B,IAAI;IAA8B,CAAC;IAEhE,yDAAyD;IACzD,KAAK,CAAC,MAAM;QACV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACvD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;QAC3C,6EAA6E;QAC7E,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;QAChF,MAAM,YAAY,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAA;QACjG,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAC7B,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CACvC,CAAA;QACD,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAA;IAClD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CACrB,cAAsB,EACtB,IAA2D;QAE3D,wFAAwF;QACxF,2FAA2F;QAC3F,uFAAuF;QACvF,yFAAyF;QACzF,0FAA0F;QAC1F,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAA;IAChG,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,uBAAuB,CAAC,cAAsB;QAClD,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAA;IAC7D,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,cAAsB,EACtB,YAAY,GAAG,KAAK,EACpB,aAAwB;QAExB,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAC3B,oBAAoB,CAAC,cAAc,EAAE,aAAa,CAAC,EACnD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACtB,CAAA;YACD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;IAClE,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,cAAsB,EACtB,aAAwB;QAExB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QAC/B,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,sBAAsB,cAAc,gBAAgB,EACxE;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,EAAE;gBAC9B,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,UAAU;gBACxB,sBAAsB,EAAE,WAAW;gBACnC,0EAA0E;gBAC1E,0EAA0E;gBAC1E,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE;YACD,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CACF,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,0BAA0B,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAA;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC7C,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;YACnC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACxF,CAAA;QACD,2FAA2F;QAC3F,8FAA8F;QAC9F,UAAU,CAAC,GAAG,CACZ,oBAAoB,CAAC,cAAc,EAAE,aAAa,CAAC,EACnD,KAAK,EACL,KAAK,CAAC,SAAS,GAAG,aAAa,EAC/B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACtB,CAAA;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,yFAAyF;YACzF,yFAAyF;YACzF,4FAA4F;YAC5F,0FAA0F;YAC1F,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM;iBAC5B,SAAS,CACR,OAAO,EACP,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EACtC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,CAAC,CACT;iBACA,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,MAAM,IAAI,KAAK,CACb,yFAAyF;oBACvF,wFAAwF;oBACxF,gEAAgE;oBAChE,OAAO,YAAY,CAAC,gBAAgB,GAAG,EACzC,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC,CAAC,CAAA;QACN,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;CACF"}

package/dist/github/GitHubAppRegistry.d.ts

@@ -28,9 +28,16 @@ export interface AppTokenSource {
      * cached token and mints a fresh one — used to defeat the in-memory token cache
      * after a permission/repo-access change on GitHub, since a token keeps its
      * grant-at-mint scopes and a stale one misreports a just-granted access.
+     *
+     * `repositoryIds` narrows the mint to those repos (GitHub's `repository_ids`): the container
+     * dispatch scopes the job token to the repos one run resolved, and the mothership delegation
+     * endpoint scopes it to an installation's App-linked repos. A source with no App key behind it
+     * (a static PAT, the delegating client) narrows what it can and ignores the rest; the engine's
+     * own calls pass none and stay installation-wide.
      */
     installationToken(installationId: number, opts?: {
         forceRefresh?: boolean;
+        repositoryIds?: number[];
     }): Promise<string>;
     /**
      * The permissions the installation token actually carries (App ∩ install approval),
@@ -59,9 +66,9 @@ export declare class GitHubAppRegistry {
     authForApp(appId: string | null | undefined): GitHubAppAuth;
     /**
      * An installation token, minted by the App that owns the installation.
-     * `repositoryIds` narrows the mint to those repos (the mothership GitHub-delegation
-     * path — see `GitHubAppAuth.installationToken`); the engine's own calls pass none
-     * and stay installation-wide.
+     * `repositoryIds` narrows the mint to those repos (the container dispatch's job token and
+     * the mothership GitHub-delegation path, see `GitHubAppAuth.installationToken`); the
+     * engine's own calls pass none and stay installation-wide.
      */
     installationToken(installationId: number, opts?: {
         forceRefresh?: boolean;

package/dist/github/GitHubAppRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GitHubAppRegistry.d.ts","sourceRoot":"","sources":["../../src/github/GitHubAppRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAevD,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,aAAa,CAAA;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,2EAA2E;IAC3E,IAAI,IAAI,SAAS;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACpC,8CAA8C;IAC9C,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAA;IAC3E;;;;;OAKG;IACH,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC7F;;;;;;OAMG;IACH,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;CAClF;AAED,MAAM,WAAW,6BAA6B;IAC5C,gFAAgF;IAChF,OAAO,EAAE,aAAa,CAAA;IACtB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,aAAa,CAAA;IAC1B,0EAA0E;IAC1E,sBAAsB,EAAE,4BAA4B,CAAA;CACrD;AAOD,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,6BAA6B,EAAI;IAEpE,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,8EAA8E;IAC9E,IAAI,IAAI,aAAa,EAAE,CAEtB;IAED,0FAA0F;IAC1F,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,aAAa,CAK1D;IAED;;;;;OAKG;IACG,iBAAiB,CACrB,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAEjB;IAED,kEAAkE;IAC5D,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAEtF;IAED;;;;OAIG;IACH,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,OAAO,CAGxD;YAEa,SAAS;CASxB"}
+{"version":3,"file":"GitHubAppRegistry.d.ts","sourceRoot":"","sources":["../../src/github/GitHubAppRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAevD,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,aAAa,CAAA;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,2EAA2E;IAC3E,IAAI,IAAI,SAAS;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACpC,8CAA8C;IAC9C,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAA;IAC3E;;;;;;;;;;;OAWG;IACH,iBAAiB,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB;;;;;;OAMG;IACH,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;CAClF;AAED,MAAM,WAAW,6BAA6B;IAC5C,gFAAgF;IAChF,OAAO,EAAE,aAAa,CAAA;IACtB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,aAAa,CAAA;IAC1B,0EAA0E;IAC1E,sBAAsB,EAAE,4BAA4B,CAAA;CACrD;AAOD,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,6BAA6B,EAAI;IAEpE,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,8EAA8E;IAC9E,IAAI,IAAI,aAAa,EAAE,CAEtB;IAED,0FAA0F;IAC1F,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,aAAa,CAK1D;IAED;;;;;OAKG;IACG,iBAAiB,CACrB,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAEjB;IAED,kEAAkE;IAC5D,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAEtF;IAED;;;;OAIG;IACH,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,OAAO,CAGxD;YAEa,SAAS;CASxB"}

package/dist/github/GitHubAppRegistry.js

@@ -23,9 +23,9 @@ export class GitHubAppRegistry {
     }
     /**
      * An installation token, minted by the App that owns the installation.
-     * `repositoryIds` narrows the mint to those repos (the mothership GitHub-delegation
-     * path — see `GitHubAppAuth.installationToken`); the engine's own calls pass none
-     * and stay installation-wide.
+     * `repositoryIds` narrows the mint to those repos (the container dispatch's job token and
+     * the mothership GitHub-delegation path, see `GitHubAppAuth.installationToken`); the
+     * engine's own calls pass none and stay installation-wide.
      */
     async installationToken(installationId, opts) {
         return (await this.ownerAuth(installationId)).installationToken(installationId, opts);

package/dist/github/GitHubAppRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"GitHubAppRegistry.js","sourceRoot":"","sources":["../../src/github/GitHubAppRegistry.ts"],"names":[],"mappings":"AAkEA,wEAAwE;AACxE,+EAA+E;AAC/E,4CAA4C;AAC5C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAA;AAE/C,MAAM,OAAO,iBAAiB;IACC,IAAI;IAAjC,YAA6B,IAAmC;oBAAnC,IAAI;IAAkC,CAAC;IAEpE,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;IAChC,CAAC;IAED,8EAA8E;IAC9E,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC/F,CAAC;IAED,0FAA0F;IAC1F,UAAU,CAAC,KAAgC;QACzC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAA;QAClC,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,cAAsB,EACtB,IAA2D;QAE3D,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;IACvF,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,uBAAuB,CAAC,cAAsB;QAClD,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAA;IACvF,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,YAAgC;QAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAA;QACrD,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAA;IACnF,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,cAAsB;QAC5C,IAAI,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAA;YACzF,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC,YAAY,CAAA;YAC1C,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC;CACF"}
+{"version":3,"file":"GitHubAppRegistry.js","sourceRoot":"","sources":["../../src/github/GitHubAppRegistry.ts"],"names":[],"mappings":"AA2EA,wEAAwE;AACxE,+EAA+E;AAC/E,4CAA4C;AAC5C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAA;AAE/C,MAAM,OAAO,iBAAiB;IACC,IAAI;IAAjC,YAA6B,IAAmC;oBAAnC,IAAI;IAAkC,CAAC;IAEpE,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;IAChC,CAAC;IAED,8EAA8E;IAC9E,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC/F,CAAC;IAED,0FAA0F;IAC1F,UAAU,CAAC,KAAgC;QACzC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAA;QAClC,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,cAAsB,EACtB,IAA2D;QAE3D,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;IACvF,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,uBAAuB,CAAC,cAAsB;QAClD,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAA;IACvF,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,YAAgC;QAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAA;QACrD,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAA;IACnF,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,cAAsB;QAC5C,IAAI,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAA;YACzF,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC,YAAY,CAAA;YAC1C,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC;CACF"}

package/dist/github/PatPreferringAppRegistry.d.ts

@@ -15,6 +15,7 @@ export declare class PatPreferringAppRegistry implements AppTokenSource {
     };
     installationToken(installationId: number, opts?: {
         forceRefresh?: boolean;
+        repositoryIds?: number[];
     }): Promise<string>;
     installationPermissions(installationId: number): Promise<InstallationPermissions>;
     /**

package/dist/github/PatPreferringAppRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PatPreferringAppRegistry.d.ts","sourceRoot":"","sources":["../../src/github/PatPreferringAppRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAiB5D,mFAAmF;AACnF,MAAM,MAAM,wBAAwB,GAAG,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;AAE5F,qBAAa,wBAAyB,YAAW,cAAc;IAE3D,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IAF3C,YACmB,KAAK,EAAE,cAAc,EACrB,wBAAwB,EAAE,wBAAwB,EACjE;IAEJ,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,IAAI,SAAS;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAEnC;IAED,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAE1E;IAEK,iBAAiB,CACrB,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAChC,OAAO,CAAC,MAAM,CAAC,CAMjB;IAEK,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAOtF;IAED;;;;OAIG;YACW,cAAc;CAI7B"}
+{"version":3,"file":"PatPreferringAppRegistry.d.ts","sourceRoot":"","sources":["../../src/github/PatPreferringAppRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAiB5D,mFAAmF;AACnF,MAAM,MAAM,wBAAwB,GAAG,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;AAE5F,qBAAa,wBAAyB,YAAW,cAAc;IAE3D,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IAF3C,YACmB,KAAK,EAAE,cAAc,EACrB,wBAAwB,EAAE,wBAAwB,EACjE;IAEJ,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,IAAI,SAAS;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAEnC;IAED,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAE1E;IAEK,iBAAiB,CACrB,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAQjB;IAEK,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAOtF;IAED;;;;OAIG;YACW,cAAc;CAI7B"}

package/dist/github/PatPreferringAppRegistry.js

@@ -16,8 +16,10 @@ export class PatPreferringAppRegistry {
         return this.inner.authForApp(appId);
     }
     async installationToken(installationId, opts) {
-        // `forceRefresh` is moot for a PAT (it never expires the way an App token does); it only
-        // matters for the wrapped App-token cache below.
+        // Both options are moot for a PAT: it never expires the way an App token does, and
+        // `repository_ids` scoping is an App-token mechanism with no PAT equivalent, so a run on the
+        // initiator's own token is bounded by that token, which is what `allowInitiatorPat` governs
+        // (`backend/docs/security-model.md`, Layer 3). They matter only for the wrapped source below.
         const pat = await this.initiatorToken();
         if (pat)
             return pat;

package/dist/github/PatPreferringAppRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"PatPreferringAppRegistry.js","sourceRoot":"","sources":["../../src/github/PatPreferringAppRegistry.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAmBjE,MAAM,OAAO,wBAAwB;IAEhB,KAAK;IACL,wBAAwB;IAF3C,YACmB,KAAqB,EACrB,wBAAkD;qBADlD,KAAK;wCACL,wBAAwB;IACxC,CAAC;IAEJ,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAA;IAChC,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,UAAU,CAAC,KAAgC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,cAAsB,EACtB,IAAiC;QAEjC,yFAAyF;QACzF,iDAAiD;QACjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAA;QACvC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAA;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,cAAsB;QAClD,gFAAgF;QAChF,iFAAiF;QACjF,mFAAmF;QACnF,6BAA6B;QAC7B,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAA;IAC3D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,cAAc;QAC1B,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAA;QACtC,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5D,CAAC;CACF"}
+{"version":3,"file":"PatPreferringAppRegistry.js","sourceRoot":"","sources":["../../src/github/PatPreferringAppRegistry.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAmBjE,MAAM,OAAO,wBAAwB;IAEhB,KAAK;IACL,wBAAwB;IAF3C,YACmB,KAAqB,EACrB,wBAAkD;qBADlD,KAAK;wCACL,wBAAwB;IACxC,CAAC;IAEJ,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAA;IAChC,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,UAAU,CAAC,KAAgC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,cAAsB,EACtB,IAA2D;QAE3D,mFAAmF;QACnF,6FAA6F;QAC7F,4FAA4F;QAC5F,8FAA8F;QAC9F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAA;QACvC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAA;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,cAAsB;QAClD,gFAAgF;QAChF,iFAAiF;QACjF,mFAAmF;QACnF,6BAA6B;QAC7B,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAA;IAC3D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,cAAc;QAC1B,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAA;QACtC,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5D,CAAC;CACF"}

package/dist/github/installationTokenCache.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The cache key for one minted installation token: the installation, plus the SORTED repo scope
+ * when the mint was narrowed with `repository_ids`.
+ *
+ * Sorting is what makes the key a function of the SET rather than of the order the dispatch's
+ * legs happened to resolve in, so two dispatches over the same repos share an entry. An UNSCOPED
+ * mint (the engine's own gate/merge calls) keys on the installation alone, so it can neither be
+ * served from a narrowed entry nor poison one.
+ */
+export declare function installationTokenKey(installationId: number, repositoryIds?: readonly number[]): string;
+/**
+ * A scope-keyed store of minted installation tokens, holding each entry until the freshness
+ * deadline its minter computed.
+ *
+ * Entries are IN MEMORY, per isolate/process, never persisted: persisting them would put a live
+ * repo-write credential at rest, readable from any DB dump, and a miss just re-mints. The map is
+ * deliberately long-lived, which is exactly why it EVICTS: keying by scope turned a map bounded
+ * by the number of installations into one bounded by the number of distinct repo SETS a
+ * deployment ever dispatches over, and a node that runs for days would otherwise accumulate an
+ * entry per set forever. Lapsed entries are dropped on write, because a write happens only on a
+ * mint (rare) while a read is on the hot path.
+ */
+export declare class InstallationTokenCache<T> {
+    private readonly entries;
+    /** The cached value for `key`, or undefined when there is none or it has lapsed. */
+    get(key: string, now: number): T | undefined;
+    /**
+     * Cache `value` under `key` until `freshUntil`. The deadline is the CALLER's to compute,
+     * because the two minters answer "still fresh?" differently: the App mint knows the token's
+     * real GitHub expiry (minus a skew margin), while the delegation client holds a token for a
+     * short window that only collapses per-call chatter.
+     */
+    set(key: string, value: T, freshUntil: number, now: number): void;
+    /** Entry count, for tests asserting that eviction actually happens. */
+    get size(): number;
+}
+//# sourceMappingURL=installationTokenCache.d.ts.map

package/dist/github/installationTokenCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installationTokenCache.d.ts","sourceRoot":"","sources":["../../src/github/installationTokenCache.ts"],"names":[],"mappings":"AAUA;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAChC,MAAM,CAGR;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,sBAAsB,CAAC,CAAC;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsD;IAE9E,oFAAoF;IACpF,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAQ3C;IAED;;;;;OAKG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAKhE;IAED,uEAAuE;IACvE,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}