@cat-factory/server 0.294.0 → 0.296.0

package/dist/modules/persistence/dispatchScope.js

@@ -0,0 +1,307 @@
+/**
+ * The per-request READ MEMO, plus the one registry substitution it earns.
+ *
+ * Every entity-keyed scope rule resolves a row to bind the call, and for a handful of methods that
+ * row IS what the call then dispatches. Memoising each read per request keeps those to one query,
+ * and the `memoOverrides` table points the dispatched method at the same memo. Extracted from
+ * {@link buildDispatchScope} when the batched resolvers pushed it past its function-size budget:
+ * this half is about READING ONCE, the other about what a read MEANS for scope.
+ */
+function buildRequestReaders(registry, request) {
+    const workspaceRepository = registry.workspaceRepository;
+    const blockRepository = registry.blockRepository;
+    const serviceRepository = registry.serviceRepository;
+    const skillSourceRepository = registry.skillSourceRepository;
+    // The owner-pair content-library source tables, keyed by the `LibrarySourceEntity` the rule
+    // names, so one resolver answers for both (and a new library is one row here). Keyed by the
+    // UNION rather than by `string`: a member added to `LibrarySourceEntity` must fail to compile
+    // here rather than resolve to nothing, which the stored-half check would otherwise be entitled
+    // to read as "no such row" and admit.
+    const librarySourceRepos = {
+        fragmentSource: registry.fragmentSourceRepository,
+        foundationalServiceSource: registry.foundationalServiceSourceRepository,
+    };
+    const resolveAccountId = (workspaceId) => workspaceRepository?.accountOf?.(workspaceId) ??
+        Promise.resolve(undefined);
+    // The BATCHED account read every list-shaped rule binds through. A registry that does not wire
+    // it answers an empty map, which fails every id closed rather than admitting one: the same
+    // disposition an unresolvable `accountOf` already has.
+    const readAccountIds = async (workspaceIds) => (await workspaceRepository?.accountIdsOf?.(workspaceIds)) ?? {};
+    // The `block`/`serviceList`/`service` scope checks resolve the owning account by reading the
+    // entity (`blockRepository.findById` / `serviceRepository.listByIds`). When the request ALSO
+    // dispatches that same read, memoise it per request so the resolver's read is reused instead
+    // of issuing a second identical query. `serviceRepository.get(id)` is the single-service form:
+    // its `service` scope resolves via `listByIds([id])`, so the dispatched `get` is routed through
+    // the same memo (a single-id `listByIds` yields the same row) rather than a second point read.
+    // (For every other `serviceList` method the dispatched method differs from the resolver's read,
+    // so there is nothing to dedupe.)
+    const memoizeRead = (fn) => {
+        const cache = new Map();
+        return (...args) => {
+            const key = JSON.stringify(args);
+            const hit = cache.get(key);
+            if (hit)
+                return hit;
+            const pending = Promise.resolve(fn(...args));
+            cache.set(key, pending);
+            return pending;
+        };
+    };
+    const installationRepository = registry.githubInstallationRepository;
+    const blockFindById = memoizeRead((blockId) => blockRepository?.findById?.(blockId));
+    // One memo per installation id, shared by the resolver and (via the override below) the
+    // dispatched point read, exactly as the source tables do. Built only when the repository is
+    // wired, so an unwired one answers `unreadable` rather than the absence an id-keyed upsert
+    // would be entitled to read as a create.
+    const installationGet = typeof installationRepository?.getByInstallationId === 'function'
+        ? memoizeRead((id) => installationRepository.getByInstallationId(id))
+        : undefined;
+    const blockFindByIds = memoizeRead((ids) => blockRepository?.findByIds?.(ids));
+    // One memo per requested SET of workspace ids, shared by the resolver and (via the override
+    // below) the dispatched `accountIdsOf`, exactly as the other self-keyed reads do.
+    const accountIdsOf = memoizeRead((ids) => readAccountIds(ids));
+    const installationListByIds = memoizeRead((ids) => installationRepository?.listByInstallationIds?.(ids));
+    const serviceListByIds = memoizeRead((ids) => serviceRepository?.listByIds?.(ids));
+    const skillSourceGet = memoizeRead((id) => skillSourceRepository?.get?.(id));
+    // One memo per source TABLE, keyed by entity: the resolver and the dispatched `get` of the same
+    // library then share a read, exactly as `skillSourceGet` does for skills. A table whose `get`
+    // this deployment does not wire gets NO reader rather than one answering `undefined`, so the
+    // resolver below can report `unreadable` instead of the absence that would admit an upsert.
+    const librarySourceReader = (entity) => {
+        const repo = librarySourceRepos[entity];
+        if (typeof repo?.get !== 'function')
+            return undefined;
+        // Called through the repository so a class-implemented `get` keeps its receiver.
+        return memoizeRead((id) => repo.get(id));
+    };
+    const librarySourceGets = {
+        fragmentSource: librarySourceReader('fragmentSource'),
+        foundationalServiceSource: librarySourceReader('foundationalServiceSource'),
+    };
+    // For the self-keyed reads, point the dispatcher's own call at the memo so it hits the
+    // resolver's already-resolved result. Only the one dispatched method is overridden; the rest
+    // of the registry is untouched. Keyed `repo.method` so a new self-keyed read is one row here
+    // rather than another rung on a ternary chain.
+    const serviceGetViaMemo = async (id) => (await serviceListByIds([id]))?.[0] ?? null;
+    const memoOverrides = {
+        'blockRepository.findById': { blockRepository: { findById: blockFindById } },
+        'blockRepository.findByIds': { blockRepository: { findByIds: blockFindByIds } },
+        'serviceRepository.listByIds': { serviceRepository: { listByIds: serviceListByIds } },
+        'serviceRepository.get': { serviceRepository: { get: serviceGetViaMemo } },
+        // The two batched self-keyed reads: the `workspaceList` rule resolves the accounts of exactly
+        // the ids `accountIdsOf` is being asked for, and `installationList` resolves the owners of
+        // exactly the ids `listByInstallationIds` is being asked for.
+        'workspaceRepository.accountIdsOf': { workspaceRepository: { accountIdsOf } },
+        'githubInstallationRepository.listByInstallationIds': {
+            githubInstallationRepository: { listByInstallationIds: installationListByIds },
+        },
+        // The `skillSource` scope resolves a source's account by reading the source; when the
+        // dispatched call IS that read (the sync service's `get`), reuse the resolver's result.
+        'skillSourceRepository.get': { skillSourceRepository: { get: skillSourceGet } },
+        // The same self-keyed read for an installation: the `installation` rule resolves the row to
+        // scope the call, and the dispatched `getByInstallationId` IS that row.
+        ...(installationGet
+            ? {
+                'githubInstallationRepository.getByInstallationId': {
+                    githubInstallationRepository: { getByInstallationId: installationGet },
+                },
+            }
+            : {}),
+        // The same self-keyed read for the two owner-pair libraries' source tables. Contributed only
+        // where a reader exists: a table whose `get` is unwired has nothing to memoise, and the
+        // dispatcher's own wiring check answers that call with `... is not wired` regardless.
+        ...(librarySourceGets.fragmentSource
+            ? {
+                'fragmentSourceRepository.get': {
+                    fragmentSourceRepository: { get: librarySourceGets.fragmentSource },
+                },
+            }
+            : {}),
+        ...(librarySourceGets.foundationalServiceSource
+            ? {
+                'foundationalServiceSourceRepository.get': {
+                    foundationalServiceSourceRepository: {
+                        get: librarySourceGets.foundationalServiceSource,
+                    },
+                },
+            }
+            : {}),
+    };
+    // Substitute ONLY for a method the real registry actually wires. `memoizeRead` returns a
+    // function unconditionally — it closes over an optional-chained call — so overriding an ABSENT
+    // repository would satisfy the dispatcher's `typeof fn !== 'function'` wiring check and answer a
+    // misconfigured deployment with a scope 404 (or a bare null) instead of the `... is not wired`
+    // that names what to fix. The key is only ever consulted after `Object.hasOwn`, so an
+    // attacker-controlled `request.repo` cannot reach an inherited member through the lookup below.
+    const memoKey = `${request.repo}.${request.method}`;
+    const override = Object.hasOwn(memoOverrides, memoKey)
+        ? typeof registry[request.repo]?.[request.method] === 'function'
+            ? memoOverrides[memoKey]
+            : undefined
+        : undefined;
+    const registryForDispatch = override ? { ...registry, ...override } : registry;
+    return {
+        registryForDispatch,
+        blockRepository,
+        installationRepository,
+        resolveAccountId,
+        accountIdsOf,
+        blockFindById,
+        blockFindByIds,
+        serviceListByIds,
+        skillSourceGet,
+        librarySourceGets,
+        installationGet,
+        installationListByIds,
+    };
+}
+/**
+ * The per-request SCOPE RESOLUTION half of `POST /internal/persistence`: the entity readers the
+ * dispatcher binds a call through (block → workspace → account, service → account, a library
+ * source's owner pair, an installation's owner, an account's roster), over the per-request memo
+ * {@link buildRequestReaders} builds.
+ *
+ * Split out of `PersistenceController` when the surface completion pushed the handler past its
+ * function-size budget. It is the half that grows: every new entity-keyed scope rule adds a
+ * resolver here, while the controller's own job (gate, parse, dispatch, relay) does not change.
+ */
+export function buildDispatchScope(registry, request, scope) {
+    const { registryForDispatch, blockRepository, installationRepository, resolveAccountId, accountIdsOf, blockFindById, blockFindByIds, serviceListByIds, skillSourceGet, librarySourceGets, installationGet, installationListByIds, } = buildRequestReaders(registry, request);
+    return {
+        registry: registryForDispatch,
+        scope,
+        resolveAccountId,
+        resolveAccountIds: async (workspaceIds) => {
+            const accounts = (await accountIdsOf(workspaceIds));
+            return new Map(Object.entries(accounts));
+        },
+        // A block is keyed only by its id; resolve its home workspace, then that workspace's account.
+        resolveBlockAccountId: async (blockId) => {
+            const found = (await blockFindById(blockId));
+            const workspaceId = found?.workspaceId;
+            return typeof workspaceId === 'string' ? resolveAccountId(workspaceId) : undefined;
+        },
+        // The batched form, in exactly two reads however long the list: one `findByIds` resolves every
+        // block's home workspace, then ONE `accountIdsOf` over the deduped workspaces. A block absent
+        // from either read is absent from the map.
+        resolveBlockAccountIds: async (blockIds) => {
+            const found = (await blockFindByIds(blockIds));
+            const entries = found ?? [];
+            const accounts = (await accountIdsOf([
+                ...new Set(entries.map((entry) => entry.workspaceId)),
+            ]));
+            const map = new Map();
+            for (const entry of entries) {
+                map.set(entry.block.id, Object.hasOwn(accounts, entry.workspaceId) ? accounts[entry.workspaceId] : undefined);
+            }
+            return map;
+        },
+        // Services are account-owned; resolve each requested id's `accountId` for the scope check.
+        resolveServiceAccountIds: async (serviceIds) => {
+            const services = (await serviceListByIds(serviceIds));
+            const map = new Map();
+            for (const service of services ?? [])
+                map.set(service.id, service.accountId);
+            return map;
+        },
+        // Skill sources are account-owned; the sync surface's methods carry only a source id, so
+        // resolve the row and project its `accountId` for the scope check. A source that does not
+        // exist resolves to undefined, which fails closed (404) exactly like a missing block/service.
+        resolveSkillSourceAccountId: async (sourceId) => {
+            const source = (await skillSourceGet(sourceId));
+            return source?.accountId;
+        },
+        // The owner-PAIR libraries' equivalent: a fragment / foundational-service source is owned by
+        // an `(ownerKind, ownerId)` tier rather than an account, so project the pair and let the rule
+        // resolve it the way it resolves a positional owner. A source that does not exist answers
+        // `absent`, which the sourceId-keyed rules fail closed on (404) exactly like a missing
+        // block/service, and which `ownerFieldUpsert` alone reads as a create.
+        resolveLibrarySourceOwner: async (entity, sourceId) => {
+            const read = librarySourceGets[entity];
+            // No reader for that table: nothing is known about the id, so say so. Answering `absent`
+            // here would let an id-keyed upsert through on its DECLARED owner alone.
+            if (!read)
+                return { status: 'unreadable' };
+            const source = (await read(sourceId));
+            return source
+                ? { status: 'found', owner: { ownerKind: source.ownerKind, ownerId: source.ownerId } }
+                : { status: 'absent' };
+        },
+        // A VCS installation binds either an ACCOUNT (a GitHub App installation, shared with every
+        // board of that account) or just its connector WORKSPACE (a per-workspace PAT, which stores
+        // no account). Resolve the effective owner so both bind the same way, and keep "no such
+        // binding" apart from "this deployment cannot read the table": the batched annotation read
+        // admits the first and must refuse the second.
+        resolveInstallationOwner: async (installationId) => {
+            if (!installationGet)
+                return { status: 'unreadable' };
+            const row = (await installationGet(installationId));
+            if (!row)
+                return { status: 'absent' };
+            if (typeof row.accountId === 'string')
+                return { status: 'found', accountId: row.accountId };
+            const workspaceId = row.workspaceId;
+            return {
+                status: 'found',
+                accountId: typeof workspaceId === 'string' ? await resolveAccountId(workspaceId) : null,
+            };
+        },
+        // The batched form: one `listByInstallationIds` plus one `accountIdsOf` over the connector
+        // workspaces of the PAT bindings that store no account. Ids with no binding are absent from
+        // the read, so the rule sees them as `absent` (the admission the annotation read needs) while
+        // an UNWIRED repository yields no map at all, which the rule fails closed on.
+        resolveInstallationOwners: async (installationIds) => {
+            const owners = new Map();
+            if (typeof installationRepository?.listByInstallationIds !== 'function') {
+                for (const id of installationIds)
+                    owners.set(id, { status: 'unreadable' });
+                return owners;
+            }
+            const rows = ((await installationListByIds(installationIds)) ?? []);
+            const patWorkspaces = rows
+                .filter((row) => typeof row.accountId !== 'string' && typeof row.workspaceId === 'string')
+                .map((row) => row.workspaceId);
+            const accounts = (await accountIdsOf([...new Set(patWorkspaces)]));
+            for (const row of rows) {
+                if (typeof row.accountId === 'string') {
+                    owners.set(row.installationId, { status: 'found', accountId: row.accountId });
+                    continue;
+                }
+                const workspaceId = row.workspaceId;
+                owners.set(row.installationId, {
+                    status: 'found',
+                    accountId: typeof workspaceId === 'string' && Object.hasOwn(accounts, workspaceId)
+                        ? accounts[workspaceId]
+                        : null,
+                });
+            }
+            for (const id of installationIds) {
+                if (!owners.has(id))
+                    owners.set(id, { status: 'absent' });
+            }
+            return owners;
+        },
+        // A service's frame block, as the three states `serviceInsert` needs: the row is written
+        // BEFORE its block, so `absent` is the ordinary create and only `found` binds.
+        resolveFrameBlockOwner: async (frameBlockId) => {
+            if (typeof blockRepository?.findById !== 'function')
+                return { status: 'unreadable' };
+            const found = (await blockFindById(frameBlockId));
+            if (!found)
+                return { status: 'absent' };
+            const workspaceId = found.workspaceId;
+            return {
+                status: 'found',
+                accountId: typeof workspaceId === 'string' ? await resolveAccountId(workspaceId) : null,
+            };
+        },
+        // The member-display scope (`user`/`userList`): a userId is in scope iff a co-member of an
+        // in-scope account, so resolve each in-scope account's roster to userIds. Bounded by the
+        // token's account scope, not the requested user list.
+        resolveAccountMemberIds: async (accountId) => {
+            const memberships = (await registry.membershipRepository?.listByAccount?.(accountId));
+            return (memberships ?? []).map((m) => m.userId);
+        },
+    };
+}
+//# sourceMappingURL=dispatchScope.js.map

package/dist/modules/persistence/dispatchScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatchScope.js","sourceRoot":"","sources":["../../../src/modules/persistence/dispatchScope.ts"],"names":[],"mappings":"AASA;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,QAA6B,EAAE,OAA8B;IACxF,MAAM,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAA;IACxD,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAA;IAChD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAA;IACpD,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAA;IAC5D,4FAA4F;IAC5F,4FAA4F;IAC5F,8FAA8F;IAC9F,+FAA+F;IAC/F,sCAAsC;IACtC,MAAM,kBAAkB,GAAyE;QAC/F,cAAc,EAAE,QAAQ,CAAC,wBAAwB;QACjD,yBAAyB,EAAE,QAAQ,CAAC,mCAAmC;KACxE,CAAA;IACD,MAAM,gBAAgB,GAAG,CAAC,WAAmB,EAAE,EAAE,CAC9C,mBAAmB,EAAE,SAAS,EAAE,CAAC,WAAW,CAAwC;QACrF,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC5B,+FAA+F;IAC/F,2FAA2F;IAC3F,uDAAuD;IACvD,MAAM,cAAc,GAAG,KAAK,EAAE,YAAsB,EAA0C,EAAE,CAC7F,CAAC,MAAM,mBAAmB,EAAE,YAAY,EAAE,CAAC,YAAY,CAAC,CAE3C,IAAI,EAAE,CAAA;IAEtB,6FAA6F;IAC7F,6FAA6F;IAC7F,6FAA6F;IAC7F,+FAA+F;IAC/F,gGAAgG;IAChG,+FAA+F;IAC/F,gGAAgG;IAChG,kCAAkC;IAClC,MAAM,WAAW,GAAG,CAAC,EAAmC,EAAE,EAAE;QAC1D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAA;QACjD,OAAO,CAAC,GAAG,IAAe,EAAoB,EAAE;YAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAChC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC1B,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAA;YACnB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;YAC5C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YACvB,OAAO,OAAO,CAAA;QAChB,CAAC,CAAA;IACH,CAAC,CAAA;IACD,MAAM,sBAAsB,GAAG,QAAQ,CAAC,4BAA4B,CAAA;IACpE,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,CAAC,OAAiB,CAAC,CAAC,CAAA;IAC9F,wFAAwF;IACxF,4FAA4F;IAC5F,2FAA2F;IAC3F,yCAAyC;IACzC,MAAM,eAAe,GACnB,OAAO,sBAAsB,EAAE,mBAAmB,KAAK,UAAU;QAC/D,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,sBAAsB,CAAC,mBAAoB,CAAC,EAAY,CAAC,CAAC;QAChF,CAAC,CAAC,SAAS,CAAA;IACf,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,EAAE,CAAC,GAAe,CAAC,CAAC,CAAA;IAC1F,4FAA4F;IAC5F,kFAAkF;IAClF,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAe,CAAC,CAAC,CAAA;IAC1E,MAAM,qBAAqB,GAAG,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CAChD,sBAAsB,EAAE,qBAAqB,EAAE,CAAC,GAAe,CAAC,CACjE,CAAA;IACD,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,EAAE,SAAS,EAAE,CAAC,GAAe,CAAC,CAAC,CAAA;IAC9F,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,EAAY,CAAC,CAAC,CAAA;IACtF,gGAAgG;IAChG,8FAA8F;IAC9F,6FAA6F;IAC7F,4FAA4F;IAC5F,MAAM,mBAAmB,GAAG,CAAC,MAA2B,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,OAAO,IAAI,EAAE,GAAG,KAAK,UAAU;YAAE,OAAO,SAAS,CAAA;QACrD,iFAAiF;QACjF,OAAO,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAI,CAAC,EAAY,CAAC,CAAC,CAAA;IACrD,CAAC,CAAA;IACD,MAAM,iBAAiB,GAGnB;QACF,cAAc,EAAE,mBAAmB,CAAC,gBAAgB,CAAC;QACrD,yBAAyB,EAAE,mBAAmB,CAAC,2BAA2B,CAAC;KAC5E,CAAA;IACD,uFAAuF;IACvF,6FAA6F;IAC7F,6FAA6F;IAC7F,+CAA+C;IAC/C,MAAM,iBAAiB,GAAG,KAAK,EAAE,EAAW,EAAE,EAAE,CAC7C,CAAC,MAAM,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IACpF,MAAM,aAAa,GAAwC;QACzD,0BAA0B,EAAE,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE;QAC5E,2BAA2B,EAAE,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE;QAC/E,6BAA6B,EAAE,EAAE,iBAAiB,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE;QACrF,uBAAuB,EAAE,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE;QAC1E,8FAA8F;QAC9F,2FAA2F;QAC3F,8DAA8D;QAC9D,kCAAkC,EAAE,EAAE,mBAAmB,EAAE,EAAE,YAAY,EAAE,EAAE;QAC7E,oDAAoD,EAAE;YACpD,4BAA4B,EAAE,EAAE,qBAAqB,EAAE,qBAAqB,EAAE;SAC/E;QACD,sFAAsF;QACtF,wFAAwF;QACxF,2BAA2B,EAAE,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE;QAC/E,4FAA4F;QAC5F,wEAAwE;QACxE,GAAG,CAAC,eAAe;YACjB,CAAC,CAAC;gBACE,kDAAkD,EAAE;oBAClD,4BAA4B,EAAE,EAAE,mBAAmB,EAAE,eAAe,EAAE;iBACvE;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,6FAA6F;QAC7F,wFAAwF;QACxF,sFAAsF;QACtF,GAAG,CAAC,iBAAiB,CAAC,cAAc;YAClC,CAAC,CAAC;gBACE,8BAA8B,EAAE;oBAC9B,wBAAwB,EAAE,EAAE,GAAG,EAAE,iBAAiB,CAAC,cAAc,EAAE;iBACpE;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,iBAAiB,CAAC,yBAAyB;YAC7C,CAAC,CAAC;gBACE,yCAAyC,EAAE;oBACzC,mCAAmC,EAAE;wBACnC,GAAG,EAAE,iBAAiB,CAAC,yBAAyB;qBACjD;iBACF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IACD,yFAAyF;IACzF,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,sFAAsF;IACtF,gGAAgG;IAChG,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAA;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC;QACpD,CAAC,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,UAAU;YAC9D,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC;YACxB,CAAC,CAAC,SAAS;QACb,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,mBAAmB,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;IAE9E,OAAO;QACL,mBAAmB;QACnB,eAAe;QACf,sBAAsB;QACtB,gBAAgB;QAChB,YAAY;QACZ,aAAa;QACb,cAAc;QACd,gBAAgB;QAChB,cAAc;QACd,iBAAiB;QACjB,eAAe;QACf,qBAAqB;KACtB,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA6B,EAC7B,OAA8B,EAC9B,KAA+C;IAE/C,MAAM,EACJ,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,qBAAqB,GACtB,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAE1C,OAAO;QACL,QAAQ,EAAE,mBAAmB;QAC7B,KAAK;QACL,gBAAgB;QAChB,iBAAiB,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;YACxC,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,CAAkC,CAAA;YACpF,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC1C,CAAC;QACD,8FAA8F;QAC9F,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACvC,MAAM,KAAK,GAAG,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAgD,CAAA;YAC3F,MAAM,WAAW,GAAG,KAAK,EAAE,WAAW,CAAA;YACtC,OAAO,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACpF,CAAC;QACD,+FAA+F;QAC/F,8FAA8F;QAC9F,2CAA2C;QAC3C,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAEhC,CAAA;YACb,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAA;YAC3B,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC;gBACnC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;aACtD,CAAC,CAAkC,CAAA;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqC,CAAA;YACxD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,GAAG,CAAC,GAAG,CACL,KAAK,CAAC,KAAK,CAAC,EAAE,EACd,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CACrF,CAAA;YACH,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,2FAA2F;QAC3F,wBAAwB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YAC7C,MAAM,QAAQ,GAAG,CAAC,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAEvC,CAAA;YACb,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqC,CAAA;YACxD,KAAK,MAAM,OAAO,IAAI,QAAQ,IAAI,EAAE;gBAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;YAC5E,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,yFAAyF;QACzF,0FAA0F;QAC1F,8FAA8F;QAC9F,2BAA2B,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC9C,MAAM,MAAM,GAAG,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAA8C,CAAA;YAC5F,OAAO,MAAM,EAAE,SAAS,CAAA;QAC1B,CAAC;QACD,6FAA6F;QAC7F,8FAA8F;QAC9F,0FAA0F;QAC1F,uFAAuF;QACvF,uEAAuE;QACvE,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAqC,EAAE;YACvF,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;YACtC,yFAAyF;YACzF,yEAAyE;YACzE,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;YAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAGvB,CAAA;YACb,OAAO,MAAM;gBACX,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE;gBACtF,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;QAC1B,CAAC;QACD,2FAA2F;QAC3F,4FAA4F;QAC5F,wFAAwF;QACxF,2FAA2F;QAC3F,+CAA+C;QAC/C,wBAAwB,EAAE,KAAK,EAAE,cAAc,EAA8B,EAAE;YAC7E,IAAI,CAAC,eAAe;gBAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;YACrD,MAAM,GAAG,GAAG,CAAC,MAAM,eAAe,CAAC,cAAc,CAAC,CAGrC,CAAA;YACb,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;YACrC,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAA;YAC3F,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAA;YACnC,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;aACxF,CAAA;QACH,CAAC;QACD,2FAA2F;QAC3F,4FAA4F;QAC5F,8FAA8F;QAC9F,8EAA8E;QAC9E,yBAAyB,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;YACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAA;YACnD,IAAI,OAAO,sBAAsB,EAAE,qBAAqB,KAAK,UAAU,EAAE,CAAC;gBACxE,KAAK,MAAM,EAAE,IAAI,eAAe;oBAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;gBAC1E,OAAO,MAAM,CAAA;YACf,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,qBAAqB,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAIhE,CAAA;YACF,MAAM,aAAa,GAAG,IAAI;iBACvB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC;iBACzF,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAqB,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAGhE,CAAA;YACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBACtC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;oBAC7E,SAAQ;gBACV,CAAC;gBACD,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAA;gBACnC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE;oBAC7B,MAAM,EAAE,OAAO;oBACf,SAAS,EACP,OAAO,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC;wBACrE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;wBACvB,CAAC,CAAC,IAAI;iBACX,CAAC,CAAA;YACJ,CAAC;YACD,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC3D,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QACD,yFAAyF;QACzF,+EAA+E;QAC/E,sBAAsB,EAAE,KAAK,EAAE,YAAY,EAA8B,EAAE;YACzE,IAAI,OAAO,eAAe,EAAE,QAAQ,KAAK,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;YACpF,MAAM,KAAK,GAAG,CAAC,MAAM,aAAa,CAAC,YAAY,CAAC,CAAoC,CAAA;YACpF,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;YACvC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;YACrC,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;aACxF,CAAA;QACH,CAAC;QACD,2FAA2F;QAC3F,yFAAyF;QACzF,sDAAsD;QACtD,uBAAuB,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YAC3C,MAAM,WAAW,GAAG,CAAC,MAAM,QAAQ,CAAC,oBAAoB,EAAE,aAAa,EAAE,CAAC,SAAS,CAAC,CAEvE,CAAA;YACb,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACjD,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/modules/publicApi/PublicProvisioningController.d.ts

@@ -1,5 +1,6 @@
-import { type BootstrapJob, type GitHubAvailableRepo, type GitHubConnection, type KubernetesManifestSource, type PublicAvailableRepo, type PublicBootstrapJob, type PublicKubernetesManifestSource, type ServiceProvisioning, type UpdatePublicServiceInput } from '@cat-factory/contracts';
+import { type BootstrapJob, type EnvironmentHandlerView, type GitHubAvailableRepo, type GitHubConnection, type KubernetesManifestSource, type PublicAvailableRepo, type PublicBootstrapJob, type PublicEnvironmentHandler, type PublicKubernetesManifestSource, type ServiceProvisioning, type UpdatePublicServiceInput } from '@cat-factory/contracts';
 import type { RepoUseByRepoId } from '@cat-factory/orchestration';
+import { type RepoFileContent, type RunRepoContext } from '@cat-factory/kernel';
 import { Hono } from 'hono';
 import type { AppEnv, ServerContainer } from '../../http/env.js';
 /**
@@ -64,11 +65,66 @@ export declare function toPublicAvailableRepo(repo: GitHubAvailableRepo, use: Re
  * prevent, on the deployment least able to tell that is what happened.
  */
 export declare function asVcsRefusal(error: unknown): unknown;
+/**
+ * Read one file, turning the two answers only this layer can name into the refusals it documents.
+ *
+ * **A blob past the PROVIDER's own contents ceiling is the same refusal as one past ours.** GitHub
+ * reports it as a `403`, which {@link asVcsRefusal} would otherwise read as a rejected credential,
+ * so an operator whose lockfile is 1.4 MB would be told to re-mint a token that works. The adapter
+ * names the fact (`VcsBlobTooLargeError`) and this maps it onto `file_too_large` with the provider's
+ * limit and NO size, because nothing here measured one.
+ *
+ * **Bytes that are not UTF-8 are refused rather than answered.** The decode is lossy for a PNG, a
+ * tarball or a Latin-1 source file, and handing back replacement characters under a field documented
+ * as the file's content is the same lie the truncation above refuses to tell: a caller comparing
+ * against its own copy sees a mismatch it cannot attribute. The `sha` rides the refusal, so the
+ * byte-exact join a grader wanted is still available.
+ *
+ * Anything else is a fact about the provider and goes through {@link asVcsRefusal} unchanged.
+ */
+export declare function readGradableFile(repo: RunRepoContext['repo'], at: string, path: string, ref: string | undefined): Promise<RepoFileContent | null>;
 /**
  * Lower a public manifest source onto the internal one, for the same reason and with the same
  * exhaustiveness as the URL source above.
  */
 export declare function toKubernetesManifestSource(source: PublicKubernetesManifestSource): KubernetesManifestSource;
+/**
+ * Project a handler for the LIST, whatever engine services it.
+ *
+ * `engine` and `backendKind` are open strings here rather than the connect view's literal, because
+ * this read reports handlers the deployment SEEDED from its composition root, and a deployment may
+ * register an environment backend of its own: the whole point of the registry. Reporting one as
+ * `kubernetes` would be the coercion the board projection refuses next door, and omitting it would
+ * make a seeded handler indistinguishable from an absent one, which is the state this read exists to
+ * make checkable.
+ *
+ * `endpoint` and not `apiServerUrl`: the Kubernetes noun is false of every other engine, and stating
+ * it anyway is what sends an operator whose environment is a VM looking for an apiserver.
+ *
+ * BOTH manifest-id fields are reported, because the engine's own resolution
+ * (`resolveInfraHandler` → `matchesCustom`) matches a service's pinned `manifestId` against EITHER,
+ * and the two ways of registering a handler each set only one: a deployment SEEDING one keys it with
+ * `manifestId`, while a `remote-custom` connection declares `acceptsManifestId`. Publishing only the
+ * second made the commonest seed shape read as a handler serving nothing, so a setup script checking
+ * that its own seed landed found no entry naming it while a run against it resolved fine.
+ *
+ * No `config`, though `EnvironmentHandlerView` carries one for the app's connect-form prefill: it is
+ * the internal per-engine bag, deliberately open, and this surface may not freeze it (ADR 0034).
+ */
+export declare function toPublicHandler(view: EnvironmentHandlerView): PublicEnvironmentHandler;
+/**
+ * Order handlers by what IDENTIFIES one, comparing code units rather than collating.
+ *
+ * `localeCompare` is ICU- and locale-dependent, so the same set of handlers can serialise in one
+ * order from a workerd isolate and in another from a Node build with a different ICU: precisely the
+ * spurious diff the ordering was added to prevent. A code-unit comparison answers the same everywhere,
+ * which is what a wire ordering needs.
+ *
+ * Both manifest ids join the key, since two `custom` handlers keyed to different manifests are
+ * otherwise equal here. A handler that ties on all four keys keeps its position from the repository
+ * read (the sort is stable), which is the honest fallback: nothing published distinguishes them.
+ */
+export declare function byHandlerIdentity(left: PublicEnvironmentHandler, right: PublicEnvironmentHandler): number;
 /**
  * Lower a public service patch onto the board patch.
  *

package/dist/modules/publicApi/PublicProvisioningController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PublicProvisioningController.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicProvisioningController.ts"],"names":[],"mappings":"AAAA,OAAO,EAaL,KAAK,YAAY,EAEjB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EAErB,KAAK,wBAAwB,EAI7B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EAGvB,KAAK,8BAA8B,EAQnC,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC9B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAKV,eAAe,EAEhB,MAAM,4BAA4B,CAAA;AAWnC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAgEhE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAQlC;AA6FD,wBAAgB,4BAA4B,IAAI,IAAI,CAAC,MAAM,CAAC,CAQ3D;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,GAAG,kBAAkB,CAgB1E;AAiDD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,mBAAmB,EACzB,GAAG,EAAE,eAAe,GACnB,mBAAmB,CAsBrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAoBpD;AAyID;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,8BAA8B,GACrC,wBAAwB,CAW1B;AAmFD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,wBAAwB,EAC/B,MAAM,EAAE,mBAAmB,GAAG,SAAS,GACtC;IACD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,mBAAmB,CAAA;CACnC,CAQA"}
+{"version":3,"file":"PublicProvisioningController.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicProvisioningController.ts"],"names":[],"mappings":"AAAA,OAAO,EAgBL,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EAErB,KAAK,wBAAwB,EAI7B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EAGvB,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,EAQnC,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC9B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAKV,eAAe,EAEhB,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EASL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAgEhE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAQlC;AA6FD,wBAAgB,4BAA4B,IAAI,IAAI,CAAC,MAAM,CAAC,CAQ3D;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,GAAG,kBAAkB,CAgB1E;AAiDD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,mBAAmB,EACzB,GAAG,EAAE,eAAe,GACnB,mBAAmB,CAsBrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAoBpD;AAoJD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,EAC5B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAsBjC;AA6DD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,8BAA8B,GACrC,wBAAwB,CAW1B;AA8BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,wBAAwB,CAYtF;AA8CD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,wBAAwB,EAC9B,KAAK,EAAE,wBAAwB,GAC9B,MAAM,CAOR;AAiCD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,wBAAwB,EAC/B,MAAM,EAAE,mBAAmB,GAAG,SAAS,GACtC;IACD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,mBAAmB,CAAA;CACnC,CAQA"}