@cat-factory/server 0.6.0

package/dist/crypto/WebCryptoSecretCipher.d.ts

@@ -0,0 +1,23 @@
+import type { SecretCipher } from '@cat-factory/kernel';
+export interface WebCryptoSecretCipherOptions {
+    /** Service-level master key, base64 (≥32 bytes decoded). */
+    masterKeyBase64: string;
+    /**
+     * HKDF `info` string, separating the keys derived for distinct uses of the
+     * same (or a shared) master key — e.g. environment secrets vs document-source
+     * credentials. Defaults to the environments tag for backward compatibility.
+     * Ciphertext is only decryptable by a cipher built with the same `info`.
+     */
+    info?: string;
+}
+export declare class WebCryptoSecretCipher implements SecretCipher {
+    private readonly masterKey;
+    private readonly info;
+    private baseKeyPromise?;
+    constructor({ masterKeyBase64, info }: WebCryptoSecretCipherOptions);
+    encrypt(plaintext: string): Promise<string>;
+    decrypt(envelope: string): Promise<string>;
+    private baseKey;
+    private deriveKey;
+}
+//# sourceMappingURL=WebCryptoSecretCipher.d.ts.map

package/dist/crypto/WebCryptoSecretCipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebCryptoSecretCipher.d.ts","sourceRoot":"","sources":["../../src/crypto/WebCryptoSecretCipher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAmBvD,MAAM,WAAW,4BAA4B;IAC3C,4DAA4D;IAC5D,eAAe,EAAE,MAAM,CAAA;IACvB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,qBAAa,qBAAsB,YAAW,YAAY;IAGxD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,OAAO,CAAC,cAAc,CAAC,CAAoB;IAE3C,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,4BAA4B,EAMlE;IAEK,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUhD;IAEK,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW/C;IAED,OAAO,CAAC,OAAO;YASD,SAAS;CASxB"}

package/dist/crypto/WebCryptoSecretCipher.js

@@ -0,0 +1,60 @@
+import { base64url, base64urlToBytes } from './encoding.js';
+// Authenticated encryption of credentials at rest, on Web Crypto (AES-256-GCM)
+// — no Node `crypto`, runs in a plain Workers isolate AND under Node (crypto.subtle
+// is a global there too). A service-level master key (e.g. the runners /
+// environments encryption-key secret) is imported once for HKDF; every record
+// derives a fresh AES key from a random per-record salt and is sealed under a
+// random per-record IV. The self-describing envelope carries a version tag so the
+// scheme/key can be rotated later without ambiguity.
+//
+//   envelope = "v1." + base64url(salt) + "." + base64url(iv) + "." + base64url(ciphertext|tag)
+const VERSION = 'v1';
+const SALT_BYTES = 16;
+const IV_BYTES = 12;
+/** Default HKDF domain-separation tag (used by the environments integration). */
+const DEFAULT_INFO = 'cat-factory:environments';
+export class WebCryptoSecretCipher {
+    // ArrayBuffer-backed (not the wider ArrayBufferLike) so the bytes satisfy the
+    // Web Crypto `BufferSource` parameters under the strict DOM lib.
+    masterKey;
+    info;
+    baseKeyPromise;
+    constructor({ masterKeyBase64, info }) {
+        this.masterKey = base64urlToBytes(masterKeyBase64.trim());
+        if (this.masterKey.length < 32) {
+            throw new Error('encryption key must decode to at least 32 bytes');
+        }
+        this.info = new TextEncoder().encode(info ?? DEFAULT_INFO);
+    }
+    async encrypt(plaintext) {
+        const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+        const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+        const key = await this.deriveKey(salt);
+        const sealed = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, new TextEncoder().encode(plaintext));
+        return [VERSION, base64url(salt), base64url(iv), base64url(new Uint8Array(sealed))].join('.');
+    }
+    async decrypt(envelope) {
+        const parts = envelope.split('.');
+        if (parts.length !== 4 || parts[0] !== VERSION) {
+            throw new Error('Invalid secret envelope');
+        }
+        const salt = base64urlToBytes(parts[1]);
+        const iv = base64urlToBytes(parts[2]);
+        const ciphertext = base64urlToBytes(parts[3]);
+        const key = await this.deriveKey(salt);
+        const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext);
+        return new TextDecoder().decode(plain);
+    }
+    baseKey() {
+        if (!this.baseKeyPromise) {
+            this.baseKeyPromise = crypto.subtle.importKey('raw', this.masterKey, 'HKDF', false, [
+                'deriveKey',
+            ]);
+        }
+        return this.baseKeyPromise;
+    }
+    async deriveKey(salt) {
+        return crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt, info: this.info }, await this.baseKey(), { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+    }
+}
+//# sourceMappingURL=WebCryptoSecretCipher.js.map

package/dist/crypto/WebCryptoSecretCipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebCryptoSecretCipher.js","sourceRoot":"","sources":["../../src/crypto/WebCryptoSecretCipher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAE3D,+EAA+E;AAC/E,oFAAoF;AACpF,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,kFAAkF;AAClF,qDAAqD;AACrD,EAAE;AACF,+FAA+F;AAE/F,MAAM,OAAO,GAAG,IAAI,CAAA;AACpB,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAA;AACnB,iFAAiF;AACjF,MAAM,YAAY,GAAG,0BAA0B,CAAA;AAc/C,MAAM,OAAO,qBAAqB;IAChC,8EAA8E;IAC9E,iEAAiE;IAChD,SAAS,CAAyB;IAClC,IAAI,CAAyB;IACtC,cAAc,CAAqB;IAE3C,YAAY,EAAE,eAAe,EAAE,IAAI,EAAgC;QACjE,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC,eAAe,CAAC,IAAI,EAAE,CAA4B,CAAA;QACpF,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,YAAY,CAA4B,CAAA;IACvF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;QAC/D,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACxC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpC,CAAA;QACD,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/F,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;QAC5C,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;QACnE,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;QACjE,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;QACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;QACnF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE;gBAClF,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAA6B;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EACxD,MAAM,IAAI,CAAC,OAAO,EAAE,EACpB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;IACH,CAAC;CACF"}

package/dist/crypto/encoding.d.ts

@@ -0,0 +1,14 @@
+/** Base64url-encode bytes or a UTF-8 string (no padding), per JWT/JWS. */
+export declare function base64url(input: ArrayBuffer | Uint8Array | string): string;
+/** Decode a base64url string to bytes. */
+export declare function base64urlToBytes(value: string): Uint8Array;
+/**
+ * Decode a PEM private key body to DER bytes. Requires PKCS#8
+ * (`-----BEGIN PRIVATE KEY-----`); GitHub issues PKCS#1
+ * (`-----BEGIN RSA PRIVATE KEY-----`), which must be converted once via
+ * `openssl pkcs8 -topk8 -nocrypt` (see backend/docs/github-operations.md).
+ */
+export declare function pkcs8PemToDer(pem: string): ArrayBuffer;
+/** Constant-time-ish equality for two byte arrays (length + XOR accumulation). */
+export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;
+//# sourceMappingURL=encoding.d.ts.map

package/dist/crypto/encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../../src/crypto/encoding.ts"],"names":[],"mappings":"AAIA,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,CAS1E;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAO1D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAetD;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAKrE"}

package/dist/crypto/encoding.js

@@ -0,0 +1,58 @@
+// Small encoding helpers built on what both the Workers runtime and Node provide
+// natively (atob/btoa, TextEncoder, Web Crypto). No Node `Buffer` or `crypto`
+// module is used, so this works in plain V8 isolates and in Node alike.
+/** Base64url-encode bytes or a UTF-8 string (no padding), per JWT/JWS. */
+export function base64url(input) {
+    let bytes;
+    if (typeof input === 'string')
+        bytes = new TextEncoder().encode(input);
+    else if (input instanceof Uint8Array)
+        bytes = input;
+    else
+        bytes = new Uint8Array(input);
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** Decode a base64url string to bytes. */
+export function base64urlToBytes(value) {
+    const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes;
+}
+/**
+ * Decode a PEM private key body to DER bytes. Requires PKCS#8
+ * (`-----BEGIN PRIVATE KEY-----`); GitHub issues PKCS#1
+ * (`-----BEGIN RSA PRIVATE KEY-----`), which must be converted once via
+ * `openssl pkcs8 -topk8 -nocrypt` (see backend/docs/github-operations.md).
+ */
+export function pkcs8PemToDer(pem) {
+    if (/BEGIN RSA PRIVATE KEY/.test(pem)) {
+        throw new Error('GITHUB_APP_PRIVATE_KEY is PKCS#1 (BEGIN RSA PRIVATE KEY); convert it to PKCS#8 ' +
+            'with `openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pk8.pem`');
+    }
+    const body = pem
+        .replace(/-----BEGIN [^-]+-----/g, '')
+        .replace(/-----END [^-]+-----/g, '')
+        .replace(/\s+/g, '');
+    const binary = atob(body);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes.buffer;
+}
+/** Constant-time-ish equality for two byte arrays (length + XOR accumulation). */
+export function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+//# sourceMappingURL=encoding.js.map

package/dist/crypto/encoding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../../src/crypto/encoding.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,8EAA8E;AAC9E,wEAAwE;AAExE,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,KAAwC;IAChE,IAAI,KAAiB,CAAA;IACrB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;SACjE,IAAI,KAAK,YAAY,UAAU;QAAE,KAAK,GAAG,KAAK,CAAA;;QAC9C,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IAElC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACvE,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,iFAAiF;YAC/E,mEAAmE,CACtE,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG;SACb,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;SACrC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC;SACnC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACvE,OAAO,KAAK,CAAC,MAAM,CAAA;AACrB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,CAAa,EAAE,CAAa;IAC1D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;IACxD,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC"}

package/dist/events/FanOutEventPublisher.d.ts

@@ -0,0 +1,32 @@
+import type { Block, BootstrapJob, ConsensusSession, ClarityReview, ExecutionEventPublisher, ExecutionInstance, LlmCallActivity, Notification, RequirementReview, WorkspaceMountRepository } from '@cat-factory/kernel';
+export interface FanOutEventPublisherDependencies {
+    workspaceMountRepository: Pick<WorkspaceMountRepository, 'listWorkspaceIdsMountingBlock'>;
+}
+/**
+ * In-org real-time fan-out. A shared service can appear on several workspaces' boards, so
+ * a live change to it (run progress, bootstrap, notification) must reach EVERY board that
+ * mounts the service — not just the workspace the engine happens to address. This decorator
+ * resolves the changed block's service, expands it to the set of mounting workspaces, and
+ * re-publishes the event to each via the inner per-workspace publisher.
+ *
+ * Best-effort like the inner publisher: the persisted row is the source of truth, so a
+ * client reconciles any miss by re-fetching its snapshot. When a block can't be resolved to
+ * a service (e.g. a legacy workspace-local block, or a coarse `boardChanged` with no block)
+ * it falls back to delivering to the originating workspace only.
+ */
+export declare class FanOutEventPublisher implements ExecutionEventPublisher {
+    private readonly inner;
+    private readonly deps;
+    constructor(inner: ExecutionEventPublisher, deps: FanOutEventPublisherDependencies);
+    /** The set of workspaces a change to `blockId` should reach: the origin + every mount. */
+    private targets;
+    executionChanged(workspaceId: string, instance: ExecutionInstance, block?: Block | null): Promise<void>;
+    boardChanged(workspaceId: string, reason: string, blockId?: string | null): Promise<void>;
+    bootstrapChanged(workspaceId: string, job: BootstrapJob, block?: Block | null): Promise<void>;
+    notificationChanged(workspaceId: string, notification: Notification): Promise<void>;
+    llmCallObserved(workspaceId: string, activity: LlmCallActivity): Promise<void>;
+    requirementReviewChanged(workspaceId: string, review: RequirementReview): Promise<void>;
+    consensusSessionChanged(workspaceId: string, session: ConsensusSession): Promise<void>;
+    clarityReviewChanged(workspaceId: string, review: ClarityReview): Promise<void>;
+}
+//# sourceMappingURL=FanOutEventPublisher.d.ts.map

package/dist/events/FanOutEventPublisher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FanOutEventPublisher.d.ts","sourceRoot":"","sources":["../../src/events/FanOutEventPublisher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAE5B,MAAM,WAAW,gCAAgC;IAC/C,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,EAAE,+BAA+B,CAAC,CAAA;CAC1F;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,oBAAqB,YAAW,uBAAuB;IAEhE,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFvB,YACmB,KAAK,EAAE,uBAAuB,EAC9B,IAAI,EAAE,gCAAgC,EACrD;IAEJ,0FAA0F;YAC5E,OAAO;IAWf,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,GACnB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ9F;IAEK,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,YAAY,EACjB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,GACnB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxF;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAMnF;IAEK,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAI5F;IAEK,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3F;IAEK,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAIpF;CACF"}

package/dist/events/FanOutEventPublisher.js

@@ -0,0 +1,76 @@
+/**
+ * In-org real-time fan-out. A shared service can appear on several workspaces' boards, so
+ * a live change to it (run progress, bootstrap, notification) must reach EVERY board that
+ * mounts the service — not just the workspace the engine happens to address. This decorator
+ * resolves the changed block's service, expands it to the set of mounting workspaces, and
+ * re-publishes the event to each via the inner per-workspace publisher.
+ *
+ * Best-effort like the inner publisher: the persisted row is the source of truth, so a
+ * client reconciles any miss by re-fetching its snapshot. When a block can't be resolved to
+ * a service (e.g. a legacy workspace-local block, or a coarse `boardChanged` with no block)
+ * it falls back to delivering to the originating workspace only.
+ */
+export class FanOutEventPublisher {
+    inner;
+    deps;
+    constructor(inner, deps) {
+        this.inner = inner;
+        this.deps = deps;
+    }
+    /** The set of workspaces a change to `blockId` should reach: the origin + every mount. */
+    async targets(originWorkspaceId, blockId) {
+        if (!blockId)
+            return [originWorkspaceId];
+        // Single join (block → its service → the workspaces mounting it). Empty when the block has
+        // no service, so the result collapses to the origin only.
+        const mounting = await this.deps.workspaceMountRepository.listWorkspaceIdsMountingBlock(originWorkspaceId, blockId);
+        return [...new Set([originWorkspaceId, ...mounting])];
+    }
+    async executionChanged(workspaceId, instance, block) {
+        for (const ws of await this.targets(workspaceId, block?.id ?? instance.blockId)) {
+            await this.inner.executionChanged(ws, instance, block);
+        }
+    }
+    async boardChanged(workspaceId, reason, blockId) {
+        // A structural change to a shared service (a module materialised, a run cancelled, a
+        // bootstrap finished) must prompt a refresh on EVERY board that mounts it. When the caller
+        // names a block of the affected service we resolve it to that set; a genuinely block-less
+        // signal falls back to the originating workspace only.
+        for (const ws of await this.targets(workspaceId, blockId)) {
+            await this.inner.boardChanged(ws, reason, blockId);
+        }
+    }
+    async bootstrapChanged(workspaceId, job, block) {
+        for (const ws of await this.targets(workspaceId, block?.id ?? job.blockId)) {
+            await this.inner.bootstrapChanged?.(ws, job, block);
+        }
+    }
+    async notificationChanged(workspaceId, notification) {
+        for (const ws of await this.targets(workspaceId, notification.blockId)) {
+            await this.inner.notificationChanged?.(ws, notification);
+        }
+    }
+    async llmCallObserved(workspaceId, activity) {
+        // The compact activity carries no block id, so there is nothing to resolve a shared
+        // service from — deliver to the originating workspace only. Model activity for a
+        // mounted service surfacing solely on its origin board is an acceptable edge; the
+        // persisted metrics (and the panel's lazy load) remain the cross-workspace source.
+        await this.inner.llmCallObserved?.(workspaceId, activity);
+    }
+    async requirementReviewChanged(workspaceId, review) {
+        for (const ws of await this.targets(workspaceId, review.blockId)) {
+            await this.inner.requirementReviewChanged?.(ws, review);
+        }
+    }
+    async consensusSessionChanged(workspaceId, session) {
+        for (const ws of await this.targets(workspaceId, session.blockId)) {
+            await this.inner.consensusSessionChanged?.(ws, session);
+        }
+    }
+    async clarityReviewChanged(workspaceId, review) {
+        for (const ws of await this.targets(workspaceId, review.blockId)) {
+            await this.inner.clarityReviewChanged?.(ws, review);
+        }
+    }
+}
+//# sourceMappingURL=FanOutEventPublisher.js.map

package/dist/events/FanOutEventPublisher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FanOutEventPublisher.js","sourceRoot":"","sources":["../../src/events/FanOutEventPublisher.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,oBAAoB;IAEZ,KAAK;IACL,IAAI;IAFvB,YACmB,KAA8B,EAC9B,IAAsC;qBADtC,KAAK;oBACL,IAAI;IACpB,CAAC;IAEJ,0FAA0F;IAClF,KAAK,CAAC,OAAO,CAAC,iBAAyB,EAAE,OAAuB;QACtE,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,iBAAiB,CAAC,CAAA;QACxC,2FAA2F;QAC3F,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,6BAA6B,CACrF,iBAAiB,EACjB,OAAO,CACR,CAAA;QACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IACvD,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,WAAmB,EACnB,QAA2B,EAC3B,KAAoB;QAEpB,KAAK,MAAM,EAAE,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QACxD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,MAAc,EAAE,OAAuB;QAC7E,qFAAqF;QACrF,2FAA2F;QAC3F,0FAA0F;QAC1F,uDAAuD;QACvD,KAAK,MAAM,EAAE,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,WAAmB,EACnB,GAAiB,EACjB,KAAoB;QAEpB,KAAK,MAAM,EAAE,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,WAAmB,EAAE,YAA0B;QACvE,KAAK,MAAM,EAAE,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,YAAY,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,QAAyB;QAClE,oFAAoF;QACpF,iFAAiF;QACjF,kFAAkF;QAClF,mFAAmF;QACnF,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,WAAmB,EAAE,MAAyB;QAC3E,KAAK,MAAM,EAAE,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,WAAmB,EAAE,OAAyB;QAC1E,KAAK,MAAM,EAAE,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,WAAmB,EAAE,MAAqB;QACnE,KAAK,MAAM,EAAE,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;CACF"}

package/dist/events/InAppNotificationChannel.d.ts

@@ -0,0 +1,20 @@
+import type { ExecutionEventPublisher, Notification, NotificationChannel } from '@cat-factory/kernel';
+/**
+ * The in-app notification channel: pushes the `notification` WorkspaceEvent to the
+ * board (via the same event publisher that carries execution/board events) so the
+ * inbox + per-block badge update live. The canonical row is already persisted by
+ * the NotificationService, so this is purely the live push — best-effort, errors
+ * swallowed by the publisher.
+ *
+ * Runtime-neutral: it wraps whatever {@link ExecutionEventPublisher} a facade wires
+ * (the Worker's Durable-Object publisher, the Node service's WebSocket-hub publisher),
+ * so both facades deliver in-app notifications through the same channel. Composed
+ * alongside Slack/email channels via CompositeNotificationChannel, with no change to
+ * the code that raises notifications.
+ */
+export declare class InAppNotificationChannel implements NotificationChannel {
+    private readonly publisher;
+    constructor(publisher: ExecutionEventPublisher);
+    deliver(workspaceId: string, notification: Notification): Promise<void>;
+}
+//# sourceMappingURL=InAppNotificationChannel.d.ts.map

package/dist/events/InAppNotificationChannel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InAppNotificationChannel.d.ts","sourceRoot":"","sources":["../../src/events/InAppNotificationChannel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,YAAY,EACZ,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;;GAYG;AACH,qBAAa,wBAAyB,YAAW,mBAAmB;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAtC,YAA6B,SAAS,EAAE,uBAAuB,EAAI;IAE7D,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;CACF"}

package/dist/events/InAppNotificationChannel.js

@@ -0,0 +1,23 @@
+/**
+ * The in-app notification channel: pushes the `notification` WorkspaceEvent to the
+ * board (via the same event publisher that carries execution/board events) so the
+ * inbox + per-block badge update live. The canonical row is already persisted by
+ * the NotificationService, so this is purely the live push — best-effort, errors
+ * swallowed by the publisher.
+ *
+ * Runtime-neutral: it wraps whatever {@link ExecutionEventPublisher} a facade wires
+ * (the Worker's Durable-Object publisher, the Node service's WebSocket-hub publisher),
+ * so both facades deliver in-app notifications through the same channel. Composed
+ * alongside Slack/email channels via CompositeNotificationChannel, with no change to
+ * the code that raises notifications.
+ */
+export class InAppNotificationChannel {
+    publisher;
+    constructor(publisher) {
+        this.publisher = publisher;
+    }
+    async deliver(workspaceId, notification) {
+        await this.publisher.notificationChanged?.(workspaceId, notification);
+    }
+}
+//# sourceMappingURL=InAppNotificationChannel.js.map

package/dist/events/InAppNotificationChannel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InAppNotificationChannel.js","sourceRoot":"","sources":["../../src/events/InAppNotificationChannel.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,wBAAwB;IACN,SAAS;IAAtC,YAA6B,SAAkC;yBAAlC,SAAS;IAA4B,CAAC;IAEnE,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,YAA0B;QAC3D,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IACvE,CAAC;CACF"}

package/dist/github/FetchGitHubClient.d.ts

@@ -0,0 +1,72 @@
+import { type Clock, type CommitFilesResult, type GitHubBranch, type GitHubCheckRun, type GitHubClient, type GitHubCodeSearchHit, type GitHubCommit, type GitHubIssue, type GitHubIssueDetail, type GitHubIssueSearchHit, type GitHubPullRequest, type GitHubRepo, type GitHubRepoRef, type IdGenerator, type InstallationMeta, type InstallationSummary, type ListOptions, type MergePullRequestInput, type OpenPullRequestInput, type Paged, type RateLimitRepository, type RepoContentEntry, type RepoEntry, type RepoFileContent } from '@cat-factory/kernel';
+import type { CommitFilesInput } from '@cat-factory/contracts';
+import type { AppTokenSource } from './GitHubAppRegistry.js';
+export interface FetchGitHubClientDependencies {
+    /**
+     * Mints the per-call token. The App registry (resolving which App's credentials to
+     * use per installation, ADR 0005) satisfies this; a static-PAT source does too (it
+     * returns the PAT for installation calls and has no app-JWT paths).
+     */
+    registry: AppTokenSource;
+    rateLimitRepository: RateLimitRepository;
+    idGenerator: IdGenerator;
+    clock: Clock;
+    apiBase: string;
+}
+export declare class FetchGitHubClient implements GitHubClient {
+    private readonly deps;
+    constructor(deps: FetchGitHubClientDependencies);
+    getInstallation(installationId: number): Promise<InstallationMeta>;
+    listInstallations(): Promise<InstallationSummary[]>;
+    listInstallationRepos(installationId: number): Promise<Paged<GitHubRepo>>;
+    getRepo(installationId: number, ref: GitHubRepoRef): Promise<GitHubRepo>;
+    listBranches(installationId: number, ref: GitHubRepoRef, etag?: string): Promise<Paged<GitHubBranch>>;
+    listRootEntries(installationId: number, ref: GitHubRepoRef): Promise<RepoEntry[]>;
+    listDirectory(installationId: number, ref: GitHubRepoRef, path: string, gitRef?: string): Promise<RepoContentEntry[]>;
+    getFileContent(installationId: number, ref: GitHubRepoRef, path: string, gitRef?: string): Promise<RepoFileContent | null>;
+    listPullRequests(installationId: number, ref: GitHubRepoRef, opts?: ListOptions): Promise<Paged<GitHubPullRequest>>;
+    listIssues(installationId: number, ref: GitHubRepoRef, opts?: ListOptions): Promise<Paged<GitHubIssue>>;
+    getIssue(installationId: number, ref: GitHubRepoRef, issueNumber: number): Promise<GitHubIssueDetail>;
+    searchIssues(installationId: number, query: string, limit?: number): Promise<GitHubIssueSearchHit[]>;
+    searchCode(installationId: number, query: string, limit?: number): Promise<GitHubCodeSearchHit[]>;
+    listCommits(installationId: number, ref: GitHubRepoRef, opts?: ListOptions & {
+        sha?: string;
+    }): Promise<Paged<GitHubCommit>>;
+    listCheckRuns(installationId: number, ref: GitHubRepoRef, sha: string): Promise<Paged<GitHubCheckRun>>;
+    createBranch(installationId: number, ref: GitHubRepoRef, name: string, fromSha: string): Promise<void>;
+    commitFiles(installationId: number, ref: GitHubRepoRef, input: CommitFilesInput): Promise<CommitFilesResult>;
+    openPullRequest(installationId: number, ref: GitHubRepoRef, input: OpenPullRequestInput): Promise<GitHubPullRequest>;
+    createIssue(installationId: number, ref: GitHubRepoRef, input: {
+        title: string;
+        body: string;
+    }): Promise<{
+        number: number;
+        url: string;
+    }>;
+    updatePullRequest(installationId: number, ref: GitHubRepoRef, number: number, patch: {
+        title?: string;
+        body?: string;
+        state?: 'open' | 'closed';
+        base?: string;
+    }): Promise<GitHubPullRequest>;
+    getPullRequestMergeability(installationId: number, ref: GitHubRepoRef, number: number): Promise<{
+        mergeable: boolean | null;
+        mergeableState: string;
+        headSha: string | null;
+    }>;
+    mergePullRequest(installationId: number, ref: GitHubRepoRef, number: number, input?: MergePullRequestInput): Promise<void>;
+    deleteBranch(installationId: number, ref: GitHubRepoRef, branch: string): Promise<void>;
+    comment(installationId: number, ref: GitHubRepoRef, issueOrPrNumber: number, body: string): Promise<void>;
+    /** Lazily resolve a repo's numeric id (needed where the payload omits it). */
+    private repoId;
+    /** Follow `Link` pagination, mapping each page, until exhausted/capped/`stop`. */
+    private paginate;
+    private request;
+    private recordRateLimit;
+}
+/** Carries the HTTP status so callers/queue can decide whether to retry. */
+export declare class GitHubApiError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+//# sourceMappingURL=FetchGitHubClient.d.ts.map

package/dist/github/FetchGitHubClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FetchGitHubClient.d.ts","sourceRoot":"","sources":["../../src/github/FetchGitHubClient.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,KAAK,EACV,KAAK,mBAAmB,EAExB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAgB5D,MAAM,WAAW,6BAA6B;IAC5C;;;;OAIG;IACH,QAAQ,EAAE,cAAc,CAAA;IACxB,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AA+DD,qBAAa,iBAAkB,YAAW,YAAY;IACxC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,6BAA6B,EAAI;IAI9D,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuBvE;IAEK,iBAAiB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CA0BxD;IAEK,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAW9E;IAIK,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAG7E;IAEK,YAAY,CAChB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAgB9B;IAEK,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAgBtF;IAEK,aAAa,CACjB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAuB7B;IAEK,cAAc,CAClB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAgBjC;IAEK,gBAAgB,CACpB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAgBnC;IAEK,UAAU,CACd,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAa7B;IAEK,QAAQ,CACZ,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CA2B5B;IAEK,YAAY,CAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,EACb,KAAK,SAAK,GACT,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAqBjC;IAEK,UAAU,CACd,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,EACb,KAAK,SAAK,GACT,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAqBhC;IAEK,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,IAAI,GAAE,WAAW,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GACxC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAY9B;IAEK,aAAa,CACjB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAShC;IAIK,YAAY,CAChB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf;IAEK,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAkD5B;IAEK,eAAe,CACnB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAQ5B;IAEK,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACrC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAQ1C;IAEK,iBAAiB,CACrB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACjF,OAAO,CAAC,iBAAiB,CAAC,CAQ5B;IAEK,0BAA0B,CAC9B,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAcxF;IAEK,gBAAgB,CACpB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,qBAAqB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAMf;IAEK,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAY5F;IAEK,OAAO,CACX,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAMf;IAID,8EAA8E;YAChE,MAAM;IAKpB,kFAAkF;YACpE,QAAQ;YAmBR,OAAO;YA4CP,eAAe;CAgB9B;AAED,4EAA4E;AAC5E,qBAAa,cAAe,SAAQ,KAAK;IAErC,QAAQ,CAAC,MAAM,EAAE,MAAM;IADzB,YACW,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EAIhB;CACF"}