@cat-factory/worker 0.128.1 → 0.129.0

package/dist/infrastructure/container-model-resolver.js

@@ -0,0 +1,110 @@
+// The Worker's INLINE model-provider resolution: the memoised `ModelProviderResolver` every
+// inline consumer shares (agent executor, requirements reviewer, doc planner, fragment
+// selector, the sandbox) plus the per-step workspace-default resolver they all consult.
+//
+// Split out of `container.ts` along the same seam the Node facade already draws with
+// `container-model-deps.ts`: model resolution is what everything else in the composition root
+// is *given*, not part of assembling it, and keeping it here is what lets the executor wiring
+// (`container-executor-deps.ts`) import it without either module reaching back into the root.
+import { composeTraceSinks } from '@cat-factory/kernel';
+import { vendorConcurrencyLimiterFromEnv } from '@cat-factory/agents';
+import { cloudflareBindingRegistry } from '@cat-factory/provider-cloudflare';
+import { buildLangfuseSink, buildOtelSink } from './container-trace-sinks.js';
+import { resolvePresetModelForKind } from '@cat-factory/orchestration';
+import { logger, createInlineInstrumentation, createScopedModelProviderResolver, wrapResolverWithTelemetry, } from '@cat-factory/server';
+import { loadLangfuseConfig } from './config/langfuse';
+import { loadObservabilityConfig } from './config/observability';
+import { loadOtelConfig } from './config/otel';
+import { requireTelemetryDb } from './env';
+import { baseUrlFor } from './ai/providerEndpoints';
+import { resolveExtraRegistries } from './ai/registries';
+import { D1LlmCallMetricRepository } from './repositories/D1LlmCallMetricRepository';
+import { D1WorkspaceSettingsRepository } from './repositories/D1WorkspaceSettingsRepository';
+import { D1ModelPresetRepository } from './repositories/D1ModelPresetRepository';
+import { buildApiKeyService, buildLocalModelEndpointService } from './wireCredentialServices';
+import { CryptoIdGenerator, SystemClock } from './runtime';
+/**
+ * The Worker's {@link ModelProvider}: the base registry plus any extra provider
+ * registries an installation registered (see ./ai/registries). Used everywhere a
+ * model provider is needed so every path — agent executor, requirements reviewer,
+ * doc planner, fragment selector — sees the same provider set. When Langfuse is
+ * configured the provider is wrapped so those INLINE (non-proxied) calls surface on
+ * the same trace sink the LLM proxy fans container calls out to.
+ */
+// Memoised per `(Env, db)`: every inline consumer (agent executor, requirements
+// reviewer, doc planner, fragment selector) shares ONE resolver — and so ONE Langfuse
+// sink — for a container build. The resolver builds a per-scope provider from the
+// DB-backed API-key pool plus the opt-in Cloudflare binding + Bedrock registries.
+const modelResolverCache = new WeakMap();
+export function buildModelProviderResolver(env, db) {
+    const cached = modelResolverCache.get(env);
+    if (cached)
+        return cached;
+    // Opt-in provider registries that need no per-scope DB key: the Cloudflare Workers
+    // AI binding (when bound) and any extra registries (e.g. Bedrock). NOT assumed —
+    // `workers-ai` resolves only when the `AI` binding is present.
+    const extraRegistries = [
+        ...(env.AI ? [cloudflareBindingRegistry({ binding: env.AI })] : []),
+        ...resolveExtraRegistries(env),
+    ];
+    // Instrument inline (non-proxied) calls with the SAME composed trace sink the proxied
+    // path uses — Langfuse and/or the OTLP exporter, whichever are enabled.
+    const traceSink = composeTraceSinks([
+        buildLangfuseSink(loadLangfuseConfig(env)),
+        buildOtelSink(loadOtelConfig(env)),
+    ]);
+    // Persist inline calls to the SAME `llm_call_metrics` store the proxy writes for Pi and
+    // the executor writes for a subscription harness, so an inline agent kind (`doc-researcher`,
+    // the judges, consensus, the requirements writer) is visible to `ObservabilityPanel`, the
+    // per-step rollups and `/api/v1/debug/*` rather than only to an external trace backend.
+    // Composed through the shared factory so the recorder's service and the provider's fallback
+    // sink cannot be handed two DIFFERENT instances — the service owns the fan-out for a call it
+    // records, so a mismatch would split the trace (and wiring both to the provider would double
+    // every inline generation on Langfuse/OTel). No cache handle is passed because
+    // `workspaceSettings` is a pass-through in the isolate-safe profile.
+    const instrument = createInlineInstrumentation({
+        llmCallMetricRepository: new D1LlmCallMetricRepository({ db: requireTelemetryDb(env) }),
+        ...(traceSink ? { traceSink } : {}),
+        recordPrompts: loadObservabilityConfig(env).recordPrompts,
+        workspaceSettingsRepository: new D1WorkspaceSettingsRepository({ db }),
+        idGenerator: new CryptoIdGenerator(),
+        clock: new SystemClock(),
+        logger,
+    });
+    const localModelEndpoints = buildLocalModelEndpointService(env, db, { now: () => Date.now() });
+    const scoped = createScopedModelProviderResolver({
+        apiKeys: buildApiKeyService(env, db, { now: () => Date.now() }),
+        baseUrlFor: (provider) => baseUrlFor(provider, env) ?? undefined,
+        extraRegistries,
+        localEndpointsFor: localModelEndpoints
+            ? (userId) => localModelEndpoints.listResolved(userId)
+            : undefined,
+    });
+    // Observe inline calls, then cap concurrency, through the ONE composer that owns their order
+    // (instrumentation inside, limiter outermost). The Worker has no facade wrap that substitutes a
+    // resolved model today, so it could not hit the local-mode blind spot this order exists for —
+    // but going through the shared composer is what keeps that true for a Worker-side wrap added
+    // later, and it keeps the two facades textually symmetric. The limiter bounds concurrency within
+    // one isolate only (no cross-isolate/global limiting — see
+    // backend/docs/concurrency-and-redis.md), and since the Worker's inline path degrades
+    // subscription refs before resolve, it is a wired pass-through here in practice.
+    const resolver = wrapResolverWithTelemetry(scoped, {
+        ...(instrument ? { instrument } : {}),
+        limiter: vendorConcurrencyLimiterFromEnv((key) => env[key]),
+    });
+    modelResolverCache.set(env, resolver);
+    return resolver;
+}
+/**
+ * The resolver every executor consults for a step's default model (block-pinned >
+ * the task's selected/default model preset > env routing). Backed by the D1
+ * model-preset repo; shared by the inline LLM executor and the container executor so
+ * both honour the workspace presets identically. The built-in default preset points
+ * every agent kind at Kimi K2.7, so an unpinned step resolves to it even before the
+ * preset library is materialised.
+ */
+export function buildResolveWorkspaceModelDefault(db) {
+    const repo = new D1ModelPresetRepository({ db });
+    return (workspaceId, agentKind, modelPresetId) => resolvePresetModelForKind(repo, workspaceId, agentKind, modelPresetId);
+}
+//# sourceMappingURL=container-model-resolver.js.map

package/dist/infrastructure/container-model-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-model-resolver.js","sourceRoot":"","sources":["../../src/infrastructure/container-model-resolver.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,uFAAuF;AACvF,wFAAwF;AACxF,EAAE;AACF,qFAAqF;AACrF,8FAA8F;AAC9F,8FAA8F;AAC9F,8FAA8F;AAE9F,OAAO,EAA8B,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAA;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAA;AAC5E,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EACL,MAAM,EACN,2BAA2B,EAC3B,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAA;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAA;AAC5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAA;AAC7F,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAG1D;;;;;;;GAOG;AACH,gFAAgF;AAChF,sFAAsF;AACtF,kFAAkF;AAClF,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,IAAI,OAAO,EAA8B,CAAA;AAEpE,MAAM,UAAU,0BAA0B,CAAC,GAAQ,EAAE,EAAc;IACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,mFAAmF;IACnF,iFAAiF;IACjF,+DAA+D;IAC/D,MAAM,eAAe,GAAG;QACtB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,sBAAsB,CAAC,GAAG,CAAC;KAC/B,CAAA;IACD,sFAAsF;IACtF,wEAAwE;IACxE,MAAM,SAAS,GAAG,iBAAiB,CAAC;QAClC,iBAAiB,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC1C,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;KACnC,CAAC,CAAA;IACF,wFAAwF;IACxF,6FAA6F;IAC7F,0FAA0F;IAC1F,wFAAwF;IACxF,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,+EAA+E;IAC/E,qEAAqE;IACrE,MAAM,UAAU,GAAG,2BAA2B,CAAC;QAC7C,uBAAuB,EAAE,IAAI,yBAAyB,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,aAAa,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC,aAAa;QACzD,2BAA2B,EAAE,IAAI,6BAA6B,CAAC,EAAE,EAAE,EAAE,CAAC;QACtE,WAAW,EAAE,IAAI,iBAAiB,EAAE;QACpC,KAAK,EAAE,IAAI,WAAW,EAAE;QACxB,MAAM;KACP,CAAC,CAAA;IACF,MAAM,mBAAmB,GAAG,8BAA8B,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC9F,MAAM,MAAM,GAAG,iCAAiC,CAAC;QAC/C,OAAO,EAAE,kBAAkB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC/D,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,SAAS;QAChE,eAAe;QACf,iBAAiB,EAAE,mBAAmB;YACpC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,YAAY,CAAC,MAAM,CAAC;YACtD,CAAC,CAAC,SAAS;KACd,CAAC,CAAA;IACF,6FAA6F;IAC7F,gGAAgG;IAChG,8FAA8F;IAC9F,6FAA6F;IAC7F,iGAAiG;IACjG,2DAA2D;IAC3D,sFAAsF;IACtF,iFAAiF;IACjF,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,EAAE;QACjD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,+BAA+B,CACtC,CAAC,GAAG,EAAE,EAAE,CAAE,GAAqD,CAAC,GAAG,CAAC,CACrE;KACF,CAAC,CAAA;IACF,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACrC,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iCAAiC,CAC/C,EAAc;IAEd,MAAM,IAAI,GAAG,IAAI,uBAAuB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAChD,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CAC/C,yBAAyB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;AAC1E,CAAC"}

package/dist/infrastructure/container-vcs-identity.d.ts

@@ -0,0 +1,39 @@
+import { type Clock } from '@cat-factory/kernel';
+import { type AppConfig } from './config';
+import type { Env } from './env';
+import { type ResolveRepoTarget, type ResolveRepoTargets } from './ai/ContainerAgentExecutor';
+import { GitHubAppRegistry } from './github/GitHubAppRegistry';
+import type { D1Database } from '@cloudflare/workers-types';
+/**
+ * Build the multi-App registry (ADR 0005): the default App always, plus the
+ * privileged App when configured. It resolves which App's key to use per
+ * installation (from the binding's recorded appId), so every token mint / app-JWT
+ * call routes correctly. Callers guard on `config.github.enabled`, which requires
+ * GITHUB_APP_PRIVATE_KEY, so the default key is present.
+ */
+export declare function buildAppRegistry(env: Env, config: AppConfig, db: D1Database, clock: Clock): GitHubAppRegistry;
+/**
+ * Resolve the repo linked to a running block's enclosing service, via the shared
+ * runtime-neutral `buildResolveRepoTarget` (the ancestry walk + no-fallback policy
+ * live in `@cat-factory/server` so the Worker and Node service can't drift). This
+ * wrapper just binds the D1 repositories. Shared by the container executor, the CI
+ * status provider and the PR merger.
+ *
+ * No `repoProjectionCache` is threaded here (unlike the Node facade, which caches the
+ * whole-projection re-list per workspace — caching-layer slice 3): the repo projection
+ * is our own mutable D1 state, and the Worker's isolate-safe profile makes that cache
+ * pass-through (no cross-isolate invalidation bus), so an in-isolate TTL would serve
+ * stale repos after a write on another isolate. Reading live IS the isolate-safe
+ * behaviour. The shared GitHub sync/webhook services still receive the (pass-through)
+ * handle via `createGitHubModule`, so their invalidation code path stays symmetric.
+ */
+export declare function buildResolveRepoTarget(db: D1Database): ResolveRepoTarget;
+/**
+ * The MULTI-REPO resolver (service-connections phase 3): the task's own repo plus each
+ * connected involved-service repo, deduped. Wired from the SAME D1 repos as the singular
+ * resolver (the D1 service repo's batched `listByFrameBlocks` resolves the involved frames'
+ * repos in one query). Fed to the container executor so the implementer can fan a
+ * cross-service change out across sibling checkouts.
+ */
+export declare function buildResolveRepoTargets(db: D1Database): ResolveRepoTargets;
+//# sourceMappingURL=container-vcs-identity.d.ts.map

package/dist/infrastructure/container-vcs-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-vcs-identity.d.ts","sourceRoot":"","sources":["../../src/infrastructure/container-vcs-identity.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAKhD,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAA;AACzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAChC,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAM7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAE3D;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,KAAK,GACX,iBAAiB,CAyBnB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,UAAU,GAAG,iBAAiB,CAOxE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,UAAU,GAAG,kBAAkB,CAO1E"}

package/dist/infrastructure/container-vcs-identity.js

@@ -0,0 +1,88 @@
+// The Worker's VCS IDENTITY + REPO-TARGETING building blocks: the multi-App GitHub registry
+// (which App's key signs a given installation's token) and the two resolvers that map a running
+// block to the repo(s) its work belongs in.
+//
+// These three are the composition root's most widely SHARED pieces — the GitHub module, the
+// tracker wiring, the merge-lifecycle deps, the executor and the assembly step all need them —
+// so they live beside it rather than in it: every consumer imports them from here, and none of
+// them has to import the root (which imports several of those consumers back).
+import {} from '@cat-factory/kernel';
+import { buildResolveRepoTarget as buildSharedResolveRepoTarget, buildResolveRepoTargets as buildSharedResolveRepoTargets, } from '@cat-factory/server';
+import {} from './config';
+import {} from './ai/ContainerAgentExecutor';
+import { D1BlockRepository } from './repositories/D1BlockRepository';
+import { D1ServiceRepository } from './repositories/D1ServiceRepository';
+import { D1GitHubInstallationRepository } from './repositories/D1GitHubInstallationRepository';
+import { D1RepoProjectionRepository } from './repositories/D1RepoProjectionRepository';
+import { GitHubAppAuth } from './github/GitHubAppAuth';
+import { GitHubAppRegistry } from './github/GitHubAppRegistry';
+/**
+ * Build the multi-App registry (ADR 0005): the default App always, plus the
+ * privileged App when configured. It resolves which App's key to use per
+ * installation (from the binding's recorded appId), so every token mint / app-JWT
+ * call routes correctly. Callers guard on `config.github.enabled`, which requires
+ * GITHUB_APP_PRIVATE_KEY, so the default key is present.
+ */
+export function buildAppRegistry(env, config, db, clock) {
+    const installationRepository = new D1GitHubInstallationRepository({ db });
+    const makeAuth = (appId, privateKeyPem) => new GitHubAppAuth({
+        appId,
+        privateKeyPem,
+        installationRepository,
+        clock,
+        apiBase: config.github.apiBase,
+    });
+    const privileged = config.github.privilegedApp && env.GITHUB_PRIVILEGED_APP_PRIVATE_KEY
+        ? {
+            appId: config.github.privilegedApp.appId,
+            auth: makeAuth(config.github.privilegedApp.appId, env.GITHUB_PRIVILEGED_APP_PRIVATE_KEY),
+        }
+        : undefined;
+    return new GitHubAppRegistry({
+        default: {
+            appId: config.github.appId,
+            auth: makeAuth(config.github.appId, env.GITHUB_APP_PRIVATE_KEY),
+        },
+        privileged,
+        installationRepository,
+    });
+}
+/**
+ * Resolve the repo linked to a running block's enclosing service, via the shared
+ * runtime-neutral `buildResolveRepoTarget` (the ancestry walk + no-fallback policy
+ * live in `@cat-factory/server` so the Worker and Node service can't drift). This
+ * wrapper just binds the D1 repositories. Shared by the container executor, the CI
+ * status provider and the PR merger.
+ *
+ * No `repoProjectionCache` is threaded here (unlike the Node facade, which caches the
+ * whole-projection re-list per workspace — caching-layer slice 3): the repo projection
+ * is our own mutable D1 state, and the Worker's isolate-safe profile makes that cache
+ * pass-through (no cross-isolate invalidation bus), so an in-isolate TTL would serve
+ * stale repos after a write on another isolate. Reading live IS the isolate-safe
+ * behaviour. The shared GitHub sync/webhook services still receive the (pass-through)
+ * handle via `createGitHubModule`, so their invalidation code path stays symmetric.
+ */
+export function buildResolveRepoTarget(db) {
+    return buildSharedResolveRepoTarget({
+        installationRepository: new D1GitHubInstallationRepository({ db }),
+        repoProjectionRepository: new D1RepoProjectionRepository({ db }),
+        blockRepository: new D1BlockRepository({ db }),
+        serviceRepository: new D1ServiceRepository({ db }),
+    });
+}
+/**
+ * The MULTI-REPO resolver (service-connections phase 3): the task's own repo plus each
+ * connected involved-service repo, deduped. Wired from the SAME D1 repos as the singular
+ * resolver (the D1 service repo's batched `listByFrameBlocks` resolves the involved frames'
+ * repos in one query). Fed to the container executor so the implementer can fan a
+ * cross-service change out across sibling checkouts.
+ */
+export function buildResolveRepoTargets(db) {
+    return buildSharedResolveRepoTargets({
+        installationRepository: new D1GitHubInstallationRepository({ db }),
+        repoProjectionRepository: new D1RepoProjectionRepository({ db }),
+        blockRepository: new D1BlockRepository({ db }),
+        serviceRepository: new D1ServiceRepository({ db }),
+    });
+}
+//# sourceMappingURL=container-vcs-identity.js.map

package/dist/infrastructure/container-vcs-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-vcs-identity.js","sourceRoot":"","sources":["../../src/infrastructure/container-vcs-identity.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,gGAAgG;AAChG,4CAA4C;AAC5C,EAAE;AACF,4FAA4F;AAC5F,+FAA+F;AAC/F,+FAA+F;AAC/F,+EAA+E;AAE/E,OAAO,EAAc,MAAM,qBAAqB,CAAA;AAChD,OAAO,EACL,sBAAsB,IAAI,4BAA4B,EACtD,uBAAuB,IAAI,6BAA6B,GACzD,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAkB,MAAM,UAAU,CAAA;AAEzC,OAAO,EAAmD,MAAM,6BAA6B,CAAA;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAA;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAA;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAG9D;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAQ,EACR,MAAiB,EACjB,EAAc,EACd,KAAY;IAEZ,MAAM,sBAAsB,GAAG,IAAI,8BAA8B,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IACzE,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,aAAqB,EAAE,EAAE,CACxD,IAAI,aAAa,CAAC;QAChB,KAAK;QACL,aAAa;QACb,sBAAsB;QACtB,KAAK;QACL,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;KAC/B,CAAC,CAAA;IACJ,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,iCAAiC;QAClE,CAAC,CAAC;YACE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK;YACxC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,iCAAiC,CAAC;SACzF;QACH,CAAC,CAAC,SAAS,CAAA;IACf,OAAO,IAAI,iBAAiB,CAAC;QAC3B,OAAO,EAAE;YACP,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;YAC1B,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,sBAAuB,CAAC;SACjE;QACD,UAAU;QACV,sBAAsB;KACvB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAc;IACnD,OAAO,4BAA4B,CAAC;QAClC,sBAAsB,EAAE,IAAI,8BAA8B,CAAC,EAAE,EAAE,EAAE,CAAC;QAClE,wBAAwB,EAAE,IAAI,0BAA0B,CAAC,EAAE,EAAE,EAAE,CAAC;QAChE,eAAe,EAAE,IAAI,iBAAiB,CAAC,EAAE,EAAE,EAAE,CAAC;QAC9C,iBAAiB,EAAE,IAAI,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAc;IACpD,OAAO,6BAA6B,CAAC;QACnC,sBAAsB,EAAE,IAAI,8BAA8B,CAAC,EAAE,EAAE,EAAE,CAAC;QAClE,wBAAwB,EAAE,IAAI,0BAA0B,CAAC,EAAE,EAAE,EAAE,CAAC;QAChE,eAAe,EAAE,IAAI,iBAAiB,CAAC,EAAE,EAAE,EAAE,CAAC;QAC9C,iBAAiB,EAAE,IAAI,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC"}

package/dist/infrastructure/container.d.ts

@@ -1,87 +1,21 @@
-import { type AgentContextRecorder, type AgentExecutor, type Clock, type ExecutionEventPublisher, type IdGenerator, type NotificationChannel, type ResolveBinaryArtifactStore, type VcsIdentityRegistry, type WorkRunner, type ProviderRegistry } from '@cat-factory/kernel';
-import { type AgentKindRegistry } from '@cat-factory/agents';
-import { type EnvironmentBackendRegistry, PersonalSubscriptionService, ProviderSubscriptionService } from '@cat-factory/integrations';
+import { type Clock, type IdGenerator, type NotificationChannel, type ResolveBinaryArtifactStore, type VcsIdentityRegistry, type WorkRunner, type ProviderRegistry } from '@cat-factory/kernel';
+import { type EnvironmentBackendRegistry } from '@cat-factory/integrations';
 import { selectTraceSink } from './container-trace-sinks.js';
 export { selectTraceSink };
+import { buildAppRegistry, buildResolveRepoTarget } from './container-vcs-identity.js';
+export { buildAppRegistry, buildResolveRepoTarget };
+import { maybeWrapConsensus, selectAgentExecutor } from './container-executor-deps.js';
+export { maybeWrapConsensus, selectAgentExecutor };
+export type { WorkerExecutorDeps } from './container-executor-deps.js';
 import { type CoreDependencies } from '@cat-factory/orchestration';
 import { ContainerEnvConfigRepairer, type ServerContainer } from '@cat-factory/server';
 import { type AppConfig } from './config';
 import type { Env } from './env';
-import { type ResolveRepoTarget, type ResolveRunnerTransport } from './ai/ContainerAgentExecutor';
+import { type ResolveRunnerTransport } from './ai/ContainerAgentExecutor';
 import { ContainerRepoBootstrapper } from './ai/ContainerRepoBootstrapper';
 import { type GateProviderOverrides } from '@cat-factory/gates';
-import { GitHubAppRegistry } from './github/GitHubAppRegistry';
 import type { D1Database } from '@cloudflare/workers-types';
 export type Container = ServerContainer;
-/**
- * Pick the agent that performs pipeline steps: real LLM work via the Vercel AI
- * SDK, composed with a per-run sandbox for the repo-operating steps (`coder`,
- * `mocker`, `playwright`, …). Container-based implementation is ALWAYS on — the
- * sandbox is a hard requirement, so this throws at startup if it can't be built.
- * Tests bypass this entirely by overriding `agentExecutor` with a fake.
- *
- * There is intentionally NO inline fallback for the sandbox kinds — a one-shot
- * LLM call cannot clone/edit/commit/open a PR, so a degraded inline implementer is
- * silently broken rather than usefully degraded. If the sandbox prerequisites are
- * missing we fail the deploy loudly here rather than starting with a half-wired
- * implementer that would only fault the moment a repo-operating step is dispatched.
- */
-/**
- * The shared prerequisites both the composite executor selection and its container leg
- * need — the Worker's infra handles (`env`/`config`/`db`/`clock`), the resolved runner
- * transport, the agent-kind registry, and the optional subscription / observability seams.
- * Bundled so the two builders take one dependency object rather than nine positional args.
- */
-interface WorkerExecutorDeps {
-    env: Env;
-    config: AppConfig;
-    db: D1Database;
-    clock: Clock;
-    resolveTransport: ResolveRunnerTransport | null;
-    agentKindRegistry: AgentKindRegistry;
-    subscriptions?: ProviderSubscriptionService;
-    personalSubscriptions?: PersonalSubscriptionService;
-    agentContextObservability?: AgentContextRecorder;
-}
-export declare function selectAgentExecutor(deps: WorkerExecutorDeps): AgentExecutor;
-/**
- * Wrap the standard executor with the optional consensus mechanism when
- * `CONSENSUS_ENABLED` is set: register the consensus capability traits (so the builder
- * offers "Enable Consensus" on eligible steps) and route consensus-enabled steps through
- * a multi-model process, persisting + pushing the transcript. Off ⇒ returns `standard`
- * unchanged (no traits, no wrapping), so behaviour is identical to before.
- */
-export declare function maybeWrapConsensus(standard: AgentExecutor, env: Env, config: AppConfig, db: D1Database, eventPublisher: ExecutionEventPublisher | undefined, agentKindRegistry: AgentKindRegistry): AgentExecutor;
-/**
- * Build the container-based implementation executor, or return null when its
- * prerequisites are missing (a runner backend — Cloudflare Containers and/or a
- * self-hosted pool — plus a configured GitHub App, the proxy's public URL and the
- * signing secret) — the caller then falls back to inline work.
- */
-/**
- * Build the multi-App registry (ADR 0005): the default App always, plus the
- * privileged App when configured. It resolves which App's key to use per
- * installation (from the binding's recorded appId), so every token mint / app-JWT
- * call routes correctly. Callers guard on `config.github.enabled`, which requires
- * GITHUB_APP_PRIVATE_KEY, so the default key is present.
- */
-export declare function buildAppRegistry(env: Env, config: AppConfig, db: D1Database, clock: Clock): GitHubAppRegistry;
-/**
- * Resolve the repo linked to a running block's enclosing service, via the shared
- * runtime-neutral `buildResolveRepoTarget` (the ancestry walk + no-fallback policy
- * live in `@cat-factory/server` so the Worker and Node service can't drift). This
- * wrapper just binds the D1 repositories. Shared by the container executor, the CI
- * status provider and the PR merger.
- *
- * No `repoProjectionCache` is threaded here (unlike the Node facade, which caches the
- * whole-projection re-list per workspace — caching-layer slice 3): the repo projection
- * is our own mutable D1 state, and the Worker's isolate-safe profile makes that cache
- * pass-through (no cross-isolate invalidation bus), so an in-isolate TTL would serve
- * stale repos after a write on another isolate. Reading live IS the isolate-safe
- * behaviour. The shared GitHub sync/webhook services still receive the (pass-through)
- * handle via `createGitHubModule`, so their invalidation code path stays symmetric.
- */
-export declare function buildResolveRepoTarget(db: D1Database): ResolveRepoTarget;
 /** What {@link selectMergeLifecycleDeps} needs. An options object rather than a positional tail:
  *  it already carried six parameters, and the notification channels it composes will keep
  *  growing (in-app, Slack, the outbound webhook, …) — a named bag stays readable and keeps the

package/dist/infrastructure/container.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/infrastructure/container.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,KAAK,EAIV,KAAK,uBAAuB,EAG5B,KAAK,WAAW,EAEhB,KAAK,mBAAmB,EAIxB,KAAK,0BAA0B,EAK/B,KAAK,mBAAmB,EAExB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAEL,KAAK,iBAAiB,EAMvB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EASL,KAAK,0BAA0B,EAI/B,2BAA2B,EAC3B,2BAA2B,EAkB5B,MAAM,2BAA2B,CAAA;AASlC,OAAO,EAIL,eAAe,EAChB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,CAAA;AAE1B,OAAO,EAGL,KAAK,gBAAgB,EAMtB,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAGL,0BAA0B,EAuB1B,KAAK,eAAe,EAErB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAc,MAAM,UAAU,CAAA;AAIrD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAKhC,OAAO,EAEL,KAAK,iBAAiB,EAEtB,KAAK,sBAAsB,EAC5B,MAAM,6BAA6B,CAAA;AAMpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAsE1E,OAAO,EACL,KAAK,qBAAqB,EAO3B,MAAM,oBAAoB,CAAA;AAoB3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAyB9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAU3D,MAAM,MAAM,SAAS,GAAG,eAAe,CAAA;AA6FvC;;;;;;;;;;;;GAYG;AACH;;;;;GAKG;AACH,UAAU,kBAAkB;IAC1B,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,EAAE,SAAS,CAAA;IACjB,EAAE,EAAE,UAAU,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;IACZ,gBAAgB,EAAE,sBAAsB,GAAG,IAAI,CAAA;IAC/C,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,aAAa,CAAC,EAAE,2BAA2B,CAAA;IAC3C,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;IACnD,yBAAyB,CAAC,EAAE,oBAAoB,CAAA;CACjD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,aAAa,CA6B3E;AAOD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,aAAa,EACvB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,cAAc,EAAE,uBAAuB,GAAG,SAAS,EACnD,iBAAiB,EAAE,iBAAiB,GACnC,aAAa,CAaf;AAsGD;;;;;GAKG;AACH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,KAAK,GACX,iBAAiB,CAyBnB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,UAAU,GAAG,iBAAiB,CAOxE;AAmED;;;+EAG+E;AAC/E,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,EAAE,SAAS,CAAA;IACjB,EAAE,EAAE,UAAU,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;IACZ,WAAW,EAAE,WAAW,CAAA;IACxB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC;;;;OAIG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAA;CACrC;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CA2F3B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,gBAAgB,EAAE,gBAAgB,GACjC,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAU7F;AAsBD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,GAAG,EACR,EAAE,EAAE,UAAU,EACd,gBAAgB,EAAE,gBAAgB,GACjC,OAAO,CAAC,gBAAgB,CAAC,CAqB3B;AAsDD;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,GAAG,EAAE,GAAG,EACR,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,WAAW,GACvB,0BAA0B,CAW5B;AAiFD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,cAAc,CAAC,EAAE,mBAAmB,GACnC,mBAAmB,GAAG,IAAI,CAO5B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS5F;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,gBAAgB,CAAC,CAkB3B;AAgOD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,CAQrD;AAgBD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAiD3B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAwC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,gBAAgB,CAAC,CAgB3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS9F;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,gBAAgB,CAAC,CAwB3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,gBAAgB,CAAC,CA0B3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,gBAAgB,CAAC,CAiB3B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,WAAW,EACxB,gBAAgB,EAAE,sBAAsB,GAAG,IAAI,GAC9C,yBAAyB,GAAG,SAAS,CAwCvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,EAAE,SAAS,CAAA;IACjB,EAAE,EAAE,UAAU,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;IACZ,gBAAgB,EAAE,sBAAsB,GAAG,IAAI,CAAA;IAC/C,QAAQ,EAAE,gBAAgB,CAAC,qBAAqB,CAAC,CAAA;IACjD,0BAA0B,EAAE,0BAA0B,CAAA;CACvD,GAAG,0BAA0B,GAAG,SAAS,CAgDzC;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,gBAAgB,CAAC,CAuB3B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,gBAAgB,CAAC,CAW3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,SAAS,GAAG,mBAAmB,CAUrF;AA6BD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,GAAG,EACR,SAAS,GAAE,OAAO,CAAC,gBAAgB,CAAM,EACzC,IAAI,GAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,qBAAqB,CAAA;CAAO,GACtF,SAAS,CAuRX"}
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/infrastructure/container.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,KAAK,EAOV,KAAK,WAAW,EAChB,KAAK,mBAAmB,EAExB,KAAK,0BAA0B,EAG/B,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EASL,KAAK,0BAA0B,EAgBhC,MAAM,2BAA2B,CAAA;AASlC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,CAAA;AAE1B,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAGtF,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,CAAA;AAEnD,OAAO,EAGL,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAA;AAClD,YAAY,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,EAGL,KAAK,gBAAgB,EAGtB,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EACL,0BAA0B,EAa1B,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAc,MAAM,UAAU,CAAA;AACrD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAIzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAgE1E,OAAO,EACL,KAAK,qBAAqB,EAO3B,MAAM,oBAAoB,CAAA;AA0C3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAU3D,MAAM,MAAM,SAAS,GAAG,eAAe,CAAA;AAmDvC;;;+EAG+E;AAC/E,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,EAAE,SAAS,CAAA;IACjB,EAAE,EAAE,UAAU,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;IACZ,WAAW,EAAE,WAAW,CAAA;IACxB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC;;;;OAIG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAA;CACrC;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CA2F3B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,gBAAgB,EAAE,gBAAgB,GACjC,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAU7F;AAsBD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,GAAG,EACR,EAAE,EAAE,UAAU,EACd,gBAAgB,EAAE,gBAAgB,GACjC,OAAO,CAAC,gBAAgB,CAAC,CAqB3B;AAsDD;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,GAAG,EAAE,GAAG,EACR,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,WAAW,GACvB,0BAA0B,CAW5B;AAsFD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,cAAc,CAAC,EAAE,mBAAmB,GACnC,mBAAmB,GAAG,IAAI,CAO5B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS5F;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,gBAAgB,CAAC,CAkB3B;AAsBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,CAQrD;AAgBD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAiD3B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAwC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,gBAAgB,CAAC,CAgB3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS9F;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,gBAAgB,CAAC,CAwB3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,gBAAgB,CAAC,CA0B3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,gBAAgB,CAAC,CAiB3B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,WAAW,EACxB,gBAAgB,EAAE,sBAAsB,GAAG,IAAI,GAC9C,yBAAyB,GAAG,SAAS,CAwCvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,EAAE,SAAS,CAAA;IACjB,EAAE,EAAE,UAAU,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;IACZ,gBAAgB,EAAE,sBAAsB,GAAG,IAAI,CAAA;IAC/C,QAAQ,EAAE,gBAAgB,CAAC,qBAAqB,CAAC,CAAA;IACjD,0BAA0B,EAAE,0BAA0B,CAAA;CACvD,GAAG,0BAA0B,GAAG,SAAS,CAgDzC;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,gBAAgB,CAAC,CAuB3B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,gBAAgB,CAAC,CAW3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,SAAS,GAAG,mBAAmB,CAUrF;AA6BD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,GAAG,EACR,SAAS,GAAE,OAAO,CAAC,gBAAgB,CAAM,EACzC,IAAI,GAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,qBAAqB,CAAA;CAAO,GACtF,SAAS,CA4RX"}