@kelpie/server 0.1.0

package/dist/modules/agent-tasks/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/agent-tasks/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAG/F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAErD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAI7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAInD,OAAO,KAAK,EAA2B,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAEjD;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,mFAAmF;AACnF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;AAEpD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,YAAa,SAAQ,kBAAkB;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAChD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;CAC7C;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAA;IAClG,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC5F,uFAAuF;IACvF,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACxE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAClD,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IACnG,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;IAC9E,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACtD,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACtE,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACpF,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACrD;AAoBD,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,sBAAsB,GAAG,iBAAiB,CA4P/F"}

package/dist/modules/agent-tasks/service.js

@@ -0,0 +1,210 @@
+import { changedKeys } from '../../lib/changes.js';
+import { AppError, describeThrown } from '../../lib/errors.js';
+import { mapPage, readListWindow, toPage } from '../../lib/pagination.js';
+import { requireWorkspaceId } from '../auth/actor.js';
+import { roleAllows } from '../workspace/roles.js';
+import { AGENT_TASK_DEFINITIONS, findTask, tasksFor } from './catalog.js';
+import { renderPrompt } from './prompt.js';
+import * as repository from './repository.js';
+import { AGENT_SORTS, DEFAULT_AGENT_SORT, DEFAULT_RUN_SORT, RUN_SORTS } from './repository.js';
+import { assemblePromptInputs } from './resolve.js';
+function toAgentView(record) {
+    return {
+        id: record.id,
+        name: record.name,
+        endpoint: record.endpoint,
+        hasAuthHeader: record.authHeaderEncrypted !== null,
+        lastRunAt: record.lastRunAt,
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+    };
+}
+function toRunView(record) {
+    const { workspaceId: _workspaceId, ...view } = record;
+    return view;
+}
+export function createAgentTasksService(dependencies) {
+    function requireAdminWorkspace(actor) {
+        const workspaceId = requireWorkspaceId(actor);
+        if (actor.role === null || !roleAllows(actor.role, 'admin')) {
+            throw new AppError('forbidden', 'This action needs the admin role');
+        }
+        return workspaceId;
+    }
+    function requireTask(taskId) {
+        const definition = findTask(taskId);
+        if (definition === undefined) {
+            throw AppError.notFound('Agent task not found');
+        }
+        return definition;
+    }
+    /**
+     * A task that exists but does not apply to the named target type is a `422`,
+     * not a `404`: the caller found the task, they aimed it wrong.
+     */
+    function requireTargetType(definition, targetType) {
+        if (!definition.targetTypes.includes(targetType)) {
+            throw AppError.validationFailed('This task does not apply to that target type', [
+                {
+                    field: 'target_type',
+                    message: `Task ${definition.id} applies to: ${definition.targetTypes.join(', ')}`,
+                },
+            ]);
+        }
+    }
+    async function requireAgent(workspaceId, id) {
+        const agent = await repository.findAgent(dependencies.db, workspaceId, id);
+        // An agent in another workspace is indistinguishable from one that never
+        // existed, per `api.md`.
+        if (agent === undefined) {
+            throw AppError.notFound('Agent not found');
+        }
+        return agent;
+    }
+    async function resolveView(workspaceId, definition, target) {
+        const inputs = await assemblePromptInputs(dependencies.db, workspaceId, definition, target.targetType, target.targetId);
+        if (inputs === undefined) {
+            throw AppError.notFound('Target record not found');
+        }
+        return {
+            taskId: definition.id,
+            targetType: target.targetType,
+            targetId: target.targetId,
+            prompt: renderPrompt(definition, target.targetType, target.targetId, inputs),
+            context: {
+                targetLabel: inputs.targetLabel,
+                deepLink: inputs.deepLink,
+                handbookSlugs: inputs.handbookPages.map((page) => page.slug),
+                pinnedNoteIds: inputs.pinnedNoteIds,
+                openPlanIds: inputs.openPlanIds,
+                openDecisionIds: inputs.openDecisionIds,
+                related: Object.fromEntries(Object.entries(inputs.related)
+                    .filter(([, list]) => list.ids.length > 0)
+                    .map(([key, list]) => [key, list.ids])),
+            },
+        };
+    }
+    return {
+        listTasks(actor, targetType) {
+            requireWorkspaceId(actor);
+            // The catalog ships in code and is the same for every workspace; the
+            // credential check is about who may ask, not whose answer differs.
+            return Promise.resolve(targetType === undefined ? AGENT_TASK_DEFINITIONS : tasksFor(targetType));
+        },
+        async resolve(actor, taskId, target) {
+            const workspaceId = requireWorkspaceId(actor);
+            const definition = requireTask(taskId);
+            requireTargetType(definition, target.targetType);
+            return resolveView(workspaceId, definition, target);
+        },
+        async run(actor, taskId, input) {
+            const workspaceId = requireWorkspaceId(actor);
+            const definition = requireTask(taskId);
+            requireTargetType(definition, input.targetType);
+            const agent = await requireAgent(workspaceId, input.agentId);
+            const resolved = await resolveView(workspaceId, definition, input);
+            const now = dependencies.now();
+            const created = await dependencies.transaction(async ({ tx }) => {
+                const run = await repository.insertRun(tx, {
+                    id: dependencies.createId('agentRun'),
+                    workspaceId,
+                    agentId: agent.id,
+                    taskId: definition.id,
+                    targetType: input.targetType,
+                    targetId: input.targetId,
+                    status: 'queued',
+                    prompt: resolved.prompt,
+                });
+                // `last_run_at` moves; `updated_at` does not. The latter answers "when
+                // did somebody last change this registration", the webhook rule.
+                await repository.updateAgent(tx, workspaceId, agent.id, { lastRunAt: now });
+                return run;
+            });
+            // After the commit, never awaited: the caller polls the run instead.
+            // `dispatch` settles every failure into the run row; this catch guards
+            // the promise chain itself so nothing leaks an unhandled rejection.
+            dependencies.engine.dispatch(created, agent, resolved).catch((error) => {
+                dependencies.log.error('agent dispatch rejected outside its own boundary', {
+                    runId: created.id,
+                    error: describeThrown(error),
+                });
+            });
+            return toRunView(created);
+        },
+        async getRun(actor, id) {
+            const workspaceId = requireWorkspaceId(actor);
+            const run = await repository.findRun(dependencies.db, workspaceId, id);
+            if (run === undefined) {
+                throw AppError.notFound('Agent run not found');
+            }
+            return toRunView(run);
+        },
+        async listRuns(actor, filters, query) {
+            const workspaceId = requireWorkspaceId(actor);
+            const window = readListWindow(query, RUN_SORTS, DEFAULT_RUN_SORT);
+            const runFilters = { agentId: filters.agentId, status: filters.status };
+            const rows = await repository.listRuns(dependencies.db, workspaceId, runFilters, window);
+            return mapPage(toPage(rows, window, (run) => run.id), toRunView);
+        },
+        async listAgents(actor, query) {
+            const workspaceId = requireWorkspaceId(actor);
+            const window = readListWindow(query, AGENT_SORTS, DEFAULT_AGENT_SORT);
+            const rows = await repository.listAgents(dependencies.db, workspaceId, window);
+            return mapPage(toPage(rows, window, (agent) => agent.id), toAgentView);
+        },
+        async getAgent(actor, id) {
+            return toAgentView(await requireAgent(requireWorkspaceId(actor), id));
+        },
+        async createAgent(actor, input) {
+            const workspaceId = requireAdminWorkspace(actor);
+            const created = await dependencies.transaction(({ tx }) => repository.insertAgent(tx, {
+                id: dependencies.createId('agentRegistration'),
+                workspaceId,
+                name: input.name,
+                endpoint: input.endpoint,
+                authHeaderEncrypted: input.authHeader === undefined ? null : dependencies.cipher.seal(input.authHeader),
+            }));
+            return toAgentView(created);
+        },
+        async updateAgent(actor, id, changes) {
+            const workspaceId = requireAdminWorkspace(actor);
+            const existing = await requireAgent(workspaceId, id);
+            const columns = {
+                ...(changes.name === undefined ? {} : { name: changes.name }),
+                ...(changes.endpoint === undefined ? {} : { endpoint: changes.endpoint }),
+            };
+            // A re-sent header always writes: sealed values cannot be compared (each
+            // seal spends a fresh IV), and re-saving a header is how a customer fixes
+            // one sealed under a lost key.
+            if (changes.authHeader !== undefined) {
+                columns.authHeaderEncrypted =
+                    changes.authHeader === null ? null : dependencies.cipher.seal(changes.authHeader);
+            }
+            // A PATCH that changes nothing is not a write, the webhook rule.
+            if (changes.authHeader === undefined && changedKeys(existing, columns).length === 0) {
+                return toAgentView(existing);
+            }
+            const updated = await dependencies.transaction(async ({ tx }) => {
+                const row = await repository.updateAgent(tx, workspaceId, id, {
+                    ...columns,
+                    updatedAt: dependencies.now(),
+                });
+                if (row === undefined) {
+                    throw AppError.notFound('Agent not found');
+                }
+                return row;
+            });
+            return toAgentView(updated);
+        },
+        async removeAgent(actor, id) {
+            const workspaceId = requireAdminWorkspace(actor);
+            // The run log cascades with the registration, like a webhook's
+            // deliveries: a run only means anything against the agent it went to.
+            await dependencies.transaction(async ({ tx }) => {
+                await requireAgent(workspaceId, id);
+                await repository.deleteAgent(tx, workspaceId, id);
+            });
+        },
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/modules/agent-tasks/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/modules/agent-tasks/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAElD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAG9D,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAKzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAEzE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AA+EnD,SAAS,WAAW,CAAC,MAAmB;IACtC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,MAAM,CAAC,mBAAmB,KAAK,IAAI;QAClD,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAA;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAAiB;IAClC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IAErD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,YAAoC;IAC1E,SAAS,qBAAqB,CAAC,KAAY;QACzC,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAE7C,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,kCAAkC,CAAC,CAAA;QACrE,CAAC;QAED,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,SAAS,WAAW,CAAC,MAAc;QACjC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;QAEnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAA;QACjD,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;;OAGG;IACH,SAAS,iBAAiB,CAAC,UAA+B,EAAE,UAA+B;QACzF,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,MAAM,QAAQ,CAAC,gBAAgB,CAAC,8CAA8C,EAAE;gBAC9E;oBACE,KAAK,EAAE,aAAa;oBACpB,OAAO,EAAE,QAAQ,UAAU,CAAC,EAAE,gBAAgB,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAClF;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,WAAmB,EAAE,EAAU;QACzD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;QAE1E,yEAAyE;QACzE,yBAAyB;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAC5C,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,UAAU,WAAW,CACxB,WAAmB,EACnB,UAA+B,EAC/B,MAA0B;QAE1B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,YAAY,CAAC,EAAE,EACf,WAAW,EACX,UAAU,EACV,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,QAAQ,CAChB,CAAA;QAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAA;QACpD,CAAC;QAED,OAAO;YACL,MAAM,EAAE,UAAU,CAAC,EAAE;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC5E,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5D,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;qBAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;qBACzC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CACzC;aACF;SACF,CAAA;IACH,CAAC;IAED,OAAO;QACL,SAAS,CAAC,KAAK,EAAE,UAAU;YACzB,kBAAkB,CAAC,KAAK,CAAC,CAAA;YAEzB,qEAAqE;YACrE,mEAAmE;YACnE,OAAO,OAAO,CAAC,OAAO,CACpB,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CACzE,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM;YACjC,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;YAC7C,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;YAEtC,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;YAEhD,OAAO,WAAW,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QACrD,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK;YAC5B,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;YAC7C,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;YAEtC,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;YAE/C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;YAC5D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;YAClE,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,CAAA;YAE9B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;gBAC9D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE;oBACzC,EAAE,EAAE,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC;oBACrC,WAAW;oBACX,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,MAAM,EAAE,UAAU,CAAC,EAAE;oBACrB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,QAAQ,CAAC,MAAM;iBACxB,CAAC,CAAA;gBAEF,uEAAuE;gBACvE,iEAAiE;gBACjE,MAAM,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAA;gBAE3E,OAAO,GAAG,CAAA;YACZ,CAAC,CAAC,CAAA;YAEF,qEAAqE;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC9E,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,kDAAkD,EAAE;oBACzE,KAAK,EAAE,OAAO,CAAC,EAAE;oBACjB,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;iBAC7B,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YAEF,OAAO,SAAS,CAAC,OAAO,CAAC,CAAA;QAC3B,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;YAC7C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;YAEtE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAA;YAChD,CAAC;YAED,OAAO,SAAS,CAAC,GAAG,CAAC,CAAA;QACvB,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK;YAClC,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAA;YACjE,MAAM,UAAU,GAAe,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;YACnF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;YAExF,OAAO,OAAO,CACZ,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EACrC,SAAS,CACV,CAAA;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK;YAC3B,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAA;YACrE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;YAE9E,OAAO,OAAO,CACZ,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EACzC,WAAW,CACZ,CAAA;QACH,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE;YACtB,OAAO,WAAW,CAAC,MAAM,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACvE,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK;YAC5B,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;YAEhD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CACxD,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE;gBACzB,EAAE,EAAE,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBAC9C,WAAW;gBACX,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,mBAAmB,EACjB,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;aACrF,CAAC,CACH,CAAA;YAED,OAAO,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO;YAClC,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;YAChD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;YAEpD,MAAM,OAAO,GAAqC;gBAChD,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC7D,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;aAC1E,CAAA;YAED,yEAAyE;YACzE,0EAA0E;YAC1E,+BAA+B;YAC/B,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,CAAC,mBAAmB;oBACzB,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YACrF,CAAC;YAED,iEAAiE;YACjE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpF,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAA;YAC9B,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;gBAC9D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;oBAC5D,GAAG,OAAO;oBACV,SAAS,EAAE,YAAY,CAAC,GAAG,EAAE;iBAC9B,CAAC,CAAA;gBAEF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACtB,MAAM,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;gBAC5C,CAAC;gBAED,OAAO,GAAG,CAAA;YACZ,CAAC,CAAC,CAAA;YAEF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE;YACzB,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;YAEhD,+DAA+D;YAC/D,sEAAsE;YACtE,MAAM,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;gBAC9C,MAAM,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;gBACnC,MAAM,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/modules/agent-tasks/wire.d.ts

@@ -0,0 +1,35 @@
+import type { AgentTaskTargetType } from '@kelpie/schemas';
+/**
+ * The resolved-task wire shape, in its own file because it has two consumers:
+ * the resolve route renders it as a response, and the dispatch engine POSTs it
+ * to a registered agent. One renderer is what keeps Copy and Run identical,
+ * which `agent-tasks.md` makes the whole point of resolve.
+ */
+export interface ContextPackView {
+    readonly targetLabel: string;
+    readonly deepLink: string;
+    readonly handbookSlugs: readonly string[];
+    readonly pinnedNoteIds: readonly string[];
+    readonly openPlanIds: readonly string[];
+    readonly openDecisionIds: readonly string[];
+    readonly related: Readonly<Record<string, readonly string[]>>;
+}
+export interface ResolvedTaskView {
+    readonly taskId: string;
+    readonly targetType: AgentTaskTargetType;
+    readonly targetId: string;
+    readonly prompt: string;
+    readonly context: ContextPackView;
+}
+export declare function resolvedTaskResponse(resolved: ResolvedTaskView): Record<string, unknown>;
+/**
+ * What a registered agent receives. The resolved task plus two fields the
+ * receiver cannot infer: which run this is (the dedupe key, like a webhook's
+ * delivery id) and which workspace it belongs to (a receiver holds no
+ * credential context, and two workspaces can share one endpoint).
+ */
+export declare function dispatchPayload(run: {
+    readonly id: string;
+    readonly workspaceId: string;
+}, resolved: ResolvedTaskView): Record<string, unknown>;
+//# sourceMappingURL=wire.d.ts.map

package/dist/modules/agent-tasks/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../../src/modules/agent-tasks/wire.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAE1D;;;;;GAKG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;CAClC;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBxF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAC1D,QAAQ,EAAE,gBAAgB,GACzB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMzB"}

package/dist/modules/agent-tasks/wire.js

@@ -0,0 +1,31 @@
+export function resolvedTaskResponse(resolved) {
+    return {
+        task_id: resolved.taskId,
+        target_type: resolved.targetType,
+        target_id: resolved.targetId,
+        prompt: resolved.prompt,
+        context: {
+            target_label: resolved.context.targetLabel,
+            deep_link: resolved.context.deepLink,
+            handbook_slugs: resolved.context.handbookSlugs,
+            pinned_note_ids: resolved.context.pinnedNoteIds,
+            open_plan_ids: resolved.context.openPlanIds,
+            open_decision_ids: resolved.context.openDecisionIds,
+            related: resolved.context.related,
+        },
+    };
+}
+/**
+ * What a registered agent receives. The resolved task plus two fields the
+ * receiver cannot infer: which run this is (the dedupe key, like a webhook's
+ * delivery id) and which workspace it belongs to (a receiver holds no
+ * credential context, and two workspaces can share one endpoint).
+ */
+export function dispatchPayload(run, resolved) {
+    return {
+        run_id: run.id,
+        workspace_id: run.workspaceId,
+        ...resolvedTaskResponse(resolved),
+    };
+}
+//# sourceMappingURL=wire.js.map

package/dist/modules/agent-tasks/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../../src/modules/agent-tasks/wire.ts"],"names":[],"mappings":"AA2BA,MAAM,UAAU,oBAAoB,CAAC,QAA0B;IAC7D,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,MAAM;QACxB,WAAW,EAAE,QAAQ,CAAC,UAAU;QAChC,SAAS,EAAE,QAAQ,CAAC,QAAQ;QAC5B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE;YACP,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW;YAC1C,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ;YACpC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa;YAC9C,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa;YAC/C,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW;YAC3C,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe;YACnD,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO;SAClC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,GAA0D,EAC1D,QAA0B;IAE1B,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,EAAE;QACd,YAAY,EAAE,GAAG,CAAC,WAAW;QAC7B,GAAG,oBAAoB,CAAC,QAAQ,CAAC;KAClC,CAAA;AACH,CAAC"}

package/dist/modules/api-keys/index.d.ts

@@ -0,0 +1,9 @@
+import type { KelpieModule } from '../../runtime/module.ts';
+/**
+ * Workspace and personal API keys.
+ *
+ * Every key is bound to one workspace at creation, so there is no workspace
+ * header and no workspace path segment anywhere in the API.
+ */
+export declare function createApiKeysModule(migrationsDirectory: string): KelpieModule;
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/api-keys/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/api-keys/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAK3D;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,mBAAmB,EAAE,MAAM,GAAG,YAAY,CAsB7E"}

package/dist/modules/api-keys/index.js

@@ -0,0 +1,29 @@
+import { mountApiKeyRoutes } from './routes.js';
+import * as schema from './schema.js';
+import { createApiKeyService } from './service.js';
+/**
+ * Workspace and personal API keys.
+ *
+ * Every key is bound to one workspace at creation, so there is no workspace
+ * header and no workspace path segment anywhere in the API.
+ */
+export function createApiKeysModule(migrationsDirectory) {
+    return {
+        id: 'api-keys',
+        requires: ['workspace'],
+        structural: true,
+        register(context) {
+            const service = createApiKeyService({
+                db: context.db,
+                createId: context.createId,
+                now: context.now,
+            });
+            context.schema(schema, migrationsDirectory);
+            context.routes((router) => {
+                mountApiKeyRoutes(router, { db: context.db, now: context.now, service });
+            });
+            return Promise.resolve();
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/modules/api-keys/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/api-keys/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAElD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,mBAA2B;IAC7D,OAAO;QACL,EAAE,EAAE,UAAU;QACd,QAAQ,EAAE,CAAC,WAAW,CAAC;QACvB,UAAU,EAAE,IAAI;QAEhB,QAAQ,CAAC,OAAO;YACd,MAAM,OAAO,GAAG,mBAAmB,CAAC;gBAClC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAA;YAEF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAE3C,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;gBACxB,iBAAiB,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC1E,CAAC,CAAC,CAAA;YAEF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/modules/api-keys/keys.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Key formatting. The prefix is what a leak scanner greps for, so it stays in the
+ * secret itself rather than only in the database.
+ */
+export declare const KEY_KINDS: readonly ['workspace', 'personal'];
+export type KeyKind = (typeof KEY_KINDS)[number];
+export interface MintedKey {
+    /** Shown once, at creation, and never retrievable again. */
+    readonly secret: string;
+    readonly secretHash: string;
+    /** Safe to store and display: prefix plus the last four characters. */
+    readonly displayPrefix: string;
+}
+export declare function parseKeyKind(value: string): KeyKind | undefined;
+/** The kind a secret claims to be, read from its prefix. */
+export declare function kindOfSecret(secret: string): KeyKind | undefined;
+export declare function mintKey(kind: KeyKind, randomToken?: () => string): MintedKey;
+/**
+ * Pulls the credential out of an `Authorization` header.
+ *
+ * @returns The bearer value, or undefined when the header is absent or not a
+ *   bearer scheme. A malformed header is not an error here; the caller decides.
+ */
+export declare function readBearerToken(header: string | undefined): string | undefined;
+//# sourceMappingURL=keys.d.ts.map

package/dist/modules/api-keys/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/modules/api-keys/keys.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH,eAAO,MAAM,SAAS,YAAI,WAAW,EAAE,UAAU,CAAU,CAAA;AAE3D,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAA;AAQhD,MAAM,WAAW,SAAS;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAE/D;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAEhE;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,GAAE,MAAM,MAAsB,GAAG,SAAS,CAQ3F;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAQ9E"}

package/dist/modules/api-keys/keys.js

@@ -0,0 +1,40 @@
+import { generateToken, hashToken } from '../../lib/tokens.js';
+/**
+ * Key formatting. The prefix is what a leak scanner greps for, so it stays in the
+ * secret itself rather than only in the database.
+ */
+export const KEY_KINDS = ['workspace', 'personal'];
+/** `api.md` pins these strings; they appear in every customer's credential store. */
+const SECRET_PREFIXES = {
+    workspace: 'kp_live_',
+    personal: 'kp_user_',
+};
+export function parseKeyKind(value) {
+    return KEY_KINDS.find((kind) => kind === value);
+}
+/** The kind a secret claims to be, read from its prefix. */
+export function kindOfSecret(secret) {
+    return KEY_KINDS.find((kind) => secret.startsWith(SECRET_PREFIXES[kind]));
+}
+export function mintKey(kind, randomToken = generateToken) {
+    const secret = `${SECRET_PREFIXES[kind]}${randomToken()}`;
+    return {
+        secret,
+        secretHash: hashToken(secret),
+        displayPrefix: `${SECRET_PREFIXES[kind]}…${secret.slice(-4)}`,
+    };
+}
+/**
+ * Pulls the credential out of an `Authorization` header.
+ *
+ * @returns The bearer value, or undefined when the header is absent or not a
+ *   bearer scheme. A malformed header is not an error here; the caller decides.
+ */
+export function readBearerToken(header) {
+    if (header === undefined) {
+        return undefined;
+    }
+    const match = /^Bearer\s+(?<token>\S+)$/iu.exec(header);
+    return match?.groups?.token;
+}
+//# sourceMappingURL=keys.js.map

package/dist/modules/api-keys/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/modules/api-keys/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE9D;;;GAGG;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,UAAU,CAAU,CAAA;AAI3D,qFAAqF;AACrF,MAAM,eAAe,GAAsC;IACzD,SAAS,EAAE,UAAU;IACrB,QAAQ,EAAE,UAAU;CACrB,CAAA;AAUD,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAA;AACjD,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAa,EAAE,WAAW,GAAiB,aAAa;IAC9E,MAAM,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,WAAW,EAAE,EAAE,CAAA;IAEzD,OAAO;QACL,MAAM;QACN,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC;QAC7B,aAAa,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;KAC9D,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAA0B;IACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAEvD,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,CAAA;AAC7B,CAAC"}

package/dist/modules/api-keys/repository.d.ts

@@ -0,0 +1,15 @@
+import type { Database } from '../../lib/database.ts';
+import type { Transaction } from '../../runtime/transaction.ts';
+import { apiKeys } from './schema.ts';
+export type Queryable = Database | Transaction;
+export type ApiKeyRecord = typeof apiKeys.$inferSelect;
+export declare function insertApiKey(db: Queryable, values: typeof apiKeys.$inferInsert): Promise<ApiKeyRecord>;
+export declare function findBySecretHash(db: Queryable, secretHash: string): Promise<ApiKeyRecord | undefined>;
+/** Workspace keys: those with no user behind them. */
+export declare function listWorkspaceKeys(db: Queryable, workspaceId: string): Promise<ApiKeyRecord[]>;
+/** Personal keys belonging to one user in one workspace. */
+export declare function listPersonalKeys(db: Queryable, workspaceId: string, userId: string): Promise<ApiKeyRecord[]>;
+export declare function findApiKey(db: Queryable, workspaceId: string, id: string): Promise<ApiKeyRecord | undefined>;
+export declare function deleteApiKey(db: Queryable, workspaceId: string, id: string): Promise<number>;
+export declare function touchLastUsed(db: Queryable, id: string, now: Date): Promise<void>;
+//# sourceMappingURL=repository.d.ts.map

package/dist/modules/api-keys/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../src/modules/api-keys/repository.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAErC,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAA;AAE9C,MAAM,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,YAAY,CAAA;AAEtD,wBAAsB,YAAY,CAChC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,OAAO,OAAO,CAAC,YAAY,GAClC,OAAO,CAAC,YAAY,CAAC,CAQvB;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAInC;AAED,sDAAsD;AACtD,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAMnG;AAED,4DAA4D;AAC5D,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,EAAE,CAAC,CAQzB;AAED,wBAAsB,UAAU,CAC9B,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAQnC;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOlG;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvF"}

package/dist/modules/api-keys/repository.js

@@ -0,0 +1,48 @@
+import { and, desc, eq, isNotNull, isNull } from 'drizzle-orm';
+import { apiKeys } from './schema.js';
+export async function insertApiKey(db, values) {
+    const [created] = await db.insert(apiKeys).values(values).returning();
+    if (created === undefined) {
+        throw new Error(`Inserting api key ${values.id} returned no row`);
+    }
+    return created;
+}
+export async function findBySecretHash(db, secretHash) {
+    const [found] = await db.select().from(apiKeys).where(eq(apiKeys.secretHash, secretHash)).limit(1);
+    return found;
+}
+/** Workspace keys: those with no user behind them. */
+export async function listWorkspaceKeys(db, workspaceId) {
+    return db
+        .select()
+        .from(apiKeys)
+        .where(and(eq(apiKeys.workspaceId, workspaceId), isNull(apiKeys.userId)))
+        .orderBy(desc(apiKeys.createdAt));
+}
+/** Personal keys belonging to one user in one workspace. */
+export async function listPersonalKeys(db, workspaceId, userId) {
+    return db
+        .select()
+        .from(apiKeys)
+        .where(and(eq(apiKeys.workspaceId, workspaceId), isNotNull(apiKeys.userId), eq(apiKeys.userId, userId)))
+        .orderBy(desc(apiKeys.createdAt));
+}
+export async function findApiKey(db, workspaceId, id) {
+    const [found] = await db
+        .select()
+        .from(apiKeys)
+        .where(and(eq(apiKeys.workspaceId, workspaceId), eq(apiKeys.id, id)))
+        .limit(1);
+    return found;
+}
+export async function deleteApiKey(db, workspaceId, id) {
+    const deleted = await db
+        .delete(apiKeys)
+        .where(and(eq(apiKeys.workspaceId, workspaceId), eq(apiKeys.id, id)))
+        .returning({ id: apiKeys.id });
+    return deleted.length;
+}
+export async function touchLastUsed(db, id, now) {
+    await db.update(apiKeys).set({ lastUsedAt: now }).where(eq(apiKeys.id, id));
+}
+//# sourceMappingURL=repository.js.map

package/dist/modules/api-keys/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../../src/modules/api-keys/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAI9D,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAMrC,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAa,EACb,MAAmC;IAEnC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAA;IAErE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAA;IACnE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAa,EACb,UAAkB;IAElB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAElG,OAAO,KAAK,CAAA;AACd,CAAC;AAED,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAa,EAAE,WAAmB;IACxE,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;SACxE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;AACrC,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAa,EACb,WAAmB,EACnB,MAAc;IAEd,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CACjG;SACA,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAa,EACb,WAAmB,EACnB,EAAU;IAEV,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;SACpE,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAa,EAAE,WAAmB,EAAE,EAAU;IAC/E,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,OAAO,CAAC;SACf,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;SACpE,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;IAEhC,OAAO,OAAO,CAAC,MAAM,CAAA;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAa,EAAE,EAAU,EAAE,GAAS;IACtE,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;AAC7E,CAAC"}

package/dist/modules/api-keys/routes.d.ts

@@ -0,0 +1,8 @@
+import type { Hono } from 'hono';
+import type { CredentialDependencies } from '../auth/credentials.ts';
+import type { ApiKeyService } from './service.ts';
+export interface ApiKeyRoutesDependencies extends CredentialDependencies {
+    readonly service: ApiKeyService;
+}
+export declare function mountApiKeyRoutes(router: Hono, dependencies: ApiKeyRoutesDependencies): void;
+//# sourceMappingURL=routes.d.ts.map

package/dist/modules/api-keys/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/modules/api-keys/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAA;AAMzC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAEpE,OAAO,KAAK,EAAE,aAAa,EAA4B,MAAM,cAAc,CAAA;AAW3E,MAAM,WAAW,wBAAyB,SAAQ,sBAAsB;IACtE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAChC;AA0BD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,wBAAwB,GAAG,IAAI,CAmC5F"}

package/dist/modules/api-keys/routes.js

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+import { AppError, toErrorDetails } from '../../lib/errors.js';
+import { resolveActorFrom } from '../auth/credentials.js';
+import { KEY_KINDS } from './keys.js';
+/** Wire shapes for `/v1/api-keys`. */
+const createBody = z.object({
+    name: z.string().min(1),
+    kind: z.enum(KEY_KINDS),
+});
+const listQuery = z.object({ kind: z.enum(KEY_KINDS) });
+async function readBody(context, schema) {
+    const raw = await context.req.json().catch(() => {
+        throw new AppError('bad_request', 'Body must be valid JSON');
+    });
+    const parsed = schema.safeParse(raw);
+    if (!parsed.success) {
+        throw AppError.validationFailed('Request body is invalid', toErrorDetails(parsed.error.issues));
+    }
+    return parsed.data;
+}
+function keyResponse(key) {
+    return {
+        id: key.id,
+        name: key.name,
+        kind: key.kind,
+        display_prefix: key.displayPrefix,
+        last_used_at: key.lastUsedAt === null ? null : key.lastUsedAt.toISOString(),
+        created_at: key.createdAt.toISOString(),
+    };
+}
+export function mountApiKeyRoutes(router, dependencies) {
+    const requireActor = (context) => resolveActorFrom(dependencies, context);
+    /** The response carries `secret`. No later request can retrieve it. */
+    router.post('/api-keys', async (context) => {
+        const body = await readBody(context, createBody);
+        const minted = await dependencies.service.create(await requireActor(context), body.name, body.kind);
+        return context.json({ ...keyResponse(minted), secret: minted.secret }, 201);
+    });
+    router.get('/api-keys', async (context) => {
+        const parsed = listQuery.safeParse({ kind: context.req.query('kind') });
+        if (!parsed.success) {
+            throw AppError.validationFailed('Specify which keys to list', toErrorDetails(parsed.error.issues));
+        }
+        const keys = await dependencies.service.list(await requireActor(context), parsed.data.kind);
+        return context.json({ data: keys.map(keyResponse), next_cursor: null });
+    });
+    router.delete('/api-keys/:id', async (context) => {
+        await dependencies.service.revoke(await requireActor(context), context.req.param('id'));
+        return context.body(null, 204);
+    });
+}
+//# sourceMappingURL=routes.js.map

package/dist/modules/api-keys/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/modules/api-keys/routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAE9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAGrC,sCAAsC;AAEtC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;CACxB,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;AAMvD,KAAK,UAAU,QAAQ,CAAI,OAAgB,EAAE,MAAoB;IAC/D,MAAM,GAAG,GAAY,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QACvD,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAEpC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,CAAC,gBAAgB,CAAC,yBAAyB,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;IACjG,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,GAAe;IAClC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,cAAc,EAAE,GAAG,CAAC,aAAa;QACjC,YAAY,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QAC3E,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACxC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAY,EAAE,YAAsC;IACpF,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAkB,EAAE,CAAC,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IAElG,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAChD,MAAM,MAAM,GAAiB,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAC5D,MAAM,YAAY,CAAC,OAAO,CAAC,EAC3B,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,CACV,CAAA;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAEvE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,QAAQ,CAAC,gBAAgB,CAC7B,4BAA4B,EAC5B,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CACpC,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE3F,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/C,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QAEvF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;AACJ,CAAC"}