@neuralis/brain-core 0.3.0 → 0.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +41 -40
- package/app/README.md +3 -3
- package/app/filesystem/FilesystemHost.tsx +7 -0
- package/app/filesystem/README.md +1 -1
- package/app/filesystem/api/index.ts +4 -4
- package/app/filesystem/hooks/README.md +1 -1
- package/app/filesystem/hooks/useFilesystemSSE.ts +41 -1
- package/app/filesystem/host/README.md +2 -2
- package/app/filesystem/host/buildFilesystemHostValue.ts +9 -2
- package/app/filesystem/lib/sourceKindForm.ts +109 -5
- package/app/filesystem/store/filesystemStore.ts +13 -3
- package/app/filesystem/ui/DiscoverDock.tsx +5 -1
- package/app/filesystem/ui/FileTree.tsx +34 -8
- package/app/filesystem/ui/FilesystemWidget.tsx +10 -2
- package/app/filesystem/ui/GitControlPanel.tsx +2 -2
- package/app/filesystem/ui/PendingChangesPanel.tsx +1 -1
- package/app/filesystem/ui/README.md +14 -13
- package/app/filesystem/ui/SourcesPanel.tsx +124 -24
- package/app/filesystem/ui/VectorHealthPanel.tsx +2 -2
- package/dist/app/host.js +41 -37
- package/dist/src/channels/filesystem.d.ts +1 -1
- package/dist/src/channels/filesystem.js +1 -1
- package/dist/src/domain/mime.d.ts +3 -3
- package/dist/src/domain/mime.js +3 -3
- package/dist/src/domain/scopeAccessCtx.d.ts +2 -2
- package/dist/src/domain/scopeAccessCtx.js +2 -2
- package/dist/src/domain/types.d.ts +8 -1
- package/dist/src/domain/types.d.ts.map +1 -1
- package/dist/src/events/pending.d.ts +1 -1
- package/dist/src/events/pending.js +1 -1
- package/dist/src/git/sourceGitControl.d.ts +2 -2
- package/dist/src/git/sourceGitControl.js +3 -3
- package/dist/src/lifecycle.d.ts +1 -1
- package/dist/src/routes/approve.d.ts +1 -1
- package/dist/src/routes/approve.js +1 -1
- package/dist/src/routes/events.d.ts +1 -1
- package/dist/src/routes/events.js +1 -1
- package/dist/src/routes/git.d.ts +7 -7
- package/dist/src/routes/git.js +18 -18
- package/dist/src/routes/health.d.ts +6 -6
- package/dist/src/routes/health.js +12 -12
- package/dist/src/routes/helpers/sourceNotConfigured.d.ts +1 -1
- package/dist/src/routes/helpers/sourceNotConfigured.js +1 -1
- package/dist/src/routes/helpers.d.ts +1 -1
- package/dist/src/routes/helpers.js +1 -1
- package/dist/src/routes/list.d.ts +1 -1
- package/dist/src/routes/list.js +1 -1
- package/dist/src/routes/pending.d.ts +4 -4
- package/dist/src/routes/pending.js +9 -9
- package/dist/src/routes/policies.d.ts +4 -4
- package/dist/src/routes/policies.d.ts.map +1 -1
- package/dist/src/routes/policies.js +11 -11
- package/dist/src/routes/policies.js.map +1 -1
- package/dist/src/routes/raw.d.ts +1 -1
- package/dist/src/routes/raw.js +1 -1
- package/dist/src/routes/read.d.ts +1 -1
- package/dist/src/routes/read.js +1 -1
- package/dist/src/routes/search.d.ts +1 -1
- package/dist/src/routes/search.js +1 -1
- package/dist/src/routes/sources.d.ts +20 -5
- package/dist/src/routes/sources.d.ts.map +1 -1
- package/dist/src/routes/sources.js +118 -118
- package/dist/src/routes/sources.js.map +1 -1
- package/dist/src/routes/upload.d.ts +1 -1
- package/dist/src/routes/upload.js +1 -1
- package/dist/src/routes/write.d.ts +2 -2
- package/dist/src/routes/write.js +2 -2
- package/dist/src/services/BridgeService.d.ts +7 -1
- package/dist/src/services/BridgeService.d.ts.map +1 -1
- package/dist/src/services/BridgeService.js +15 -3
- package/dist/src/services/BridgeService.js.map +1 -1
- package/dist/src/services/FilesystemService.d.ts +1 -1
- package/dist/src/services/FilesystemService.js +2 -2
- package/dist/src/services/declaredSources.d.ts +9 -3
- package/dist/src/services/declaredSources.d.ts.map +1 -1
- package/dist/src/services/declaredSources.js +2 -1
- package/dist/src/services/declaredSources.js.map +1 -1
- package/dist/src/tools/execCtx.d.ts +2 -2
- package/dist/src/tools/execCtx.js +2 -2
- package/dist/src/tools/fs_read.d.ts.map +1 -1
- package/dist/src/tools/fs_read.js +5 -0
- package/dist/src/tools/fs_read.js.map +1 -1
- package/dist/src/usecases/embeddingBacklog.js +1 -1
- package/dist/src/usecases/embeddingBacklog.js.map +1 -1
- package/dist/src/usecases/readFiles.d.ts.map +1 -1
- package/dist/src/usecases/readFiles.js +84 -1
- package/dist/src/usecases/readFiles.js.map +1 -1
- package/dist/src/usecases/syncPointWrites.d.ts +2 -0
- package/dist/src/usecases/syncPointWrites.d.ts.map +1 -1
- package/dist/src/usecases/syncPointWrites.js +5 -1
- package/dist/src/usecases/syncPointWrites.js.map +1 -1
- package/dist/src/usecases/vectorMaintenance.js +1 -1
- package/dist/src/usecases/vectorMaintenance.js.map +1 -1
- package/dist/src/usecases/write/content.js +1 -1
- package/dist/tools/fs_list.json +1 -1
- package/dist/tools/fs_read.json +1 -1
- package/dist/tools/fs_search.json +1 -1
- package/dist/tools/fs_write.json +1 -1
- package/instructions/brain-model.md +1 -1
- package/package.json +70 -63
- package/rules/brain-rules.md +2 -2
- package/skills/brain-start/SKILL.md +1 -1
- package/skills/connect-business-data/SKILL.md +1 -1
- package/skills/create-package/SKILL.md +8 -8
- package/skills/create-package/references/connectors-and-uri-policies.md +7 -2
- package/skills/create-package/references/runtime-and-build.md +1 -1
- package/skills/create-package/references/skills-and-context.md +1 -1
- package/skills/create-package/references/test-and-ship.md +4 -4
- package/skills/create-package/scripts/check-package.sh +1 -1
- package/skills/git/SKILL.md +23 -23
- package/skills/manage-files/SKILL.md +13 -13
- package/skills/manage-files/scripts/upload.sh +1 -1
- package/skills/manage-sources/SKILL.md +55 -54
- package/skills/manage-sources/scripts/reembed.sh +1 -1
- package/skills/manage-uri-policy/SKILL.md +9 -9
- package/skills/organize/SKILL.md +1 -1
- package/skills/sync/SKILL.md +2 -2
- package/tools/fs_list.json +1 -1
- package/tools/fs_read.json +1 -1
- package/tools/fs_search.json +1 -1
- package/tools/fs_write.json +1 -1
- package/workflows/sources-digest.json +1 -1
- package/docs/drive-overview.md +0 -59
|
@@ -9,6 +9,6 @@
|
|
|
9
9
|
import type { ChannelSubscribeHandler } from '@neuralis/package-system/contracts';
|
|
10
10
|
export declare const channel = "filesystem";
|
|
11
11
|
/** The feature of the route this channel mirrors (`routes/events.ts`). */
|
|
12
|
-
export declare const feature = "
|
|
12
|
+
export declare const feature = "files.read";
|
|
13
13
|
export declare const subscribe: ChannelSubscribeHandler;
|
|
14
14
|
//# sourceMappingURL=filesystem.d.ts.map
|
|
@@ -9,7 +9,7 @@
|
|
|
9
9
|
import { subscribeFilesystemEventsImpl } from '../routes/helpers.js';
|
|
10
10
|
export const channel = 'filesystem';
|
|
11
11
|
/** The feature of the route this channel mirrors (`routes/events.ts`). */
|
|
12
|
-
export const feature = '
|
|
12
|
+
export const feature = 'files.read';
|
|
13
13
|
export const subscribe = async (session, params, emit, state) => {
|
|
14
14
|
if (params.agentIds.length === 0)
|
|
15
15
|
return () => { };
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
*
|
|
17
17
|
* ## The rule the policy encodes
|
|
18
18
|
*
|
|
19
|
-
* A member with `
|
|
19
|
+
* A member with `files.write` can put arbitrary bytes at a URI another member
|
|
20
20
|
* can read. If the byte lane then serves those bytes as a DOCUMENT on the app
|
|
21
21
|
* origin (`content-type: image/svg+xml` + `content-disposition: inline`), the
|
|
22
22
|
* document's script runs with the READER's session. That is a stored-XSS
|
|
@@ -67,7 +67,7 @@
|
|
|
67
67
|
* multipart part type), by the write engine's create lane (the caller's
|
|
68
68
|
* `fields.metadata`), and by its `fields` verb (a metadata PATCH — historically
|
|
69
69
|
* the least guarded of the three, because the deleted `modify` route excluded
|
|
70
|
-
* `set_fields` from the uri-policy check). All three are `
|
|
70
|
+
* `set_fields` from the uri-policy check). All three are `files.write`. `normalizeStoredMimeType` and
|
|
71
71
|
* `normalizeNodeMetadataMime` below close all three; each one left open keeps
|
|
72
72
|
* the classification input caller-controlled. The first round of this fix closed
|
|
73
73
|
* only ONE, the architect's review found the second, and the live run found the
|
|
@@ -159,7 +159,7 @@ export declare function normalizeStoredMimeType(declared: string | undefined, fi
|
|
|
159
159
|
*
|
|
160
160
|
* `metadata.mimeType` has THREE writers — the byte lane (the multipart part
|
|
161
161
|
* type), the write engine's create lane and its `fields` verb. All are
|
|
162
|
-
* `
|
|
162
|
+
* `files.write`, a MEMBER default on the seeded `data` source, and the field is
|
|
163
163
|
* the FIRST thing `loadRawBytes` reads — i.e. the input the byte lane's
|
|
164
164
|
* classifier rules on. Normalizing only one writer leaves that input
|
|
165
165
|
* caller-controlled, so all three go through here. The `fields` verb
|
package/dist/src/domain/mime.js
CHANGED
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
*
|
|
17
17
|
* ## The rule the policy encodes
|
|
18
18
|
*
|
|
19
|
-
* A member with `
|
|
19
|
+
* A member with `files.write` can put arbitrary bytes at a URI another member
|
|
20
20
|
* can read. If the byte lane then serves those bytes as a DOCUMENT on the app
|
|
21
21
|
* origin (`content-type: image/svg+xml` + `content-disposition: inline`), the
|
|
22
22
|
* document's script runs with the READER's session. That is a stored-XSS
|
|
@@ -67,7 +67,7 @@
|
|
|
67
67
|
* multipart part type), by the write engine's create lane (the caller's
|
|
68
68
|
* `fields.metadata`), and by its `fields` verb (a metadata PATCH — historically
|
|
69
69
|
* the least guarded of the three, because the deleted `modify` route excluded
|
|
70
|
-
* `set_fields` from the uri-policy check). All three are `
|
|
70
|
+
* `set_fields` from the uri-policy check). All three are `files.write`. `normalizeStoredMimeType` and
|
|
71
71
|
* `normalizeNodeMetadataMime` below close all three; each one left open keeps
|
|
72
72
|
* the classification input caller-controlled. The first round of this fix closed
|
|
73
73
|
* only ONE, the architect's review found the second, and the live run found the
|
|
@@ -280,7 +280,7 @@ export function normalizeStoredMimeType(declared, filename, bytes) {
|
|
|
280
280
|
*
|
|
281
281
|
* `metadata.mimeType` has THREE writers — the byte lane (the multipart part
|
|
282
282
|
* type), the write engine's create lane and its `fields` verb. All are
|
|
283
|
-
* `
|
|
283
|
+
* `files.write`, a MEMBER default on the seeded `data` source, and the field is
|
|
284
284
|
* the FIRST thing `loadRawBytes` reads — i.e. the input the byte lane's
|
|
285
285
|
* classifier rules on. Normalizing only one writer leaves that input
|
|
286
286
|
* caller-controlled, so all three go through here. The `fields` verb
|
|
@@ -17,8 +17,8 @@ export declare function scopeAccessCtxFromExecution(ctx: ExecutionContext): Scop
|
|
|
17
17
|
* Synthesize the per-record owner scope used by the pending-change floor.
|
|
18
18
|
* `canAccessScope` does NOT isolate per-user on a project-kind source (true for
|
|
19
19
|
* every member), so a `{kind:'user', userId}` scope makes the ONE shared
|
|
20
|
-
* predicate yield exactly "own record OR a `
|
|
21
|
-
* `
|
|
20
|
+
* predicate yield exactly "own record OR a `files.readOthers` /
|
|
21
|
+
* `files.writeOthers` HOLDER" — the grant decides, not the role NAME (D-A removed
|
|
22
22
|
* `canAccessScope`'s role-name conjunct, so a custom role granted the feature
|
|
23
23
|
* passes exactly like the seeded `owner`/`admin`). The `' __no_owner__'`
|
|
24
24
|
* sentinel (a leading space ⇒ an impossible real userId) fences an ownerless
|
|
@@ -23,8 +23,8 @@ export function scopeAccessCtxFromExecution(ctx) {
|
|
|
23
23
|
* Synthesize the per-record owner scope used by the pending-change floor.
|
|
24
24
|
* `canAccessScope` does NOT isolate per-user on a project-kind source (true for
|
|
25
25
|
* every member), so a `{kind:'user', userId}` scope makes the ONE shared
|
|
26
|
-
* predicate yield exactly "own record OR a `
|
|
27
|
-
* `
|
|
26
|
+
* predicate yield exactly "own record OR a `files.readOthers` /
|
|
27
|
+
* `files.writeOthers` HOLDER" — the grant decides, not the role NAME (D-A removed
|
|
28
28
|
* `canAccessScope`'s role-name conjunct, so a custom role granted the feature
|
|
29
29
|
* passes exactly like the seeded `owner`/`admin`). The `' __no_owner__'`
|
|
30
30
|
* sentinel (a leading space ⇒ an impossible real userId) fences an ownerless
|
|
@@ -245,7 +245,14 @@ export type ReadFilesResponse = {
|
|
|
245
245
|
createdAt?: string;
|
|
246
246
|
updatedAt?: string;
|
|
247
247
|
content?: string;
|
|
248
|
-
|
|
248
|
+
/**
|
|
249
|
+
* Where the content came from: the index (`brain`), the connector (`live`),
|
|
250
|
+
* or the INDEXED copy of a file whose source is offline (`index` — an
|
|
251
|
+
* offline paired device's text, up to what the index holds).
|
|
252
|
+
*/
|
|
253
|
+
readSource?: 'brain' | 'live' | 'index';
|
|
254
|
+
/** `readSource: 'index'` only: the indexed copy is shorter than the file was. */
|
|
255
|
+
truncated?: boolean;
|
|
249
256
|
version?: FileVersionInfo;
|
|
250
257
|
selected_version?: 'current' | 'baseline';
|
|
251
258
|
available_versions?: Array<'current' | 'baseline'>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/domain/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAE3E;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,iFAAiF;IACjF,QAAQ,CAAC,EAAE;QACT,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,SAAS,EAAE,MAAM,CAAC;QAClB,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC;IACF,kEAAkE;IAClE,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IAEjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAEhB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE3C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAElB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IAItB;4EACwE;IACxE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;6EACyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;oFACgF;IAChF,WAAW,CAAC,EAAE,OAAO,iCAAiC,EAAE,uBAAuB,CAAC;IAChF;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACnD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,4EAA4E;IAC5E,aAAa,CAAC,EAAE,IAAI,CAAC;IAErB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC;IAC5D,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,uEAAuE;IACvE,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B,CAAC;AAMF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4GAA4G;IAC5G,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,oFAAoF;IACpF,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oFAAoF;IACpF,YAAY,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IACtC,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,KAAK,CAAC;QACX,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ;;;;;;;;;;;;WAYG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QAC9B,OAAO,CAAC,EAAE,eAAe,CAAC;QAC1B,gBAAgB,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;QAC1C,kBAAkB,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC;QACnD;;;;WAIG;QACH,UAAU,CAAC,EAAE;YACX,KAAK,EAAE,MAAM,CAAC;YACd,GAAG,EAAE,MAAM,CAAC;YACZ,KAAK,EAAE,MAAM,CAAC;YACd,eAAe,EAAE,OAAO,CAAC;YACzB,cAAc,EAAE,OAAO,CAAC;YACxB;;;;;eAKG;YACH,QAAQ,EAAE,OAAO,CAAC;SACnB,CAAC;QACF;;;;WAIG;QACH,KAAK,CAAC,EAAE,OAAO,oCAAoC,EAAE,gBAAgB,CAAC;QACtE;;;;;;;WAOG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB;;;;WAIG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,oFAAoF;QACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,0EAA0E;QAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAgBF,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,OAAO,GAAG,SAAS,CAAC;AACtD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,yEAAyE;IACzE,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iGAAiG;IACjG,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,WAAW,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IAC9D;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+EAA+E;IAC/E,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACrJ,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE,KAAK,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,YAAY,CAAC;QACxB,wGAAwG;QACxG,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC,CAAC;IACH,KAAK,EAAE,KAAK,CAAC;QACX,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,kBAAkB,CAAC;QAC7B,QAAQ,CAAC,EAAE,YAAY,CAAC;QACxB;;;;;WAKG;QACH,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC,CAAC;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mFAAmF;IACnF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC7C;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,cAAc,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;IAChD,cAAc,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;IAChD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,kFAAkF;QAClF,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,4EAA4E;QAC5E,OAAO,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAAC,KAAK,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QAChD,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;QAC/C,gBAAgB,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;QAC/D,mGAAmG;QACnG,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;QACtC,gDAAgD;QAChD,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,kBAAkB,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,cAAc,GACd,aAAa,GACb,cAAc,GACd,QAAQ,GACR,eAAe,GACf,YAAY,GACZ,QAAQ,GACR,MAAM,GACN,QAAQ,CAAC;AAEb,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,YAAY,GAAG;IACzB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wCAAwC;IACxC,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,yEAAyE;IACzE,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,YAAY,CAAC;IACrB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oGAAoG;IACpG,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC9B,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;6EACyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8HAA8H;IAC9H,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEN;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,eAAe,CAAC;AAE9E,MAAM,MAAM,mBAAmB,GAAG;IAChC,kFAAkF;IAClF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,EAAE;QACJ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,UAAU,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,IAAI,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC"}
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/domain/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAE3E;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,iFAAiF;IACjF,QAAQ,CAAC,EAAE;QACT,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,SAAS,EAAE,MAAM,CAAC;QAClB,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC;IACF,kEAAkE;IAClE,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IAEjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAEhB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE3C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAElB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IAItB;4EACwE;IACxE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;6EACyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;oFACgF;IAChF,WAAW,CAAC,EAAE,OAAO,iCAAiC,EAAE,uBAAuB,CAAC;IAChF;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACnD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,4EAA4E;IAC5E,aAAa,CAAC,EAAE,IAAI,CAAC;IAErB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC;IAC5D,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,uEAAuE;IACvE,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B,CAAC;AAMF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4GAA4G;IAC5G,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,oFAAoF;IACpF,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oFAAoF;IACpF,YAAY,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IACtC,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,KAAK,CAAC;QACX,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ;;;;;;;;;;;;WAYG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;;WAIG;QACH,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;QACxC,iFAAiF;QACjF,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,OAAO,CAAC,EAAE,eAAe,CAAC;QAC1B,gBAAgB,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;QAC1C,kBAAkB,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC;QACnD;;;;WAIG;QACH,UAAU,CAAC,EAAE;YACX,KAAK,EAAE,MAAM,CAAC;YACd,GAAG,EAAE,MAAM,CAAC;YACZ,KAAK,EAAE,MAAM,CAAC;YACd,eAAe,EAAE,OAAO,CAAC;YACzB,cAAc,EAAE,OAAO,CAAC;YACxB;;;;;eAKG;YACH,QAAQ,EAAE,OAAO,CAAC;SACnB,CAAC;QACF;;;;WAIG;QACH,KAAK,CAAC,EAAE,OAAO,oCAAoC,EAAE,gBAAgB,CAAC;QACtE;;;;;;;WAOG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB;;;;WAIG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,oFAAoF;QACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,0EAA0E;QAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAgBF,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,OAAO,GAAG,SAAS,CAAC;AACtD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,yEAAyE;IACzE,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iGAAiG;IACjG,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,WAAW,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IAC9D;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+EAA+E;IAC/E,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACrJ,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE,KAAK,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,YAAY,CAAC;QACxB,wGAAwG;QACxG,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC,CAAC;IACH,KAAK,EAAE,KAAK,CAAC;QACX,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,kBAAkB,CAAC;QAC7B,QAAQ,CAAC,EAAE,YAAY,CAAC;QACxB;;;;;WAKG;QACH,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC,CAAC;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mFAAmF;IACnF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC7C;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,cAAc,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;IAChD,cAAc,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;IAChD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,kFAAkF;QAClF,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,4EAA4E;QAC5E,OAAO,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAAC,KAAK,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QAChD,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;QAC/C,gBAAgB,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;QAC/D,mGAAmG;QACnG,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;QACtC,gDAAgD;QAChD,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,kBAAkB,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,cAAc,GACd,aAAa,GACb,cAAc,GACd,QAAQ,GACR,eAAe,GACf,YAAY,GACZ,QAAQ,GACR,MAAM,GACN,QAAQ,CAAC;AAEb,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,YAAY,GAAG;IACzB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wCAAwC;IACxC,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,yEAAyE;IACzE,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,YAAY,CAAC;IACrB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oGAAoG;IACpG,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC9B,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;6EACyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8HAA8H;IAC9H,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEN;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,eAAe,CAAC;AAE9E,MAAM,MAAM,mBAAmB,GAAG;IAChC,kFAAkF;IAClF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,EAAE;QACJ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,UAAU,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,IAAI,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC"}
|
|
@@ -17,7 +17,7 @@
|
|
|
17
17
|
* `pending:changed` re-count debounce.
|
|
18
18
|
*
|
|
19
19
|
* `visible`: a role-holding member of the event's project — the declaration's
|
|
20
|
-
* `requires.features` (`
|
|
20
|
+
* `requires.features` (`files.read`, the pending route's feature) is checked by
|
|
21
21
|
* the host before this runs. Content-free, so nothing else is needed to judge
|
|
22
22
|
* it; the list behind the `nav` re-applies every per-record gate.
|
|
23
23
|
*
|
|
@@ -17,7 +17,7 @@
|
|
|
17
17
|
* `pending:changed` re-count debounce.
|
|
18
18
|
*
|
|
19
19
|
* `visible`: a role-holding member of the event's project — the declaration's
|
|
20
|
-
* `requires.features` (`
|
|
20
|
+
* `requires.features` (`files.read`, the pending route's feature) is checked by
|
|
21
21
|
* the host before this runs. Content-free, so nothing else is needed to judge
|
|
22
22
|
* it; the list behind the `nav` re-applies every per-record gate.
|
|
23
23
|
*
|
|
@@ -444,7 +444,7 @@ export declare function getSourceGitSummary(resolvedRoot: string, gitBin?: strin
|
|
|
444
444
|
* owner gains write via `byRole`/`byUser`). PURE (no git I/O) → O(1)/source, safe on
|
|
445
445
|
* the hot list path. Deny-by-default: false unless BOTH planes allow.
|
|
446
446
|
*
|
|
447
|
-
* canWrite = caller HAS `
|
|
447
|
+
* canWrite = caller HAS `files.write` (the file-level FEATURE, same predicate as
|
|
448
448
|
* the route `denyIfNoWrite`) ∧ the caller's RESOLVED uri-policy
|
|
449
449
|
* `write` on the source ROOT `<slug>://` is allowed.
|
|
450
450
|
*/
|
|
@@ -457,7 +457,7 @@ export declare function resolveGitCanWrite(permissions: HierarchicalPermissions,
|
|
|
457
457
|
* ROOT `<slug>://`, exactly what the remote-op route gates on
|
|
458
458
|
* (`resolveGitSource({capability:'exec'})`). Drives whether the panel enables
|
|
459
459
|
* the fetch/pull/push popover vs the "grant exec" affordance. Unlike canWrite it
|
|
460
|
-
* does NOT gate the `
|
|
460
|
+
* does NOT gate the `files.write` FEATURE (the route + the panel's canWrite
|
|
461
461
|
* trigger gate that separately) — it reflects ONLY the exec policy so the
|
|
462
462
|
* affordance is precise. PURE (no git I/O). Deny-by-default: `exec:false`
|
|
463
463
|
* baseline out of the box.
|
|
@@ -802,12 +802,12 @@ async function computeSummaryUncached(resolvedRoot, gitBin) {
|
|
|
802
802
|
* owner gains write via `byRole`/`byUser`). PURE (no git I/O) → O(1)/source, safe on
|
|
803
803
|
* the hot list path. Deny-by-default: false unless BOTH planes allow.
|
|
804
804
|
*
|
|
805
|
-
* canWrite = caller HAS `
|
|
805
|
+
* canWrite = caller HAS `files.write` (the file-level FEATURE, same predicate as
|
|
806
806
|
* the route `denyIfNoWrite`) ∧ the caller's RESOLVED uri-policy
|
|
807
807
|
* `write` on the source ROOT `<slug>://` is allowed.
|
|
808
808
|
*/
|
|
809
809
|
export function resolveGitCanWrite(permissions, source, createdBy, caller) {
|
|
810
|
-
if (!hasFeature({ grantedFeatures: caller.grantedFeatures ?? [] }, '
|
|
810
|
+
if (!hasFeature({ grantedFeatures: caller.grantedFeatures ?? [] }, 'files.write'))
|
|
811
811
|
return false;
|
|
812
812
|
return (resolvePermissions(permissions, `${source}://`, {
|
|
813
813
|
userId: caller.userId,
|
|
@@ -825,7 +825,7 @@ export function resolveGitCanWrite(permissions, source, createdBy, caller) {
|
|
|
825
825
|
* ROOT `<slug>://`, exactly what the remote-op route gates on
|
|
826
826
|
* (`resolveGitSource({capability:'exec'})`). Drives whether the panel enables
|
|
827
827
|
* the fetch/pull/push popover vs the "grant exec" affordance. Unlike canWrite it
|
|
828
|
-
* does NOT gate the `
|
|
828
|
+
* does NOT gate the `files.write` FEATURE (the route + the panel's canWrite
|
|
829
829
|
* trigger gate that separately) — it reflects ONLY the exec policy so the
|
|
830
830
|
* affordance is precise. PURE (no git I/O). Deny-by-default: `exec:false`
|
|
831
831
|
* baseline out of the box.
|
package/dist/src/lifecycle.d.ts
CHANGED
|
@@ -67,7 +67,7 @@ export type BrainCoreApi = {
|
|
|
67
67
|
* per source (local kinds: a single `fs.access`; webtop: in-memory session
|
|
68
68
|
* lookup) — NO live walk / vector count — so it is safe to call once per
|
|
69
69
|
* stream without hurting time-to-first-token. Scope + feature filtered
|
|
70
|
-
* (`canAccessScope` → `
|
|
70
|
+
* (`canAccessScope` → `files.readOthers` for user/agent-scoped
|
|
71
71
|
* sources), deny-by-default.
|
|
72
72
|
*/
|
|
73
73
|
listSourceRuntimeSummaries: (projectId: string, opts: SourceRuntimeSummaryOptions) => Promise<SourceRuntimeSummary[]>;
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import type { RouteHandler } from '@neuralis/package-system/contracts';
|
|
2
2
|
export declare const pattern = "approve";
|
|
3
|
-
export declare const feature = "
|
|
3
|
+
export declare const feature = "files.write";
|
|
4
4
|
export declare const POST: RouteHandler;
|
|
5
5
|
//# sourceMappingURL=approve.d.ts.map
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { SourcePermissionDeniedError } from '../domain/sourceConfig.js';
|
|
2
2
|
import { extractCtx, ensureAccess, getServices } from './helpers.js';
|
|
3
3
|
export const pattern = 'approve';
|
|
4
|
-
export const feature = '
|
|
4
|
+
export const feature = 'files.write';
|
|
5
5
|
export const POST = async (req, raw) => {
|
|
6
6
|
const state = raw;
|
|
7
7
|
const ctx = extractCtx(req);
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import type { RouteHandler } from '@neuralis/package-system/contracts';
|
|
2
2
|
export declare const pattern = "events";
|
|
3
|
-
export declare const feature = "
|
|
3
|
+
export declare const feature = "files.read";
|
|
4
4
|
export declare const GET: RouteHandler;
|
|
5
5
|
//# sourceMappingURL=events.d.ts.map
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { extractCtx, ensureAccess, subscribeFilesystemEventsImpl } from './helpers.js';
|
|
2
2
|
export const pattern = 'events';
|
|
3
|
-
export const feature = '
|
|
3
|
+
export const feature = 'files.read';
|
|
4
4
|
const HEARTBEAT_MS = 25_000;
|
|
5
5
|
export const GET = async (req, raw) => {
|
|
6
6
|
const state = raw;
|
package/dist/src/routes/git.d.ts
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
* "Git Control" sidebar panel, branch-switcher, side-by-side diff, and the
|
|
4
4
|
* in-panel commit graph.
|
|
5
5
|
*
|
|
6
|
-
* READ routes (GET, `
|
|
6
|
+
* READ routes (GET, `files.read`-gated):
|
|
7
7
|
* GET /git/status?source=<slug> — the WHOLE-repo change-set (staged /
|
|
8
8
|
* unstaged / untracked) + current branch +
|
|
9
9
|
* upstream/ahead/behind when an upstream
|
|
@@ -75,7 +75,7 @@
|
|
|
75
75
|
* including the hunk-extracted ones. Without `repo` everything is
|
|
76
76
|
* byte-identical to the single-repo behavior.
|
|
77
77
|
*
|
|
78
|
-
* WRITE routes (POST, additionally `
|
|
78
|
+
* WRITE routes (POST, additionally `files.write`-gated — G2.3):
|
|
79
79
|
* POST /git/stage {source, paths?[], hunk?} — whole-file `add` OR hunk
|
|
80
80
|
* `apply --cached`.
|
|
81
81
|
* POST /git/unstage {source, paths?[], hunk?} — whole-file `reset -- <p>`
|
|
@@ -90,7 +90,7 @@
|
|
|
90
90
|
* (plain, non-force — git refuses
|
|
91
91
|
* if it would overwrite local changes).
|
|
92
92
|
*
|
|
93
|
-
* REMOTE routes (POST, `
|
|
93
|
+
* REMOTE routes (POST, `files.write` + uri-policy `exec` — G4 keyring-kestrel Slice 2):
|
|
94
94
|
* POST /git/fetch {source} — `git fetch origin` (updates remote-tracking refs).
|
|
95
95
|
* POST /git/pull {source} — `fetch` + `merge --ff-only FETCH_HEAD` (S4: token
|
|
96
96
|
* never rides the working-tree-writing merge).
|
|
@@ -114,7 +114,7 @@
|
|
|
114
114
|
* composed ONCE in the resolver, threaded into `guardWritePaths` (incl.
|
|
115
115
|
* hunk-extracted paths) so no gate site can drift (MAJOR-B).
|
|
116
116
|
* - WRITE is the HUMAN face: the caller's authenticated session IS the consent
|
|
117
|
-
* (uri-policy `write` + the `
|
|
117
|
+
* (uri-policy `write` + the `files.write` feature). The agent-approval
|
|
118
118
|
* `PendingInteraction` ladder is a SEPARATE later increment (G3) — NOT here.
|
|
119
119
|
* A synthetic/agent sentinel identity is rejected upstream (catch-all boundary).
|
|
120
120
|
* - Q6 SECURITY FLOOR: before ANY destructive op (discard, branch -D) the SERVER
|
|
@@ -134,13 +134,13 @@
|
|
|
134
134
|
import type { RouteHandler } from '@neuralis/package-system/contracts';
|
|
135
135
|
import { type GitBranchInfo } from '../git/GitRunner.js';
|
|
136
136
|
export declare const pattern = "git/*";
|
|
137
|
-
export declare const feature = "
|
|
137
|
+
export declare const feature = "files.read";
|
|
138
138
|
export declare const escalations: string[];
|
|
139
139
|
export declare const GET: RouteHandler;
|
|
140
140
|
/**
|
|
141
141
|
* WRITE routes (G2.3) — the HUMAN face of the git engine. Dispatched on
|
|
142
|
-
* `req.path[0]`. Each handler additionally gates `
|
|
143
|
-
* `feature` only guarantees `
|
|
142
|
+
* `req.path[0]`. Each handler additionally gates `files.write` (the file-level
|
|
143
|
+
* `feature` only guarantees `files.read`) and the uri-policy `write` capability,
|
|
144
144
|
* auto-snapshots before a destructive op (Q6), and publishes the IN-APP badge
|
|
145
145
|
* with the actor's real identity (N3) on success.
|
|
146
146
|
*/
|
package/dist/src/routes/git.js
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
* "Git Control" sidebar panel, branch-switcher, side-by-side diff, and the
|
|
4
4
|
* in-panel commit graph.
|
|
5
5
|
*
|
|
6
|
-
* READ routes (GET, `
|
|
6
|
+
* READ routes (GET, `files.read`-gated):
|
|
7
7
|
* GET /git/status?source=<slug> — the WHOLE-repo change-set (staged /
|
|
8
8
|
* unstaged / untracked) + current branch +
|
|
9
9
|
* upstream/ahead/behind when an upstream
|
|
@@ -75,7 +75,7 @@
|
|
|
75
75
|
* including the hunk-extracted ones. Without `repo` everything is
|
|
76
76
|
* byte-identical to the single-repo behavior.
|
|
77
77
|
*
|
|
78
|
-
* WRITE routes (POST, additionally `
|
|
78
|
+
* WRITE routes (POST, additionally `files.write`-gated — G2.3):
|
|
79
79
|
* POST /git/stage {source, paths?[], hunk?} — whole-file `add` OR hunk
|
|
80
80
|
* `apply --cached`.
|
|
81
81
|
* POST /git/unstage {source, paths?[], hunk?} — whole-file `reset -- <p>`
|
|
@@ -90,7 +90,7 @@
|
|
|
90
90
|
* (plain, non-force — git refuses
|
|
91
91
|
* if it would overwrite local changes).
|
|
92
92
|
*
|
|
93
|
-
* REMOTE routes (POST, `
|
|
93
|
+
* REMOTE routes (POST, `files.write` + uri-policy `exec` — G4 keyring-kestrel Slice 2):
|
|
94
94
|
* POST /git/fetch {source} — `git fetch origin` (updates remote-tracking refs).
|
|
95
95
|
* POST /git/pull {source} — `fetch` + `merge --ff-only FETCH_HEAD` (S4: token
|
|
96
96
|
* never rides the working-tree-writing merge).
|
|
@@ -114,7 +114,7 @@
|
|
|
114
114
|
* composed ONCE in the resolver, threaded into `guardWritePaths` (incl.
|
|
115
115
|
* hunk-extracted paths) so no gate site can drift (MAJOR-B).
|
|
116
116
|
* - WRITE is the HUMAN face: the caller's authenticated session IS the consent
|
|
117
|
-
* (uri-policy `write` + the `
|
|
117
|
+
* (uri-policy `write` + the `files.write` feature). The agent-approval
|
|
118
118
|
* `PendingInteraction` ladder is a SEPARATE later increment (G3) — NOT here.
|
|
119
119
|
* A synthetic/agent sentinel identity is rejected upstream (catch-all boundary).
|
|
120
120
|
* - Q6 SECURITY FLOOR: before ANY destructive op (discard, branch -D) the SERVER
|
|
@@ -145,10 +145,10 @@ import { resolveGitToken } from '../git/tokenResolve.js';
|
|
|
145
145
|
import { extractCtx, ensureAccess, getServices, toScopeAccessCtx, publishInAppGitBadge, } from './helpers.js';
|
|
146
146
|
import { assertUriCapability, uriPolicyDeniedResponse, UriPolicyDeniedError, } from './helpers/uriGuard.js';
|
|
147
147
|
export const pattern = 'git/*';
|
|
148
|
-
export const feature = '
|
|
148
|
+
export const feature = 'files.read';
|
|
149
149
|
// The mutating op-class escalates in-handler (`denyIfNoWrite`, and the per-row
|
|
150
150
|
// `canWrite` projection); the module gate only guarantees the read tier.
|
|
151
|
-
export const escalations = ['
|
|
151
|
+
export const escalations = ['files.write'];
|
|
152
152
|
/** Max change-set entries returned across all three buckets (response size cap). */
|
|
153
153
|
const MAX_STATUS_ENTRIES = 1000;
|
|
154
154
|
/**
|
|
@@ -221,8 +221,8 @@ export const GET = async (req, raw) => {
|
|
|
221
221
|
};
|
|
222
222
|
/**
|
|
223
223
|
* WRITE routes (G2.3) — the HUMAN face of the git engine. Dispatched on
|
|
224
|
-
* `req.path[0]`. Each handler additionally gates `
|
|
225
|
-
* `feature` only guarantees `
|
|
224
|
+
* `req.path[0]`. Each handler additionally gates `files.write` (the file-level
|
|
225
|
+
* `feature` only guarantees `files.read`) and the uri-policy `write` capability,
|
|
226
226
|
* auto-snapshots before a destructive op (Q6), and publishes the IN-APP badge
|
|
227
227
|
* with the actor's real identity (N3) on success.
|
|
228
228
|
*/
|
|
@@ -932,7 +932,7 @@ async function handleGitRepos(req, state) {
|
|
|
932
932
|
}
|
|
933
933
|
/**
|
|
934
934
|
* Per-repo write capability for a `/git/repos` row (MAJOR-C tail) — the SAME
|
|
935
|
-
* two-plane gate as `resolveGitCanWrite` (the caller must HOLD `
|
|
935
|
+
* two-plane gate as `resolveGitCanWrite` (the caller must HOLD `files.write`
|
|
936
936
|
* AND the resolved uri-policy `write` must allow), evaluated at the REPO
|
|
937
937
|
* granularity `<slug>://<repo>/`: root-level canWrite is the wrong
|
|
938
938
|
* granularity in both directions — a `<repo>/**` write-deny must flip that
|
|
@@ -949,7 +949,7 @@ function resolveRepoCanWrite(resolved, rel) {
|
|
|
949
949
|
return false;
|
|
950
950
|
if (rel === '')
|
|
951
951
|
return resolveGitCanWrite(permissions, source, createdBy, ctx);
|
|
952
|
-
if (!hasFeature({ grantedFeatures: ctx.grantedFeatures }, '
|
|
952
|
+
if (!hasFeature({ grantedFeatures: ctx.grantedFeatures }, 'files.write'))
|
|
953
953
|
return false;
|
|
954
954
|
return (resolvePermissions(permissions, `${source}://${rel}/`, {
|
|
955
955
|
userId: ctx.userId,
|
|
@@ -965,7 +965,7 @@ function resolveRepoCanWrite(resolved, rel) {
|
|
|
965
965
|
* Per-repo REMOTE-op capability (NIT-2) — the uri-policy `exec` capability at
|
|
966
966
|
* the repo granularity `<slug>://[<rel>/]`, exactly what the remote-op route
|
|
967
967
|
* gates on (`resolveGitSource({capability:'exec'})`). Unlike canWrite this does
|
|
968
|
-
* NOT gate `
|
|
968
|
+
* NOT gate `files.write` (the route gates that separately) — it reflects ONLY
|
|
969
969
|
* whether `exec` is granted, so the panel can show a precise "grant exec to
|
|
970
970
|
* enable remote ops" affordance. PURE — no git I/O.
|
|
971
971
|
*/
|
|
@@ -1035,7 +1035,7 @@ function filterReadableChanges(resolved, rows) {
|
|
|
1035
1035
|
});
|
|
1036
1036
|
}
|
|
1037
1037
|
// ---------------------------------------------------------------------------
|
|
1038
|
-
// WRITE handlers (G2.3) — the HUMAN face; each gates `
|
|
1038
|
+
// WRITE handlers (G2.3) — the HUMAN face; each gates `files.write` + uri-policy
|
|
1039
1039
|
// `write`, and returns { ok:true, ... } / a structured error.
|
|
1040
1040
|
// ---------------------------------------------------------------------------
|
|
1041
1041
|
async function handleStage(req, state) {
|
|
@@ -1287,7 +1287,7 @@ async function handleCheckout(req, state) {
|
|
|
1287
1287
|
* - `{kind:'branch', ref:<anchor>, name}` → `git branch <name> <anchor>`
|
|
1288
1288
|
* (recreate a deleted branch; NON-force → git 409s on an existing name, never
|
|
1289
1289
|
* clobbers a live branch).
|
|
1290
|
-
* Gated EXACTLY like the other writes: `
|
|
1290
|
+
* Gated EXACTLY like the other writes: `files.write` + uri-policy `write` (root) —
|
|
1291
1291
|
* NO new capability, NO exec, NO per-path gate (stash-apply is whole-WT), NO
|
|
1292
1292
|
* `PendingInteraction` (a human-consent WRITE route). The caller-echoed
|
|
1293
1293
|
* `ref`/`name` are `#guardRef`-validated at the GitRunner boundary (m4). A
|
|
@@ -1351,7 +1351,7 @@ const GIT_REMOTE = 'origin';
|
|
|
1351
1351
|
* POST /git/fetch | /git/pull | /git/push — the network-reaching git ops
|
|
1352
1352
|
* (G4 keyring-kestrel Slice 2). The security-heaviest git surface:
|
|
1353
1353
|
*
|
|
1354
|
-
* 1. `
|
|
1354
|
+
* 1. `files.write` (feature) + uri-policy `exec` on the SOURCE ROOT
|
|
1355
1355
|
* (`capability:'exec'`) — remote ops are exec-class, deny-by-default
|
|
1356
1356
|
* (`exec:false` out of the box → 403 with the D4 grant-exec affordance).
|
|
1357
1357
|
* 2. Derive the remote HOST server-side from the checkout's `origin` URL
|
|
@@ -1470,17 +1470,17 @@ async function handleRemoteOp(req, state, op) {
|
|
|
1470
1470
|
// WRITE helpers
|
|
1471
1471
|
// ---------------------------------------------------------------------------
|
|
1472
1472
|
/**
|
|
1473
|
-
* The `
|
|
1473
|
+
* The `files.write` feature gate for every WRITE route. Checked FIRST (before the
|
|
1474
1474
|
* source is resolved) so a write-lacking caller gets a UNIFORM 403 regardless of
|
|
1475
1475
|
* whether the source exists — no existence inference. The file-level `feature`
|
|
1476
|
-
* export only guarantees `
|
|
1476
|
+
* export only guarantees `files.read`; the mutation op-class needs `files.write`.
|
|
1477
1477
|
*/
|
|
1478
1478
|
function denyIfNoWrite(req) {
|
|
1479
|
-
if (hasFeature(req.session, '
|
|
1479
|
+
if (hasFeature(req.session, 'files.write'))
|
|
1480
1480
|
return null;
|
|
1481
1481
|
return {
|
|
1482
1482
|
status: 403,
|
|
1483
|
-
body: { error: "Forbidden: missing feature '
|
|
1483
|
+
body: { error: "Forbidden: missing feature 'files.write'", code: 'feature_denied', feature: 'files.write' },
|
|
1484
1484
|
};
|
|
1485
1485
|
}
|
|
1486
1486
|
/**
|
|
@@ -2,14 +2,14 @@
|
|
|
2
2
|
* Vector-index health.
|
|
3
3
|
*
|
|
4
4
|
* TWO TIERS, and the second one is hand-coded. The module feature is
|
|
5
|
-
* `
|
|
5
|
+
* `files.read` — a `viewer` default — because the bare path and `scan` are
|
|
6
6
|
* pure reads. The `gc` sub-path is not: it runs `garbageCollect` /
|
|
7
7
|
* `repairOrphans`, whose `dryRun` DEFAULTS TO FALSE, so an un-parameterised
|
|
8
8
|
* call really deletes the project's `deleted` vector points. It therefore
|
|
9
|
-
* escalates in-handler to `
|
|
10
|
-
* caller without it with 403 `Missing feature:
|
|
9
|
+
* escalates in-handler to `files.write` (`escalations` below) and answers a
|
|
10
|
+
* caller without it with 403 `Missing feature: files.write (vector health
|
|
11
11
|
* repair)`, exactly as the sibling `policies` route escalates to
|
|
12
|
-
* `
|
|
12
|
+
* `sources.policy`. Its `repair-pending` action runs on the CALLER's context (the
|
|
13
13
|
* per-record pending floor), not the project scope the vector passes use.
|
|
14
14
|
* `ensureAccess` is the orthogonal SCOPE axis (which agent),
|
|
15
15
|
* never a write-feature gate — it cannot stand in for this one.
|
|
@@ -20,7 +20,7 @@
|
|
|
20
20
|
*
|
|
21
21
|
* The `hot-uris` sub-path (the vector write monitor) is a read, but it names
|
|
22
22
|
* files across the project's users and agents, so it takes the SAME
|
|
23
|
-
* `
|
|
23
|
+
* `files.write` tier and then filters per uri for the caller
|
|
24
24
|
* (`usecases/writeMonitor.ts` `listHotUris`): source scope, the uri READ
|
|
25
25
|
* policy, and agent isolation for `brain://`.
|
|
26
26
|
*
|
|
@@ -36,7 +36,7 @@
|
|
|
36
36
|
*/
|
|
37
37
|
import type { RouteHandler } from '@neuralis/package-system/contracts';
|
|
38
38
|
export declare const pattern = "health/*";
|
|
39
|
-
export declare const feature = "
|
|
39
|
+
export declare const feature = "files.read";
|
|
40
40
|
export declare const escalations: string[];
|
|
41
41
|
export declare const GET: RouteHandler;
|
|
42
42
|
export declare const POST: RouteHandler;
|
|
@@ -2,14 +2,14 @@
|
|
|
2
2
|
* Vector-index health.
|
|
3
3
|
*
|
|
4
4
|
* TWO TIERS, and the second one is hand-coded. The module feature is
|
|
5
|
-
* `
|
|
5
|
+
* `files.read` — a `viewer` default — because the bare path and `scan` are
|
|
6
6
|
* pure reads. The `gc` sub-path is not: it runs `garbageCollect` /
|
|
7
7
|
* `repairOrphans`, whose `dryRun` DEFAULTS TO FALSE, so an un-parameterised
|
|
8
8
|
* call really deletes the project's `deleted` vector points. It therefore
|
|
9
|
-
* escalates in-handler to `
|
|
10
|
-
* caller without it with 403 `Missing feature:
|
|
9
|
+
* escalates in-handler to `files.write` (`escalations` below) and answers a
|
|
10
|
+
* caller without it with 403 `Missing feature: files.write (vector health
|
|
11
11
|
* repair)`, exactly as the sibling `policies` route escalates to
|
|
12
|
-
* `
|
|
12
|
+
* `sources.policy`. Its `repair-pending` action runs on the CALLER's context (the
|
|
13
13
|
* per-record pending floor), not the project scope the vector passes use.
|
|
14
14
|
* `ensureAccess` is the orthogonal SCOPE axis (which agent),
|
|
15
15
|
* never a write-feature gate — it cannot stand in for this one.
|
|
@@ -20,7 +20,7 @@
|
|
|
20
20
|
*
|
|
21
21
|
* The `hot-uris` sub-path (the vector write monitor) is a read, but it names
|
|
22
22
|
* files across the project's users and agents, so it takes the SAME
|
|
23
|
-
* `
|
|
23
|
+
* `files.write` tier and then filters per uri for the caller
|
|
24
24
|
* (`usecases/writeMonitor.ts` `listHotUris`): source scope, the uri READ
|
|
25
25
|
* policy, and agent isolation for `brain://`.
|
|
26
26
|
*
|
|
@@ -43,10 +43,10 @@ import { buildRebuildDeps } from '../usecases/vector/rebuildGeneration.js';
|
|
|
43
43
|
import { resolveNeuralisHome } from '@neuralis/package-system/paths';
|
|
44
44
|
import { extractCtx, ensureAccess, getServices } from './helpers.js';
|
|
45
45
|
export const pattern = 'health/*';
|
|
46
|
-
export const feature = '
|
|
47
|
-
// The `gc` and `hot-uris` sub-paths escalate in-handler to `
|
|
46
|
+
export const feature = 'files.read';
|
|
47
|
+
// The `gc` and `hot-uris` sub-paths escalate in-handler to `files.write`, the
|
|
48
48
|
// `collection` sub-path to `platform.vector.maintain`; the module gate is the read tier.
|
|
49
|
-
export const escalations = ['
|
|
49
|
+
export const escalations = ['files.write', 'platform.vector.maintain'];
|
|
50
50
|
const MAINTAIN_FEATURE = 'platform.vector.maintain';
|
|
51
51
|
export const GET = async (req, raw) => {
|
|
52
52
|
const state = raw;
|
|
@@ -61,8 +61,8 @@ export const GET = async (req, raw) => {
|
|
|
61
61
|
};
|
|
62
62
|
}
|
|
63
63
|
if (sub === 'hot-uris') {
|
|
64
|
-
if (!hasFeature({ grantedFeatures: ctx.grantedFeatures }, '
|
|
65
|
-
return { status: 403, body: { error: 'Missing feature:
|
|
64
|
+
if (!hasFeature({ grantedFeatures: ctx.grantedFeatures }, 'files.write')) {
|
|
65
|
+
return { status: 403, body: { error: 'Missing feature: files.write (vector write monitor)' } };
|
|
66
66
|
}
|
|
67
67
|
return handleHotUris(ctx, state);
|
|
68
68
|
}
|
|
@@ -86,8 +86,8 @@ export const POST = async (req, raw) => {
|
|
|
86
86
|
await ensureAccess(ctx, state);
|
|
87
87
|
const [sub] = req.path;
|
|
88
88
|
if (sub === 'gc') {
|
|
89
|
-
if (!hasFeature({ grantedFeatures: ctx.grantedFeatures }, '
|
|
90
|
-
return { status: 403, body: { error: 'Missing feature:
|
|
89
|
+
if (!hasFeature({ grantedFeatures: ctx.grantedFeatures }, 'files.write')) {
|
|
90
|
+
return { status: 403, body: { error: 'Missing feature: files.write (vector health repair)' } };
|
|
91
91
|
}
|
|
92
92
|
try {
|
|
93
93
|
return await handleHealthGc(req, ctx, state);
|
|
@@ -14,7 +14,7 @@
|
|
|
14
14
|
* - **The suggestion list is the caller's OWN visible set**, resolved through
|
|
15
15
|
* `FilesystemService.listAccessibleSourceNames` (`canAccessScope` +
|
|
16
16
|
* source-level read + enabled). A raw `sourceConfigs.list()` here would make
|
|
17
|
-
* a `
|
|
17
|
+
* a `files.read` error body a cross-scope source enumerator — strictly worse
|
|
18
18
|
* than the 500 it replaces. Live-verified across two identities and two
|
|
19
19
|
* projects, including a cache-poisoning attempt: 13 probes, zero leaks.
|
|
20
20
|
* - **`nextStep` stays an enum TOKEN**, like `SourceDisabledError.nextStep`.
|
|
@@ -14,7 +14,7 @@
|
|
|
14
14
|
* - **The suggestion list is the caller's OWN visible set**, resolved through
|
|
15
15
|
* `FilesystemService.listAccessibleSourceNames` (`canAccessScope` +
|
|
16
16
|
* source-level read + enabled). A raw `sourceConfigs.list()` here would make
|
|
17
|
-
* a `
|
|
17
|
+
* a `files.read` error body a cross-scope source enumerator — strictly worse
|
|
18
18
|
* than the 500 it replaces. Live-verified across two identities and two
|
|
19
19
|
* projects, including a cache-poisoning attempt: 13 probes, zero leaks.
|
|
20
20
|
* - **`nextStep` stays an enum TOKEN**, like `SourceDisabledError.nextStep`.
|
|
@@ -106,7 +106,7 @@ export declare function httpError(status: number, message: string): Error & {
|
|
|
106
106
|
* Without it the WHOLE open-shape `connection.config` is withheld — never a
|
|
107
107
|
* `root`/`hostRoot` denylist, because a later root-bearing kind carries its
|
|
108
108
|
* path under a key no list names.
|
|
109
|
-
* - `maySeeSyncErrors`: the caller holds `
|
|
109
|
+
* - `maySeeSyncErrors`: the caller holds `sources.sync`. The raw last-sync error
|
|
110
110
|
* names files (URIs the caller may not read) and container paths, so below
|
|
111
111
|
* that tier a fixed text only says the run failed — never a variant scrubbed
|
|
112
112
|
* of absolute paths, which would still carry the file names.
|
|
@@ -132,7 +132,7 @@ export async function subscribeFilesystemEventsImpl(state, session, agentIds, ty
|
|
|
132
132
|
}
|
|
133
133
|
// The derived `pending:changed` frame needs no agent or source match: the
|
|
134
134
|
// subscription itself is the gate (the channel and the `/events` route are both
|
|
135
|
-
// `
|
|
135
|
+
// `files.read`, the hub resolves membership) plus the project check below.
|
|
136
136
|
const deliversPendingSignal = acceptedTypes.size === 0 || acceptedTypes.has('pending:changed');
|
|
137
137
|
return state.subscribeEvents(session.projectId, (event) => {
|
|
138
138
|
const e = event;
|