@nocobase/app-plugin-agents 0.1.0-beta.1 → 0.1.0-beta.10

package/dist/server/core/runs/extensions.js

@@ -13,7 +13,10 @@
  *
  * - Repository access is asked per run (`forRun`, in the claim's transaction) once the run has repositories to check
  *   out. Its credentials are minted in `prepare` (a network call is fine there), handed to the runner in the payload
- *   and never stored; the claim remembers them as secrets, so nothing the run reports carries them.
+ *   and never stored; the claim remembers them as secrets, so nothing the run reports carries them. When the runner
+ *   asks for credentials on demand (the `gitCredentials` feature, `RepoAccessContext.onDemand`), a provider that can
+ *   `issue` one lists its repositories in `RunGit.onDemand` instead and mints nothing at the claim: the runner asks
+ *   for each credential whenever git needs one, for as long as it holds the run (`git-credentials.ts`).
  *
  * Inside the claim's transaction a provider reads through the claim's connection only: on SQLite that transaction
  * holds the one connection there is, so anything else (a person's permissions, another plugin's services) would wait
@@ -104,6 +107,19 @@ export async function mountsFor(conn, registry, context, prepared) {
     }
     return { mounts, resumeNotes };
 }
+/**
+ * What a provider throws from `issue` when it cannot give a credential, with a message safe to show the run's people
+ * and the agent (no credential, no internal detail): `unavailable` when its code host is down or slow and asking again
+ * later may work, `denied` when it will not issue one (no access to the repository, an installation gone).
+ */
+export class RepoAccessError extends Error {
+    name = 'RepoAccessError';
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+    }
+}
 export function createRepoAccessRegistry() {
     const providers = new Map();
     return {
@@ -121,7 +137,9 @@ export function createRepoAccessRegistry() {
 }
 /**
  * The run's git, from every provider: the first author given, every trailer and credential in order (one credential
- * per URL, the first).
+ * per URL, the first). With `context.onDemand`, the URLs any provider lists in `onDemand` (only repositories of the
+ * run) are asked for on demand, and no credential of the claim is handed out for them; without it, `onDemand` is
+ * dropped.
  */
 export async function repoAccessFor(conn, registry, context, prepared) {
     if (context.repos.length === 0)
@@ -129,6 +147,8 @@ export async function repoAccessFor(conn, registry, context, prepared) {
     let author;
     const trailers = [];
     const credentials = new Map();
+    const repoUrls = new Set(context.repos.map((repo) => repo.url));
+    const onDemand = new Set();
     for (const provider of registry?.list() ?? []) {
         const given = await provider.forRun(conn, context, prepared.get(`repo:${provider.key}`));
         if (!given)
@@ -140,20 +160,30 @@ export async function repoAccessFor(conn, registry, context, prepared) {
         for (const credential of given.credentials ?? [])
             if (!credentials.has(credential.url))
                 credentials.set(credential.url, credential);
+        if (context.onDemand)
+            for (const url of given.onDemand ?? [])
+                if (repoUrls.has(url))
+                    onDemand.add(url);
     }
-    if (!author && trailers.length === 0 && credentials.size === 0)
+    for (const url of onDemand)
+        credentials.delete(url);
+    if (!author &&
+        trailers.length === 0 &&
+        credentials.size === 0 &&
+        onDemand.size === 0)
         return null;
     return {
         ...(author ? { author } : {}),
         ...(trailers.length > 0 ? { trailers } : {}),
         ...(credentials.size > 0 ? { credentials: [...credentials.values()] } : {}),
+        ...(onDemand.size > 0 ? { onDemand: [...onDemand] } : {}),
     };
 }
 /**
  * Runs every provider's `prepare` for `run`, outside any transaction. A provider whose preparation fails gets
  * undefined, and is told so by its own absent answer; the claim goes on.
  */
-export async function prepareExtensions(run, sections, mounts, onError, repoAccess) {
+export async function prepareExtensions(run, sections, mounts, onError, repoAccess, repoOptions = { onDemand: false }) {
     const prepared = new Map();
     const hooks = [
         ...(sections?.list() ?? []).flatMap((provider) => provider.prepare
@@ -166,11 +196,17 @@ export async function prepareExtensions(run, sections, mounts, onError, repoAcce
                 [`mount:${provider.name}`, provider.prepare],
             ]
             : []),
-        ...(repoAccess?.list() ?? []).flatMap((provider) => provider.prepare
-            ? [
-                [`repo:${provider.key}`, provider.prepare],
-            ]
-            : []),
+        ...(repoAccess?.list() ?? []).flatMap((provider) => {
+            const prepare = provider.prepare;
+            return prepare
+                ? [
+                    [
+                        `repo:${provider.key}`,
+                        (each) => prepare(each, repoOptions),
+                    ],
+                ]
+                : [];
+        }),
     ];
     for (const [key, prepare] of hooks)
         try {

package/dist/server/core/runs/extensions.js.map

@@ -1 +1 @@
-{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../../../../server/core/runs/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,aAAa,GAKd,MAAM,0BAA0B,CAAC;AA8BlC,MAAM,UAAU,0BAA0B;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC1D,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YACvE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ;oBAC1C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CACT,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;aACpB,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;aAC/C,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC;YAC5C,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC;YAChD,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CACpB;aACA,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAwB,EACxB,QAA0C,EAC1C,KAAmB,EACnB,QAAyB,EACzB,QAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CACjC,IAAI,EACJ,KAAK,EACL,QAAQ,EACR,QAAQ,CAAC,GAAG,CAAC,WAAW,QAAQ,CAAC,GAAG,EAAE,CAAC,CACxC,CAAC;QACF,IAAI,IAAI,EAAE,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC;aACzC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;aAC7B,IAAI,CAAC,MAAM,CAAC;KAChB,CAAC;AACJ,CAAC;AAuDD,MAAM,UAAU,sBAAsB;IACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ;oBAC3C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC,CAAC;QACJ,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,GAAwB;IACnD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAC1E,IAAI,CACL,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAwB,EACxB,QAAsC,EACtC,OAAqB,EACrB,QAAkB;IAElB,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CACjC,IAAI,EACJ,OAAO,EACP,QAAQ,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,uGAAuG;YACvG,SAAS,EAAE,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE;gBACxC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC;YACF,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YAC1D,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC;AA2BD,MAAM,UAAU,wBAAwB;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,CAAC,GAAG,EAAE,CACxD,CAAC;YACJ,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ;oBAC1C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAwB,EACxB,QAAwC,EACxC,OAA0B,EAC1B,QAAkB;IAElB,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,MAAwB,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAGxB,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CACjC,IAAI,EACJ,OAAO,EACP,QAAQ,CAAC,GAAG,CAAC,QAAQ,QAAQ,CAAC,GAAG,EAAE,CAAC,CACrC,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;YACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAC9C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAClC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAKD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,QAA0C,EAC1C,MAAoC,EACpC,OAAkC,EAClC,UAA+B;IAE/B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,MAAM,KAAK,GAAiC;QAC1C,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,WAAW,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAG3C;aACF;YACH,CAAC,CAAC,EAAE,CACP;QACD,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC7C,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,OAAO,CAG1C;aACF;YACH,CAAC,CAAC,EAAE,CACP;QACD,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACjD,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,QAAQ,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAGxC;aACF;YACH,CAAC,CAAC,EAAE,CACP;KACF,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,KAAK;QAChC,IAAI,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../../../../server/core/runs/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,aAAa,GAKd,MAAM,0BAA0B,CAAC;AA8BlC,MAAM,UAAU,0BAA0B;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC1D,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YACvE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ;oBAC1C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CACT,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;aACpB,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;aAC/C,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC;YAC5C,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC;YAChD,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CACpB;aACA,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAwB,EACxB,QAA0C,EAC1C,KAAmB,EACnB,QAAyB,EACzB,QAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CACjC,IAAI,EACJ,KAAK,EACL,QAAQ,EACR,QAAQ,CAAC,GAAG,CAAC,WAAW,QAAQ,CAAC,GAAG,EAAE,CAAC,CACxC,CAAC;QACF,IAAI,IAAI,EAAE,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC;aACzC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;aAC7B,IAAI,CAAC,MAAM,CAAC;KAChB,CAAC;AACJ,CAAC;AAuDD,MAAM,UAAU,sBAAsB;IACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ;oBAC3C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC,CAAC;QACJ,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,GAAwB;IACnD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAC1E,IAAI,CACL,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAwB,EACxB,QAAsC,EACtC,OAAqB,EACrB,QAAkB;IAElB,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CACjC,IAAI,EACJ,OAAO,EACP,QAAQ,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,uGAAuG;YACvG,SAAS,EAAE,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE;gBACxC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC;YACF,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YAC1D,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC;AA0CD;;;;GAIG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,GAAG,iBAAiB,CAAC;IACzB,IAAI,CAA2B;IAExC,YAAY,IAA8B,EAAE,OAAe;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAmCD,MAAM,UAAU,wBAAwB;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,CAAC,GAAG,EAAE,CACxD,CAAC;YACJ,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ;oBAC1C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAwB,EACxB,QAAwC,EACxC,OAA0B,EAC1B,QAAkB;IAElB,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,MAAwB,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAGxB,CAAC;IACJ,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CACjC,IAAI,EACJ,OAAO,EACP,QAAQ,CAAC,GAAG,CAAC,QAAQ,QAAQ,CAAC,GAAG,EAAE,CAAC,CACrC,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;YACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAC9C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAClC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,QAAQ;YAClB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;gBACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ;QAAE,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,IACE,CAAC,MAAM;QACP,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,WAAW,CAAC,IAAI,KAAK,CAAC;QACtB,QAAQ,CAAC,IAAI,KAAK,CAAC;QAEnB,OAAO,IAAI,CAAC;IACd,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAKD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,QAA0C,EAC1C,MAAoC,EACpC,OAAkC,EAClC,UAA+B,EAC/B,cAAkC,EAAE,QAAQ,EAAE,KAAK,EAAE;IAErD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,MAAM,KAAK,GAAiC;QAC1C,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,WAAW,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAG3C;aACF;YACH,CAAC,CAAC,EAAE,CACP;QACD,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC7C,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,OAAO,CAG1C;aACF;YACH,CAAC,CAAC,EAAE,CACP;QACD,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YACjC,OAAO,OAAO;gBACZ,CAAC,CAAC;oBACE;wBACE,QAAQ,QAAQ,CAAC,GAAG,EAAE;wBACtB,CAAC,IAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC;qBACZ;iBAChC;gBACH,CAAC,CAAC,EAAE,CAAC;QACT,CAAC,CAAC;KACH,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,KAAK;QAChC,IAAI,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/server/core/runs/git-credentials.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Repository credentials on demand (`RUNNER_ROUTES.gitCredential`, the `gitCredentials` feature): a runner asks for the
+ * credential of one of its run's repositories whenever git needs one, instead of keeping the one a claim handed out
+ * for the whole run, which a long run outlives.
+ *
+ * The answer is given only while the asking runner holds the run (`reports.holds`), for the attempt it names, under a
+ * lease that has not run out, and for a URL the claim listed in `RunGit.onDemand` (`agRuns.gitCredentialUrls`),
+ * compared exactly: case, a trailing `.git` and anything else the runner sends must match what it was given. Anything
+ * else is refused, so a run that ended, went back to the queue or was taken by another attempt gets nothing.
+ *
+ * The application issues the credential (`RepoAccessProvider.issue`), outside any transaction, within
+ * `ISSUE_TIMEOUT_MS`; whether a cached one is still good enough is its decision. Every credential handed out is added
+ * to the run's remembered secrets, so what the run reports afterwards is redacted of it too. A failure is answered
+ * with a reason the runner can act on and a message safe to show: `REPO_ACCESS_UNAVAILABLE` (try again later) or
+ * `REPO_ACCESS_DENIED` (the application will not issue one).
+ */
+import { type GitCredential, type GitCredentialRequest } from '@nocobase/agent-protocol';
+import type { Clock } from '../../kernel/clock.js';
+import { type SecretMemory } from '../../kernel/redaction.js';
+import type { TxRunner } from '../../kernel/tx.js';
+import type { Runner } from '../../../shared/runners.js';
+import { type RepoAccessRegistry } from './extensions.js';
+import type { RunnerReports } from './lifecycle.js';
+import { type RunRecord } from './run.store.js';
+/** How long the server waits for the application to issue a credential before answering `REPO_ACCESS_UNAVAILABLE`. */
+export declare const ISSUE_TIMEOUT_MS = 15000;
+export interface GitCredentialService {
+    issue(runner: Pick<Runner, 'id'>, runId: string, request: GitCredentialRequest): Promise<GitCredential>;
+}
+export interface GitCredentialDeps {
+    readonly tx: TxRunner;
+    readonly clock: Clock;
+    readonly reports: Pick<RunnerReports, 'holds'>;
+    readonly repoAccess: RepoAccessRegistry;
+    readonly secrets?: SecretMemory;
+    /** Told what went wrong when a provider failed in a way it did not explain (`RepoAccessError`). */
+    readonly onError?: (message: string, error: unknown) => void;
+    readonly timeoutMs?: number;
+}
+/** The URLs a claim listed for on-demand credentials, as stored on the run. */
+export declare function gitCredentialUrls(run: Pick<RunRecord, 'gitCredentialUrls'>): string[];
+export declare function createGitCredentialService(deps: GitCredentialDeps): GitCredentialService;
+//# sourceMappingURL=git-credentials.d.ts.map

package/dist/server/core/runs/git-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credentials.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/git-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEtE,sHAAsH;AACtH,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAEvC,MAAM,WAAW,oBAAoB;IACnC,KAAK,CACH,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,mGAAmG;IACnG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,GACxC,MAAM,EAAE,CAEV;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,iBAAiB,GACtB,oBAAoB,CAwJtB"}

package/dist/server/core/runs/git-credentials.js

@@ -0,0 +1,129 @@
+/**
+ * Repository credentials on demand (`RUNNER_ROUTES.gitCredential`, the `gitCredentials` feature): a runner asks for the
+ * credential of one of its run's repositories whenever git needs one, instead of keeping the one a claim handed out
+ * for the whole run, which a long run outlives.
+ *
+ * The answer is given only while the asking runner holds the run (`reports.holds`), for the attempt it names, under a
+ * lease that has not run out, and for a URL the claim listed in `RunGit.onDemand` (`agRuns.gitCredentialUrls`),
+ * compared exactly: case, a trailing `.git` and anything else the runner sends must match what it was given. Anything
+ * else is refused, so a run that ended, went back to the queue or was taken by another attempt gets nothing.
+ *
+ * The application issues the credential (`RepoAccessProvider.issue`), outside any transaction, within
+ * `ISSUE_TIMEOUT_MS`; whether a cached one is still good enough is its decision. Every credential handed out is added
+ * to the run's remembered secrets, so what the run reports afterwards is redacted of it too. A failure is answered
+ * with a reason the runner can act on and a message safe to show: `REPO_ACCESS_UNAVAILABLE` (try again later) or
+ * `REPO_ACCESS_DENIED` (the application will not issue one).
+ */
+import { ProtocolError, } from '@nocobase/agent-protocol';
+import { runSecretsKey } from '../../kernel/redaction.js';
+import { stringArray } from '../../kernel/values.js';
+import { RepoAccessError, } from './extensions.js';
+import { findRunRecord, toRun } from './run.store.js';
+/** How long the server waits for the application to issue a credential before answering `REPO_ACCESS_UNAVAILABLE`. */
+export const ISSUE_TIMEOUT_MS = 15_000;
+/** The URLs a claim listed for on-demand credentials, as stored on the run. */
+export function gitCredentialUrls(run) {
+    return stringArray(run.gitCredentialUrls);
+}
+export function createGitCredentialService(deps) {
+    const timeoutMs = deps.timeoutMs ?? ISSUE_TIMEOUT_MS;
+    const lost = (message, status) => new ProtocolError('LEASE_LOST', message, { status });
+    async function withTimeout(issue) {
+        const controller = new AbortController();
+        let timer;
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => {
+                controller.abort();
+                reject(new RepoAccessError('unavailable', 'The application did not issue a credential in time.'));
+            }, timeoutMs);
+        });
+        try {
+            return await Promise.race([issue(controller.signal), timeout]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    function checked(grant, now) {
+        const expires = Date.parse(grant.expiresAt);
+        if (typeof grant.username !== 'string' ||
+            grant.username === '' ||
+            typeof grant.password !== 'string' ||
+            grant.password === '' ||
+            Number.isNaN(expires) ||
+            expires <= now.getTime())
+            throw new RepoAccessError('unavailable', 'The application issued a credential that is incomplete or already expired.');
+        return grant;
+    }
+    /**
+     * The run while `runner` still holds this attempt of it under a live lease and the claim listed `url`; the protocol
+     * reason otherwise. Checked before the application is asked and again once it answered, since issuing may take long
+     * enough for the run to end, be taken back or move to another attempt.
+     */
+    async function held(runner, runId, request) {
+        await deps.reports.holds(runner, runId);
+        const run = await findRunRecord(deps.tx.read(), runId);
+        if (!run)
+            throw new ProtocolError('RUN_NOT_FOUND', 'No such run.');
+        if (Number(run.attempt) !== request.attempt)
+            throw lost(`Attempt ${request.attempt} of the run is over; it is on attempt ${Number(run.attempt)}.`, run.status);
+        if (run.leaseExpiresAt === null ||
+            Date.parse(run.leaseExpiresAt) <= deps.clock.now().getTime())
+            throw lost('The run’s lease ran out.', run.status);
+        if (!gitCredentialUrls(run).includes(request.url))
+            throw new ProtocolError('INVALID_REQUEST', 'This repository is not one the run asks credentials for on demand.', { url: request.url });
+        return run;
+    }
+    /** The first answer of a provider that issues for the URL; null when none does. */
+    async function ask(run, runner, request) {
+        const providers = deps.repoAccess
+            .list()
+            .filter((provider) => provider.issue !== undefined);
+        try {
+            for (const provider of providers) {
+                const grant = await withTimeout((signal) => provider.issue({
+                    run: toRun(run),
+                    runnerId: runner.id,
+                    attempt: request.attempt,
+                    url: request.url,
+                    refresh: request.refresh === true,
+                    signal,
+                }));
+                if (grant)
+                    return grant;
+            }
+            return null;
+        }
+        catch (error) {
+            if (error instanceof RepoAccessError)
+                throw new ProtocolError(error.kind === 'denied'
+                    ? 'REPO_ACCESS_DENIED'
+                    : 'REPO_ACCESS_UNAVAILABLE', error.message, { url: request.url });
+            deps.onError?.(`Agents could not issue a repository credential for run ${run.id}.`, error);
+            throw new ProtocolError('REPO_ACCESS_UNAVAILABLE', 'The application could not issue a credential for this repository.', { url: request.url });
+        }
+    }
+    return {
+        async issue(runner, runId, request) {
+            const run = await held(runner, runId, request);
+            const grant = await ask(run, runner, request);
+            if (!grant)
+                throw new ProtocolError('REPO_ACCESS_DENIED', 'The application issues no credential for this repository.', { url: request.url });
+            // The run may have ended, been taken back or moved to another attempt while the application issued: then the
+            // credential is dropped, never remembered, and the runner told why.
+            await held(runner, runId, request);
+            let valid;
+            try {
+                // Checked against the time it came back, not the time it was asked for.
+                valid = checked(grant, deps.clock.now());
+            }
+            catch (error) {
+                throw new ProtocolError('REPO_ACCESS_UNAVAILABLE', error instanceof Error ? error.message : String(error), { url: request.url });
+            }
+            const { username, password, expiresAt } = valid;
+            deps.secrets?.add(runSecretsKey(run.id), [password]);
+            return { username, password, expiresAt };
+        },
+    };
+}
+//# sourceMappingURL=git-credentials.js.map

package/dist/server/core/runs/git-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credentials.js","sourceRoot":"","sources":["../../../../server/core/runs/git-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,aAAa,GAGd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,aAAa,EAAqB,MAAM,2BAA2B,CAAC;AAE7E,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EACL,eAAe,GAGhB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAkB,MAAM,gBAAgB,CAAC;AAEtE,sHAAsH;AACtH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAqBvC,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAC/B,GAAyC;IAEzC,OAAO,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAErD,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,EAAE,CAC/C,IAAI,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvD,KAAK,UAAU,WAAW,CACxB,KAAmE;QAEnE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,KAAiC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,CACJ,IAAI,eAAe,CACjB,aAAa,EACb,qDAAqD,CACtD,CACF,CAAC;YACJ,CAAC,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,SAAS,OAAO,CAAC,KAA0B,EAAE,GAAS;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5C,IACE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAClC,KAAK,CAAC,QAAQ,KAAK,EAAE;YACrB,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAClC,KAAK,CAAC,QAAQ,KAAK,EAAE;YACrB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;YACrB,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE;YAExB,MAAM,IAAI,eAAe,CACvB,aAAa,EACb,4EAA4E,CAC7E,CAAC;QACJ,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,IAAI,CACjB,MAA0B,EAC1B,KAAa,EACb,OAA6B;QAE7B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO;YACzC,MAAM,IAAI,CACR,WAAW,OAAO,CAAC,OAAO,yCAAyC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EACzF,GAAG,CAAC,MAAM,CACX,CAAC;QACJ,IACE,GAAG,CAAC,cAAc,KAAK,IAAI;YAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;YAE5D,MAAM,IAAI,CAAC,0BAA0B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;YAC/C,MAAM,IAAI,aAAa,CACrB,iBAAiB,EACjB,oEAAoE,EACpE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;QACJ,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mFAAmF;IACnF,KAAK,UAAU,GAAG,CAChB,GAAc,EACd,MAA0B,EAC1B,OAA6B;QAE7B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU;aAC9B,IAAI,EAAE;aACN,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,QAAQ,CAAC,KAAM,CAAC;oBACd,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;oBACf,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI;oBACjC,MAAM;iBACP,CAAC,CACH,CAAC;gBACF,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;YAC1B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe;gBAClC,MAAM,IAAI,aAAa,CACrB,KAAK,CAAC,IAAI,KAAK,QAAQ;oBACrB,CAAC,CAAC,oBAAoB;oBACtB,CAAC,CAAC,yBAAyB,EAC7B,KAAK,CAAC,OAAO,EACb,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;YACJ,IAAI,CAAC,OAAO,EAAE,CACZ,0DAA0D,GAAG,CAAC,EAAE,GAAG,EACnE,KAAK,CACN,CAAC;YACF,MAAM,IAAI,aAAa,CACrB,yBAAyB,EACzB,mEAAmE,EACnE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO;YAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK;gBACR,MAAM,IAAI,aAAa,CACrB,oBAAoB,EACpB,2DAA2D,EAC3D,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;YACJ,6GAA6G;YAC7G,oEAAoE;YACpE,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACnC,IAAI,KAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,wEAAwE;gBACxE,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,aAAa,CACrB,yBAAyB,EACzB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;YAChD,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/core/runs/identity.d.ts

@@ -0,0 +1,6 @@
+/** Subject-selected identities, refreshed before a queued run can borrow a runner or credentials. */
+import type { Tx } from '../../kernel/tx.js';
+import type { TransitionDeps } from './transitions.js';
+import { type RunRecord } from './run.store.js';
+export declare function refreshQueuedIdentity(unit: Tx, deps: TransitionDeps, run: RunRecord): Promise<RunRecord | null>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/server/core/runs/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/identity.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AAExB,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,EAAE,EACR,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CA+C3B"}

package/dist/server/core/runs/identity.js

@@ -0,0 +1,49 @@
+import { finishRun } from './transitions.js';
+import { inputsRepo, runsRepo, toInput, toExecutions, } from './run.store.js';
+export async function refreshQueuedIdentity(unit, deps, run) {
+    const resolve = deps.subjects.get(run.subjectKind)?.actsAs;
+    // A run returned to the queue after a lease loss has already fixed its identity.
+    if (!resolve ||
+        run.status !== 'queued' ||
+        run.dispatchedAt ||
+        Number(run.attempt) > 1 ||
+        toExecutions(run).length > 0)
+        return run;
+    const inputs = await inputsRepo(unit.conn).findMany({
+        filter: { runId: run.id },
+    });
+    const identity = await resolve(unit.conn, {
+        subjectId: run.subjectId,
+        agentId: run.agentId,
+        causedByRunId: run.retryOfRunId ?? undefined,
+        inputs: inputs.map(toInput),
+    });
+    if (!identity)
+        return run;
+    if (!identity.actorUserId) {
+        await finishRun(unit, deps, run, {
+            status: 'cancelled',
+            reason: null,
+            detail: identity.reason ?? 'noOwner',
+        });
+        return null;
+    }
+    if (run.actorUserId === identity.actorUserId &&
+        run.ownerUserId === identity.actorUserId)
+        return run;
+    const values = {
+        actorUserId: identity.actorUserId,
+        ownerUserId: identity.actorUserId,
+        requestedByUserId: run.requestedByUserId ?? run.actorUserId,
+        updatedAt: deps.clock.now().toISOString(),
+    };
+    const updated = await runsRepo(unit.conn).updateMany({
+        filter: { id: run.id, status: 'queued', actorUserId: run.actorUserId },
+        values,
+    });
+    if (updated.updatedCount !== 1)
+        return null;
+    unit.emit({ type: 'run.changed', runId: run.id, status: 'queued' });
+    return { ...run, ...values };
+}
+//# sourceMappingURL=identity.js.map

package/dist/server/core/runs/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../../server/core/runs/identity.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,UAAU,EACV,QAAQ,EACR,OAAO,EACP,YAAY,GAEb,MAAM,gBAAgB,CAAC;AAExB,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAQ,EACR,IAAoB,EACpB,GAAc;IAEd,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC3D,iFAAiF;IACjF,IACE,CAAC,OAAO;QACR,GAAG,CAAC,MAAM,KAAK,QAAQ;QACvB,GAAG,CAAC,YAAY;QAChB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACvB,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAE5B,OAAO,GAAG,CAAC;IACb,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QAClD,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE;KAC1B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;QACxC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,GAAG,CAAC,YAAY,IAAI,SAAS;QAC5C,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC1B,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC/B,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,SAAS;SACrC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QACxC,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAExC,OAAO,GAAG,CAAC;IACb,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,WAAW;QAC3D,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC1C,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;QACnD,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;QACtE,MAAM;KACP,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;AAC/B,CAAC"}

package/dist/server/core/runs/index.d.ts

@@ -1,15 +1,19 @@
-export { briefOf, createClaimService, fits, hasTool, onlineEntryOf, pickEntry, isServerHolder, payloadDirs, payloadRequires, skillTargets, variableTargets, type ClaimService, type RenderedBrief, type ServerClaim, type ServerHolder, } from './claim.js';
+export { briefOf, createClaimService, fits, fitsActor, hasTool, pickEntry, payloadDirs, payloadRequires, skillTargets, variableTargets, type ClaimService, type RenderedBrief, } from './claim.js';
 export { resolveAgentCli, type AgentCli } from './policy.js';
-export { createBriefSectionRegistry, createRepoAccessRegistry, createRunMountRegistry, sessionKeyOf, type BriefSectionProvider, type BriefSectionRegistry, type ExtensionPrepare, type MountContext, type MountOffer, type RepoAccessContext, type RepoAccessProvider, type RepoAccessRegistry, type RunMountProvider, type RunMountRegistry, } from './extensions.js';
+export { createClaimEligibility, type ClaimEligibility, type EligibilityRequest, } from './eligibility.js';
+export { createBriefSectionRegistry, createRepoAccessRegistry, createRunMountRegistry, sessionKeyOf, type BriefSectionProvider, type BriefSectionRegistry, type ExtensionPrepare, type MountContext, type MountOffer, RepoAccessError, type RepoAccessContext, type RepoAccessProvider, type RepoAccessRegistry, type RepoCredentialGrant, type RepoCredentialRequest, type RepoPrepareOptions, type RunMountProvider, type RunMountRegistry, } from './extensions.js';
+export { createGitCredentialService, ISSUE_TIMEOUT_MS, type GitCredentialService, } from './git-credentials.js';
 export { createBriefPreviewer, type BriefPreviewer } from './preview.js';
 export { findBrief, requestReset } from './workspace.store.js';
-export { createRunnerReports, type OnlineUsageRecord, type RunnerReports, } from './lifecycle.js';
-export { commandRef, createSubjectRegistry, dialectOf, takesType, type ClaimContext, type CommandDialect, type ContextProvider, type SubjectAssembly, type SubjectSample, type SubjectBinding, type SubjectDir, type SubjectFacts, type SubjectRegistry, type SubjectReports, type SubjectScope, type WorkSink, } from './ports.js';
+export { createRunnerReports, type RunnerReports } from './lifecycle.js';
+export { commandRef, createSubjectRegistry, type ClaimContext, type ContextProvider, type SubjectAssembly, type SubjectSample, type SubjectBinding, type SubjectDir, type SubjectFacts, type SubjectRegistry, type SubjectReports, type SubjectWorkspaces, type SubjectScope, type WorkSink, } from './ports.js';
 export { DEFAULT_TOOL_POLICY, MAX_CLAIM_FAILURES, retryDelayMs, toolPolicyFor, } from './policy.js';
 export type { RunTokenIdentity } from './run-tokens.js';
 export { countActive, eventsAfter, hasSession, inputsOnSince, lastSummary, openCounts, openRunsOn, openRunsOnEach, pendingInputs, type EventRecord, } from './run.store.js';
-export { createRunService, DEFAULT_THREAD, type EnqueueRequest, type EnqueueResult, type NewInput, type RunFilter, type RunService, } from './run.service.js';
+export { createRunService, DEFAULT_THREAD, queuedRun, type EnqueueRequest, type EnqueueResult, type NewInput, type RunEnqueued, type RunFilter, type RunRequestPending, type RunService, } from './run.service.js';
+export { RUN_REQUEST_TTL_MS, type RequestedRun, type RunRequestFilter, type RunRequestReassignment, type RunRequestService, } from './run-requests.js';
 export { createSweeper, type Sweeper, type SweepReport } from './sweeper.js';
+export { executionForViewer, runForViewer, type RunMachineViewer, } from './execution-view.js';
 export { createAvailability, type AgentAvailability, type Availability, } from './availability.js';
 export { cliPackageFor, type AgentCliSource } from './cli-package.js';
 export { createRunnerView, runsHeldBy, runsHeldByTool, type RunnerView, } from './runner-view.js';

package/dist/server/core/runs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,kBAAkB,EAClB,IAAI,EACJ,OAAO,EACP,aAAa,EACb,SAAS,EACT,cAAc,EACd,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,SAAS,EACT,SAAS,EACT,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,QAAQ,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,UAAU,EACV,cAAc,EACd,aAAa,EACb,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,kBAAkB,EAClB,IAAI,EACJ,SAAS,EACT,OAAO,EACP,SAAS,EACT,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,QAAQ,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,UAAU,EACV,cAAc,EACd,aAAa,EACb,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,KAAK,gBAAgB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC"}

package/dist/server/core/runs/index.js

@@ -1,14 +1,18 @@
-export { briefOf, createClaimService, fits, hasTool, onlineEntryOf, pickEntry, isServerHolder, payloadDirs, payloadRequires, skillTargets, variableTargets, } from './claim.js';
+export { briefOf, createClaimService, fits, fitsActor, hasTool, pickEntry, payloadDirs, payloadRequires, skillTargets, variableTargets, } from './claim.js';
 export { resolveAgentCli } from './policy.js';
-export { createBriefSectionRegistry, createRepoAccessRegistry, createRunMountRegistry, sessionKeyOf, } from './extensions.js';
+export { createClaimEligibility, } from './eligibility.js';
+export { createBriefSectionRegistry, createRepoAccessRegistry, createRunMountRegistry, sessionKeyOf, RepoAccessError, } from './extensions.js';
+export { createGitCredentialService, ISSUE_TIMEOUT_MS, } from './git-credentials.js';
 export { createBriefPreviewer } from './preview.js';
 export { findBrief, requestReset } from './workspace.store.js';
-export { createRunnerReports, } from './lifecycle.js';
-export { commandRef, createSubjectRegistry, dialectOf, takesType, } from './ports.js';
+export { createRunnerReports } from './lifecycle.js';
+export { commandRef, createSubjectRegistry, } from './ports.js';
 export { DEFAULT_TOOL_POLICY, MAX_CLAIM_FAILURES, retryDelayMs, toolPolicyFor, } from './policy.js';
 export { countActive, eventsAfter, hasSession, inputsOnSince, lastSummary, openCounts, openRunsOn, openRunsOnEach, pendingInputs, } from './run.store.js';
-export { createRunService, DEFAULT_THREAD, } from './run.service.js';
+export { createRunService, DEFAULT_THREAD, queuedRun, } from './run.service.js';
+export { RUN_REQUEST_TTL_MS, } from './run-requests.js';
 export { createSweeper } from './sweeper.js';
+export { executionForViewer, runForViewer, } from './execution-view.js';
 export { createAvailability, } from './availability.js';
 export { cliPackageFor } from './cli-package.js';
 export { createRunnerView, runsHeldBy, runsHeldByTool, } from './runner-view.js';

package/dist/server/core/runs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../server/core/runs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,kBAAkB,EAClB,IAAI,EACJ,OAAO,EACP,aAAa,EACb,SAAS,EACT,cAAc,EACd,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,GAKhB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAiB,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,GAWb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAuB,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EACL,mBAAmB,GAGpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,SAAS,EACT,SAAS,GAaV,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,UAAU,EACV,cAAc,EACd,aAAa,GAEd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,cAAc,GAMf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAkC,MAAM,cAAc,CAAC;AAC7E,OAAO,EACL,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAuB,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,cAAc,GAEf,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../server/core/runs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,kBAAkB,EAClB,IAAI,EACJ,SAAS,EACT,OAAO,EACP,SAAS,EACT,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,GAGhB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAiB,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,sBAAsB,GAGvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,EAMZ,eAAe,GAShB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,GAEjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAuB,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAsB,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,UAAU,EACV,qBAAqB,GAatB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,UAAU,EACV,cAAc,EACd,aAAa,GAEd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,SAAS,GAQV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,GAKnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAkC,MAAM,cAAc,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,YAAY,GAEb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAuB,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,cAAc,GAEf,MAAM,kBAAkB,CAAC"}

package/dist/server/core/runs/input-gate.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The subject's admission and input policy (`ContextProvider.admit` and `selectInputs`) applied to a run that is
+ * already working: before new input joins it, and before its pending input is delivered.
+ */
+import type { RunInput } from '@nocobase/agent-protocol';
+import type { DatabaseConnection } from '@nocobase/db';
+import type { Agent } from '../../../shared/agents.js';
+import { type InputRecord, type RunRecord } from './run.store.js';
+import type { SubjectRegistry } from './ports.js';
+export interface InputGateDeps {
+    readonly subjects: SubjectRegistry;
+    readonly cliName: string;
+    readonly appName: string;
+}
+/**
+ * Of `inputs` for `run`, the ones its agent may act on now: none when the subject rejects the agent's work on it, else
+ * what the subject selects. Without a policy, all of them.
+ */
+export declare function gateInputs(conn: DatabaseConnection, deps: InputGateDeps, run: RunRecord, agent: Agent, inputs: readonly RunInput[]): Promise<readonly RunInput[]>;
+/** Marks the inputs of `ids` handled without delivering them: the run is not to act on them. */
+export declare function dropInputs(conn: DatabaseConnection, ids: readonly string[], now: string): Promise<void>;
+/** A working run's unhandled input, split by whether the run may still act on it. */
+export interface GatedPending {
+    /** What the run was already given, and the new input the subject still admits and selects. */
+    readonly kept: readonly InputRecord[];
+    /** New input the subject no longer lets the run act on. */
+    readonly withheld: readonly InputRecord[];
+}
+/**
+ * Splits `run`'s unhandled input by the subject's policy. Input already delivered stays with the run, whatever
+ * happened since; only input not yet delivered is judged.
+ */
+export declare function gatePending(conn: DatabaseConnection, deps: InputGateDeps, run: RunRecord): Promise<GatedPending>;
+//# sourceMappingURL=input-gate.d.ts.map

package/dist/server/core/runs/input-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-gate.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/input-gate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,SAAS,QAAQ,EAAE,GAC1B,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAe9B;AAED,gGAAgG;AAChG,wBAAsB,UAAU,CAC9B,IAAI,EAAE,kBAAkB,EACxB,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,qFAAqF;AACrF,MAAM,WAAW,YAAY;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAC;IACtC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;CAC3C;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,YAAY,CAAC,CAevB"}

package/dist/server/core/runs/input-gate.js

@@ -0,0 +1,54 @@
+import { findAgent } from '../agents/index.js';
+import { inputsRepo, pendingInputs, toInput, toRun, } from './run.store.js';
+/**
+ * Of `inputs` for `run`, the ones its agent may act on now: none when the subject rejects the agent's work on it, else
+ * what the subject selects. Without a policy, all of them.
+ */
+export async function gateInputs(conn, deps, run, agent, inputs) {
+    const context = deps.subjects.get(run.subjectKind)?.context;
+    if (!context || inputs.length === 0)
+        return inputs;
+    const claim = {
+        run: toRun(run),
+        agent,
+        runner: null,
+        inputs,
+        cli: deps.cliName,
+        appName: deps.appName,
+    };
+    if (await context.admit?.(conn, claim))
+        return [];
+    return context.selectInputs
+        ? await context.selectInputs(conn, claim)
+        : inputs;
+}
+/** Marks the inputs of `ids` handled without delivering them: the run is not to act on them. */
+export async function dropInputs(conn, ids, now) {
+    if (ids.length === 0)
+        return;
+    await inputsRepo(conn).updateMany({
+        filter: (f) => f.and([
+            f.or(ids.map((id) => f.string('id').eq(id))),
+            f.date('handledAt').empty(),
+        ]),
+        values: { handledAt: now },
+    });
+}
+/**
+ * Splits `run`'s unhandled input by the subject's policy. Input already delivered stays with the run, whatever
+ * happened since; only input not yet delivered is judged.
+ */
+export async function gatePending(conn, deps, run) {
+    const pending = await pendingInputs(conn, run.id);
+    const fresh = pending.filter((input) => !input.deliveredAt);
+    const agent = fresh.length > 0 ? await findAgent(conn, run.agentId) : null;
+    if (!agent)
+        return { kept: pending, withheld: [] };
+    const admitted = new Set((await gateInputs(conn, deps, run, agent, fresh.map(toInput))).map((input) => input.id));
+    const withheld = fresh.filter((input) => !admitted.has(input.id));
+    return {
+        kept: pending.filter((input) => !withheld.includes(input)),
+        withheld,
+    };
+}
+//# sourceMappingURL=input-gate.js.map

package/dist/server/core/runs/input-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-gate.js","sourceRoot":"","sources":["../../../../server/core/runs/input-gate.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACL,UAAU,EACV,aAAa,EACb,OAAO,EACP,KAAK,GAGN,MAAM,gBAAgB,CAAC;AASxB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAwB,EACxB,IAAmB,EACnB,GAAc,EACd,KAAY,EACZ,MAA2B;IAE3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC5D,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACnD,MAAM,KAAK,GAAG;QACZ,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;QACf,KAAK;QACL,MAAM,EAAE,IAAI;QACZ,MAAM;QACN,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;IACF,IAAI,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,OAAO,OAAO,CAAC,YAAY;QACzB,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;QACzC,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAwB,EACxB,GAAsB,EACtB,GAAW;IAEX,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC7B,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;QAChC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CACZ,CAAC,CAAC,GAAG,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE;SAC5B,CAAC;QACJ,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;KAC3B,CAAC,CAAC;AACL,CAAC;AAUD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAwB,EACxB,IAAmB,EACnB,GAAc;IAEd,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAChE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CACpB,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1D,QAAQ;KACT,CAAC;AACJ,CAAC"}