@wascartech/devbot 0.0.0-stage → 2.1.1

package/dist/types/env.js

@@ -0,0 +1,190 @@
+import { z } from "zod";
+const booleanStr = z.coerce
+    .string()
+    .transform((v) => v === "true" || v === "1");
+export const EnvSchema = z.object({
+    // Forge backend this process talks to. One instance ↔ one forge.
+    PLATFORM: z.enum(["gitlab", "forgejo", "gitea", "github"]).default("gitlab"),
+    PLATFORM_URL: z.string().url(),
+    PLATFORM_TOKEN: z.string().min(1),
+    // SSH port of the forge host, used only to build the same-host SSH→HTTPS
+    // submodule rewrite when SSH is not on 22 (e.g. 2222). PLATFORM_URL is HTTPS,
+    // so the SSH port cannot be inferred from it. Unset/empty = default port.
+    PLATFORM_SSH_PORT: z.preprocess((v) => (typeof v === "string" && v.trim() === "" ? undefined : v), z.coerce.number().int().positive().optional()),
+    PUBLIC_URL: z.string().url().refine((u) => u.startsWith("https:"), { message: "PUBLIC_URL must be https" }),
+    PLATFORM_OAUTH_CLIENT_ID: z.string().min(1),
+    PLATFORM_OAUTH_CLIENT_SECRET: z.string().min(1),
+    // Onboarding authorization gate for every platform. Comma-separated forge
+    // usernames allowed to complete WebUI onboarding; any other authenticated
+    // user is denied. This replaces the per-forge instance-admin check (which
+    // github.com cannot provide) so all drivers share one gate. FAILS CLOSED:
+    // when this is unset/empty, onboarding is denied for everyone.
+    ONBOARDING_USERS: z.string().default(""),
+    // GitHub API base. Defaults to the public github.com API; set only to point
+    // at a GitHub Enterprise Server (not officially supported yet) or a test
+    // double. Ignored on the other platforms.
+    GITHUB_API_URL: z.string().url().default("https://api.github.com"),
+    SESSION_KEY: z.string().min(32),
+    BOT_USERNAME: z.string().min(1),
+    BOT_USER_ID: z.coerce.number().int().positive(),
+    BOT_GIT_NAME: z.string().min(1).default("DevBot"),
+    BOT_GIT_EMAIL: z.string().email(),
+    // LLM providers, models, OpenCode plugins, base branches, and OCR languages live in the WebUI (global settings, devbot.db). Legacy LLM_*/OPENCODE_PLUGINS/BASE_BRANCHES/ATTACHMENT_OCR_LANG env vars are ignored.
+    BUILDER_IMAGE: z.string().min(1).default("devbot-builder:latest"),
+    PLAN_TIMEOUT_MS: z.coerce.number().int().positive().default(600_000),
+    BUILD_TIMEOUT_MS: z.coerce.number().int().positive().default(1_800_000),
+    // Kill an agent run that produces no stdout/stderr for this long. A wedged
+    // opencode process — or a model looping on a guard-blocked tool call until the
+    // total PLAN_/BUILD_TIMEOUT_MS — otherwise just sits "running". Silence is a
+    // heuristic: a legitimately quiet long-running bash tool also counts as
+    // silence, so keep this comfortably above the longest expected silent command.
+    // 0 disables the stall detector (the total timeout still applies). Work item #96.
+    RUN_STALL_TIMEOUT_MS: z.coerce.number().int().min(0).default(900_000),
+    MAX_QUEUE_PER_WORK_ITEM: z.coerce.number().int().positive().default(3),
+    // Max podman builder containers running simultaneously across all work
+    // items. Different work items run in parallel up to this limit; beyond it
+    // tasks wait in a global FIFO and the thread is notified at milestones
+    // (queued / you're next / starting).
+    MAX_CONCURRENT_RUNS: z.coerce.number().int().positive().default(4),
+    // Max pending tasks in the global FIFO (across all work items) before
+    // overflow is dropped with a ⚠️ note. 0 = unbounded (legacy behavior);
+    // a positive cap prevents a webhook flood from exhausting memory/disk.
+    MAX_GLOBAL_QUEUE: z.coerce.number().int().min(0).default(50),
+    // Worker poll cadence (ms) for the DB-backed queue. The sync DatabaseSync
+    // driver blocks per query, so this avoids a tight loop starving the event
+    // loop. 250ms is responsive enough for human-scale triggers.
+    QUEUE_POLL_INTERVAL_MS: z.coerce.number().int().positive().default(250),
+    // App-level retry on transient run failures (podman spawn, git network blip).
+    // 0 = disabled (posts one error note, matches pre-retry behavior). On a
+    // transient failure the same row is requeued with attempts++ (preserving its
+    // seq so global FIFO order is unchanged). Linear backoff: RETRY_BACKOFF_MS * attempts.
+    MAX_RETRIES: z.coerce.number().int().min(0).default(2),
+    RETRY_BACKOFF_MS: z.coerce.number().int().positive().default(5000),
+    // ponytail: env booleans must be string-parsed, not Boolean()-coerced;
+    // "0" is truthy under coerce.boolean and silently enables features.
+    QUEUE_FEEDBACK: booleanStr.default(true),
+    // Number of trusted reverse proxy hops in front of the bot. Set to 1 (or
+    // more) when behind nginx/Traefik/etc. so Express honors X-Forwarded-* and
+    // secure cookies work over TLS-terminated connections. 0 = off.
+    TRUST_PROXY: z.coerce.number().int().min(0).default(0),
+    PORT: z.coerce.number().int().positive().default(3000),
+    // Internal MCP server port. Bind address is MCP_HOST (default 0.0.0.0); the
+    // container reaches it via MCP_BASE_URL (host.containers.internal).
+    MCP_PORT: z.coerce.number().int().positive().default(3001),
+    // Bind address for the internal MCP server. Default 0.0.0.0 is required for
+    // rootless podman: the run container's host-gateway can reach neither host
+    // loopback (127.0.0.1) nor a host LAN IP — only an all-interfaces bind works.
+    // Set 127.0.0.1 for non-rootless deploys (e.g. bot in a container with
+    // --network host). Bearer auth (mcp_thread_tokens) gates every /mcp request
+    // regardless of bind.
+    MCP_HOST: z.string().default("0.0.0.0"),
+    // URL the container uses to reach the internal MCP server. Defaults to
+    // http://host.containers.internal:<MCP_PORT> (podman's host alias via
+    // --add-host). Override for --network host deploys (e.g. http://localhost:3001)
+    // or custom networks where the alias doesn't resolve.
+    MCP_BASE_URL: z.string().url().optional(),
+    DRY_RUN: booleanStr.default(false),
+    LOG_LEVEL: z.enum(["debug", "info", "warn", "error"]).default("info"),
+    // Instance identifier for HA deploys — prefixes volume names + container
+    // names so multiple devbot instances on the same host don't collide.
+    // Empty (default) = single-instance, no prefix. Must be [a-zA-Z0-9-]+.
+    INSTANCE_ID: z.string().regex(/^[a-zA-Z0-9-]*$/).default(""),
+    // ---- Attachments -----------------------------------------------------------
+    // DevBot does not read or OCR attachment content host-side. Work-item
+    // attachments are listed in the prompt as Markdown links; the agent downloads
+    // whole files on demand (the download_work_item_attachment MCP tool) and
+    // handles them itself — OCR/PDF extraction runs inside the builder image
+    // (tesseract/poppler), not here.
+    // Skip files larger than this many bytes (the download is aborted at the
+    // limit). Applies to both agent downloads and outbound uploads. 10 MB default
+    // balances "most screenshots fit" against "don't stream a 200 MB PDF just to
+    // reject it".
+    ATTACHMENT_MAX_BYTES: z.coerce.number().int().positive().default(10_000_000),
+    // Auto-purge per-work-item volumes inactive for VOLUME_GC_TTL_MS. A volume is
+    //   eligible when now - last_run_at >= TTL. On purge, a note is posted to the
+    //   work item (top-level); volumes created before the tracking table existed
+    //   (orphan rows with no project/iid) are removed silently. The sweep runs on
+    //   startup and every VOLUME_GC_INTERVAL_MS. Set VOLUME_GC_ENABLED=false to
+    //   disable both the startup and periodic sweeps.
+    VOLUME_GC_TTL_MS: z.coerce.number().int().positive().default(7 * 24 * 60 * 60_000), // 1 week
+    VOLUME_GC_INTERVAL_MS: z.coerce.number().int().positive().default(24 * 60 * 60_000), // daily sweep
+    VOLUME_GC_ENABLED: booleanStr.default(true),
+    // Retention for persisted container/run error logs (container_error_logs).
+    // Rows older than this many days are purged at startup and by a daily sweep.
+    // Default 30 days; set 0 to disable purging (keep forever).
+    ERROR_LOG_RETENTION_DAYS: z.coerce.number().int().min(0).default(30),
+    // Periodic reconciliation of enrolled project paths from the live forge. A
+    // forge-side rename/transfer is not delivered as a project-level webhook on
+    // GitLab/Gitea/ForgeJo (and GitHub's `repository.renamed` is GitHub-only), so
+    // the stored path is refreshed from the forge instead. Runs once at startup
+    // and every PROJECT_SYNC_INTERVAL_MS. Set PROJECT_SYNC_ENABLED=false to
+    // disable both; the WebUI's GET /api/managed still refreshes on load.
+    PROJECT_SYNC_ENABLED: booleanStr.default(true),
+    PROJECT_SYNC_INTERVAL_MS: z.coerce.number().int().positive().default(24 * 60 * 60_000), // daily
+    // ---- MCP OAuth token refresh ----------------------------------------------
+    // Host-side refresh of remote MCP server OAuth tokens. opencode refreshes
+    // tokens inside the run container, but its rotated tokens are discarded (the
+    // runner overwrites mcp-auth.json from the DB each run); refreshing here and
+    // persisting the rotation fixes that. When enabled, a sweep runs on startup
+    // (only if enabled) and every MCP_REFRESH_INTERVAL_MS. Independently, tokens
+    // expiring within a run's TTL are always refreshed before that run starts.
+    // Default OFF — opt-in, since it makes DevBot issue outbound token requests.
+    MCP_REFRESH_ENABLED: booleanStr.default(false),
+    // Sweep cadence. Clamped to at most 8h so a mis-set value cannot let a token
+    // expire between two checks. Default 8h; a shorter value checks more often but
+    // only actually refreshes entries that are due.
+    MCP_REFRESH_INTERVAL_MS: z.coerce.number().int().positive().default(8 * 60 * 60_000),
+    // ---- Nested rootless Podman dev containers (work item #17) -----------------
+    // When true, build-mode runs launch the per-work-item builder container with
+    // the extra userns/capability flags needed for a nested rootless Podman, and
+    // mount a private per-work-item podman store volume. Each work item gets an
+    // isolated runtime (own images/networks/containers); no host podman socket is
+    // mounted. Plan mode and disabled projects keep today's unprivileged launch.
+    // Default false because enabling it broadens the builder container's
+    // privileges (nested namespaces + mount + mknod) versus the default.
+    DEVCONTAINER_ENABLED: booleanStr.default(false),
+    // Inner runtime storage driver. "auto" probes for /dev/fuse at startup:
+    // fuse-overlayfs when present (layered, disk-efficient; needs --device
+    // /dev/fuse), else vfs (portable but full-copy, disk-heavy). Pin explicitly
+    // to force one.
+    DEVCONTAINER_STORAGE_DRIVER: z.enum(["auto", "fuse-overlayfs", "vfs"]).default("auto"),
+    // ---- Outbound webhooks (work item #50) ------------------------------------
+    // DevBot POSTs signed JSON events to admin-configured URLs when a run reaches
+    // a terminal state or a change request is created/updated. Deliveries are
+    // persisted and retried; they never block or alter a run.
+    //
+    // SSRF posture: block loopback/link-local/private/CGNAT/ULA targets by
+    // default. Set true to allow internal endpoints (CI, messaging) — the admin
+    // configuring them is already trusted via ONBOARDING_USERS.
+    WEBHOOK_ALLOW_PRIVATE_HOSTS: booleanStr.default(false),
+    // Per-attempt HTTP timeout for an outbound delivery (ms).
+    WEBHOOK_DELIVERY_TIMEOUT_MS: z.coerce.number().int().positive().default(10_000),
+    // Total attempts per delivery before it is marked terminally failed.
+    WEBHOOK_RETRY_MAX: z.coerce.number().int().positive().default(5),
+    // Linear retry backoff base: next_attempt_at = now + base * attempts.
+    WEBHOOK_RETRY_BACKOFF_MS: z.coerce.number().int().positive().default(5_000),
+    // Worker poll cadence (ms) for claiming due deliveries.
+    WEBHOOK_POLL_INTERVAL_MS: z.coerce.number().int().positive().default(1_000),
+    // Retention for delivery rows. 0 = keep forever.
+    WEBHOOK_RETENTION_DAYS: z.coerce.number().int().min(0).default(30),
+    // ---- Git submodules (work item #21) ---------------------------------------
+    // When true, first-run clone and every subsequent fetch also initialize and
+    // update submodules (`git submodule update --init --recursive`). Best-effort:
+    // a submodule that can't be fetched does not abort the run — the affected
+    // paths are reported in an informational note and the run proceeds. The bot
+    // token is scoped to the forge host only, so external submodule hosts are
+    // fetched anonymously. Default true.
+    GIT_SUBMODULES_ENABLED: booleanStr.default(true),
+    // ---- Run history log files (work item #61) --------------------------------
+    // Per-run container output is captured to one file per run (run_history stores
+    // only the filename). Files older than this are purged at startup and hourly;
+    // the history row survives and the detail view reports "logs expired". 0 =
+    // keep forever. This governs the log FILES only — ERROR_LOG_RETENTION_DAYS
+    // still governs error-log rows.
+    RUN_LOG_TTL_HOURS: z.coerce.number().int().min(0).default(48),
+    // Directory for the per-run log files, relative to the process cwd unless
+    // absolute. ENV-only: it is a filesystem location, not a runtime knob, so it
+    // has no WebUI override (mirrors DRY_RUN / LOG_LEVEL). Default "run-logs".
+    RUN_LOG_DIR: z.string().default("run-logs"),
+});
+//# sourceMappingURL=env.js.map

package/dist/types/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/types/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM;KACxB,MAAM,EAAE;KACR,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,iEAAiE;IACjE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC5E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,yEAAyE;IACzE,8EAA8E;IAC9E,0EAA0E;IAC1E,iBAAiB,EAAE,CAAC,CAAC,UAAU,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EACjE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAC9C;IACD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC3G,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,4EAA4E;IAC5E,yEAAyE;IACzE,0CAA0C;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACjC,kNAAkN;IAClN,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;IACjE,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACpE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACvE,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,wEAAwE;IACxE,+EAA+E;IAC/E,kFAAkF;IAClF,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACrE,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,qCAAqC;IACrC,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5D,0EAA0E;IAC1E,0EAA0E;IAC1E,6DAA6D;IAC7D,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACvE,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,uFAAuF;IACvF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClE,uEAAuE;IACvE,oEAAoE;IACpE,cAAc,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,yEAAyE;IACzE,2EAA2E;IAC3E,gEAAgE;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtD,4EAA4E;IAC5E,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1D,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,uEAAuE;IACvE,4EAA4E;IAC5E,sBAAsB;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,uEAAuE;IACvE,sEAAsE;IACtE,gFAAgF;IAChF,sDAAsD;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,uEAAuE;IACvE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE5D,+EAA+E;IAC/E,sEAAsE;IACtE,8EAA8E;IAC9E,yEAAyE;IACzE,yEAAyE;IACzE,iCAAiC;IAEjC,yEAAyE;IACzE,8EAA8E;IAC9E,6EAA6E;IAC7E,cAAc;IACd,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IAE5E,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,SAAS;IAC7F,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,cAAc;IACnG,iBAAiB,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;IAE3C,2EAA2E;IAC3E,6EAA6E;IAC7E,4DAA4D;IAC5D,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEpE,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtE,oBAAoB,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,QAAQ;IAEhG,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,mBAAmB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,6EAA6E;IAC7E,+EAA+E;IAC/E,gDAAgD;IAChD,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IAEpF,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,qEAAqE;IACrE,qEAAqE;IACrE,oBAAoB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,wEAAwE;IACxE,uEAAuE;IACvE,4EAA4E;IAC5E,gBAAgB;IAChB,2BAA2B,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEtF,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,0DAA0D;IAC1D,EAAE;IACF,uEAAuE;IACvE,4EAA4E;IAC5E,4DAA4D;IAC5D,2BAA2B,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IACtD,0DAA0D;IAC1D,2BAA2B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/E,qEAAqE;IACrE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,sEAAsE;IACtE,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3E,wDAAwD;IACxD,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3E,iDAAiD;IACjD,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAElE,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,qCAAqC;IACrC,sBAAsB,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;IAEhD,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,gCAAgC;IAChC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;CAC5C,CAAC,CAAC"}

package/dist/types/global-settings.js

@@ -0,0 +1,178 @@
+import { z } from "zod";
+import { findUnknownPlaceholders, WORKFLOW_PLACEHOLDERS, MR_DESCRIPTION_PLACEHOLDERS, } from "../build-workflow.js";
+import { globalMinRoleField, globalRequireAuthorOrAssigneeField } from "./access.js";
+import { RuntimeSettingsSchema, DEFAULT_RUNTIME_SETTINGS } from "./runtime-settings.js";
+import { DEFAULT_LSP_SERVERS, isLspServerId, normalizeLspServers } from "../lsp-servers.js";
+import { ASSIGNEE_RE } from "../assignee-value.js";
+// Build-output automation switches. Both default OFF: a build run only publishes
+// its branch / opens a merge request when explicitly enabled (or when the user
+// asks per-run with /push and /mr). autoMr is meaningful only when autoPush is
+// on — a merge request needs a published branch.
+const autoPushField = z.boolean().default(false);
+const autoMrField = z.boolean().default(false);
+// Detect latent merge conflicts before creating/updating an MR and, when on,
+// delegate resolution to a direct build run. Off by default.
+const autoResolveConflictsField = z.boolean().default(false);
+// CI-failure auto-report switch. Defaults OFF: when on, a failed pipeline on a
+// merge/pull request DevBot created triggers an automatic plan run seeded with
+// the failing job logs. Opt-in, like the build-output switches above.
+const ciFailAutoReportField = z.boolean().default(false);
+// Global LSP allowlist. Unknown ids are a validation error (not silently
+// dropped); duplicates and ordering are normalized to the shipped order. An
+// empty list is the off switch and emits `lsp:false` for the run.
+const lspServersField = z
+    .array(z.string())
+    .refine((ids) => ids.every(isLspServerId), { message: "unknown LSP server id" })
+    .transform(normalizeLspServers)
+    .default(() => [...DEFAULT_LSP_SERVERS]);
+// Global (bot-wide) settings and the provider registry. The DB replaced the
+// LLM_*, OPENCODE_PLUGINS, BASE_BRANCHES and ATTACHMENT_OCR_LANG env vars,
+// which are now ignored.
+// Global MCP servers/auth entries reuse the per-project tables with this
+// sentinel project_id. Real forge project ids are positive, so 0 is safe.
+export const GLOBAL_SCOPE_ID = 0;
+export const SETTINGS_STRING_MAX = 2048;
+export const MODEL_STRING_MAX = 256;
+export const VARIANT_STRING_MAX = 64;
+// Per-model price for a custom provider (work item #66). USD per 1M tokens,
+// matching models.dev and opencode's config `cost` block. Injected into the
+// generated opencode.json so opencode computes step cost itself.
+export const ModelCostSchema = z
+    .object({
+    input: z.number().min(0).default(0),
+    output: z.number().min(0).default(0),
+    cacheRead: z.number().min(0).default(0),
+    cacheWrite: z.number().min(0).default(0),
+})
+    .strict();
+const modelCostsField = z.record(z.string(), ModelCostSchema).default({});
+export const PROVIDER_ID_RE = /^[a-z0-9][a-z0-9-_]*$/;
+export const PROVIDER_ID_MAX = 64;
+// Editable build-mode prompt templates. Empty string means "use the built-in
+// default"; unknown `{{...}}` placeholders are a validation error.
+export const TEMPLATE_STRING_MAX = 8192;
+const workflowTemplateField = z
+    .string()
+    .max(TEMPLATE_STRING_MAX)
+    .transform((v) => v.trim())
+    .refine((v) => findUnknownPlaceholders(v, WORKFLOW_PLACEHOLDERS).length === 0, {
+    message: "unknown placeholder (allowed: {{iid}}, {{branch}}, {{mrTarget}}, {{mrBlock}})",
+})
+    .default("");
+const mrDescriptionTemplateField = z
+    .string()
+    .max(TEMPLATE_STRING_MAX)
+    .transform((v) => v.trim())
+    .refine((v) => findUnknownPlaceholders(v, MR_DESCRIPTION_PLACEHOLDERS).length === 0, {
+    message: "unknown placeholder (allowed: {{iid}}, {{branch}}, {{mrTarget}})",
+})
+    .default("");
+// opencode `--variant` values are single CLI tokens (e.g. "high", "xhigh",
+// "max"). Restrict to a safe charset so a value can never break the arg list.
+export const VARIANT_RE = /^[a-zA-Z0-9._-]*$/;
+// Builder image reference (e.g. "devbot-builder:latest", "registry.example.com/
+// team/builder:2.0"). Passed as a bare argument to `podman run`, so it must
+// never start with "-" (option injection) or contain whitespace/quotes/shell
+// metacharacters. Empty = unset (inherit the next level: project -> global ->
+// BUILDER_IMAGE env).
+export const BUILDER_IMAGE_MAX = 512;
+export const BUILDER_IMAGE_RE = /^[a-zA-Z0-9][a-zA-Z0-9._/:@-]*$/;
+const assigneeField = z
+    .string()
+    .max(255)
+    .transform((v) => v.trim())
+    .refine((v) => v === "" || ASSIGNEE_RE.test(v), { message: "must be a forge username or empty" })
+    .default("");
+const builderImageField = z
+    .string()
+    .max(BUILDER_IMAGE_MAX)
+    .transform((v) => v.trim())
+    .refine((v) => v === "" || BUILDER_IMAGE_RE.test(v), {
+    message: "must be a valid image reference (letters, digits, dot, dash, underscore, slash, colon, at)",
+})
+    .default("");
+// Empty = unset, otherwise must be "provider/model".
+const modelField = z
+    .string()
+    .max(MODEL_STRING_MAX)
+    .transform((v) => v.trim())
+    .refine((v) => v === "" || v.includes("/"), { message: "must be 'provider/model' or empty" });
+// Empty = unset (opencode default), otherwise a safe variant token.
+const variantField = z
+    .string()
+    .max(VARIANT_STRING_MAX)
+    .transform((v) => v.trim())
+    .refine((v) => VARIANT_RE.test(v), { message: "must be letters, digits, dot, dash or underscore" })
+    .default("");
+export const GlobalSettingsSchema = z
+    .object({
+    planModel: modelField,
+    buildModel: modelField,
+    planVariant: variantField,
+    buildVariant: variantField,
+    plugins: z.string().max(SETTINGS_STRING_MAX).transform((v) => v.trim()),
+    baseBranches: z.string().max(SETTINGS_STRING_MAX).transform((v) => v.trim()),
+    builderImage: builderImageField,
+    assignee: assigneeField,
+    buildWorkflow: workflowTemplateField,
+    mrDescription: mrDescriptionTemplateField,
+    minRole: globalMinRoleField,
+    requireAuthorOrAssignee: globalRequireAuthorOrAssigneeField,
+    autoPush: autoPushField,
+    autoMr: autoMrField,
+    autoResolveConflicts: autoResolveConflictsField,
+    ciFailAutoReport: ciFailAutoReportField,
+    lspServers: lspServersField,
+    runtime: RuntimeSettingsSchema.default(DEFAULT_RUNTIME_SETTINGS),
+})
+    .strict();
+export const DEFAULT_GLOBAL_SETTINGS = {
+    planModel: "",
+    buildModel: "",
+    planVariant: "",
+    buildVariant: "",
+    plugins: "",
+    baseBranches: "dev,master",
+    builderImage: "",
+    assignee: "",
+    buildWorkflow: "",
+    mrDescription: "",
+    minRole: "write",
+    requireAuthorOrAssignee: true,
+    autoPush: false,
+    autoMr: false,
+    autoResolveConflicts: false,
+    ciFailAutoReport: false,
+    lspServers: [...DEFAULT_LSP_SERVERS],
+    runtime: { ...DEFAULT_RUNTIME_SETTINGS },
+};
+// Body for PUT /api/settings/providers/:id. An empty/absent apiKey on edit
+// means "leave unchanged" (the store keeps the existing encrypted key). A new
+// provider requires a non-empty key (enforced in the store).
+export const ProviderBodySchema = z
+    .object({
+    name: z.string().min(1).max(100).transform((v) => v.trim()),
+    npm: z.string().min(1).max(200).transform((v) => v.trim()),
+    apiUrl: z.string().url().or(z.literal("")).optional(),
+    envVar: z.string().max(100).or(z.literal("")).optional(),
+    baseUrl: z.string().url().or(z.literal("")).optional(),
+    apiKey: z.string().max(4096).optional(),
+    models: z.array(z.string().min(1).max(200)).min(1).max(2000),
+    enabled: z.boolean(),
+    source: z.enum(["registry", "custom"]),
+    modelCosts: modelCostsField,
+})
+    .strict();
+// Validate a provider id (used by route path params and custom providers).
+export function isValidProviderId(id) {
+    return PROVIDER_ID_RE.test(id) && id.length <= PROVIDER_ID_MAX;
+}
+// Normalize a models.dev model id to a bare id: some providers key models as
+// "<providerId>/<model>" (e.g. "subconscious/glm-5.2") and others as a bare
+// "claude-sonnet-4-6". opencode's `--model` is "<providerId>/<bareId>", so a
+// duplicated prefix must be stripped.
+export function normalizeModelId(providerId, modelId) {
+    const prefix = `${providerId}/`;
+    return modelId.startsWith(prefix) ? modelId.slice(prefix.length) : modelId;
+}
+//# sourceMappingURL=global-settings.js.map

package/dist/types/global-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-settings.js","sourceRoot":"","sources":["../../src/types/global-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,kCAAkC,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,iFAAiF;AACjF,+EAA+E;AAC/E,+EAA+E;AAC/E,iDAAiD;AACjD,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACjD,MAAM,WAAW,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC/C,6EAA6E;AAC7E,6DAA6D;AAC7D,MAAM,yBAAyB,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE7D,+EAA+E;AAC/E,+EAA+E;AAC/E,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEzD,yEAAyE;AACzE,4EAA4E;AAC5E,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAC;KACtB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACjB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;KAC/E,SAAS,CAAC,mBAAmB,CAAC;KAC9B,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC;AAE3C,4EAA4E;AAC5E,2EAA2E;AAC3E,yBAAyB;AAEzB,yEAAyE;AACzE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACxC,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AACpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,4EAA4E;AAC5E,4EAA4E;AAC5E,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,6EAA6E;AAC7E,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACxC,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,mBAAmB,CAAC;KACxB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;IAC7E,OAAO,EAAE,+EAA+E;CACzF,CAAC;KACD,OAAO,CAAC,EAAE,CAAC,CAAC;AACf,MAAM,0BAA0B,GAAG,CAAC;KACjC,MAAM,EAAE;KACR,GAAG,CAAC,mBAAmB,CAAC;KACxB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;IACnF,OAAO,EAAE,kEAAkE;CAC5E,CAAC;KACD,OAAO,CAAC,EAAE,CAAC,CAAC;AAEf,2EAA2E;AAC3E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAE9C,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,sBAAsB;AACtB,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;AAClE,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;KAChG,OAAO,CAAC,EAAE,CAAC,CAAC;AAEf,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,GAAG,CAAC,iBAAiB,CAAC;KACtB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACnD,OAAO,EAAE,4FAA4F;CACtG,CAAC;KACD,OAAO,CAAC,EAAE,CAAC,CAAC;AAEf,qDAAqD;AACrD,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,GAAG,CAAC,gBAAgB,CAAC;KACrB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;AAEhG,oEAAoE;AACpE,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,EAAE;KACR,GAAG,CAAC,kBAAkB,CAAC;KACvB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;KAClG,OAAO,CAAC,EAAE,CAAC,CAAC;AAEf,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,SAAS,EAAE,UAAU;IACrB,UAAU,EAAE,UAAU;IACtB,WAAW,EAAE,YAAY;IACzB,YAAY,EAAE,YAAY;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,YAAY,EAAE,iBAAiB;IAC/B,QAAQ,EAAE,aAAa;IACvB,aAAa,EAAE,qBAAqB;IACpC,aAAa,EAAE,0BAA0B;IACzC,OAAO,EAAE,kBAAkB;IAC3B,uBAAuB,EAAE,kCAAkC;IAC3D,QAAQ,EAAE,aAAa;IACvB,MAAM,EAAE,WAAW;IACnB,oBAAoB,EAAE,yBAAyB;IAC/C,gBAAgB,EAAE,qBAAqB;IACvC,UAAU,EAAE,eAAe;IAC3B,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,wBAAwB,CAAC;CACjE,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACrD,SAAS,EAAE,EAAE;IACb,UAAU,EAAE,EAAE;IACd,WAAW,EAAE,EAAE;IACf,YAAY,EAAE,EAAE;IAChB,OAAO,EAAE,EAAE;IACX,YAAY,EAAE,YAAY;IAC1B,YAAY,EAAE,EAAE;IAChB,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE,EAAE;IACjB,aAAa,EAAE,EAAE;IACjB,OAAO,EAAE,OAAO;IAChB,uBAAuB,EAAE,IAAI;IAC7B,QAAQ,EAAE,KAAK;IACf,MAAM,EAAE,KAAK;IACb,oBAAoB,EAAE,KAAK;IAC3B,gBAAgB,EAAE,KAAK;IACvB,UAAU,EAAE,CAAC,GAAG,mBAAmB,CAAC;IACpC,OAAO,EAAE,EAAE,GAAG,wBAAwB,EAAE;CACzC,CAAC;AAEF,2EAA2E;AAC3E,8EAA8E;AAC9E,6DAA6D;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACtC,UAAU,EAAE,eAAe;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAiCZ,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,OAAO,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC;AACjE,CAAC;AAED,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,sCAAsC;AACtC,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,OAAe;IAClE,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC;IAChC,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7E,CAAC"}

package/dist/types/lsp-servers.js

@@ -0,0 +1,145 @@
+// Metadata for the LSP servers DevBot can enable. The shipped opencode.json is
+// the source of truth for which ids exist and how they are launched; this table
+// supplies the UI labels, extension hints, and cost/requirements shown to
+// operators. scripts/check-opencode-lsp.ts pins the two together.
+export const LSP_SERVER_META = [
+    {
+        id: "typescript",
+        label: "TypeScript / JavaScript",
+        group: "JavaScript / TypeScript",
+        extensions: [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"],
+        ram: "150-350 MB",
+        toolchain: "Node + TypeScript in the builder image; workspace TypeScript is preferred when present",
+        degrades: "starts with the image's TypeScript when the repo has no local install",
+    },
+    {
+        id: "vue",
+        label: "Vue",
+        group: "JavaScript / TypeScript",
+        extensions: [".vue"],
+        ram: "200-400 MB",
+        toolchain: "vue-language-server in the builder image; project Vue dependencies improve resolution",
+        degrades: "starts for .vue files, but unresolved imports are likely without project dependencies",
+    },
+    {
+        id: "eslint",
+        label: "ESLint",
+        group: "JavaScript / TypeScript",
+        extensions: [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts", ".vue"],
+        ram: "80-200 MB",
+        toolchain: "vscode-eslint-language-server in the builder image; a project-local eslint is required for rules",
+        degrades: "idles or exits when the repo has no project-local ESLint; the run continues",
+    },
+    {
+        id: "oxlint",
+        label: "Oxlint",
+        group: "JavaScript / TypeScript",
+        extensions: [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts", ".vue", ".astro", ".svelte"],
+        ram: "30-80 MB",
+        toolchain: "oxlint in the builder image",
+        degrades: "starts for JS projects even without project lint dependencies",
+    },
+    {
+        id: "pyright",
+        label: "Python (Pyright)",
+        group: "Python",
+        extensions: [".py", ".pyi"],
+        ram: "150-300 MB",
+        toolchain: "pyright-langserver + system Python in the builder image",
+        degrades: "uses system Python; project virtualenvs are not auto-detected",
+    },
+    {
+        id: "rust",
+        label: "Rust",
+        group: "Rust",
+        extensions: [".rs"],
+        ram: "300-800 MB",
+        toolchain: "rustup stable toolchain + rust-analyzer; a Cargo workspace gives full analysis",
+        degrades: "starts for any .rs file; without Cargo.toml it falls back to loose-file mode with limited analysis and still costs RAM",
+    },
+    {
+        id: "kotlin-ls",
+        label: "Kotlin",
+        group: "Kotlin / JVM",
+        extensions: [".kt", ".kts"],
+        ram: "250-600 MB",
+        toolchain: "kotlin-language-server + headless JVM installed on both architectures",
+        degrades: "starts for Kotlin files; Gradle/Maven resolution depends on the project",
+    },
+    {
+        id: "terraform",
+        label: "Terraform",
+        group: "Infrastructure",
+        extensions: [".tf", ".tfvars"],
+        ram: "50-150 MB",
+        toolchain: "pinned terraform-ls release in the builder image",
+        degrades: "starts for .tf files without needing the Terraform CLI",
+    },
+    {
+        id: "dockerfile",
+        label: "Dockerfile",
+        group: "Infrastructure",
+        extensions: [".dockerfile", "Dockerfile"],
+        ram: "40-100 MB",
+        toolchain: "docker-langserver in the builder image",
+        degrades: "starts for Dockerfiles; no daemon is required",
+    },
+    {
+        id: "yaml-ls",
+        label: "YAML",
+        group: "Config / markup",
+        extensions: [".yaml", ".yml"],
+        ram: "40-80 MB",
+        toolchain: "yaml-language-server in the builder image",
+        degrades: "starts for YAML files without project dependencies",
+    },
+    {
+        id: "php intelephense",
+        label: "PHP",
+        group: "PHP",
+        extensions: [".php"],
+        ram: "100-250 MB",
+        toolchain: "intelephense + PHP in the builder image",
+        degrades: "starts for PHP files; Composer dependencies improve resolution",
+    },
+    {
+        id: "bash",
+        label: "Shell",
+        group: "Shell",
+        extensions: [".sh", ".bash", ".zsh", ".ksh"],
+        ram: "30-60 MB",
+        toolchain: "bash-language-server in the builder image",
+        degrades: "starts for shell files without project dependencies",
+    },
+    {
+        id: "json",
+        label: "JSON",
+        group: "Config / markup",
+        extensions: [".json", ".jsonc"],
+        ram: "40-80 MB",
+        toolchain: "vscode-json-language-server in the builder image",
+        degrades: "starts for JSON files without project dependencies",
+    },
+    {
+        id: "css",
+        label: "CSS",
+        group: "Config / markup",
+        extensions: [".css", ".scss", ".less"],
+        ram: "40-80 MB",
+        toolchain: "vscode-css-language-server in the builder image",
+        degrades: "starts for CSS-family files without project dependencies",
+    },
+    {
+        id: "html",
+        label: "HTML",
+        group: "Config / markup",
+        extensions: [".html", ".htm"],
+        ram: "40-80 MB",
+        toolchain: "vscode-html-language-server in the builder image",
+        degrades: "starts for HTML files without project dependencies",
+    },
+];
+export function lspServerMeta(id) {
+    return LSP_SERVER_META.find((server) => server.id === id);
+}
+//# sourceMappingURL=lsp-servers.js.map

package/dist/types/lsp-servers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lsp-servers.js","sourceRoot":"","sources":["../../src/types/lsp-servers.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gFAAgF;AAChF,0EAA0E;AAC1E,kEAAkE;AAYlE,MAAM,CAAC,MAAM,eAAe,GAA6B;IACvD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,yBAAyB;QAChC,KAAK,EAAE,yBAAyB;QAChC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC1E,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,wFAAwF;QACnG,QAAQ,EAAE,uEAAuE;KAClF;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,yBAAyB;QAChC,UAAU,EAAE,CAAC,MAAM,CAAC;QACpB,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,uFAAuF;QAClG,QAAQ,EAAE,uFAAuF;KAClG;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,yBAAyB;QAChC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAClF,GAAG,EAAE,WAAW;QAChB,SAAS,EAAE,kGAAkG;QAC7G,QAAQ,EAAE,6EAA6E;KACxF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,yBAAyB;QAChC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;QACvG,GAAG,EAAE,UAAU;QACf,SAAS,EAAE,6BAA6B;QACxC,QAAQ,EAAE,+DAA+D;KAC1E;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,QAAQ;QACf,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QAC3B,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,yDAAyD;QACpE,QAAQ,EAAE,+DAA+D;KAC1E;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,MAAM;QACb,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,gFAAgF;QAC3F,QAAQ,EAAE,wHAAwH;KACnI;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,cAAc;QACrB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QAC3B,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,uEAAuE;QAClF,QAAQ,EAAE,yEAAyE;KACpF;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,WAAW;QAClB,KAAK,EAAE,gBAAgB;QACvB,UAAU,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;QAC9B,GAAG,EAAE,WAAW;QAChB,SAAS,EAAE,kDAAkD;QAC7D,QAAQ,EAAE,wDAAwD;KACnE;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,KAAK,EAAE,gBAAgB;QACvB,UAAU,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;QACzC,GAAG,EAAE,WAAW;QAChB,SAAS,EAAE,wCAAwC;QACnD,QAAQ,EAAE,+CAA+C;KAC1D;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,iBAAiB;QACxB,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,GAAG,EAAE,UAAU;QACf,SAAS,EAAE,2CAA2C;QACtD,QAAQ,EAAE,oDAAoD;KAC/D;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,CAAC,MAAM,CAAC;QACpB,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,yCAAyC;QACpD,QAAQ,EAAE,gEAAgE;KAC3E;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,OAAO;QACd,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;QAC5C,GAAG,EAAE,UAAU;QACf,SAAS,EAAE,2CAA2C;QACtD,QAAQ,EAAE,qDAAqD;KAChE;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,iBAAiB;QACxB,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,GAAG,EAAE,UAAU;QACf,SAAS,EAAE,kDAAkD;QAC7D,QAAQ,EAAE,oDAAoD;KAC/D;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,iBAAiB;QACxB,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QACtC,GAAG,EAAE,UAAU;QACf,SAAS,EAAE,iDAAiD;QAC5D,QAAQ,EAAE,0DAA0D;KACrE;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,iBAAiB;QACxB,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,GAAG,EAAE,UAAU;QACf,SAAS,EAAE,kDAAkD;QAC7D,QAAQ,EAAE,oDAAoD;KAC/D;CACF,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5D,CAAC"}

package/dist/types/mcp-config.js

@@ -0,0 +1,77 @@
+import { z } from "zod";
+// One entry in the opencode.json `mcp` map. See
+//   https://opencode.ai/docs/mcp-servers/
+// Values may carry `{env:VAR}` placeholders — preserved verbatim, resolved
+// inside the container by opencode against the container env.
+export const McpServerConfigSchema = z.discriminatedUnion("type", [
+    z
+        .object({
+        type: z.literal("local"),
+        command: z.array(z.string()).min(1),
+        enabled: z.boolean().optional(),
+        environment: z.record(z.string(), z.string()).optional(),
+        cwd: z.string().optional(),
+        timeout: z.number().int().positive().optional(),
+    })
+        .strict(),
+    z
+        .object({
+        type: z.literal("remote"),
+        url: z.string().url(),
+        enabled: z.boolean().optional(),
+        headers: z.record(z.string(), z.string()).optional(),
+        oauth: z
+            .union([
+            z
+                .object({
+                clientId: z.string(),
+                clientSecret: z.string(),
+                scope: z.string().optional(),
+            })
+                .strict(),
+            z.literal(false),
+        ])
+            .optional(),
+        timeout: z.number().int().positive().optional(),
+    })
+        .strict(),
+]);
+// Name namespace for the mcp map. Reserved: devbot-forge (the bot's own
+// server, injected by the runner — never user-configurable) and
+// chrome-devtools (bundled chrome-devtools-mcp server, always active).
+export const MCP_NAME_RE = /^[a-zA-Z0-9_-]+$/;
+export const MCP_NAME_MAX = 50;
+export const RESERVED_MCP_NAMES = ["devbot-forge", "chrome-devtools"];
+// ---- MCP OAuth auth entry ---------------------------------------------------
+// Shape of one server's entry in opencode's `mcp-auth.json`, authored at
+// `$XDG_DATA_HOME/opencode/mcp-auth.json`. Source of truth:
+//   packages/opencode/src/mcp/auth.ts (Schema.Struct { tokens, clientInfo,
+//   codeVerifier, oauthState, serverUrl }).
+// We accept a relaxed shape: only `tokens.accessToken` is required; the rest
+// is optional per opencode's own decoder. Transient fields (codeVerifier,
+// oauthState) are accepted so a raw paste of the file round-trips, but they
+// are never useful post-auth and we drop them on write to keep the row tidy.
+export const McpAuthTokensSchema = z
+    .object({
+    accessToken: z.string(),
+    refreshToken: z.string().optional(),
+    expiresAt: z.number().optional(), // SECONDS since epoch (opencode compares to Date.now()/1000)
+    scope: z.string().optional(),
+})
+    .strict();
+export const McpAuthClientInfoSchema = z
+    .object({
+    clientId: z.string(),
+    clientSecret: z.string().optional(),
+    clientIdIssuedAt: z.number().optional(),
+    clientSecretExpiresAt: z.number().optional(),
+})
+    .strict();
+export const McpAuthEntrySchema = z
+    .object({
+    tokens: McpAuthTokensSchema,
+    clientInfo: McpAuthClientInfoSchema.optional(),
+    serverUrl: z.string().optional(), // overwritten by the runner with the stored config's url
+})
+    .strict();
+//# sourceMappingURL=mcp-config.js.map

package/dist/types/mcp-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-config.js","sourceRoot":"","sources":["../../src/types/mcp-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gDAAgD;AAChD,0CAA0C;AAC1C,2EAA2E;AAC3E,8DAA8D;AAE9D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAChE,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACxD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAChD,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACpD,KAAK,EAAE,CAAC;aACL,KAAK,CAAC;YACL,CAAC;iBACE,MAAM,CAAC;gBACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;gBACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;gBACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aAC7B,CAAC;iBACD,MAAM,EAAE;YACX,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;SACjB,CAAC;aACD,QAAQ,EAAE;QACb,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAChD,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAGH,wEAAwE;AACxE,gEAAgE;AAChE,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAC9C,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAC;AAC/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAU,CAAC;AAE/E,gFAAgF;AAChF,yEAAyE;AACzE,4DAA4D;AAC5D,2EAA2E;AAC3E,4CAA4C;AAC5C,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,6DAA6D;IAC/F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,MAAM,EAAE,mBAAmB;IAC3B,UAAU,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yDAAyD;CAC5F,CAAC;KACD,MAAM,EAAE,CAAC"}