@yadsh/dsh-qa-surface 0.17.0 → 0.19.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (213) hide show
  1. package/README.md +35 -25
  2. package/compatibility.json +1 -1
  3. package/lib/account-remotes.js +4 -0
  4. package/lib/account-remotes.js.map +1 -1
  5. package/lib/accounts/database.js +86 -1
  6. package/lib/accounts/database.js.map +1 -1
  7. package/lib/accounts/file.js.map +1 -1
  8. package/lib/accounts/store.js +111 -5
  9. package/lib/accounts/store.js.map +1 -1
  10. package/lib/accounts/token.js +8 -2
  11. package/lib/accounts/token.js.map +1 -1
  12. package/lib/admin/metrics.js +15 -2
  13. package/lib/admin/metrics.js.map +1 -1
  14. package/lib/admin/read-budget.js +28 -0
  15. package/lib/admin/read-budget.js.map +1 -0
  16. package/lib/admin/service.js +135 -40
  17. package/lib/admin/service.js.map +1 -1
  18. package/lib/admin/session-log.js +63 -4
  19. package/lib/admin/session-log.js.map +1 -1
  20. package/lib/attachment-access.js +147 -0
  21. package/lib/attachment-access.js.map +1 -0
  22. package/lib/chat-sharing/native-fence.js +20 -0
  23. package/lib/chat-sharing/native-fence.js.map +1 -1
  24. package/lib/chat-sharing/search.js +89 -0
  25. package/lib/chat-sharing/search.js.map +1 -0
  26. package/lib/chat-sharing/transport.js +10 -9
  27. package/lib/chat-sharing/transport.js.map +1 -1
  28. package/lib/chat-sharing/uploads.js +79 -6
  29. package/lib/chat-sharing/uploads.js.map +1 -1
  30. package/lib/cli.js +13 -0
  31. package/lib/cli.js.map +1 -1
  32. package/lib/client/QaAccountsController.js +61 -0
  33. package/lib/client/QaAccountsController.js.map +1 -1
  34. package/lib/client/QaRouteController.js +3 -1
  35. package/lib/client/QaRouteController.js.map +1 -1
  36. package/lib/client/QaSessionController.js +141 -35
  37. package/lib/client/QaSessionController.js.map +1 -1
  38. package/lib/client/QaSurface.js +43 -13
  39. package/lib/client/QaSurface.js.map +1 -1
  40. package/lib/client/account-sessions.js +74 -8
  41. package/lib/client/account-sessions.js.map +1 -1
  42. package/lib/client/admin/CapabilityPicker.js +50 -0
  43. package/lib/client/admin/CapabilityPicker.js.map +1 -0
  44. package/lib/client/admin/CoverageNotice.js +9 -0
  45. package/lib/client/admin/CoverageNotice.js.map +1 -0
  46. package/lib/client/admin/QaAdmin.js +3 -150
  47. package/lib/client/admin/QaAdmin.js.map +1 -1
  48. package/lib/client/admin/RoleEditor.js +46 -0
  49. package/lib/client/admin/RoleEditor.js.map +1 -0
  50. package/lib/client/admin/capability-selection.js +63 -0
  51. package/lib/client/admin/capability-selection.js.map +1 -0
  52. package/lib/client/admin/pages/Conversations.js +35 -17
  53. package/lib/client/admin/pages/Conversations.js.map +1 -1
  54. package/lib/client/admin/pages/Overview.js +3 -2
  55. package/lib/client/admin/pages/Overview.js.map +1 -1
  56. package/lib/client/admin/pages/Quality.js +77 -20
  57. package/lib/client/admin/pages/Quality.js.map +1 -1
  58. package/lib/client/admin/pages/SkillFiles.js +14 -3
  59. package/lib/client/admin/pages/SkillFiles.js.map +1 -1
  60. package/lib/client/admin/shared.js +68 -3
  61. package/lib/client/admin/shared.js.map +1 -1
  62. package/lib/client/components/QaAuthGate.js +31 -28
  63. package/lib/client/components/QaAuthGate.js.map +1 -1
  64. package/lib/client/components/QaChangelog.js +71 -0
  65. package/lib/client/components/QaChangelog.js.map +1 -1
  66. package/lib/client/components/QaComposer.js +27 -4
  67. package/lib/client/components/QaComposer.js.map +1 -1
  68. package/lib/client/components/QaFormItem.js +63 -0
  69. package/lib/client/components/QaFormItem.js.map +1 -0
  70. package/lib/client/components/QaInputForm.js +281 -0
  71. package/lib/client/components/QaInputForm.js.map +1 -0
  72. package/lib/client/components/QaModal.js +17 -4
  73. package/lib/client/components/QaModal.js.map +1 -1
  74. package/lib/client/components/QaRequestWait.js +15 -0
  75. package/lib/client/components/QaRequestWait.js.map +1 -0
  76. package/lib/client/forms-styles.js +14 -0
  77. package/lib/client/forms-styles.js.map +1 -0
  78. package/lib/client/forms.js +40 -0
  79. package/lib/client/forms.js.map +1 -0
  80. package/lib/client/index.js +18 -2
  81. package/lib/client/index.js.map +1 -1
  82. package/lib/client/oidc-browser.js +39 -0
  83. package/lib/client/oidc-browser.js.map +1 -0
  84. package/lib/client/panels/PanelHost.js +23 -1
  85. package/lib/client/panels/PanelHost.js.map +1 -1
  86. package/lib/client/project-session-state.js.map +1 -1
  87. package/lib/client/request-wait-styles.js +7 -0
  88. package/lib/client/request-wait-styles.js.map +1 -0
  89. package/lib/client/settings/sections/interface.js +2 -1
  90. package/lib/client/settings/sections/interface.js.map +1 -1
  91. package/lib/client/settings/sections/status.js +3 -1
  92. package/lib/client/settings/sections/status.js.map +1 -1
  93. package/lib/client/styles.js +5 -3
  94. package/lib/client/styles.js.map +1 -1
  95. package/lib/client/types.js.map +1 -1
  96. package/lib/client.js +471 -72918
  97. package/lib/client.js.map +1 -1
  98. package/lib/config-resolvers/accounts.js +5 -4
  99. package/lib/config-resolvers/accounts.js.map +1 -1
  100. package/lib/config-resolvers/defaults.js +16 -0
  101. package/lib/config-resolvers/defaults.js.map +1 -1
  102. package/lib/config-resolvers/oidc.js +53 -0
  103. package/lib/config-resolvers/oidc.js.map +1 -0
  104. package/lib/config.js +71 -0
  105. package/lib/config.js.map +1 -1
  106. package/lib/filesystem-intent.js +39 -0
  107. package/lib/filesystem-intent.js.map +1 -0
  108. package/lib/forms/attachments.js +230 -0
  109. package/lib/forms/attachments.js.map +1 -0
  110. package/lib/forms/errors.js +37 -0
  111. package/lib/forms/errors.js.map +1 -0
  112. package/lib/forms/fingerprint.js +21 -0
  113. package/lib/forms/fingerprint.js.map +1 -0
  114. package/lib/forms/gate.js +125 -0
  115. package/lib/forms/gate.js.map +1 -0
  116. package/lib/forms/schema.js +182 -0
  117. package/lib/forms/schema.js.map +1 -0
  118. package/lib/forms/service.js +220 -0
  119. package/lib/forms/service.js.map +1 -0
  120. package/lib/forms/store.js +194 -0
  121. package/lib/forms/store.js.map +1 -0
  122. package/lib/forms/types.js +2 -0
  123. package/lib/forms/types.js.map +1 -0
  124. package/lib/forms/validation.js +113 -0
  125. package/lib/forms/validation.js.map +1 -0
  126. package/lib/index.js +271 -81
  127. package/lib/index.js.map +1 -1
  128. package/lib/oidc/http.js +30 -0
  129. package/lib/oidc/http.js.map +1 -0
  130. package/lib/oidc/service.js +250 -0
  131. package/lib/oidc/service.js.map +1 -0
  132. package/lib/qa-tools/activation-manager.js +24 -2
  133. package/lib/qa-tools/activation-manager.js.map +1 -1
  134. package/lib/qa-tools/catalog.js +11 -1
  135. package/lib/qa-tools/catalog.js.map +1 -1
  136. package/lib/qa-tools/index.js +27 -0
  137. package/lib/qa-tools/index.js.map +1 -1
  138. package/lib/qa-tools/request-user-form.js +121 -0
  139. package/lib/qa-tools/request-user-form.js.map +1 -0
  140. package/lib/request-scheduler.js +235 -0
  141. package/lib/request-scheduler.js.map +1 -0
  142. package/lib/resolve-config.js +2 -0
  143. package/lib/resolve-config.js.map +1 -1
  144. package/lib/secure-session.js +60 -60
  145. package/lib/secure-session.js.map +1 -1
  146. package/lib/session-create.js +125 -0
  147. package/lib/session-create.js.map +1 -0
  148. package/lib/typert.host.js +4636 -1103
  149. package/lib/typert.remote-client.d.ts +135 -5
  150. package/lib/typert.remote-client.js +4502 -1095
  151. package/lib/types/accounts/database.d.ts +8 -0
  152. package/lib/types/accounts/file.d.ts +2 -0
  153. package/lib/types/accounts/store.d.ts +17 -0
  154. package/lib/types/accounts/token.d.ts +3 -1
  155. package/lib/types/admin/metrics.d.ts +5 -1
  156. package/lib/types/admin/read-budget.d.ts +8 -0
  157. package/lib/types/admin/service.d.ts +17 -0
  158. package/lib/types/admin/session-log.d.ts +30 -1
  159. package/lib/types/attachment-access.d.ts +29 -0
  160. package/lib/types/chat-sharing/search.d.ts +5 -0
  161. package/lib/types/chat-sharing/uploads.d.ts +2 -1
  162. package/lib/types/client/QaAccountsController.d.ts +4 -0
  163. package/lib/types/client/QaRouteController.d.ts +1 -0
  164. package/lib/types/client/QaSessionController.d.ts +24 -12
  165. package/lib/types/client/QaSurface.d.ts +2 -0
  166. package/lib/types/client/admin/CapabilityPicker.d.ts +14 -0
  167. package/lib/types/client/admin/CoverageNotice.d.ts +6 -0
  168. package/lib/types/client/admin/RoleEditor.d.ts +15 -0
  169. package/lib/types/client/admin/capability-selection.d.ts +27 -0
  170. package/lib/types/client/admin/shared.d.ts +39 -1
  171. package/lib/types/client/components/QaAuthGate.d.ts +2 -0
  172. package/lib/types/client/components/QaFormItem.d.ts +20 -0
  173. package/lib/types/client/components/QaInputForm.d.ts +18 -0
  174. package/lib/types/client/components/QaRequestWait.d.ts +6 -0
  175. package/lib/types/client/forms-styles.d.ts +2 -0
  176. package/lib/types/client/forms.d.ts +23 -0
  177. package/lib/types/client/oidc-browser.d.ts +12 -0
  178. package/lib/types/client/project-session-state.d.ts +2 -4
  179. package/lib/types/client/request-wait-styles.d.ts +2 -0
  180. package/lib/types/client/types.d.ts +10 -4
  181. package/lib/types/config-resolvers/oidc.d.ts +3 -0
  182. package/lib/types/filesystem-intent.d.ts +12 -0
  183. package/lib/types/forms/attachments.d.ts +51 -0
  184. package/lib/types/forms/errors.d.ts +11 -0
  185. package/lib/types/forms/fingerprint.d.ts +9 -0
  186. package/lib/types/forms/gate.d.ts +33 -0
  187. package/lib/types/forms/schema.d.ts +72 -0
  188. package/lib/types/forms/service.d.ts +15 -0
  189. package/lib/types/forms/store.d.ts +25 -0
  190. package/lib/types/forms/types.d.ts +215 -0
  191. package/lib/types/forms/validation.d.ts +20 -0
  192. package/lib/types/index.d.ts +33 -12
  193. package/lib/types/oidc/http.d.ts +5 -0
  194. package/lib/types/oidc/service.d.ts +30 -0
  195. package/lib/types/oidc.js +2 -0
  196. package/lib/types/oidc.js.map +1 -0
  197. package/lib/types/qa-tools/activation-manager.d.ts +5 -0
  198. package/lib/types/qa-tools/catalog.d.ts +4 -1
  199. package/lib/types/qa-tools/index.d.ts +5 -1
  200. package/lib/types/qa-tools/request-user-form.d.ts +5 -0
  201. package/lib/types/request-scheduler.d.ts +28 -0
  202. package/lib/types/secure-session.d.ts +13 -26
  203. package/lib/types/session-create.d.ts +29 -0
  204. package/lib/types/types/accounts.d.ts +2 -0
  205. package/lib/types/types/admin.d.ts +6 -0
  206. package/lib/types/types/config.d.ts +6 -0
  207. package/lib/types/types/oidc.d.ts +36 -0
  208. package/lib/types/types/session.d.ts +8 -0
  209. package/lib/types/types.d.ts +2 -0
  210. package/lib/types/user-workspace.d.ts +4 -6
  211. package/lib/user-workspace.js +13 -67
  212. package/lib/user-workspace.js.map +1 -1
  213. package/package.json +66 -62
@@ -19,7 +19,12 @@ export interface QaToolActivationManagerOptions {
19
19
  export declare class QaToolActivationManager implements QaToolActivation {
20
20
  private readonly options;
21
21
  private readonly states;
22
+ private readonly activeAgents;
23
+ private catalog;
22
24
  constructor(options: QaToolActivationManagerOptions);
25
+ /** Reconcile feature switches only for scopes which already earned activation. */
26
+ replaceCatalog(catalog: readonly QaToolDescriptor[]): void;
27
+ disposeAll(): void;
23
28
  /**
24
29
  * Register the whole catalog on one agent, all or nothing.
25
30
  *
@@ -1,5 +1,6 @@
1
1
  import type { Agent } from "@deepseek-ai/dsh-agent";
2
2
  import type { QaToolDescriptor } from "./types.js";
3
+ import type { QaFormGate } from "../forms/gate.js";
3
4
  /**
4
5
  * Deterministic catalog identity. The durable activation marker is derived from
5
6
  * the session log rather than stored, so this version is not compared against a
@@ -8,9 +9,11 @@ import type { QaToolDescriptor } from "./types.js";
8
9
  *
9
10
  * Bump it whenever the catalog's tool set or their schemas change.
10
11
  */
11
- export declare const QA_TOOL_CATALOG_VERSION = "3";
12
+ export declare const QA_TOOL_CATALOG_VERSION = "4";
12
13
  /** What the catalog's definitions read, beyond the execution record. */
13
14
  export interface QaToolsSelfcheckDeps {
15
+ readonly forms?: QaFormGate;
16
+ readonly formProjection?: (submission: import("../forms/types.js").QaFormSubmission, sessionId: string) => Promise<unknown>;
14
17
  readonly catalogVersion: string;
15
18
  readonly activationMode: string;
16
19
  /** Names the catalog contributes, in catalog order. */
@@ -3,6 +3,9 @@ import type { Context } from "@deepseek-ai/cordis";
3
3
  import type { PluginLogger } from "@yadsh/dsh-plugin-log";
4
4
  import type { QaToolActivation } from "./types.js";
5
5
  export interface QaToolsOptions {
6
+ readonly forms?: import("../forms/gate.js").QaFormGate;
7
+ readonly formsEnabled?: () => boolean;
8
+ readonly formProjection?: (submission: import("../forms/types.js").QaFormSubmission, sessionId: string) => Promise<unknown>;
6
9
  readonly logger: PluginLogger;
7
10
  readonly dynamicActivation: boolean;
8
11
  readonly activationSkill: string;
@@ -31,12 +34,13 @@ export declare class QaTools implements QaToolActivation {
31
34
  private readonly manager;
32
35
  private readonly detector;
33
36
  private readonly lifecycle;
34
- private readonly catalogTools;
37
+ private catalogTools;
35
38
  constructor(ctx: Context, options: QaToolsOptions);
36
39
  /** Names currently registered on one agent; the admission guard reads this per call. */
37
40
  activeToolNames(agent: Agent): readonly string[];
38
41
  /** Shipped scope-local names, including entries not activated on an agent yet. */
39
42
  catalogToolNames(): readonly string[];
43
+ refreshForms(): void;
40
44
  dispose(): void;
41
45
  /**
42
46
  * The preset gate. An empty `activationPresets` leaves it open, which is only
@@ -0,0 +1,5 @@
1
+ import type { ToolDefinition } from "@deepseek-ai/dsh-tools";
2
+ import type { QaFormGate } from "../forms/gate.js";
3
+ /** Build only; the QA activation manager owns registration and role admission. */
4
+ export declare function createRequestUserFormTool(gate: QaFormGate, project?: (submission: import("../forms/types.js").QaFormSubmission, sessionId: string) => Promise<unknown>): ToolDefinition;
5
+ //# sourceMappingURL=request-user-form.d.ts.map
@@ -0,0 +1,28 @@
1
+ import type { Context } from "@deepseek-ai/cordis";
2
+ import type { Agent } from "@deepseek-ai/dsh-agent";
3
+ import type { QaQueueStatus } from "./types.js";
4
+ /** A FIFO admission lease covers a complete root turn, including its experts. */
5
+ export declare class QaRequestScheduler {
6
+ private readonly limit;
7
+ private readonly roots;
8
+ private readonly now;
9
+ private readonly familyBusy;
10
+ private readonly active;
11
+ private readonly waiting;
12
+ private readonly completed;
13
+ private readonly retiring;
14
+ private closed;
15
+ constructor(limit: () => number, roots: () => readonly Agent[], now?: () => number, familyBusy?: (agent: Agent) => boolean);
16
+ install(ctx: Context): () => void;
17
+ acquire(agent: Agent, signal: AbortSignal): Promise<void>;
18
+ release(agent: Agent, completed?: boolean): void;
19
+ private pump;
20
+ status(sessionId?: string): QaQueueStatus;
21
+ private estimate;
22
+ dispose(): void;
23
+ }
24
+ /** Include background descendants whose root has already ended its own turn. */
25
+ export declare function qaRequestFamilyBusy(ctx: Context, root: Agent): boolean;
26
+ /** Older optional compositions may lack the registry, but cannot enforce a cap. */
27
+ export declare function qaRequestRoots(ctx: Context, required: boolean): readonly Agent[];
28
+ //# sourceMappingURL=request-scheduler.d.ts.map
@@ -1,5 +1,6 @@
1
1
  import type { Agent } from "@deepseek-ai/dsh-agent";
2
2
  import type { Context } from "@deepseek-ai/cordis";
3
+ import { type QaAttachmentRecovery } from "./attachment-access.js";
3
4
  import type { PluginLogger } from "@yadsh/dsh-plugin-log";
4
5
  import { type QaSessionFacts } from "./accounts/store.js";
5
6
  import type { QaIntegrationPrincipalBindings } from "./integration-principals.js";
@@ -71,12 +72,10 @@ export declare class QaPolicyAdmission {
71
72
  * one set answers for the whole chat.
72
73
  */
73
74
  private readonly attested;
75
+ private readonly rejected;
76
+ private readonly questionWarnings;
74
77
  private readonly workspaceAccess;
75
- /**
76
- * Removers of the document input roots granted per session, so a grant lives
77
- * exactly as long as the workspace access that justified it.
78
- */
79
- private readonly documentInputRoots;
78
+ private readonly attachmentAccess;
80
79
  /**
81
80
  * Every name reachable anywhere in one QA conversation, keyed by session id.
82
81
  *
@@ -115,7 +114,7 @@ export declare class QaPolicyAdmission {
115
114
  * deliberately not a delegation); {@link secureSessionForUser} has no token
116
115
  * to compare, so it fills it here, against the ownership record it checked.
117
116
  */
118
- principals?: QaIntegrationPrincipalBindings | undefined);
117
+ principals?: QaIntegrationPrincipalBindings | undefined, attachmentRecovery?: QaAttachmentRecovery);
119
118
  /**
120
119
  * Add tools whose own executor resolves the QA principal server-side.
121
120
  * Enabling the contributing plugin is the operator decision; model arguments
@@ -129,29 +128,17 @@ export declare class QaPolicyAdmission {
129
128
  * newly-created, permanently unusable chat behind.
130
129
  */
131
130
  preflightDeployment(): void;
131
+ /** Keep a failed creation fenced even when its Host teardown cannot finish. */
132
+ rejectSession(sessionId: string): void;
133
+ /** Called only after failed creation confirms resource and ownership cleanup. */
134
+ forgetRejectedSession(sessionId: string): void;
132
135
  /**
133
- * The mounted attachment store's verbatim root, when the backend exposes
134
- * one. It sits outside every workspace, so the per-user fence would
135
- * otherwise deny the model the exact file an upload produced and the prompt
136
- * points it at. A backend without a resolvable root simply keeps the fence
137
- * closed — attachments then only work where reads are not fenced per user.
138
- * Source preview asks for the same root, so one upload is readable by both.
136
+ * The backend location used to validate exact file capabilities. The root
137
+ * itself grants no read access; only this conversation's Host-admitted
138
+ * user-message references and verified submitted form resources do.
139
139
  */
140
140
  attachmentRoot(): string | undefined;
141
- /**
142
- * Carry the fence's attachment exemption into the document pipeline.
143
- *
144
- * The guard above lets a single-file read reach the mounted store: an upload
145
- * is content-addressed, immutable, outside every workspace, and the prompt
146
- * hands the model exactly that path. The document pipeline keeps its own
147
- * read scope and knew nothing about the store, so `document_*` refused the
148
- * very file the model was allowed to read — the panel's own Word preview hit
149
- * the same wall. The grant is the missing hand-over, made where the access it
150
- * mirrors is made: per admitted session, and revoked with it.
151
- */
152
- private grantDocumentInputRoots;
153
- /** Drop one session's document grant, if the pipeline still holds it. */
154
- private revokeDocumentInputRoots;
141
+ grantAttachmentFile(sessionId: string, file: string): void;
155
142
  /**
156
143
  * The live agent for one session, resuming a Session the Host has not
157
144
  * materialized in this process.
@@ -0,0 +1,29 @@
1
+ import type { Context } from "@deepseek-ai/cordis";
2
+ import type { PluginLogger } from "@yadsh/dsh-plugin-log";
3
+ import type { QaStoredSessionEraser } from "./admin/session-log.js";
4
+ import type { QaSessionModelPolicy } from "./access/model-policy.js";
5
+ import type { ResolvedQaSurfaceConfig } from "./types.js";
6
+ export interface QaSessionCreateOptions {
7
+ readonly ctx: Context;
8
+ readonly config: ResolvedQaSurfaceConfig;
9
+ readonly logger: PluginLogger;
10
+ readonly sessionFiles: QaStoredSessionEraser;
11
+ reserve(id: string): {
12
+ readonly id: string;
13
+ } | undefined;
14
+ release(owner: string, id: string): void;
15
+ modelPolicy(id: string): QaSessionModelPolicy;
16
+ preflight(): void;
17
+ admit(id: string): Promise<unknown>;
18
+ attest(id: string, owner: string | undefined): void;
19
+ reject(id: string): void;
20
+ /** Drop failure-only metadata after resource and ownership cleanup succeeds. */
21
+ forget(id: string): void;
22
+ }
23
+ /**
24
+ * Admit inside the native factory's serial publication callback. A failure is
25
+ * rolled back by the Host's lifecycle owner before we erase this UUID's log;
26
+ * native preset composition and dynamic default-model hooks stay intact.
27
+ */
28
+ export declare function createQaSession(options: QaSessionCreateOptions): Promise<string>;
29
+ //# sourceMappingURL=session-create.d.ts.map
@@ -1,6 +1,8 @@
1
1
  import type { QaAccountRole } from "./policy.js";
2
2
  /** The account fields projected to browsers; never includes credentials. */
3
3
  export interface QaAccountUserPublic {
4
+ /** Corporate passwords are managed outside QA. Absent on legacy/local accounts. */
5
+ readonly authMethod?: "oidc";
4
6
  readonly id: string;
5
7
  readonly email: string;
6
8
  readonly displayName: string;
@@ -196,6 +196,12 @@ export interface QaQualityTrendPoint {
196
196
  readonly negative: number;
197
197
  }
198
198
  export interface QaQualityMetrics {
199
+ /** Counts derived from journals are incomplete until every journal was read. */
200
+ readonly coverage?: {
201
+ readonly complete: boolean;
202
+ readonly readConversations: number;
203
+ readonly totalConversations: number;
204
+ };
199
205
  readonly conversations: number;
200
206
  readonly activeUsers: number;
201
207
  readonly assistantMessages: number;
@@ -94,6 +94,7 @@ export interface QaNotesConfig {
94
94
  };
95
95
  }
96
96
  export interface QaSurfaceConfig {
97
+ readonly forms?: Partial<import("../forms/types.js").QaFormPolicy>;
97
98
  readonly enabled?: boolean;
98
99
  readonly route?: {
99
100
  readonly path?: string;
@@ -237,6 +238,8 @@ export interface QaSurfaceConfig {
237
238
  readonly frameAncestors?: string | null;
238
239
  };
239
240
  readonly accounts?: {
241
+ readonly localLogin?: boolean;
242
+ readonly oidc?: import("./oidc.js").QaOidcConfig;
240
243
  /** Opt-in; the QA gate stays off until the deployment turns this on. */
241
244
  readonly enabled?: boolean;
242
245
  readonly allowRegistration?: boolean;
@@ -372,6 +375,7 @@ export interface QaAttachmentsConfig {
372
375
  readonly extensions?: readonly string[];
373
376
  }
374
377
  export interface ResolvedQaSurfaceConfig {
378
+ readonly forms: Readonly<import("../forms/types.js").QaFormPolicy>;
375
379
  readonly enabled: boolean;
376
380
  readonly route: {
377
381
  readonly path: string;
@@ -441,6 +445,8 @@ export interface ResolvedQaSurfaceConfig {
441
445
  readonly frameAncestors: string | null;
442
446
  };
443
447
  readonly accounts: {
448
+ readonly localLogin: boolean;
449
+ readonly oidc: import("./oidc.js").ResolvedQaOidcConfig;
444
450
  readonly enabled: boolean;
445
451
  readonly allowRegistration: boolean;
446
452
  readonly sessionTtlDays: number;
@@ -0,0 +1,36 @@
1
+ /** Server OIDC configuration. Secrets are referenced by environment name only. */
2
+ export interface QaOidcConfig {
3
+ readonly enabled?: boolean;
4
+ readonly issuer?: string;
5
+ readonly clientId?: string;
6
+ readonly clientSecretEnv?: string;
7
+ /** Exact public HTTPS callback URL, including any reverse proxy prefix. */
8
+ readonly redirectUri?: string;
9
+ readonly buttonLabel?: string;
10
+ readonly autoProvision?: boolean;
11
+ /** Client roles included in the signed ID token's resource_access claim. */
12
+ readonly requiredRole?: string;
13
+ readonly adminRole?: string;
14
+ readonly reviewerRole?: string;
15
+ /** Upper bound on QA access before another OIDC authentication. */
16
+ readonly sessionTtlSeconds?: number;
17
+ }
18
+ export interface ResolvedQaOidcConfig {
19
+ readonly enabled: boolean;
20
+ readonly issuer: string;
21
+ readonly clientId: string;
22
+ readonly clientSecretEnv: string;
23
+ readonly redirectUri: string;
24
+ readonly buttonLabel: string;
25
+ readonly autoProvision: boolean;
26
+ readonly requiredRole: string;
27
+ readonly adminRole: string;
28
+ readonly reviewerRole: string;
29
+ readonly sessionTtlSeconds: number;
30
+ }
31
+ /** The browser retains completionKey in sessionStorage before leaving QA. */
32
+ export interface QaOidcStart {
33
+ readonly authorizationUrl: string;
34
+ readonly completionKey: string;
35
+ }
36
+ //# sourceMappingURL=oidc.d.ts.map
@@ -331,6 +331,14 @@ export interface QaQueueStatus {
331
331
  readonly active: number;
332
332
  /** Whether one more turn fits; false while no ceiling is set. */
333
333
  readonly full: boolean;
334
+ /** The Host enforces admission and starts queued turns automatically. */
335
+ readonly managed?: boolean;
336
+ readonly queued?: number;
337
+ /** Present only for the authorized chat whose status was requested. */
338
+ readonly waiting?: boolean;
339
+ readonly position?: number | null;
340
+ /** Approximate delay derived from completed turns, or null without a sample. */
341
+ readonly estimatedWaitMs?: number | null;
334
342
  }
335
343
  export interface QaSessionState {
336
344
  readonly chatAccess?: import("../chat-sharing/types.js").QaChatAccess;
@@ -1,7 +1,9 @@
1
1
  export type * from "./types/policy.js";
2
+ export type * from "./forms/types.js";
2
3
  export type * from "./types/capability.js";
3
4
  export type * from "./types/access.js";
4
5
  export type * from "./types/accounts.js";
6
+ export type * from "./types/oidc.js";
5
7
  export type * from "./types/skills.js";
6
8
  export type * from "./types/expert-memory.js";
7
9
  export type * from "./types/config.js";
@@ -10,6 +10,8 @@ export interface QaToolExecutionLike {
10
10
  export interface QaUserWorkspaceReadPolicy {
11
11
  /** Shared directories exposed only to read-only filesystem tools. */
12
12
  readonly sharedReadOnlyRoots?: readonly string[];
13
+ /** Exact canonical files derived from this conversation's trusted references. */
14
+ readonly attachmentFiles?: readonly string[];
13
15
  }
14
16
  export declare function pathIsInside(target: string, root: string): boolean;
15
17
  /**
@@ -31,12 +33,8 @@ export declare function existingQaUserWorkspace(workspaceRoot: string, userId: s
31
33
  * fences model-controlled file paths for both reads and writes, rejects tools
32
34
  * whose implementation can walk above cwd, and enforces bounded scratch use.
33
35
  *
34
- * `attachmentRoot` is the one deliberate read exemption: an uploaded file is
35
- * an immutable content-addressed copy the deployment stores outside every
36
- * workspace, and the model reaches it exactly as the harness intends (the
37
- * prompt carries the stored path). Reads of a single such file are allowed;
38
- * directory-wide tools stay confined because the store is shared by every
39
- * account, and writes are never exempted.
36
+ * `attachmentRoot` identifies the storage backend, never authority to read it.
37
+ * Only regular files in `attachmentFiles` may cross the workspace boundary.
40
38
  */
41
39
  export declare function qaUserWorkspaceDenial(execution: QaToolExecutionLike, root: string, attachmentRoot?: string, readPolicy?: QaUserWorkspaceReadPolicy): string | undefined;
42
40
  //# sourceMappingURL=user-workspace.d.ts.map
@@ -1,5 +1,6 @@
1
1
  import { chmodSync, lstatSync, mkdirSync, readdirSync, realpathSync, statSync, } from "node:fs";
2
2
  import path from "node:path";
3
+ import { qaFilesystemIntent } from "./filesystem-intent.js";
3
4
  /** Stable, non-workspace child used to keep account directories out of sight. */
4
5
  export const QA_USER_WORKSPACES_DIRECTORY = ".qa-users";
5
6
  /** Conservative fixed budgets; there is deliberately no browser override. */
@@ -105,49 +106,6 @@ function record(value) {
105
106
  ? value
106
107
  : undefined;
107
108
  }
108
- function requestedPaths(execution) {
109
- const args = record(execution.arguments);
110
- if (args === undefined)
111
- return [];
112
- switch (execution.name) {
113
- case "read":
114
- case "read_image":
115
- case "write":
116
- case "edit": {
117
- return typeof args.file_path === "string" ? [args.file_path] : [];
118
- }
119
- case "glob":
120
- case "grep": {
121
- return [typeof args.path === "string" ? args.path : "."];
122
- }
123
- case "str_replace_editor": {
124
- return typeof args.path === "string" ? [args.path] : [];
125
- }
126
- default:
127
- return [];
128
- }
129
- }
130
- /**
131
- * Whether the named path is only read. Directory-wide tools stay confined even
132
- * for reads: the attachment store is shared by every account, and only the
133
- * exact file an upload produced is meant to be reachable.
134
- */
135
- function readsSharedRoot(execution) {
136
- if (execution.name === "read" ||
137
- execution.name === "read_image" ||
138
- execution.name === "glob" ||
139
- execution.name === "grep") {
140
- return true;
141
- }
142
- return (execution.name === "str_replace_editor" &&
143
- record(execution.arguments)?.command === "view");
144
- }
145
- function readsSingleFile(execution) {
146
- if (execution.name === "read" || execution.name === "read_image")
147
- return true;
148
- return (execution.name === "str_replace_editor" &&
149
- record(execution.arguments)?.command === "view");
150
- }
151
109
  function directoryBytes(root, stopAfter) {
152
110
  let total = 0;
153
111
  const pending = [root];
@@ -167,24 +125,13 @@ function directoryBytes(root, stopAfter) {
167
125
  }
168
126
  return total;
169
127
  }
170
- function requestedWriteBytes(execution) {
171
- const args = record(execution.arguments);
172
- if (args === undefined)
173
- return 0;
174
- const values = [args.content, args.new_string, args.new_str];
175
- return values.reduce((total, value) => total + (typeof value === "string" ? Buffer.byteLength(value) : 0), 0);
176
- }
177
128
  /**
178
129
  * Monotonic guard used in addition to DSH's workspace-write sandbox. It
179
130
  * fences model-controlled file paths for both reads and writes, rejects tools
180
131
  * whose implementation can walk above cwd, and enforces bounded scratch use.
181
132
  *
182
- * `attachmentRoot` is the one deliberate read exemption: an uploaded file is
183
- * an immutable content-addressed copy the deployment stores outside every
184
- * workspace, and the model reaches it exactly as the harness intends (the
185
- * prompt carries the stored path). Reads of a single such file are allowed;
186
- * directory-wide tools stay confined because the store is shared by every
187
- * account, and writes are never exempted.
133
+ * `attachmentRoot` identifies the storage backend, never authority to read it.
134
+ * Only regular files in `attachmentFiles` may cross the workspace boundary.
188
135
  */
189
136
  export function qaUserWorkspaceDenial(execution, root, attachmentRoot, readPolicy = {}) {
190
137
  const args = record(execution.arguments);
@@ -202,35 +149,34 @@ export function qaUserWorkspaceDenial(execution, root, attachmentRoot, readPolic
202
149
  execution.name === "apply_patch") {
203
150
  return PATH_DENIAL;
204
151
  }
205
- const readsShared = readsSharedRoot(execution);
206
- const readsOneFile = readsSingleFile(execution);
152
+ const intent = qaFilesystemIntent(execution.name, args);
207
153
  try {
208
154
  const sharedReadOnlyRoots = (readPolicy.sharedReadOnlyRoots ?? []).map(canonicalCandidate);
209
- for (const requested of requestedPaths(execution)) {
155
+ for (const requested of intent === undefined ? [] : [intent.path]) {
210
156
  const absolute = path.isAbsolute(requested)
211
157
  ? requested
212
158
  : path.resolve(root, requested);
213
159
  const canonical = canonicalCandidate(absolute);
214
160
  if (pathIsInside(canonical, root))
215
161
  continue;
216
- if (readsShared &&
162
+ if (intent?.kind === "read" &&
217
163
  sharedReadOnlyRoots.some((readRoot) => pathIsInside(canonical, readRoot))) {
218
164
  continue;
219
165
  }
220
166
  // Resolved only for a path the fence would otherwise refuse, so the
221
167
  // common case pays no extra filesystem walk.
222
- if (readsOneFile &&
168
+ if (intent?.kind === "read" &&
169
+ intent.fileOnlyGrant &&
223
170
  attachmentRoot !== undefined &&
224
- pathIsInside(canonical, canonicalCandidate(attachmentRoot))) {
171
+ pathIsInside(canonical, canonicalCandidate(attachmentRoot)) &&
172
+ (readPolicy.attachmentFiles ?? []).some((file) => samePath(canonical, file)) &&
173
+ statSync(canonical).isFile()) {
225
174
  continue;
226
175
  }
227
176
  return PATH_DENIAL;
228
177
  }
229
- if (execution.name === "write" ||
230
- execution.name === "edit" ||
231
- (execution.name === "str_replace_editor" &&
232
- record(execution.arguments)?.command !== "view")) {
233
- const requested = requestedWriteBytes(execution);
178
+ if (intent?.kind === "write") {
179
+ const requested = intent.bytes;
234
180
  if (requested > QA_USER_WORKSPACE_MAX_WRITE_BYTES ||
235
181
  directoryBytes(root, QA_USER_WORKSPACE_MAX_BYTES) + requested >
236
182
  QA_USER_WORKSPACE_MAX_BYTES) {
@@ -1 +1 @@
1
- {"version":3,"file":"user-workspace.js","sourceRoot":"","sources":["../src/user-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AAExD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAElE,MAAM,eAAe,GACnB,6EAA6E,CAAC;AAChF,MAAM,WAAW,GACf,+DAA+D,CAAC;AAClE,MAAM,YAAY,GAAG,gDAAgD,CAAC;AAYtE,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,QAAQ,KAAK,IAAI;YACjB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,KAAK,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtC,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACvD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QACrD,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,SAA8B;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC;QACZ,KAAK,YAAY,CAAC;QAClB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,oBAAoB,EAAE,CAAC;YAC1B,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,CAAC;QACD;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,SAA8B;IACrD,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,YAAY;QAC/B,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,MAAM,EACzB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,oBAAoB;QACvC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,MAAM,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,SAA8B;IACrD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,oBAAoB;QACvC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,MAAM,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,SAAiB;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAG,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACrC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;iBAC5C,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAC3D,IAAI,KAAK,GAAG,SAAS;gBAAE,MAAM;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,SAA8B;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,KAAK,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACpE,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA8B,EAC9B,IAAY,EACZ,cAAuB,EACvB,UAAU,GAA8B,EAAE;IAE1C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IACE,IAAI,EAAE,mBAAmB,KAAK,SAAS;QACvC,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;YACxB,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,IAAI,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,OAAO;QAC1B,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QACtC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACjC,SAAS,CAAC,IAAI,KAAK,UAAU;QAC7B,SAAS,CAAC,IAAI,KAAK,KAAK;QACxB,SAAS,CAAC,IAAI,KAAK,aAAa,EAChC,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,CAAC,UAAU,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CACpE,kBAAkB,CACnB,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;gBAAE,SAAS;YAC5C,IACE,WAAW;gBACX,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACpC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAClC,EACD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,oEAAoE;YACpE,6CAA6C;YAC7C,IACE,YAAY;gBACZ,cAAc,KAAK,SAAS;gBAC5B,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,cAAc,CAAC,CAAC,EAC3D,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IACE,SAAS,CAAC,IAAI,KAAK,OAAO;YAC1B,SAAS,CAAC,IAAI,KAAK,MAAM;YACzB,CAAC,SAAS,CAAC,IAAI,KAAK,oBAAoB;gBACtC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC,EAClD,CAAC;YACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACjD,IACE,SAAS,GAAG,iCAAiC;gBAC7C,cAAc,CAAC,IAAI,EAAE,2BAA2B,CAAC,GAAG,SAAS;oBAC3D,2BAA2B,EAC7B,CAAC;gBACD,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC"}
1
+ {"version":3,"file":"user-workspace.js","sourceRoot":"","sources":["../src/user-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AAExD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAElE,MAAM,eAAe,GACnB,6EAA6E,CAAC;AAChF,MAAM,WAAW,GACf,+DAA+D,CAAC;AAClE,MAAM,YAAY,GAAG,gDAAgD,CAAC;AActE,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,QAAQ,KAAK,IAAI;YACjB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,KAAK,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtC,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACvD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QACrD,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,SAAiB;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAG,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACrC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;iBAC5C,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAC3D,IAAI,KAAK,GAAG,SAAS;gBAAE,MAAM;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA8B,EAC9B,IAAY,EACZ,cAAuB,EACvB,UAAU,GAA8B,EAAE;IAE1C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IACE,IAAI,EAAE,mBAAmB,KAAK,SAAS;QACvC,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;YACxB,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,IAAI,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,OAAO;QAC1B,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QACtC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACjC,SAAS,CAAC,IAAI,KAAK,UAAU;QAC7B,SAAS,CAAC,IAAI,KAAK,KAAK;QACxB,SAAS,CAAC,IAAI,KAAK,aAAa,EAChC,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,CAAC,UAAU,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CACpE,kBAAkB,CACnB,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;gBAAE,SAAS;YAC5C,IACE,MAAM,EAAE,IAAI,KAAK,MAAM;gBACvB,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACpC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAClC,EACD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,oEAAoE;YACpE,6CAA6C;YAC7C,IACE,MAAM,EAAE,IAAI,KAAK,MAAM;gBACvB,MAAM,CAAC,aAAa;gBACpB,cAAc,KAAK,SAAS;gBAC5B,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBAC3D,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/C,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAC1B;gBACD,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAC5B,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;YAC/B,IACE,SAAS,GAAG,iCAAiC;gBAC7C,cAAc,CAAC,IAAI,EAAE,2BAA2B,CAAC,GAAG,SAAS;oBAC3D,2BAA2B,EAC7B,CAAC;gBACD,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC"}