@decaf-ts/integrations 0.8.0 → 0.10.0

package/lib/cjs/graph/engine/validation/GraphCredentialReferenceValidator.cjs

@@ -0,0 +1,160 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GraphCredentialReferenceValidator = void 0;
+const GraphParameterValidator_js_1 = require("./GraphParameterValidator.cjs");
+/** Nesting depth cap for the recursive plain-secret scan. */
+const MAX_PLAIN_SECRET_SCAN_DEPTH = 8;
+/**
+ * Validates credential references and the absence of plain secrets.
+ */
+class GraphCredentialReferenceValidator {
+    constructor(authorizer) {
+        this.authorizer = authorizer;
+    }
+    /**
+     * Stage 8 — credential-reference authorization for one resolved node.
+     */
+    async validate(node, manifest, issues, path) {
+        const references = this.collectReferences(node, manifest);
+        for (const requirement of manifest.credentials ?? []) {
+            const match = references.find((reference) => reference.credentialType === undefined ||
+                reference.credentialType === requirement.type);
+            if (!match) {
+                if (requirement.required !== false) {
+                    issues.push({
+                        code: "credential.missing",
+                        path,
+                        message: `Node '${node.id}' does not provide the required credential of type '${requirement.type}'`,
+                        nodeId: node.id,
+                        details: { credentialType: requirement.type },
+                    });
+                }
+                continue;
+            }
+            const typeError = this.checkType(match, requirement);
+            if (typeError) {
+                issues.push({
+                    code: "credential.type-mismatch",
+                    path,
+                    message: `Node '${node.id}' credential '${match.credentialId}' has type '${match.credentialType}' but kind '${manifest.kind}' requires '${requirement.type}'`,
+                    nodeId: node.id,
+                    details: { credentialType: match.credentialType ?? "", requiredType: requirement.type },
+                });
+                continue;
+            }
+            if (this.authorizer) {
+                if (!(await this.authorizer.hasCredential(match))) {
+                    issues.push({
+                        code: "credential.not-found",
+                        path,
+                        message: `Node '${node.id}' references credential '${match.credentialId}' which does not exist`,
+                        nodeId: node.id,
+                        details: { credentialId: match.credentialId },
+                    });
+                    continue;
+                }
+                if (!(await this.authorizer.authorize(match, requirement))) {
+                    issues.push({
+                        code: "credential.unauthorized",
+                        path,
+                        message: `Node '${node.id}' is not authorized to use credential '${match.credentialId}'`,
+                        nodeId: node.id,
+                        details: { credentialId: match.credentialId },
+                    });
+                }
+            }
+        }
+        this.scanPlainSecrets(node, issues, path);
+    }
+    /**
+     * Collects the credential references carried by a node instance:
+     * credential-type parameter values and the `credentials` record in
+     * instance metadata.
+     */
+    collectReferences(node, manifest) {
+        const references = [];
+        for (const parameter of manifest.parameters) {
+            if (parameter.type !== "credential")
+                continue;
+            const value = (node.parameters ?? {})[parameter.id];
+            if ((0, GraphParameterValidator_js_1.isGraphCredentialReferenceLike)(value)) {
+                references.push(this.normalize(value, parameter.credentialType));
+            }
+        }
+        const extra = (node.metadata ?? {})["credentials"];
+        if (extra && typeof extra === "object" && !Array.isArray(extra)) {
+            for (const value of Object.values(extra)) {
+                if ((0, GraphParameterValidator_js_1.isGraphCredentialReferenceLike)(value)) {
+                    references.push(this.normalize(value));
+                }
+            }
+        }
+        return references;
+    }
+    normalize(value, credentialType) {
+        if (typeof value === "string") {
+            return { credentialId: value, credentialType: credentialType ?? "" };
+        }
+        return {
+            credentialId: value.credentialId,
+            credentialType: value.credentialType ?? credentialType ?? "",
+        };
+    }
+    checkType(reference, requirement) {
+        return (reference.credentialType !== undefined &&
+            reference.credentialType !== requirement.type);
+    }
+    /**
+     * Plain credential secrets must never appear in workflow documents: any
+     * parameter or metadata key on the secret deny-list is an issue at any
+     * nesting depth (objects and arrays are walked recursively with a depth
+     * cap and cycle guard), as is a credential reference object carrying
+     * extra material (e.g. a `secret` or `value` member).
+     */
+    scanPlainSecrets(node, issues, path) {
+        const denyList = new Set(GraphParameterValidator_js_1.GRAPH_PLAIN_SECRET_KEYS);
+        for (const [key, value] of Object.entries(node.parameters ?? {})) {
+            this.scanPlainSecretValue(value, [key], node, `${path}.parameters`, denyList, issues);
+        }
+        for (const [key, value] of Object.entries(node.metadata ?? {})) {
+            this.scanPlainSecretValue(value, [key], node, `${path}.metadata`, denyList, issues);
+        }
+    }
+    /**
+     * Recursive worker for {@link scanPlainSecrets}: walks one parameter or
+     * metadata value, reporting a `credential.plain-secret` issue when the
+     * current path's key is on the deny-list, and recursing into objects and
+     * arrays otherwise (array items append a `[]` path segment). The
+     * {@link MAX_PLAIN_SECRET_SCAN_DEPTH} cap bounds the walk — deep enough
+     * for legitimate documents, and a guard against pathological/cyclic
+     * input — so nested deny-list keys are caught at any practical depth.
+     */
+    scanPlainSecretValue(value, keyPath, node, basePath, denyList, issues, depth = 0) {
+        const key = keyPath[keyPath.length - 1];
+        if (denyList.has(key)) {
+            issues.push({
+                code: "credential.plain-secret",
+                path: `${basePath}.${keyPath.join(".")}`,
+                message: `Node '${node.id}' carries plain secret material in '${keyPath.join(".")}'; workflow documents may only hold credential references`,
+                nodeId: node.id,
+            });
+            return;
+        }
+        if (depth >= MAX_PLAIN_SECRET_SCAN_DEPTH || value === null)
+            return;
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                this.scanPlainSecretValue(item, [...keyPath, "[]"], node, basePath, denyList, issues, depth + 1);
+            }
+            return;
+        }
+        if (typeof value === "object") {
+            for (const [innerKey, innerValue] of Object.entries(value)) {
+                this.scanPlainSecretValue(innerValue, [...keyPath, innerKey], node, basePath, denyList, issues, depth + 1);
+            }
+        }
+    }
+}
+exports.GraphCredentialReferenceValidator = GraphCredentialReferenceValidator;
+//# sourceMappingURL=GraphCredentialReferenceValidator.js.map
+//# sourceMappingURL=GraphCredentialReferenceValidator.cjs.map

package/lib/cjs/graph/engine/validation/GraphCredentialReferenceValidator.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph/engine/validation/GraphCredentialReferenceValidator.cjs","sourceRoot":"","sources":["graph/engine/validation/GraphCredentialReferenceValidator.js"],"names":[],"mappings":";;;AAAA,6EAAuG;AACvG,6DAA6D;AAC7D,MAAM,2BAA2B,GAAG,CAAC,CAAC;AACtC;;GAEG;AACH,MAAa,iCAAiC;IAC1C,YAAY,UAAU;QAClB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IACD;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1D,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,KAAK,SAAS;gBAC/E,SAAS,CAAC,cAAc,KAAK,WAAW,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,IAAI,WAAW,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;oBACjC,MAAM,CAAC,IAAI,CAAC;wBACR,IAAI,EAAE,oBAAoB;wBAC1B,IAAI;wBACJ,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,uDAAuD,WAAW,CAAC,IAAI,GAAG;wBACnG,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,IAAI,EAAE;qBAChD,CAAC,CAAC;gBACP,CAAC;gBACD,SAAS;YACb,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YACrD,IAAI,SAAS,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,0BAA0B;oBAChC,IAAI;oBACJ,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,iBAAiB,KAAK,CAAC,YAAY,eAAe,KAAK,CAAC,cAAc,eAAe,QAAQ,CAAC,IAAI,eAAe,WAAW,CAAC,IAAI,GAAG;oBAC7J,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE,EAAE,YAAY,EAAE,WAAW,CAAC,IAAI,EAAE;iBAC1F,CAAC,CAAC;gBACH,SAAS;YACb,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAClB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAChD,MAAM,CAAC,IAAI,CAAC;wBACR,IAAI,EAAE,sBAAsB;wBAC5B,IAAI;wBACJ,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,4BAA4B,KAAK,CAAC,YAAY,wBAAwB;wBAC/F,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;qBAChD,CAAC,CAAC;oBACH,SAAS;gBACb,CAAC;gBACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;oBACzD,MAAM,CAAC,IAAI,CAAC;wBACR,IAAI,EAAE,yBAAyB;wBAC/B,IAAI;wBACJ,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,0CAA0C,KAAK,CAAC,YAAY,GAAG;wBACxF,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;qBAChD,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;QACL,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD;;;;OAIG;IACH,iBAAiB,CAAC,IAAI,EAAE,QAAQ;QAC5B,MAAM,UAAU,GAAG,EAAE,CAAC;QACtB,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC1C,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY;gBAC/B,SAAS;YACb,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACpD,IAAI,IAAA,2DAA8B,EAAC,KAAK,CAAC,EAAE,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;YACrE,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvC,IAAI,IAAA,2DAA8B,EAAC,KAAK,CAAC,EAAE,CAAC;oBACxC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3C,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC;IACtB,CAAC;IACD,SAAS,CAAC,KAAK,EAAE,cAAc;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,IAAI,EAAE,EAAE,CAAC;QACzE,CAAC;QACD,OAAO;YACH,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,cAAc,IAAI,EAAE;SAC/D,CAAC;IACN,CAAC;IACD,SAAS,CAAC,SAAS,EAAE,WAAW;QAC5B,OAAO,CAAC,SAAS,CAAC,cAAc,KAAK,SAAS;YAC1C,SAAS,CAAC,cAAc,KAAK,WAAW,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD;;;;;;OAMG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI;QAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,oDAAuB,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1F,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxF,CAAC;IACL,CAAC;IACD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC;QAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,yBAAyB;gBAC/B,IAAI,EAAE,GAAG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACxC,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,uCAAuC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,2DAA2D;gBAC5I,MAAM,EAAE,IAAI,CAAC,EAAE;aAClB,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,IAAI,KAAK,IAAI,2BAA2B,IAAI,KAAK,KAAK,IAAI;YACtD,OAAO;QACX,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACrG,CAAC;YACD,OAAO;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,GAAG,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC/G,CAAC;QACL,CAAC;IACL,CAAC;CACJ;AAnJD,8EAmJC;AACD,6DAA6D"}

package/lib/cjs/graph/engine/validation/GraphDefinitionValidator.cjs

@@ -2,19 +2,17 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GraphDefinitionValidator = void 0;
 const GraphInputError_js_1 = require("./../errors/GraphInputError.cjs");
-const GraphExecutionPlanner_js_1 = require("./../planning/GraphExecutionPlanner.cjs");
 /**
- * Validates a {@link GraphWorkflowDefinition} before execution.
+ * Performs cheap structural checks on a legacy {@link GraphWorkflowDefinition}.
+ *
+ * @deprecated Validate canonical documents with
+ *   {@link GraphWorkflowDocumentValidator} instead.
  */
 class GraphDefinitionValidator {
-    constructor(planner) {
-        this.planner = planner ?? new GraphExecutionPlanner_js_1.GraphExecutionPlanner();
-    }
     /**
-     * Validates the workflow definition.
+     * Validates the workflow definition structure.
      *
-     * @throws {GraphInputError} when the workflow has no name or invalid structure.
-     * @throws {GraphCycleError} when the workflow contains an unsupported cycle.
+     * @throws {GraphInputError} when the workflow has no name or duplicate node ids.
      */
     validate(workflow) {
         if (!workflow.name) {
@@ -24,8 +22,6 @@ class GraphDefinitionValidator {
         if (nodeIds.size !== (workflow.nodes ?? []).length) {
             throw new GraphInputError_js_1.GraphInputError("Workflow node IDs must be unique");
         }
-        // The planner performs full topology validation (endpoints, ports, cycles)
-        this.planner.plan(workflow);
     }
 }
 exports.GraphDefinitionValidator = GraphDefinitionValidator;

package/lib/cjs/graph/engine/validation/GraphDefinitionValidator.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"graph/engine/validation/GraphDefinitionValidator.cjs","sourceRoot":"","sources":["graph/engine/validation/GraphDefinitionValidator.js"],"names":[],"mappings":";;;AAAA,uEAAiE;AACjE,qFAA+E;AAC/E;;GAEG;AACH,MAAa,wBAAwB;IACjC,YAAY,OAAO;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,gDAAqB,EAAE,CAAC;IAC1D,CAAC;IACD;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ;QACb,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,oCAAe,CAAC,2BAA2B,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,IAAI,oCAAe,CAAC,kCAAkC,CAAC,CAAC;QAClE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACJ;AArBD,4DAqBC;AACD,oDAAoD"}
+{"version":3,"file":"graph/engine/validation/GraphDefinitionValidator.cjs","sourceRoot":"","sources":["graph/engine/validation/GraphDefinitionValidator.js"],"names":[],"mappings":";;;AAAA,uEAAiE;AACjE;;;;;GAKG;AACH,MAAa,wBAAwB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ;QACb,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,oCAAe,CAAC,2BAA2B,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,IAAI,oCAAe,CAAC,kCAAkC,CAAC,CAAC;QAClE,CAAC;IACL,CAAC;CACJ;AAfD,4DAeC;AACD,oDAAoD"}

package/lib/cjs/graph/engine/validation/GraphEdgeInstanceValidator.cjs

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GraphEdgeInstanceValidator = void 0;
+const graph_1 = require("@decaf-ts/ui-decorators/graph");
+const constants_js_1 = require("./../constants.cjs");
+/**
+ * Validates edge instances and resolves them into flattened plan edges.
+ */
+class GraphEdgeInstanceValidator {
+    /**
+     * Stage 5 — edge endpoints. Returns the resolved (flattened) edges for
+     * every structurally valid edge; invalid edges are skipped (issues
+     * recorded) so the planner only ever sees valid routing.
+     *
+     * Port existence/direction checks are skipped for nodes whose manifest
+     * policy allows undeclared parameters (transition placeholder kinds with
+     * no declared ports) — the catalogue is authoritative and those legacy
+     * registrations declare no port surface to check against.
+     */
+    resolveEdges(document, nodesById, issues) {
+        const workflowInputs = new Set(document.inputs.map((port) => port.id));
+        const workflowOutputs = new Set(document.outputs.map((port) => port.id));
+        const resolved = [];
+        for (const [index, edge] of (document.edges ?? []).entries()) {
+            const path = `edges[${index}]`;
+            const source = this.resolveEndpoint(edge, "source", nodesById, workflowInputs, workflowOutputs, issues, path);
+            const target = this.resolveEndpoint(edge, "target", nodesById, workflowInputs, workflowOutputs, issues, path);
+            if (!source || !target)
+                continue;
+            const valid = this.validateDirectionAndType(edge, source, target, nodesById, issues, path);
+            if (!valid)
+                continue;
+            const resolvedEdge = {
+                id: edge.id,
+                type: edge.type,
+                sourceNodeId: source.nodeId,
+                sourcePort: source.port,
+                targetNodeId: target.nodeId,
+                targetPort: target.port,
+                metadata: edge.metadata,
+                edge,
+            };
+            if (edge.label !== undefined)
+                resolvedEdge.label = edge.label;
+            resolved.push(resolvedEdge);
+        }
+        return resolved;
+    }
+    resolveEndpoint(edge, side, nodesById, workflowInputs, workflowOutputs, issues, path) {
+        const endpoint = edge[side];
+        if ((0, graph_1.isGraphWorkflowEndpoint)(endpoint)) {
+            const portKnown = side === "source"
+                ? workflowInputs.has(endpoint.port)
+                : workflowOutputs.has(endpoint.port);
+            if (!portKnown) {
+                issues.push({
+                    code: "edge.unknown-port",
+                    path: `${path}.${side}`,
+                    message: `Edge '${edge.id}' ${side} references workflow port '${endpoint.port}' which is not declared on the document boundary`,
+                    edgeId: edge.id,
+                    details: { scope: "workflow", port: endpoint.port },
+                });
+                return undefined;
+            }
+            return { nodeId: constants_js_1.GRAPH_WORKFLOW_BOUNDARY, port: endpoint.port };
+        }
+        if ((0, graph_1.isGraphNodeEndpoint)(endpoint)) {
+            const node = nodesById.get(endpoint.nodeId);
+            if (!node) {
+                issues.push({
+                    code: "edge.unknown-node",
+                    path: `${path}.${side}`,
+                    message: `Edge '${edge.id}' ${side} references node '${endpoint.nodeId}' which is not part of the document or did not resolve`,
+                    edgeId: edge.id,
+                    nodeId: endpoint.nodeId,
+                });
+                return undefined;
+            }
+            return { nodeId: endpoint.nodeId, port: endpoint.port };
+        }
+        issues.push({
+            code: "edge.invalid-endpoint",
+            path: `${path}.${side}`,
+            message: `Edge '${edge.id}' ${side} endpoint is not a valid GraphEndpoint`,
+            edgeId: edge.id,
+        });
+        return undefined;
+    }
+    validateDirectionAndType(edge, source, target, nodesById, issues, path) {
+        let valid = true;
+        const sourceNode = source.nodeId === constants_js_1.GRAPH_WORKFLOW_BOUNDARY
+            ? undefined
+            : nodesById.get(source.nodeId);
+        const targetNode = target.nodeId === constants_js_1.GRAPH_WORKFLOW_BOUNDARY
+            ? undefined
+            : nodesById.get(target.nodeId);
+        // Direction validity. Skipped for lenient placeholder manifests
+        // (transition kinds with no declared port surface).
+        const lenient = (node) => node?.manifest.policies?.allowUndeclaredParameters === true;
+        if (edge.type === "data") {
+            // Data edges: source must be an output port (or workflow input), target
+            // must be an input port (or workflow output). Connection-only ports are
+            // structural and never route data.
+            if (sourceNode && !lenient(sourceNode) && !this.hasPortDirection(sourceNode, source.port, "output")) {
+                this.pushPortIssue(edge, "source", source, sourceNode, issues, path);
+                valid = false;
+            }
+            if (targetNode && !lenient(targetNode) && !this.hasPortDirection(targetNode, target.port, "input")) {
+                this.pushPortIssue(edge, "target", target, targetNode, issues, path);
+                valid = false;
+            }
+        }
+        else {
+            // Structural (connection) edges: both endpoints must be connection
+            // ports on real nodes — the workflow boundary never carries
+            // structural edges (boundary routing validity).
+            if (!sourceNode || !targetNode) {
+                issues.push({
+                    code: "edge.boundary-routing",
+                    path,
+                    message: `Connection edge '${edge.id}' must connect two node connection ports; the workflow boundary only routes data`,
+                    edgeId: edge.id,
+                });
+                return false;
+            }
+            if (!lenient(sourceNode) && !lenient(targetNode) &&
+                (!this.hasPortDirection(sourceNode, source.port, "connection") ||
+                    !this.hasPortDirection(targetNode, target.port, "connection"))) {
+                issues.push({
+                    code: "edge.type-mismatch",
+                    path,
+                    message: `Connection edge '${edge.id}' endpoints must both be connection ports`,
+                    edgeId: edge.id,
+                    details: {
+                        sourcePort: source.port,
+                        targetPort: target.port,
+                    },
+                });
+                return false;
+            }
+        }
+        return valid;
+    }
+    hasPortDirection(node, port, direction) {
+        const ports = direction === "input"
+            ? node.manifest.inputs
+            : direction === "output"
+                ? node.manifest.outputs
+                : node.manifest.connections ?? [];
+        return ports.some((candidate) => candidate.id === port);
+    }
+    pushPortIssue(edge, side, endpoint, node, issues, path) {
+        const expected = side === "source" ? "output" : "input";
+        issues.push({
+            code: edge.type === "data" ? "edge.invalid-direction" : "edge.type-mismatch",
+            path: `${path}.${side}`,
+            message: `Edge '${edge.id}' ${side} port '${endpoint.port}' on node '${endpoint.nodeId}' is not an ${expected} port of kind '${node.manifest.kind}'`,
+            edgeId: edge.id,
+            nodeId: endpoint.nodeId,
+            details: { port: endpoint.port, expected },
+        });
+    }
+}
+exports.GraphEdgeInstanceValidator = GraphEdgeInstanceValidator;
+//# sourceMappingURL=GraphEdgeInstanceValidator.js.map
+//# sourceMappingURL=GraphEdgeInstanceValidator.cjs.map

package/lib/cjs/graph/engine/validation/GraphEdgeInstanceValidator.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph/engine/validation/GraphEdgeInstanceValidator.cjs","sourceRoot":"","sources":["graph/engine/validation/GraphEdgeInstanceValidator.js"],"names":[],"mappings":";;;AAAA,yDAA6F;AAC7F,oDAA4D;AAC5D;;GAEG;AACH,MAAa,0BAA0B;IACnC;;;;;;;;;OASG;IACH,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM;QACpC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,SAAS,KAAK,GAAG,CAAC;YAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9G,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9G,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;gBAClB,SAAS;YACb,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3F,IAAI,CAAC,KAAK;gBACN,SAAS;YACb,MAAM,YAAY,GAAG;gBACjB,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI;aACP,CAAC;YACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,YAAY,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI;QAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,IAAA,+BAAuB,EAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,IAAI,KAAK,QAAQ;gBAC/B,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE;oBACvB,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,KAAK,IAAI,8BAA8B,QAAQ,CAAC,IAAI,kDAAkD;oBAC/H,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;iBACtD,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,sCAAuB,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,IAAA,2BAAmB,EAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACR,MAAM,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE;oBACvB,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,KAAK,IAAI,qBAAqB,QAAQ,CAAC,MAAM,wDAAwD;oBAC9H,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,QAAQ,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE;YACvB,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,KAAK,IAAI,wCAAwC;YAC1E,MAAM,EAAE,IAAI,CAAC,EAAE;SAClB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI;QAClE,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,KAAK,sCAAuB;YACxD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,KAAK,sCAAuB;YACxD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,gEAAgE;QAChE,oDAAoD;QACpD,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,KAAK,IAAI,CAAC;QACtF,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACvB,wEAAwE;YACxE,wEAAwE;YACxE,mCAAmC;YACnC,IAAI,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAClG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrE,KAAK,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,IAAI,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBACjG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrE,KAAK,GAAG,KAAK,CAAC;YAClB,CAAC;QACL,CAAC;aACI,CAAC;YACF,mEAAmE;YACnE,4DAA4D;YAC5D,gDAAgD;YAChD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,uBAAuB;oBAC7B,IAAI;oBACJ,OAAO,EAAE,oBAAoB,IAAI,CAAC,EAAE,kFAAkF;oBACtH,MAAM,EAAE,IAAI,CAAC,EAAE;iBAClB,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC5C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC;oBAC1D,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,oBAAoB;oBAC1B,IAAI;oBACJ,OAAO,EAAE,oBAAoB,IAAI,CAAC,EAAE,2CAA2C;oBAC/E,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE;wBACL,UAAU,EAAE,MAAM,CAAC,IAAI;wBACvB,UAAU,EAAE,MAAM,CAAC,IAAI;qBAC1B;iBACJ,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS;QAClC,MAAM,KAAK,GAAG,SAAS,KAAK,OAAO;YAC/B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM;YACtB,CAAC,CAAC,SAAS,KAAK,QAAQ;gBACpB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;gBACvB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;QAClD,MAAM,QAAQ,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,oBAAoB;YAC5E,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE;YACvB,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,KAAK,IAAI,UAAU,QAAQ,CAAC,IAAI,cAAc,QAAQ,CAAC,MAAM,eAAe,QAAQ,kBAAkB,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG;YACpJ,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE;SAC7C,CAAC,CAAC;IACP,CAAC;CACJ;AA1JD,gEA0JC;AACD,sDAAsD"}

package/lib/cjs/graph/engine/validation/GraphNodeInstanceValidator.cjs

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GraphNodeInstanceValidator = void 0;
+/**
+ * Resolves node instances against the backend catalogue and validates the
+ * resolved dynamic-port surface.
+ */
+class GraphNodeInstanceValidator {
+    constructor(catalogue) {
+        this.catalogue = catalogue;
+    }
+    /**
+     * Stage 2 — kind resolution. Every node kind must exist in the backend
+     * catalogue; the effective manifest (with dynamic ports expanded from the
+     * instance parameters) and the paired executor are attached to the
+     * resolved node. Nodes that fail resolution are skipped (issues recorded)
+     * and never reach the planner.
+     */
+    async resolveNodes(nodes, issues, resolutionContext) {
+        const resolved = new Map();
+        for (const [index, node] of nodes.entries()) {
+            const path = `nodes[${index}]`;
+            if (!this.catalogue.has(node.kind)) {
+                issues.push({
+                    code: "kind.unknown",
+                    path: `${path}.kind`,
+                    message: `Node '${node.id}' references kind '${node.kind}' which is not registered in the backend catalogue`,
+                    nodeId: node.id,
+                    details: { kind: node.kind },
+                });
+                continue;
+            }
+            try {
+                const manifest = await this.catalogue.resolveManifest(node.kind, node, resolutionContext);
+                const executor = this.catalogue.getExecutor(node.kind);
+                resolved.set(node.id, { instance: node, manifest, executor });
+            }
+            catch (error) {
+                issues.push({
+                    code: "kind.resolution-failed",
+                    path: `${path}.kind`,
+                    message: `Node '${node.id}' kind '${node.kind}' failed to resolve: ${error.message}`,
+                    nodeId: node.id,
+                    details: { kind: node.kind },
+                });
+            }
+        }
+        return resolved;
+    }
+    /**
+     * Stage 4 — dynamic ports and binding ids. Verifies that input/output
+     * binding ids refer to ports on the effective (dynamics-expanded) manifest
+     * surface, unless the manifest policy explicitly allows undeclared
+     * parameters (transition placeholder kinds).
+     */
+    validateEffectivePorts(node, manifest, issues, path) {
+        const lenient = manifest.policies?.allowUndeclaredParameters === true;
+        const effectiveInputs = new Set(manifest.inputs.map((port) => port.id));
+        const effectiveOutputs = new Set(manifest.outputs.map((port) => port.id));
+        for (const key of Object.keys(node.inputBindings ?? {})) {
+            if (lenient || effectiveInputs.has(key))
+                continue;
+            issues.push({
+                code: "binding.unknown-port",
+                path: `${path}.inputBindings.${key}`,
+                message: `Node '${node.id}' input binding '${key}' does not refer to an effective input port of kind '${manifest.kind}'`,
+                nodeId: node.id,
+                details: { effectiveInputs: [...effectiveInputs] },
+            });
+        }
+        for (const key of Object.keys(node.outputBindings ?? {})) {
+            if (lenient || effectiveOutputs.has(key))
+                continue;
+            issues.push({
+                code: "binding.unknown-port",
+                path: `${path}.outputBindings.${key}`,
+                message: `Node '${node.id}' output binding '${key}' does not refer to an effective output port of kind '${manifest.kind}'`,
+                nodeId: node.id,
+                details: { effectiveOutputs: [...effectiveOutputs] },
+            });
+        }
+    }
+}
+exports.GraphNodeInstanceValidator = GraphNodeInstanceValidator;
+//# sourceMappingURL=GraphNodeInstanceValidator.js.map
+//# sourceMappingURL=GraphNodeInstanceValidator.cjs.map

package/lib/cjs/graph/engine/validation/GraphNodeInstanceValidator.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph/engine/validation/GraphNodeInstanceValidator.cjs","sourceRoot":"","sources":["graph/engine/validation/GraphNodeInstanceValidator.js"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,MAAa,0BAA0B;IACnC,YAAY,SAAS;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;IACD;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,SAAS,KAAK,GAAG,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,GAAG,IAAI,OAAO;oBACpB,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,sBAAsB,IAAI,CAAC,IAAI,oDAAoD;oBAC5G,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;iBAC/B,CAAC,CAAC;gBACH,SAAS;YACb,CAAC;YACD,IAAI,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,wBAAwB;oBAC9B,IAAI,EAAE,GAAG,IAAI,OAAO;oBACpB,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,WAAW,IAAI,CAAC,IAAI,wBAAwB,KAAK,CAAC,OAAO,EAAE;oBACpF,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;iBAC/B,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD;;;;;OAKG;IACH,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,KAAK,IAAI,CAAC;QACtE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC;YACtD,IAAI,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;gBACnC,SAAS;YACb,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,GAAG,IAAI,kBAAkB,GAAG,EAAE;gBACpC,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,oBAAoB,GAAG,wDAAwD,QAAQ,CAAC,IAAI,GAAG;gBACxH,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,OAAO,EAAE,EAAE,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE;aACrD,CAAC,CAAC;QACP,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;YACvD,IAAI,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;gBACpC,SAAS;YACb,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,GAAG,IAAI,mBAAmB,GAAG,EAAE;gBACrC,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,qBAAqB,GAAG,yDAAyD,QAAQ,CAAC,IAAI,GAAG;gBAC1H,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,OAAO,EAAE,EAAE,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC,EAAE;aACvD,CAAC,CAAC;QACP,CAAC;IACL,CAAC;CACJ;AA3ED,gEA2EC;AACD,sDAAsD"}