@decaf-ts/integrations 0.8.0 → 0.10.0

package/lib/esm/graph/engine/runs/InMemoryGraphRunEventStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InMemoryGraphRunEventStore.js","sourceRoot":"","sources":["../../../../../src/graph/engine/runs/InMemoryGraphRunEventStore.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAE5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,OAAO,0BAA0B;IAQrC,YAAY,SAAyB,EAAE;QAPtB,WAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;QACpD,cAAS,GAAG,IAAI,GAAG,EAGjC,CAAC;QAIF,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,wBAAwB,EAAE,GAAG,MAAM,EAAE,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA4B;QACvC,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7D,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CACb,KAAa,EACb,QAAgB;QAEhB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,SAAS,CACP,KAAa,EACb,QAAgD;QAEhD,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClB,OAAO,GAAG,EAAE;YACV,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrB,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEO,gBAAgB,CAAC,IAA6B;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAC/B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,CACpD,CAAC;YACF,IAAI,UAAU,KAAK,CAAC,CAAC;gBAAE,MAAM;YAC7B,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;CACF"}

package/lib/esm/graph/engine/runs/InMemoryGraphRunStore.js

@@ -0,0 +1,21 @@
+/**
+ * Non-persistent {@link GraphRunStore} backed by a `Map`: serves tests and
+ * in-process deployments. Runs are cloned on save/read so callers never
+ * share mutable references with the store.
+ */
+export class InMemoryGraphRunStore {
+    constructor() {
+        this.runs = new Map();
+    }
+    async saveRun(run) {
+        this.runs.set(run.runId, { ...run });
+    }
+    async readRun(runId) {
+        const run = this.runs.get(runId);
+        return run ? { ...run } : null;
+    }
+    release(runId) {
+        this.runs.delete(runId);
+    }
+}
+//# sourceMappingURL=InMemoryGraphRunStore.js.map

package/lib/esm/graph/engine/runs/InMemoryGraphRunStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InMemoryGraphRunStore.js","sourceRoot":"","sources":["../../../../../src/graph/engine/runs/InMemoryGraphRunStore.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IAAlC;QACmB,SAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IActD,CAAC;IAZC,KAAK,CAAC,OAAO,CAAC,GAAa;QACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/lib/esm/graph/engine/runs/index.js

@@ -0,0 +1,9 @@
+export * from "./types.js";
+export * from "./ownership.js";
+export * from "./GraphRunFingerprint.js";
+export * from "./InMemoryGraphRunEventStore.js";
+export * from "./InMemoryGraphRunStore.js";
+export * from "./GraphRunEventPublisher.js";
+export * from "./GraphRunExecutor.js";
+export * from "./GraphRunService.js";
+//# sourceMappingURL=index.js.map

package/lib/esm/graph/engine/runs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/graph/engine/runs/index.ts"],"names":[],"mappings":"AAAA,2BAAwB;AACxB,+BAA4B;AAC5B,yCAAsC;AACtC,gDAA6C;AAC7C,2CAAwC;AACxC,4CAAyC;AACzC,sCAAmC;AACnC,qCAAkC"}

package/lib/esm/graph/engine/runs/ownership.js

@@ -0,0 +1,30 @@
+import { ForbiddenError } from "@decaf-ts/core";
+/**
+ * Centralized graph resource ownership check (SAA-595 security hardening).
+ *
+ * Fail-closed by default: a resource that carries an owner is only accessible
+ * to that owner; an absent caller identity is denied unless the explicit
+ * `allowAnonymousAccess` tolerance (DECAF-48 §4.15 standalone runs) is set.
+ * Owner-less resources remain accessible to everyone.
+ *
+ * @param resource - The guarded resource (or its persisted record); only its
+ *   `owner` member is read. `null`/`undefined` counts as owner-less.
+ * @param callerOwner - Identity of the caller resolved from the request
+ *   context; `null`/`undefined`/`""` represent anonymous callers.
+ * @param options - `resourceKind`/`resourceId` name the resource in the
+ *   denial message; `allowAnonymousAccess` opts in to the DECAF-48 §4.15
+ *   standalone tolerance (default `false`).
+ * @throws ForbiddenError when the resource is owned and the caller is a
+ *   different user, or an anonymous caller without the explicit tolerance.
+ */
+export function assertGraphResourceOwnership(resource, callerOwner, options) {
+    const owner = resource?.owner ?? null;
+    if (!owner || owner === callerOwner)
+        return;
+    if ((callerOwner === undefined || callerOwner === null || callerOwner === "") &&
+        options.allowAnonymousAccess === true) {
+        return;
+    }
+    throw new ForbiddenError(`${options.resourceKind} '${options.resourceId}' is owned by another user`);
+}
+//# sourceMappingURL=ownership.js.map

package/lib/esm/graph/engine/runs/ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.js","sourceRoot":"","sources":["../../../../../src/graph/engine/runs/ownership.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAsD,EACtD,WAAsC,EACtC,OAIC;IAED,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO;IAC5C,IACE,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,EAAE,CAAC;QACzE,OAAO,CAAC,oBAAoB,KAAK,IAAI,EACrC,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,cAAc,CACtB,GAAG,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,UAAU,4BAA4B,CAC3E,CAAC;AACJ,CAAC"}

package/lib/esm/graph/engine/runs/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/lib/esm/graph/engine/runs/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../src/graph/engine/runs/types.ts"],"names":[],"mappings":""}

package/lib/esm/graph/engine/snapshots/GraphExecutionSnapshotMapper.js

@@ -3,7 +3,7 @@
  * @summary Maps execution results to snapshot patches.
  * @description Produces a GraphExecutionSnapshotPatch consumable by `@decaf-ts/ui-decorators/graph` snapshots, rather than replacing the snapshot system.
  */
-import { GraphExecutionStatus } from "./../../shared/constants.js";
+import { GraphExecutionStatus } from "@decaf-ts/ui-decorators/graph";
 /**
  * Maps a {@link GraphExecutionResult} to a {@link GraphExecutionSnapshotPatch}.
  */

package/lib/esm/graph/engine/snapshots/GraphExecutionSnapshotMapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"GraphExecutionSnapshotMapper.js","sourceRoot":"","sources":["../../../../../src/graph/engine/snapshots/GraphExecutionSnapshotMapper.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,oBAAoB,EAAE,oCAA+B;AAO9D;;GAEG;AACH,MAAM,OAAO,4BAA4B;IACvC;;OAEG;IACH,GAAG,CAAC,MAA4B;QAC9B,MAAM,KAAK,GAAyC,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAClE,KAAK,CAAC,EAAE,CAAC,GAAG;gBACV,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE;gBAC9C,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,WAAW,EAAE;gBAChD,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAyC,EAAE,CAAC;QACvD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACtD,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;oBACpB,MAAM,EAAE,oBAAoB,CAAC,SAAS;oBACtC,SAAS,EAAG,KAAK,CAAC,OAAe,EAAE,KAAK;oBACxC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;iBACzC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAA0B,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAEzD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK;YACL,KAAK;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM;SACP,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"GraphExecutionSnapshotMapper.js","sourceRoot":"","sources":["../../../../../src/graph/engine/snapshots/GraphExecutionSnapshotMapper.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AASrE;;GAEG;AACH,MAAM,OAAO,4BAA4B;IACvC;;OAEG;IACH,GAAG,CAAC,MAA4B;QAC9B,MAAM,KAAK,GAAyC,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAClE,KAAK,CAAC,EAAE,CAAC,GAAG;gBACV,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE;gBAC9C,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,WAAW,EAAE;gBAChD,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAyC,EAAE,CAAC;QACvD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACtD,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;oBACpB,MAAM,EAAE,oBAAoB,CAAC,SAAS;oBACtC,SAAS,EAAG,KAAK,CAAC,OAAe,EAAE,KAAK;oBACxC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;iBACzC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAA0B,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAEzD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK;YACL,KAAK;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM;SACP,CAAC;IACJ,CAAC;CACF"}

package/lib/esm/graph/engine/validation/GraphConnectionPolicyValidator.js

@@ -0,0 +1,137 @@
+/**
+ * Validates connection policies and edge-level structural conflicts.
+ */
+export class GraphConnectionPolicyValidator {
+    /**
+     * Stage 6 — connection policies and counts. Operates on the resolved
+     * workflow (stage 5 output). Records issues; never mutates the graph.
+     */
+    validate(workflow, issues) {
+        this.validateDuplicates(workflow.edges, issues);
+        this.validatePolicies(workflow, issues);
+    }
+    /**
+     * Conflicting duplicate edges: two edges with identical flattened
+     * endpoints (`source:port -> target:port`) are rejected, whatever their
+     * ids.
+     */
+    validateDuplicates(edges, issues) {
+        const seen = new Map();
+        for (const edge of edges) {
+            const key = `${edge.sourceNodeId}:${edge.sourcePort}->${edge.targetNodeId}:${edge.targetPort}`;
+            const previous = seen.get(key);
+            if (previous) {
+                issues.push({
+                    code: "connection.duplicate-edge",
+                    path: `edges[${edge.id}]`,
+                    message: `Edge '${edge.id}' duplicates the routing of edge '${previous.id}' (${key})`,
+                    edgeId: edge.id,
+                    details: { duplicateOf: previous.id, routing: key },
+                });
+                continue;
+            }
+            seen.set(key, edge);
+        }
+    }
+    /**
+     * Port-declared connection policies: kind allow/block lists, port
+     * categories, self-connections, and connection counts.
+     */
+    validatePolicies(workflow, issues) {
+        const connectionsByPort = new Map();
+        for (const edge of workflow.edges) {
+            if (edge.type !== "connection")
+                continue;
+            const key = `${edge.targetNodeId}:${edge.targetPort}`;
+            const list = connectionsByPort.get(key) ?? [];
+            list.push(edge);
+            connectionsByPort.set(key, list);
+        }
+        for (const edge of workflow.edges) {
+            if (edge.type !== "connection")
+                continue;
+            const target = workflow.nodeById.get(edge.targetNodeId);
+            const policy = target?.manifest.connections?.find((candidate) => candidate.id === edge.targetPort)?.connectionPolicy;
+            this.validateEdgePolicy(edge, workflow.nodeById, policy, issues);
+        }
+        for (const [key, connections] of connectionsByPort) {
+            const separator = key.lastIndexOf(":");
+            const nodeId = key.slice(0, separator);
+            const portId = key.slice(separator + 1);
+            const target = workflow.nodeById.get(nodeId);
+            const policy = target?.manifest.connections?.find((candidate) => candidate.id === portId)?.connectionPolicy;
+            if (!policy)
+                continue;
+            const max = policy.maxConnections !== undefined
+                ? policy.maxConnections
+                : policy.allowMultiple === false
+                    ? 1
+                    : Number.POSITIVE_INFINITY;
+            if (connections.length > max) {
+                issues.push({
+                    code: "connection.max-connections",
+                    path: `edges[${connections[connections.length - 1].id}]`,
+                    message: `Connection port '${portId}' on node '${nodeId}' accepts at most ${max} connection(s) but has ${connections.length}`,
+                    nodeId,
+                    edgeId: connections[connections.length - 1].id,
+                    details: { port: portId, max, actual: connections.length },
+                });
+            }
+        }
+    }
+    validateEdgePolicy(edge, nodeById, policy, issues) {
+        // Self-connections are rejected unless the policy allows them.
+        if (edge.sourceNodeId === edge.targetNodeId) {
+            if (!policy?.allowSelf) {
+                issues.push({
+                    code: "connection.self-connection",
+                    path: `edges[${edge.id}]`,
+                    message: `Edge '${edge.id}' connects node '${edge.sourceNodeId}' to itself, which the target port policy does not allow`,
+                    edgeId: edge.id,
+                    nodeId: edge.sourceNodeId,
+                });
+                return;
+            }
+        }
+        if (!policy)
+            return;
+        const source = nodeById.get(edge.sourceNodeId);
+        const sourceKind = source?.manifest.kind;
+        if (policy.allowedNodeKinds?.length &&
+            (!sourceKind || !policy.allowedNodeKinds.includes(sourceKind))) {
+            issues.push({
+                code: "connection.policy",
+                path: `edges[${edge.id}]`,
+                message: `Connection edge '${edge.id}' source kind '${sourceKind ?? "unknown"}' is not in the allowed node kinds of target port '${edge.targetPort}'`,
+                edgeId: edge.id,
+                nodeId: edge.sourceNodeId,
+                details: { allowedNodeKinds: policy.allowedNodeKinds },
+            });
+        }
+        if (sourceKind && policy.blockedNodeKinds?.includes(sourceKind)) {
+            issues.push({
+                code: "connection.policy",
+                path: `edges[${edge.id}]`,
+                message: `Connection edge '${edge.id}' source kind '${sourceKind}' is blocked by target port '${edge.targetPort}'`,
+                edgeId: edge.id,
+                nodeId: edge.sourceNodeId,
+                details: { blockedNodeKinds: policy.blockedNodeKinds },
+            });
+        }
+        if (policy.allowedPortCategories?.length) {
+            const sourcePortCategory = source?.manifest.connections?.find((candidate) => candidate.id === edge.sourcePort)?.category;
+            if (!sourcePortCategory ||
+                !policy.allowedPortCategories.includes(sourcePortCategory)) {
+                issues.push({
+                    code: "connection.policy",
+                    path: `edges[${edge.id}]`,
+                    message: `Connection edge '${edge.id}' source port '${edge.sourcePort}' category '${sourcePortCategory ?? "unknown"}' is not in the allowed port categories of target port '${edge.targetPort}'`,
+                    edgeId: edge.id,
+                    nodeId: edge.sourceNodeId,
+                    details: { allowedPortCategories: policy.allowedPortCategories },
+                });
+            }
+        }
+    }
+}
+//# sourceMappingURL=GraphConnectionPolicyValidator.js.map

package/lib/esm/graph/engine/validation/GraphConnectionPolicyValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GraphConnectionPolicyValidator.js","sourceRoot":"","sources":["../../../../../src/graph/engine/validation/GraphConnectionPolicyValidator.ts"],"names":[],"mappings":"AAeA;;GAEG;AACH,MAAM,OAAO,8BAA8B;IACzC;;;OAGG;IACH,QAAQ,CACN,QAA2D,EAC3D,MAA8B;QAE9B,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CACxB,KAAkC,EAClC,MAA8B;QAE9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqC,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,2BAA2B;oBACjC,IAAI,EAAE,SAAS,IAAI,CAAC,EAAE,GAAG;oBACzB,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,qCAAqC,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;oBACrF,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE;iBACpD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,gBAAgB,CACtB,QAA2D,EAC3D,MAA8B;QAE9B,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAuC,CAAC;QACzE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;gBAAE,SAAS;YACzC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;gBAAE,SAAS;YACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAC/C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,CAChD,EAAE,gBAAgB,CAAC;YACpB,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,iBAAiB,EAAE,CAAC;YACnD,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAC/C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CACvC,EAAE,gBAAgB,CAAC;YACpB,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,GAAG,GACP,MAAM,CAAC,cAAc,KAAK,SAAS;gBACjC,CAAC,CAAC,MAAM,CAAC,cAAc;gBACvB,CAAC,CAAC,MAAM,CAAC,aAAa,KAAK,KAAK;oBAC9B,CAAC,CAAC,CAAC;oBACH,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACjC,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,4BAA4B;oBAClC,IAAI,EAAE,SAAS,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;oBACxD,OAAO,EAAE,oBAAoB,MAAM,cAAc,MAAM,qBAAqB,GAAG,0BAA0B,WAAW,CAAC,MAAM,EAAE;oBAC7H,MAAM;oBACN,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE;oBAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,kBAAkB,CACxB,IAA+B,EAC/B,QAAgD,EAChD,MAOa,EACb,MAA8B;QAE9B,+DAA+D;QAC/D,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,4BAA4B;oBAClC,IAAI,EAAE,SAAS,IAAI,CAAC,EAAE,GAAG;oBACzB,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,oBAAoB,IAAI,CAAC,YAAY,0DAA0D;oBACxH,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,YAAY;iBAC1B,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;QAEzC,IACE,MAAM,CAAC,gBAAgB,EAAE,MAAM;YAC/B,CAAC,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAC9D,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE,SAAS,IAAI,CAAC,EAAE,GAAG;gBACzB,OAAO,EAAE,oBAAoB,IAAI,CAAC,EAAE,kBAAkB,UAAU,IAAI,SAAS,sDAAsD,IAAI,CAAC,UAAU,GAAG;gBACrJ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,OAAO,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,IAAI,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE,SAAS,IAAI,CAAC,EAAE,GAAG;gBACzB,OAAO,EAAE,oBAAoB,IAAI,CAAC,EAAE,kBAAkB,UAAU,gCAAgC,IAAI,CAAC,UAAU,GAAG;gBAClH,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,OAAO,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;YACzC,MAAM,kBAAkB,GAAG,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAC3D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,CAChD,EAAE,QAAQ,CAAC;YACZ,IACE,CAAC,kBAAkB;gBACnB,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAC1D,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,SAAS,IAAI,CAAC,EAAE,GAAG;oBACzB,OAAO,EAAE,oBAAoB,IAAI,CAAC,EAAE,kBAAkB,IAAI,CAAC,UAAU,eAAe,kBAAkB,IAAI,SAAS,2DAA2D,IAAI,CAAC,UAAU,GAAG;oBAChM,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,YAAY;oBACzB,OAAO,EAAE,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/lib/esm/graph/engine/validation/GraphCredentialReferenceValidator.js

@@ -0,0 +1,155 @@
+import { GRAPH_PLAIN_SECRET_KEYS, isGraphCredentialReferenceLike } from "./GraphParameterValidator.js";
+/** Nesting depth cap for the recursive plain-secret scan. */
+const MAX_PLAIN_SECRET_SCAN_DEPTH = 8;
+/**
+ * Validates credential references and the absence of plain secrets.
+ */
+export class GraphCredentialReferenceValidator {
+    constructor(authorizer) {
+        this.authorizer = authorizer;
+    }
+    /**
+     * Stage 8 — credential-reference authorization for one resolved node.
+     */
+    async validate(node, manifest, issues, path) {
+        const references = this.collectReferences(node, manifest);
+        for (const requirement of manifest.credentials ?? []) {
+            const match = references.find((reference) => reference.credentialType === undefined ||
+                reference.credentialType === requirement.type);
+            if (!match) {
+                if (requirement.required !== false) {
+                    issues.push({
+                        code: "credential.missing",
+                        path,
+                        message: `Node '${node.id}' does not provide the required credential of type '${requirement.type}'`,
+                        nodeId: node.id,
+                        details: { credentialType: requirement.type },
+                    });
+                }
+                continue;
+            }
+            const typeError = this.checkType(match, requirement);
+            if (typeError) {
+                issues.push({
+                    code: "credential.type-mismatch",
+                    path,
+                    message: `Node '${node.id}' credential '${match.credentialId}' has type '${match.credentialType}' but kind '${manifest.kind}' requires '${requirement.type}'`,
+                    nodeId: node.id,
+                    details: { credentialType: match.credentialType ?? "", requiredType: requirement.type },
+                });
+                continue;
+            }
+            if (this.authorizer) {
+                if (!(await this.authorizer.hasCredential(match))) {
+                    issues.push({
+                        code: "credential.not-found",
+                        path,
+                        message: `Node '${node.id}' references credential '${match.credentialId}' which does not exist`,
+                        nodeId: node.id,
+                        details: { credentialId: match.credentialId },
+                    });
+                    continue;
+                }
+                if (!(await this.authorizer.authorize(match, requirement))) {
+                    issues.push({
+                        code: "credential.unauthorized",
+                        path,
+                        message: `Node '${node.id}' is not authorized to use credential '${match.credentialId}'`,
+                        nodeId: node.id,
+                        details: { credentialId: match.credentialId },
+                    });
+                }
+            }
+        }
+        this.scanPlainSecrets(node, issues, path);
+    }
+    /**
+     * Collects the credential references carried by a node instance:
+     * credential-type parameter values and the `credentials` record in
+     * instance metadata.
+     */
+    collectReferences(node, manifest) {
+        const references = [];
+        for (const parameter of manifest.parameters) {
+            if (parameter.type !== "credential")
+                continue;
+            const value = (node.parameters ?? {})[parameter.id];
+            if (isGraphCredentialReferenceLike(value)) {
+                references.push(this.normalize(value, parameter.credentialType));
+            }
+        }
+        const extra = (node.metadata ?? {})["credentials"];
+        if (extra && typeof extra === "object" && !Array.isArray(extra)) {
+            for (const value of Object.values(extra)) {
+                if (isGraphCredentialReferenceLike(value)) {
+                    references.push(this.normalize(value));
+                }
+            }
+        }
+        return references;
+    }
+    normalize(value, credentialType) {
+        if (typeof value === "string") {
+            return { credentialId: value, credentialType: credentialType ?? "" };
+        }
+        return {
+            credentialId: value.credentialId,
+            credentialType: value.credentialType ?? credentialType ?? "",
+        };
+    }
+    checkType(reference, requirement) {
+        return (reference.credentialType !== undefined &&
+            reference.credentialType !== requirement.type);
+    }
+    /**
+     * Plain credential secrets must never appear in workflow documents: any
+     * parameter or metadata key on the secret deny-list is an issue at any
+     * nesting depth (objects and arrays are walked recursively with a depth
+     * cap and cycle guard), as is a credential reference object carrying
+     * extra material (e.g. a `secret` or `value` member).
+     */
+    scanPlainSecrets(node, issues, path) {
+        const denyList = new Set(GRAPH_PLAIN_SECRET_KEYS);
+        for (const [key, value] of Object.entries(node.parameters ?? {})) {
+            this.scanPlainSecretValue(value, [key], node, `${path}.parameters`, denyList, issues);
+        }
+        for (const [key, value] of Object.entries(node.metadata ?? {})) {
+            this.scanPlainSecretValue(value, [key], node, `${path}.metadata`, denyList, issues);
+        }
+    }
+    /**
+     * Recursive worker for {@link scanPlainSecrets}: walks one parameter or
+     * metadata value, reporting a `credential.plain-secret` issue when the
+     * current path's key is on the deny-list, and recursing into objects and
+     * arrays otherwise (array items append a `[]` path segment). The
+     * {@link MAX_PLAIN_SECRET_SCAN_DEPTH} cap bounds the walk — deep enough
+     * for legitimate documents, and a guard against pathological/cyclic
+     * input — so nested deny-list keys are caught at any practical depth.
+     */
+    scanPlainSecretValue(value, keyPath, node, basePath, denyList, issues, depth = 0) {
+        const key = keyPath[keyPath.length - 1];
+        if (denyList.has(key)) {
+            issues.push({
+                code: "credential.plain-secret",
+                path: `${basePath}.${keyPath.join(".")}`,
+                message: `Node '${node.id}' carries plain secret material in '${keyPath.join(".")}'; workflow documents may only hold credential references`,
+                nodeId: node.id,
+            });
+            return;
+        }
+        if (depth >= MAX_PLAIN_SECRET_SCAN_DEPTH || value === null)
+            return;
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                this.scanPlainSecretValue(item, [...keyPath, "[]"], node, basePath, denyList, issues, depth + 1);
+            }
+            return;
+        }
+        if (typeof value === "object") {
+            for (const [innerKey, innerValue] of Object.entries(value)) {
+                this.scanPlainSecretValue(innerValue, [...keyPath, innerKey], node, basePath, denyList, issues, depth + 1);
+            }
+        }
+    }
+}
+//# sourceMappingURL=GraphCredentialReferenceValidator.js.map

package/lib/esm/graph/engine/validation/GraphCredentialReferenceValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GraphCredentialReferenceValidator.js","sourceRoot":"","sources":["../../../../../src/graph/engine/validation/GraphCredentialReferenceValidator.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,qCAAkC;AAGpG,6DAA6D;AAC7D,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAiBtC;;GAEG;AACH,MAAM,OAAO,iCAAiC;IAC5C,YAA6B,UAAsC;QAAtC,eAAU,GAAV,UAAU,CAA4B;IAAG,CAAC;IAEvE;;OAEG;IACH,KAAK,CAAC,QAAQ,CACZ,IAAuB,EACvB,QAAmC,EACnC,MAA8B,EAC9B,IAAY;QAEZ,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE1D,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAC3B,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,cAAc,KAAK,SAAS;gBACtC,SAAS,CAAC,cAAc,KAAK,WAAW,CAAC,IAAI,CAChD,CAAC;YACF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,WAAW,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;oBACnC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,oBAAoB;wBAC1B,IAAI;wBACJ,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,uDAAuD,WAAW,CAAC,IAAI,GAAG;wBACnG,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,IAAI,EAAE;qBAC9C,CAAC,CAAC;gBACL,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YACrD,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,0BAA0B;oBAChC,IAAI;oBACJ,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,iBAAiB,KAAK,CAAC,YAAY,eAAe,KAAK,CAAC,cAAc,eAAe,QAAQ,CAAC,IAAI,eAAe,WAAW,CAAC,IAAI,GAAG;oBAC7J,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE,EAAE,YAAY,EAAE,WAAW,CAAC,IAAI,EAAE;iBACxF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAClD,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,sBAAsB;wBAC5B,IAAI;wBACJ,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,4BAA4B,KAAK,CAAC,YAAY,wBAAwB;wBAC/F,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;qBAC9C,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;oBAC3D,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,yBAAyB;wBAC/B,IAAI;wBACJ,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,0CAA0C,KAAK,CAAC,YAAY,GAAG;wBACxF,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;qBAC9C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACK,iBAAiB,CACvB,IAAuB,EACvB,QAAmC;QAEnC,MAAM,UAAU,GAA+B,EAAE,CAAC;QAClD,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY;gBAAE,SAAS;YAC9C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACpD,IAAI,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAC/B,KAAuC,CACxC,EAAE,CAAC;gBACF,IAAI,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,SAAS,CACf,KAAwC,EACxC,cAAuB;QAEvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,IAAI,EAAE,EAAE,CAAC;QACvE,CAAC;QACD,OAAO;YACL,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,cAAc,IAAI,EAAE;SAC7D,CAAC;IACJ,CAAC;IAEO,SAAS,CACf,SAAmC,EACnC,WAAuC;QAEvC,OAAO,CACL,SAAS,CAAC,cAAc,KAAK,SAAS;YACtC,SAAS,CAAC,cAAc,KAAK,WAAW,CAAC,IAAI,CAC9C,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,IAAuB,EACvB,MAA8B,EAC9B,IAAY;QAEZ,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,uBAAuB,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC,oBAAoB,CACvB,KAAK,EACL,CAAC,GAAG,CAAC,EACL,IAAI,EACJ,GAAG,IAAI,aAAa,EACpB,QAAQ,EACR,MAAM,CACP,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,oBAAoB,CACvB,KAAK,EACL,CAAC,GAAG,CAAC,EACL,IAAI,EACJ,GAAG,IAAI,WAAW,EAClB,QAAQ,EACR,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,oBAAoB,CAC1B,KAAc,EACd,OAAiB,EACjB,IAAuB,EACvB,QAAgB,EAChB,QAAqB,EACrB,MAA8B,EAC9B,KAAK,GAAG,CAAC;QAET,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,yBAAyB;gBAC/B,IAAI,EAAE,GAAG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACxC,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,uCAAuC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,2DAA2D;gBAC5I,MAAM,EAAE,IAAI,CAAC,EAAE;aAChB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,KAAK,IAAI,2BAA2B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO;QACnE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,oBAAoB,CACvB,IAAI,EACJ,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,EAClB,IAAI,EACJ,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,KAAK,GAAG,CAAC,CACV,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACjD,KAAgC,CACjC,EAAE,CAAC;gBACF,IAAI,CAAC,oBAAoB,CACvB,UAAU,EACV,CAAC,GAAG,OAAO,EAAE,QAAQ,CAAC,EACtB,IAAI,EACJ,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,KAAK,GAAG,CAAC,CACV,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/lib/esm/graph/engine/validation/GraphDefinitionValidator.js

@@ -1,17 +1,15 @@
 import { GraphInputError } from "./../errors/GraphInputError.js";
-import { GraphExecutionPlanner } from "./../planning/GraphExecutionPlanner.js";
 /**
- * Validates a {@link GraphWorkflowDefinition} before execution.
+ * Performs cheap structural checks on a legacy {@link GraphWorkflowDefinition}.
+ *
+ * @deprecated Validate canonical documents with
+ *   {@link GraphWorkflowDocumentValidator} instead.
  */
 export class GraphDefinitionValidator {
-    constructor(planner) {
-        this.planner = planner ?? new GraphExecutionPlanner();
-    }
     /**
-     * Validates the workflow definition.
+     * Validates the workflow definition structure.
      *
-     * @throws {GraphInputError} when the workflow has no name or invalid structure.
-     * @throws {GraphCycleError} when the workflow contains an unsupported cycle.
+     * @throws {GraphInputError} when the workflow has no name or duplicate node ids.
      */
     validate(workflow) {
         if (!workflow.name) {
@@ -21,8 +19,6 @@ export class GraphDefinitionValidator {
         if (nodeIds.size !== (workflow.nodes ?? []).length) {
             throw new GraphInputError("Workflow node IDs must be unique");
         }
-        // The planner performs full topology validation (endpoints, ports, cycles)
-        this.planner.plan(workflow);
     }
 }
 //# sourceMappingURL=GraphDefinitionValidator.js.map

package/lib/esm/graph/engine/validation/GraphDefinitionValidator.js.map

@@ -1 +1 @@
-{"version":3,"file":"GraphDefinitionValidator.js","sourceRoot":"","sources":["../../../../../src/graph/engine/validation/GraphDefinitionValidator.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAAE,uCAAkC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,+CAA0C;AAE1E;;GAEG;AACH,MAAM,OAAO,wBAAwB;IAGnC,YAAY,OAA+B;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,qBAAqB,EAAE,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,QAAiC;QACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YACnD,MAAM,IAAI,eAAe,CAAC,kCAAkC,CAAC,CAAC;QAChE,CAAC;QAED,2EAA2E;QAC3E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"GraphDefinitionValidator.js","sourceRoot":"","sources":["../../../../../src/graph/engine/validation/GraphDefinitionValidator.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,eAAe,EAAE,uCAAkC;AAE5D;;;;;GAKG;AACH,MAAM,OAAO,wBAAwB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,QAAiC;QACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YACnD,MAAM,IAAI,eAAe,CAAC,kCAAkC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;CACF"}

package/lib/esm/graph/engine/validation/GraphEdgeInstanceValidator.js

@@ -0,0 +1,161 @@
+import { isGraphNodeEndpoint, isGraphWorkflowEndpoint } from "@decaf-ts/ui-decorators/graph";
+import { GRAPH_WORKFLOW_BOUNDARY } from "./../constants.js";
+/**
+ * Validates edge instances and resolves them into flattened plan edges.
+ */
+export class GraphEdgeInstanceValidator {
+    /**
+     * Stage 5 — edge endpoints. Returns the resolved (flattened) edges for
+     * every structurally valid edge; invalid edges are skipped (issues
+     * recorded) so the planner only ever sees valid routing.
+     *
+     * Port existence/direction checks are skipped for nodes whose manifest
+     * policy allows undeclared parameters (transition placeholder kinds with
+     * no declared ports) — the catalogue is authoritative and those legacy
+     * registrations declare no port surface to check against.
+     */
+    resolveEdges(document, nodesById, issues) {
+        const workflowInputs = new Set(document.inputs.map((port) => port.id));
+        const workflowOutputs = new Set(document.outputs.map((port) => port.id));
+        const resolved = [];
+        for (const [index, edge] of (document.edges ?? []).entries()) {
+            const path = `edges[${index}]`;
+            const source = this.resolveEndpoint(edge, "source", nodesById, workflowInputs, workflowOutputs, issues, path);
+            const target = this.resolveEndpoint(edge, "target", nodesById, workflowInputs, workflowOutputs, issues, path);
+            if (!source || !target)
+                continue;
+            const valid = this.validateDirectionAndType(edge, source, target, nodesById, issues, path);
+            if (!valid)
+                continue;
+            const resolvedEdge = {
+                id: edge.id,
+                type: edge.type,
+                sourceNodeId: source.nodeId,
+                sourcePort: source.port,
+                targetNodeId: target.nodeId,
+                targetPort: target.port,
+                metadata: edge.metadata,
+                edge,
+            };
+            if (edge.label !== undefined)
+                resolvedEdge.label = edge.label;
+            resolved.push(resolvedEdge);
+        }
+        return resolved;
+    }
+    resolveEndpoint(edge, side, nodesById, workflowInputs, workflowOutputs, issues, path) {
+        const endpoint = edge[side];
+        if (isGraphWorkflowEndpoint(endpoint)) {
+            const portKnown = side === "source"
+                ? workflowInputs.has(endpoint.port)
+                : workflowOutputs.has(endpoint.port);
+            if (!portKnown) {
+                issues.push({
+                    code: "edge.unknown-port",
+                    path: `${path}.${side}`,
+                    message: `Edge '${edge.id}' ${side} references workflow port '${endpoint.port}' which is not declared on the document boundary`,
+                    edgeId: edge.id,
+                    details: { scope: "workflow", port: endpoint.port },
+                });
+                return undefined;
+            }
+            return { nodeId: GRAPH_WORKFLOW_BOUNDARY, port: endpoint.port };
+        }
+        if (isGraphNodeEndpoint(endpoint)) {
+            const node = nodesById.get(endpoint.nodeId);
+            if (!node) {
+                issues.push({
+                    code: "edge.unknown-node",
+                    path: `${path}.${side}`,
+                    message: `Edge '${edge.id}' ${side} references node '${endpoint.nodeId}' which is not part of the document or did not resolve`,
+                    edgeId: edge.id,
+                    nodeId: endpoint.nodeId,
+                });
+                return undefined;
+            }
+            return { nodeId: endpoint.nodeId, port: endpoint.port };
+        }
+        issues.push({
+            code: "edge.invalid-endpoint",
+            path: `${path}.${side}`,
+            message: `Edge '${edge.id}' ${side} endpoint is not a valid GraphEndpoint`,
+            edgeId: edge.id,
+        });
+        return undefined;
+    }
+    validateDirectionAndType(edge, source, target, nodesById, issues, path) {
+        let valid = true;
+        const sourceNode = source.nodeId === GRAPH_WORKFLOW_BOUNDARY
+            ? undefined
+            : nodesById.get(source.nodeId);
+        const targetNode = target.nodeId === GRAPH_WORKFLOW_BOUNDARY
+            ? undefined
+            : nodesById.get(target.nodeId);
+        // Direction validity. Skipped for lenient placeholder manifests
+        // (transition kinds with no declared port surface).
+        const lenient = (node) => node?.manifest.policies?.allowUndeclaredParameters === true;
+        if (edge.type === "data") {
+            // Data edges: source must be an output port (or workflow input), target
+            // must be an input port (or workflow output). Connection-only ports are
+            // structural and never route data.
+            if (sourceNode && !lenient(sourceNode) && !this.hasPortDirection(sourceNode, source.port, "output")) {
+                this.pushPortIssue(edge, "source", source, sourceNode, issues, path);
+                valid = false;
+            }
+            if (targetNode && !lenient(targetNode) && !this.hasPortDirection(targetNode, target.port, "input")) {
+                this.pushPortIssue(edge, "target", target, targetNode, issues, path);
+                valid = false;
+            }
+        }
+        else {
+            // Structural (connection) edges: both endpoints must be connection
+            // ports on real nodes — the workflow boundary never carries
+            // structural edges (boundary routing validity).
+            if (!sourceNode || !targetNode) {
+                issues.push({
+                    code: "edge.boundary-routing",
+                    path,
+                    message: `Connection edge '${edge.id}' must connect two node connection ports; the workflow boundary only routes data`,
+                    edgeId: edge.id,
+                });
+                return false;
+            }
+            if (!lenient(sourceNode) && !lenient(targetNode) &&
+                (!this.hasPortDirection(sourceNode, source.port, "connection") ||
+                    !this.hasPortDirection(targetNode, target.port, "connection"))) {
+                issues.push({
+                    code: "edge.type-mismatch",
+                    path,
+                    message: `Connection edge '${edge.id}' endpoints must both be connection ports`,
+                    edgeId: edge.id,
+                    details: {
+                        sourcePort: source.port,
+                        targetPort: target.port,
+                    },
+                });
+                return false;
+            }
+        }
+        return valid;
+    }
+    hasPortDirection(node, port, direction) {
+        const ports = direction === "input"
+            ? node.manifest.inputs
+            : direction === "output"
+                ? node.manifest.outputs
+                : node.manifest.connections ?? [];
+        return ports.some((candidate) => candidate.id === port);
+    }
+    pushPortIssue(edge, side, endpoint, node, issues, path) {
+        const expected = side === "source" ? "output" : "input";
+        issues.push({
+            code: edge.type === "data" ? "edge.invalid-direction" : "edge.type-mismatch",
+            path: `${path}.${side}`,
+            message: `Edge '${edge.id}' ${side} port '${endpoint.port}' on node '${endpoint.nodeId}' is not an ${expected} port of kind '${node.manifest.kind}'`,
+            edgeId: edge.id,
+            nodeId: endpoint.nodeId,
+            details: { port: endpoint.port, expected },
+        });
+    }
+}
+//# sourceMappingURL=GraphEdgeInstanceValidator.js.map

package/lib/esm/graph/engine/validation/GraphEdgeInstanceValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GraphEdgeInstanceValidator.js","sourceRoot":"","sources":["../../../../../src/graph/engine/validation/GraphEdgeInstanceValidator.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAE7F,OAAO,EAAE,uBAAuB,EAAE,0BAAqB;AAIvD;;GAEG;AACH,MAAM,OAAO,0BAA0B;IACrC;;;;;;;;;OASG;IACH,YAAY,CACV,QAA+B,EAC/B,SAAiD,EACjD,MAA8B;QAE9B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAgC,EAAE,CAAC;QAEjD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,SAAS,KAAK,GAAG,CAAC;YAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CACjC,IAAI,EACJ,QAAQ,EACR,SAAS,EACT,cAAc,EACd,eAAe,EACf,MAAM,EACN,IAAI,CACL,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CACjC,IAAI,EACJ,QAAQ,EACR,SAAS,EACT,cAAc,EACd,eAAe,EACf,MAAM,EACN,IAAI,CACL,CAAC;YACF,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;gBAAE,SAAS;YAEjC,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CACzC,IAAI,EACJ,MAAM,EACN,MAAM,EACN,SAAS,EACT,MAAM,EACN,IAAI,CACL,CAAC;YACF,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,MAAM,YAAY,GAA8B;gBAC9C,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI;aACL,CAAC;YACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,eAAe,CACrB,IAAuB,EACvB,IAAyB,EACzB,SAAiD,EACjD,cAA2B,EAC3B,eAA4B,EAC5B,MAA8B,EAC9B,IAAY;QAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,MAAM,SAAS,GACb,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE;oBACvB,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,KAAK,IAAI,8BAA8B,QAAQ,CAAC,IAAI,kDAAkD;oBAC/H,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;iBACpD,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE;oBACvB,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,KAAK,IAAI,qBAAqB,QAAQ,CAAC,MAAM,wDAAwD;oBAC9H,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,QAAQ,CAAC,MAAM;iBACxB,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE;YACvB,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,KAAK,IAAI,wCAAwC;YAC1E,MAAM,EAAE,IAAI,CAAC,EAAE;SAChB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,wBAAwB,CAC9B,IAAuB,EACvB,MAAwC,EACxC,MAAwC,EACxC,SAAiD,EACjD,MAA8B,EAC9B,IAAY;QAEZ,IAAI,KAAK,GAAG,IAAI,CAAC;QAEjB,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,KAAK,uBAAuB;YACvC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,KAAK,uBAAuB;YACvC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEnC,gEAAgE;QAChE,oDAAoD;QACpD,MAAM,OAAO,GAAG,CAAC,IAA2C,EAAE,EAAE,CAC9D,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,KAAK,IAAI,CAAC;QAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,wEAAwE;YACxE,wEAAwE;YACxE,mCAAmC;YACnC,IAAI,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACpG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrE,KAAK,GAAG,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBACnG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrE,KAAK,GAAG,KAAK,CAAC;YAChB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,mEAAmE;YACnE,4DAA4D;YAC5D,gDAAgD;YAChD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,uBAAuB;oBAC7B,IAAI;oBACJ,OAAO,EAAE,oBAAoB,IAAI,CAAC,EAAE,kFAAkF;oBACtH,MAAM,EAAE,IAAI,CAAC,EAAE;iBAChB,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IACE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC5C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC;oBAC5D,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAChE,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,oBAAoB;oBAC1B,IAAI;oBACJ,OAAO,EAAE,oBAAoB,IAAI,CAAC,EAAE,2CAA2C;oBAC/E,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE;wBACP,UAAU,EAAE,MAAM,CAAC,IAAI;wBACvB,UAAU,EAAE,MAAM,CAAC,IAAI;qBACxB;iBACF,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,gBAAgB,CACtB,IAA+B,EAC/B,IAAY,EACZ,SAA4C;QAE5C,MAAM,KAAK,GACT,SAAS,KAAK,OAAO;YACnB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM;YACtB,CAAC,CAAC,SAAS,KAAK,QAAQ;gBACtB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;gBACvB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IAC1D,CAAC;IAEO,aAAa,CACnB,IAAuB,EACvB,IAAyB,EACzB,QAA0C,EAC1C,IAA+B,EAC/B,MAA8B,EAC9B,IAAY;QAEZ,MAAM,QAAQ,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,oBAAoB;YAC5E,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE;YACvB,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,KAAK,IAAI,UAAU,QAAQ,CAAC,IAAI,cAAc,QAAQ,CAAC,MAAM,eAAe,QAAQ,kBAAkB,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG;YACpJ,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;CACF"}