@kindgi/api 0.0.0-bootstrap.0 → 0.1.0

package/dist/routes/flows.d.ts

@@ -0,0 +1,23 @@
+import { Hono } from 'hono';
+import type { FlowRegistryBinding } from '../flow-binding.js';
+import type { Authorizer } from '../middleware/authorize.js';
+import type { AppEnv } from '../types.js';
+/**
+ * Flows resource routes.
+ *
+ * Registry storage is caller-plugged via `FlowRegistryBinding`,
+ * mirroring `AgentRegistryBinding` 1:1. The API package does not own
+ * persistence — the binding implementation supplies the store (tests
+ * wrap an in-memory `Map`-backed adapter).
+ *
+ * Publish is data-as-code: the body is a full `Flow` definition
+ * (`@kindgi/specs/flow.schema.json`). Validation runs through
+ * `@kindgi/flow.loadFlow(...)` so a flow published through the
+ * API is byte-identical to one constructed in-process.
+ *
+ * Run initiation stays at `POST /v1/runs` (one primitive,
+ * discriminated subject). No
+ * `/v1/flows/:flowId/run` route is added here.
+ */
+export declare function flowsRouter(binding: FlowRegistryBinding, authorizer?: Authorizer): Hono<AppEnv>;
+//# sourceMappingURL=flows.d.ts.map

package/dist/routes/flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flows.d.ts","sourceRoot":"","sources":["../../src/routes/flows.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,mBAAmB,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CA8V/F"}

package/dist/routes/flows.js

@@ -0,0 +1,344 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Hono } from 'hono';
+import { ref, tuplesForCreate } from '@kindgi/authz';
+import { loadFlow } from '@kindgi/flow';
+import { statusFor, toWireError } from '../errors.js';
+import { clampLimit } from './pagination.js';
+import { parseScopeParams } from './scope-params.js';
+/**
+ * Flows resource routes.
+ *
+ * Registry storage is caller-plugged via `FlowRegistryBinding`,
+ * mirroring `AgentRegistryBinding` 1:1. The API package does not own
+ * persistence — the binding implementation supplies the store (tests
+ * wrap an in-memory `Map`-backed adapter).
+ *
+ * Publish is data-as-code: the body is a full `Flow` definition
+ * (`@kindgi/specs/flow.schema.json`). Validation runs through
+ * `@kindgi/flow.loadFlow(...)` so a flow published through the
+ * API is byte-identical to one constructed in-process.
+ *
+ * Run initiation stays at `POST /v1/runs` (one primitive,
+ * discriminated subject). No
+ * `/v1/flows/:flowId/run` route is added here.
+ */
+export function flowsRouter(binding, authorizer) {
+    const r = new Hono();
+    // Authorization — mirrors agents 1:1. Check the resource directly;
+    // permissions cascade from the parent project because publish writes
+    // the parent tuple in the same transaction.
+    if (authorizer !== undefined) {
+        r.use('/', async (c, next) => {
+            if (c.req.method !== 'POST')
+                return next();
+            const tenantId = c.get('tenantId');
+            const mw = authorizer.authorize('admin', async () => {
+                try {
+                    const body = await c.req.json();
+                    const pid = body !== null && typeof body === 'object'
+                        ? body.projectId
+                        : undefined;
+                    if (typeof pid === 'string' && pid.length > 0)
+                        return ref('project', pid);
+                }
+                catch {
+                    // POST handler validates + returns 400
+                }
+                return ref('tenant', tenantId);
+            });
+            return mw(c, next);
+        });
+        r.use('/', async (c, next) => {
+            if (c.req.method !== 'GET')
+                return next();
+            // A project filter needs read on that project. Parse it as the
+            // handler does (`?scopeKind=project&scopeId=`).
+            const s = parseScopeParams((n) => c.req.query(n), {
+                tenantId: c.get('tenantId'),
+            });
+            if (s.kind !== 'ok' || s.scope?.kind !== 'project')
+                return next();
+            const scopeProjectId = s.scope.projectId;
+            const mw = authorizer.authorize('read', () => ref('project', scopeProjectId));
+            return mw(c, next);
+        });
+        r.use('/:flowId/*', async (c, next) => {
+            const action = c.req.method === 'GET' ? 'read' : 'admin';
+            const flowId = c.req.param('flowId') ?? '';
+            const mw = authorizer.authorize(action, () => ref('flow', flowId));
+            return mw(c, next);
+        });
+        r.use('/:flowId', async (c, next) => {
+            if (c.req.method !== 'GET')
+                return next();
+            const flowId = c.req.param('flowId') ?? '';
+            const mw = authorizer.authorize('read', () => ref('flow', flowId));
+            return mw(c, next);
+        });
+    }
+    // ---------- GET / (list, cursor-paginated) ----------
+    r.get('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const limit = clampLimit(c.req.query('limit'));
+        const cursorRaw = c.req.query('cursor');
+        const nameRaw = c.req.query('name');
+        const scopeParsed = parseScopeParams(c.req.query(), { tenantId });
+        if (scopeParsed.kind === 'err') {
+            c.status(statusFor('scope-invalid'));
+            return c.json(toWireError({ code: 'scope-invalid', message: scopeParsed.message }, requestId));
+        }
+        const page = await binding.list({
+            tenantId,
+            limit,
+            ...(cursorRaw !== undefined && cursorRaw.length > 0 && { cursor: cursorRaw }),
+            ...(nameRaw !== undefined && nameRaw.length > 0 && { nameFilter: nameRaw }),
+            ...(scopeParsed.scope !== undefined && { scope: scopeParsed.scope }),
+            ...(scopeParsed.inherit !== undefined && { inherit: scopeParsed.inherit }),
+        });
+        return c.json({
+            data: page.data.map(serializeGraph),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    // ---------- GET /:flowId (latest version) ----------
+    r.get('/:flowId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const flowId = c.req.param('flowId');
+        const flow = await binding.get({ tenantId, flowId });
+        if (flow === null) {
+            // 410 gone (head exists, no active version) vs 404 not-found
+            // (never registered).
+            const exists = await binding.headExists({ tenantId, flowId });
+            if (exists) {
+                c.status(statusFor('flow-gone'));
+                return c.json(toWireError({
+                    code: 'flow-gone',
+                    message: `Flow "${flowId}" has no active versions; reinstate a tombstoned version or publish a new one`,
+                    flowId: flowId,
+                }, requestId));
+            }
+            c.status(statusFor('flow-not-found'));
+            return c.json(toWireError({
+                code: 'flow-not-found',
+                message: `No flow registered with id "${flowId}"`,
+                flowId: flowId,
+            }, requestId));
+        }
+        return c.json(serializeGraph(flow));
+    });
+    // ---------- GET /:flowId/versions (list versions) ----------
+    r.get('/:flowId/versions', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const flowId = c.req.param('flowId');
+        const limit = clampLimit(c.req.query('limit'));
+        const cursorRaw = c.req.query('cursor');
+        // Confirm the id exists at all — an empty versions list from the
+        // binding is ambiguous (no versions vs. unknown id), so we do a
+        // preliminary `get` to flip an unknown id to a `404`.
+        const latest = await binding.get({ tenantId, flowId });
+        if (latest === null) {
+            c.status(statusFor('flow-not-found'));
+            return c.json(toWireError({
+                code: 'flow-not-found',
+                message: `No flow registered with id "${flowId}"`,
+                flowId: flowId,
+            }, requestId));
+        }
+        const page = await binding.listVersions({
+            tenantId,
+            flowId,
+            limit,
+            ...(cursorRaw !== undefined && cursorRaw.length > 0 && { cursor: cursorRaw }),
+        });
+        return c.json({
+            data: page.data.map(serializeGraph),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    // ---------- GET /:flowId/versions/:version ----------
+    r.get('/:flowId/versions/:version', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const flowId = c.req.param('flowId');
+        const version = c.req.param('version');
+        const flow = await binding.getVersion({ tenantId, flowId, version });
+        if (flow === null) {
+            c.status(statusFor('flow-not-found'));
+            return c.json(toWireError({
+                code: 'flow-not-found',
+                message: `No flow "${flowId}" at version "${version}"`,
+                flowId: flowId,
+                version: version,
+            }, requestId));
+        }
+        return c.json(serializeGraph(flow));
+    });
+    // ---------- POST / (publish) ----------
+    r.post('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId));
+        }
+        if (body === null || typeof body !== 'object') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be an object' }, requestId));
+        }
+        // `projectId` is REQUIRED on the POST body.
+        // Missing / empty / non-string → 400 bad-input. Absent from the
+        // flow-shape validator on purpose — the caller controls what
+        // project the flow lands in; the flow definition itself is
+        // project-agnostic.
+        const bodyObj = body;
+        const projectIdRaw = bodyObj.projectId;
+        if (typeof projectIdRaw !== 'string' || projectIdRaw.length === 0) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`projectId` is required' }, requestId));
+        }
+        const projectId = projectIdRaw;
+        // Validate via loadFlow — same rules as the runtime loader, so a
+        // flow published through the API is byte-identical to one
+        // constructed in-process. `loadFlow` returns a Result rather than
+        // throwing. `projectId` is stripped from the wire body before
+        // validation — the flow definition itself is project-agnostic
+        // (loadFlow rejects unknown top-level keys).
+        const { projectId: _pid, ...bodyWithoutProjectId } = bodyObj;
+        const loaded = loadFlow(bodyWithoutProjectId);
+        if (loaded.kind === 'err') {
+            c.status(statusFor('validation-failed'));
+            return c.json(toWireError({
+                code: 'validation-failed',
+                message: loaded.error.message,
+                issues: toIssues(loaded.error),
+            }, requestId));
+        }
+        const principal = c.get('principal');
+        const creatorUserId = principal?.actor.kind === 'user' ? principal.actor.id : undefined;
+        const outcome = await binding.publish({
+            tenantId,
+            projectId,
+            flow: loaded.value,
+            enqueueTuples: (flowId) => tuplesForCreate({ kind: 'flow', id: flowId, tenantId, projectId }, creatorUserId),
+        });
+        if (outcome.kind === 'already-registered') {
+            c.status(statusFor('flow-already-registered'));
+            return c.json(toWireError({
+                code: 'flow-already-registered',
+                message: `Flow "${outcome.flowId}" version "${outcome.version}" is already registered`,
+                flowId: outcome.flowId,
+                version: outcome.version,
+            }, requestId));
+        }
+        if (outcome.kind === 'project-not-found') {
+            // Caller supplied a `projectId` that does not resolve within
+            // this tenant. Distinct signal from `already-registered` so the
+            // client can prompt for a valid project rather than assume the
+            // version was already used. Answered as `400 bad-input`; the
+            // caller learns from the message which field was invalid.
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({
+                code: 'bad-input',
+                message: `\`projectId\` "${outcome.projectId}" does not resolve to a project in this tenant`,
+            }, requestId));
+        }
+        c.status(201);
+        return c.json({
+            flowId: outcome.flowId,
+            version: outcome.version,
+        });
+    });
+    // ---------- POST /:flowId/versions/:version/unregister ----------
+    r.post('/:flowId/versions/:version/unregister', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const flowId = c.req.param('flowId');
+        const version = c.req.param('version');
+        const outcome = await binding.unregister({ tenantId, flowId, version });
+        if (!outcome.unregistered) {
+            c.status(statusFor('flow-not-found'));
+            return c.json(toWireError({
+                code: 'flow-not-found',
+                message: `No flow "${flowId}" at version "${version}" to unregister`,
+                flowId: flowId,
+                version: version,
+            }, requestId));
+        }
+        return c.json({
+            flowId: flowId,
+            version: version,
+            unregistered: true,
+        });
+    });
+    // ---------- POST /:flowId/versions/:version/reinstate ----------
+    r.post('/:flowId/versions/:version/reinstate', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const flowId = c.req.param('flowId');
+        const version = c.req.param('version');
+        const outcome = await binding.reinstateVersion({ tenantId, flowId, version });
+        if (outcome.kind === 'not-found') {
+            c.status(statusFor('flow-not-found'));
+            return c.json(toWireError({
+                code: 'flow-not-found',
+                message: `No flow "${flowId}" at version "${version}" to reinstate`,
+                flowId: flowId,
+                version,
+            }, requestId));
+        }
+        return c.json({
+            flowId: outcome.flowId,
+            version: outcome.version,
+            wasTombstoned: outcome.wasTombstoned,
+        });
+    });
+    return r;
+}
+function serializeGraph(g) {
+    return {
+        id: g.id,
+        version: g.version,
+        ...(g.name !== undefined && { name: g.name }),
+        ...(g.description !== undefined && { description: g.description }),
+        nodes: g.nodes,
+        edges: g.edges,
+        ...(g.maxParallelism !== undefined && { maxParallelism: g.maxParallelism }),
+        ...(g.metadata !== undefined && { metadata: g.metadata }),
+    };
+}
+/**
+ * Normalize any `FlowError` to a flat `issues[]` list so the wire
+ * response shape is uniform. Errors that already carry an `issues`
+ * array (schema-validation-failed, loop-invalid-output-schema) pass
+ * through unchanged; the discrete errors project their structural
+ * fields into a single-element issues list keyed by the natural path.
+ */
+function toIssues(err) {
+    if ('issues' in err)
+        return err.issues;
+    const path = derivePath(err);
+    return [{ path, message: err.message }];
+}
+function derivePath(err) {
+    if ('edgeId' in err && err.edgeId !== undefined) {
+        return `edges/${err.edgeId}`;
+    }
+    if ('nodeId' in err && err.nodeId !== undefined) {
+        return `nodes/${err.nodeId}`;
+    }
+    if ('loopNodeId' in err && err.loopNodeId !== undefined) {
+        return `nodes/${err.loopNodeId}`;
+    }
+    return '';
+}
+//# sourceMappingURL=flows.js.map

package/dist/routes/flows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flows.js","sourceRoot":"","sources":["../../src/routes/flows.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAkB,GAAG,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAA6B,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGnE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CAAC,OAA4B,EAAE,UAAuB;IAC/E,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,mEAAmE;IACnE,qEAAqE;IACrE,4CAA4C;IAC5C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;YAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClD,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAChC,MAAM,GAAG,GACP,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;wBACvC,CAAC,CAAE,IAAgC,CAAC,SAAS;wBAC7C,CAAC,CAAC,SAAS,CAAC;oBAChB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;wBAAE,OAAO,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAC5E,CAAC;gBAAC,MAAM,CAAC;oBACP,uCAAuC;gBACzC,CAAC;gBACD,OAAO,GAAG,CAAC,QAAQ,EAAE,QAA6B,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,+DAA+D;YAC/D,gDAAgD;YAChD,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAChD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,EAAE,CAAC;YAClE,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,SAA8B,CAAC;YAC9D,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACzD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACnE,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAClC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACnE,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAU,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ;YACR,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;YACvF,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAC3E,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;YACpE,GAAG,CAAC,WAAW,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;SAC3E,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAE/C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,6DAA6D;YAC7D,sBAAsB;YACtB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9D,IAAI,MAAM,EAAE,CAAC;gBACX,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,SAAS,MAA2B,+EAA+E;oBAC5H,MAAM,EAAE,MAA2B;iBACpC,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAU,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,+BAA+B,MAA2B,GAAG;gBACtE,MAAM,EAAE,MAA2B;aACpC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,8DAA8D;IAC9D,CAAC,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExC,iEAAiE;QACjE,gEAAgE;QAChE,sDAAsD;QACtD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAU,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,+BAA+B,MAA2B,GAAG;gBACtE,MAAM,EAAE,MAA2B;aACpC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;YACtC,QAAQ;YACR,MAAM;YACN,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;SACxF,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uDAAuD;IACvD,CAAC,CAAC,GAAG,CAAC,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAU,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,YAAY,MAA2B,iBAAiB,OAAO,GAAG;gBAC3E,MAAM,EAAE,MAA2B;gBACnC,OAAO,EAAE,OAAO;aACjB,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,yCAAyC;IACzC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QAED,4CAA4C;QAC5C,gEAAgE;QAChE,6DAA6D;QAC7D,2DAA2D;QAC3D,oBAAoB;QACpB,MAAM,OAAO,GAAG,IAA+B,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;QACvC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,SAAS,CAAC,CAClF,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,YAAyB,CAAC;QAE5C,iEAAiE;QACjE,0DAA0D;QAC1D,kEAAkE;QAClE,8DAA8D;QAC9D,8DAA8D;QAC9D,6CAA6C;QAC7C,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,GAAG,OAAO,CAAC;QAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAyC;aACvE,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;QAC9D,MAAM,aAAa,GACjB,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAE,SAAS,CAAC,KAAK,CAAC,EAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACpC,QAAQ;YACR,SAAS;YACT,IAAI,EAAE,MAAM,CAAC,KAAK;YAClB,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACxB,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,aAAa,CAAC;SAC9F,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC1C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,yBAAyB,CAAU,CAAC,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,SAAS,OAAO,CAAC,MAA2B,cAAc,OAAO,CAAC,OAAO,yBAAyB;gBAC3G,MAAM,EAAE,OAAO,CAAC,MAA2B;gBAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACzC,6DAA6D;YAC7D,gEAAgE;YAChE,+DAA+D;YAC/D,6DAA6D;YAC7D,0DAA0D;YAC1D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,kBAAkB,OAAO,CAAC,SAA8B,gDAAgD;aAClH,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,OAAO,CAAC,MAA2B;YAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,CAAC,CAAC,IAAI,CAAC,uCAAuC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAU,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,YAAY,MAA2B,iBAAiB,OAAO,iBAAiB;gBACzF,MAAM,EAAE,MAA2B;gBACnC,OAAO,EAAE,OAAO;aACjB,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAA2B;YACnC,OAAO,EAAE,OAAO;YAChB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,CAAC,CAAC,IAAI,CAAC,sCAAsC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAU,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,YAAY,MAA2B,iBAAiB,OAAO,gBAAgB;gBACxF,MAAM,EAAE,MAA2B;gBACnC,OAAO;aACR,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,OAAO,CAAC,MAA2B;YAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CAAC,CAAO;IAC7B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAuB;QAC7B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;QAC3E,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,GAAc;IAC9B,IAAI,QAAQ,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CAAC,GAAc;IAChC,IAAI,QAAQ,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,SAAS,GAAG,CAAC,MAA2B,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,SAAS,GAAG,CAAC,MAA2B,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,YAAY,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxD,OAAO,SAAS,GAAG,CAAC,UAA+B,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/routes/guardrails.d.ts

@@ -0,0 +1,33 @@
+import { Hono } from 'hono';
+import type { GuardrailId, TenantId } from '@kindgi/types';
+import type { GuardrailRegistryBinding } from '../guardrail-binding.js';
+import type { Authorizer } from '../middleware/authorize.js';
+import type { AppEnv } from '../types.js';
+/**
+ * Guardrails resource routes, paired with tools.
+ *
+ * Registry storage is caller-plugged via `GuardrailRegistryBinding`.
+ * The API package does not own persistence — deployments wire a durable
+ * store; tests can wrap an in-memory one.
+ *
+ * Registration is metadata-only: the body is a full `Guardrail` shape
+ * (id + kind + check-id + action). The actual `check` implementation
+ * must already be registered with the runtime — deployments publish
+ * guardrails whose check code is already bundled server-side. Check
+ * code is not uploaded over this surface.
+ */
+/**
+ * Optional side-effect callback fired after a successful write
+ * (register, unregister) to a guardrail. Lets an in-process
+ * runtime cache (e.g. a per-tenant guardrail cache) invalidate
+ * its per-tenant snapshot so the next agent turn picks up the
+ * new/dropped guardrail without a process restart. Mirror of
+ * `ToolWriteHook` / `ProviderWriteHook`.
+ */
+export type GuardrailWriteHook = (params: {
+    readonly tenantId: TenantId;
+    readonly guardrailId: GuardrailId;
+    readonly kind: 'register' | 'unregister';
+}) => void | Promise<void>;
+export declare function guardrailsRouter(binding: GuardrailRegistryBinding, authorizer?: Authorizer, onWrite?: GuardrailWriteHook): Hono<AppEnv>;
+//# sourceMappingURL=guardrails.d.ts.map

package/dist/routes/guardrails.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../src/routes/guardrails.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAU,WAAW,EAAa,QAAQ,EAAU,MAAM,eAAe,CAAC;AAGtF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C;;;;;;;;;;;;GAYG;AACH;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CAAC;CAC1C,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3B,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,wBAAwB,EACjC,UAAU,CAAC,EAAE,UAAU,EACvB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,IAAI,CAAC,MAAM,CAAC,CAgQd"}