@kindgi/api 0.1.4-rc.0 → 0.1.4-rc.2

package/dist/routes/agent-releases.js

@@ -0,0 +1,462 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { statusFor, toWireError } from '../errors.js';
+import { evaluateGate } from '../gate.js';
+import { serializeGatePolicy } from './gate-policy-wire.js';
+import { liveScopeToWire, parseLiveScopeBody } from './live-scope-wire.js';
+import { clampLimit } from './pagination.js';
+import { parseSegmentsQuery } from './segments.js';
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** The routes that change what's live: authorized as `promote` on the agent, not `admin`. */
+export function isPromotionWrite(method, path) {
+    return method === 'POST' && /\/(promotions|live\/rollback|live\/unpin)$/.test(path);
+}
+/** `POST …/promotions/check` changes nothing: `read` on the agent. */
+export function isPromotionCheck(method, path) {
+    return method === 'POST' && path.endsWith('/promotions/check');
+}
+/**
+ * Live versions of an agent per scope, and the promotions that set them
+ * (evals step 4):
+ *   GET  /:agentId/live            the version a run would use for a project and segment path
+ *   GET  /:agentId/live-versions   every pin
+ *   POST /:agentId/promotions      make a version live for a scope, through its gate
+ *                                    (201 promoted, 202 waiting for approval, 422 gate-failed)
+ *   POST /:agentId/promotions/check  what the gate would say, writing nothing
+ *   GET  /:agentId/gate-policy     the gate policy that applies to a scope
+ *   GET  /:agentId/promotions[/:id]  the history
+ *   POST /:agentId/live/rollback   back to the scope's previous live version
+ *   POST /:agentId/live/unpin      remove the scope's pin (it falls back to the scope above)
+ */
+export function mountAgentReleaseRoutes(r, registry, releases, deps = {}) {
+    r.get('/:agentId/live', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const agentId = c.req.param('agentId');
+        const projectId = c.req.query('projectId');
+        if (projectId !== undefined && !UUID_RE.test(projectId)) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`projectId` must be a project id (a UUID)' }, requestId));
+        }
+        const segments = parseSegmentsQuery(c.req.queries('segment') ?? []);
+        if (segments.kind === 'err') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: segments.message }, requestId));
+        }
+        if (segments.segments !== undefined && projectId === undefined) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'A `segment` path needs a `projectId`' }, requestId));
+        }
+        const resolved = await releases.live.resolve({
+            tenantId,
+            agentId,
+            ...(projectId !== undefined && { projectId: projectId }),
+            ...(segments.segments !== undefined && { segments: segments.segments }),
+        });
+        if (resolved !== null) {
+            return c.json({
+                agentId,
+                version: resolved.version,
+                via: 'live',
+                liveScope: liveScopeToWire(resolved.scope),
+            });
+        }
+        // Nothing pinned on the way up: what a run gets is the latest registered version.
+        const latest = await registry.get({ tenantId, agentId: agentId });
+        if (latest === null) {
+            c.status(statusFor('agent-not-found'));
+            return c.json(toWireError({ code: 'agent-not-found', message: `No agent "${agentId}" is registered` }, requestId));
+        }
+        return c.json({ agentId, version: latest.version, via: 'latest' });
+    });
+    r.get('/:agentId/live-versions', async (c) => {
+        const tenantId = c.get('tenantId');
+        const pins = await releases.live.list({ tenantId, agentId: c.req.param('agentId') });
+        return c.json({
+            data: pins.map((p) => ({
+                agentId: p.agentId,
+                scope: liveScopeToWire(p.scope),
+                version: p.version,
+                promotionId: p.promotionId,
+                setAt: p.setAt,
+            })),
+        });
+    });
+    r.post('/:agentId/promotions', async (c) => {
+        const requestId = c.get('requestId');
+        const parsed = await readPromotionBody(c);
+        if (parsed.kind === 'err')
+            return badInput(c, requestId, parsed.message);
+        const tenantId = c.get('tenantId');
+        const agentId = c.req.param('agentId');
+        const input = {
+            tenantId,
+            agentId,
+            version: parsed.value.version,
+            scope: parsed.value.scope,
+            requestedBy: actorOf(c),
+            ...(parsed.value.reason !== undefined && { reason: parsed.value.reason }),
+            ...(parsed.value.evalRunId !== undefined && { evalRunId: parsed.value.evalRunId }),
+        };
+        const policy = await policyFor(releases, tenantId, agentId, parsed.value.scope);
+        if (releases.promotions.request === undefined) {
+            if (policy !== null) {
+                c.status(statusFor('promotion-gate-unsupported'));
+                return c.json(toWireError({
+                    code: 'promotion-gate-unsupported',
+                    message: `Gate policy ${policy.id} ${policy.version} applies to this promotion, and this deployment can't record a gated promotion yet.`,
+                }, requestId));
+            }
+            // No gate, and a binding from before gates: promote as before.
+            const outcome = await releases.promotions.promote(input);
+            if (outcome.kind === 'err')
+                return failed(c, requestId, outcome.error);
+            c.status(201);
+            return c.json(serializePromotion(outcome.value));
+        }
+        const gate = await runGate(registry, releases, deps, { ...parsed.value, tenantId, agentId }, policy);
+        if (gate.kind === 'err')
+            return failed(c, requestId, gate.error);
+        const outcome = await releases.promotions.request({
+            ...input,
+            gate: {
+                policy: policy === null ? null : { id: policy.id, version: policy.version },
+                checks: gate.result.checks,
+                passed: gate.result.passed,
+                ...(gate.result.approval !== undefined && { approval: gate.result.approval }),
+                servingVersion: gate.servingVersion,
+            },
+        });
+        if (outcome.kind === 'err')
+            return failed(c, requestId, outcome.error);
+        const promotion = outcome.value;
+        if (promotion.status === 'refused') {
+            const checks = promotion.checks ?? gate.result.checks;
+            c.status(statusFor('gate-failed'));
+            return c.json(toWireError({
+                code: 'gate-failed',
+                message: `The gate refused ${agentId} ${parsed.value.version}: ${checks
+                    .filter((check) => !check.passed)
+                    .map((check) => check.message)
+                    .join(' ')}`,
+                promotionId: promotion.id,
+                policy: promotion.policy ?? null,
+                checks,
+            }, requestId));
+        }
+        c.status(promotion.status === 'pending-approval' ? 202 : 201);
+        return c.json(serializePromotion(promotion));
+    });
+    r.post('/:agentId/promotions/check', async (c) => {
+        const requestId = c.get('requestId');
+        const parsed = await readPromotionBody(c);
+        if (parsed.kind === 'err')
+            return badInput(c, requestId, parsed.message);
+        const tenantId = c.get('tenantId');
+        const agentId = c.req.param('agentId');
+        const policy = await policyFor(releases, tenantId, agentId, parsed.value.scope);
+        const gate = await runGate(registry, releases, deps, { ...parsed.value, tenantId, agentId }, policy);
+        if (gate.kind === 'err')
+            return failed(c, requestId, gate.error);
+        const { result } = gate;
+        return c.json({
+            outcome: !result.passed
+                ? 'gate-failed'
+                : result.approval !== undefined
+                    ? 'needs-approval'
+                    : 'would-promote',
+            policy: policy === null ? null : { id: policy.id, version: policy.version },
+            checks: result.checks,
+            ...(result.approval !== undefined && { approval: result.approval }),
+        });
+    });
+    r.get('/:agentId/gate-policy', async (c) => {
+        const requestId = c.get('requestId');
+        const scope = scopeFromQuery((n) => c.req.query(n), c.req.queries('segment') ?? []);
+        if (scope.kind === 'err')
+            return badInput(c, requestId, scope.message);
+        if (scope.scope === undefined) {
+            return badInput(c, requestId, '`scopeKind` is required: the scope a promotion would be for');
+        }
+        const policy = await policyFor(releases, c.get('tenantId'), c.req.param('agentId'), scope.scope);
+        return c.json({ policy: policy === null ? null : serializeGatePolicy(policy) });
+    });
+    r.get('/:agentId/promotions', async (c) => {
+        const requestId = c.get('requestId');
+        const scope = scopeFromQuery((n) => c.req.query(n), c.req.queries('segment') ?? []);
+        if (scope.kind === 'err')
+            return badInput(c, requestId, scope.message);
+        const cursor = c.req.query('cursor');
+        const page = await releases.promotions.list({
+            tenantId: c.get('tenantId'),
+            agentId: c.req.param('agentId'),
+            limit: clampLimit(c.req.query('limit')),
+            ...(scope.scope !== undefined && { scope: scope.scope }),
+            ...(cursor !== undefined && cursor.length > 0 && { cursor: cursor }),
+        });
+        return c.json({
+            data: page.data.map(serializePromotion),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    r.get('/:agentId/promotions/:promotionId', async (c) => {
+        const requestId = c.get('requestId');
+        const found = await releases.promotions.get(c.get('tenantId'), c.req.param('promotionId'));
+        if (found === null || found.agentId !== c.req.param('agentId')) {
+            c.status(statusFor('promotion-not-found'));
+            return c.json(toWireError({ code: 'promotion-not-found', message: 'No such promotion for this agent' }, requestId));
+        }
+        return c.json(serializePromotion(found));
+    });
+    r.post('/:agentId/live/rollback', async (c) => {
+        const requestId = c.get('requestId');
+        const body = await readBody(c);
+        if (body === undefined)
+            return badJson(c, requestId);
+        const scope = parseLiveScopeBody(body.scope);
+        if (scope.kind === 'err')
+            return badInput(c, requestId, scope.message);
+        if (body.toVersion !== undefined &&
+            (typeof body.toVersion !== 'string' || body.toVersion === '')) {
+            return badInput(c, requestId, '`toVersion` must be a version when supplied');
+        }
+        const text = optionalText(body, ['reason']);
+        if (text.kind === 'err')
+            return badInput(c, requestId, text.message);
+        const outcome = await releases.promotions.rollback({
+            tenantId: c.get('tenantId'),
+            agentId: c.req.param('agentId'),
+            scope: scope.scope,
+            requestedBy: actorOf(c),
+            ...(typeof body.toVersion === 'string' && { toVersion: body.toVersion }),
+            ...text.value,
+        });
+        if (outcome.kind === 'err')
+            return failed(c, requestId, outcome.error);
+        return c.json(serializePromotion(outcome.value));
+    });
+    r.post('/:agentId/live/unpin', async (c) => {
+        const requestId = c.get('requestId');
+        const body = await readBody(c);
+        if (body === undefined)
+            return badJson(c, requestId);
+        const scope = parseLiveScopeBody(body.scope);
+        if (scope.kind === 'err')
+            return badInput(c, requestId, scope.message);
+        const text = optionalText(body, ['reason']);
+        if (text.kind === 'err')
+            return badInput(c, requestId, text.message);
+        const outcome = await releases.promotions.unpin({
+            tenantId: c.get('tenantId'),
+            agentId: c.req.param('agentId'),
+            scope: scope.scope,
+            requestedBy: actorOf(c),
+            ...text.value,
+        });
+        if (outcome.kind === 'err')
+            return failed(c, requestId, outcome.error);
+        return c.json(serializePromotion(outcome.value));
+    });
+}
+async function readBody(c) {
+    try {
+        const body = await c.req.json();
+        return body !== null && typeof body === 'object' && !Array.isArray(body)
+            ? body
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function badJson(c, requestId) {
+    return badInput(c, requestId, 'Request body must be a JSON object');
+}
+function badInput(c, requestId, message) {
+    c.status(statusFor('bad-input'));
+    return c.json(toWireError({ code: 'bad-input', message }, requestId));
+}
+function failed(c, requestId, error) {
+    c.status(statusFor(error.code));
+    return c.json(toWireError(error, requestId));
+}
+/** Optional short strings (`reason`, `evalRunId`): absent, or a non-empty string. */
+function optionalText(body, fields) {
+    const value = {};
+    for (const field of fields) {
+        const v = body[field];
+        if (v === undefined)
+            continue;
+        if (typeof v !== 'string' || v.trim() === '' || v.length > 2000) {
+            return { kind: 'err', message: `\`${field}\` must be a non-empty string when supplied` };
+        }
+        value[field] = v;
+    }
+    return { kind: 'ok', value };
+}
+/** The promotion body: `{version, scope, evalRunId?, reason?}`. */
+async function readPromotionBody(c) {
+    const body = await readBody(c);
+    if (body === undefined)
+        return { kind: 'err', message: 'Request body must be a JSON object' };
+    const scope = parseLiveScopeBody(body.scope);
+    if (scope.kind === 'err')
+        return scope;
+    if (typeof body.version !== 'string' || body.version.length === 0) {
+        return { kind: 'err', message: '`version` is required: the agent version to make live' };
+    }
+    const text = optionalText(body, ['reason', 'evalRunId']);
+    if (text.kind === 'err')
+        return text;
+    return {
+        kind: 'ok',
+        value: { version: body.version, scope: scope.scope, ...text.value },
+    };
+}
+/** The gate policy for a promotion of `agentId` for `scope`; `null` when none applies. */
+async function policyFor(releases, tenantId, agentId, scope) {
+    return releases.gatePolicies === undefined
+        ? null
+        : releases.gatePolicies.resolve({ tenantId, agentId, scope });
+}
+/** The scope's coordinates, as a run in it would resolve its version. */
+function coordinatesOf(scope) {
+    switch (scope.kind) {
+        case 'tenant':
+            return {};
+        case 'org':
+            return { orgId: scope.orgId };
+        case 'project':
+            return { projectId: scope.projectId };
+        case 'segment':
+            return { projectId: scope.projectId, segments: scope.path };
+    }
+}
+/** A finished comparison's summary, or `null` for any other eval run. */
+function summaryOf(run) {
+    const summary = run.result?.summary;
+    return run.kind === 'judged' && summary !== null && typeof summary === 'object'
+        ? summary
+        : null;
+}
+/**
+ * The gate for a promotion request: what serves the scope now, the
+ * comparison it names, and the policy's checks against them. With no
+ * policy there's nothing to check.
+ */
+async function runGate(registry, releases, deps, req, policy) {
+    const { tenantId, agentId } = req;
+    const err = (code, message) => ({
+        kind: 'err',
+        error: { code, message },
+    });
+    const promoted = await registry.getVersion({
+        tenantId,
+        agentId: agentId,
+        version: req.version,
+    });
+    if (promoted === null || promoted.unregisteredAt !== undefined) {
+        return err('agent-version-not-found', `${agentId} has no active version ${req.version}`);
+    }
+    const live = await releases.live.resolve({ tenantId, agentId, ...coordinatesOf(req.scope) });
+    let servingVersion = live?.version;
+    if (servingVersion === undefined) {
+        const latest = await registry.get({ tenantId, agentId: agentId });
+        if (latest === null)
+            return err('agent-not-found', `No agent "${agentId}" is registered`);
+        servingVersion = latest.version;
+    }
+    if (policy === null)
+        return { kind: 'ok', result: { checks: [], passed: true }, servingVersion };
+    let summary = null;
+    if (req.evalRunId !== undefined) {
+        const run = deps.evalRuns === undefined
+            ? null
+            : await deps.evalRuns.get({ tenantId, runId: req.evalRunId });
+        if (run === null)
+            return err('eval-run-not-found', `No eval run ${req.evalRunId}`);
+        summary = summaryOf(run);
+        if (summary === null) {
+            return err('bad-input', `Eval run ${req.evalRunId} isn't a finished comparison: it has no comparison summary`);
+        }
+    }
+    let summaryProjectOrgId;
+    const judgedIn = summary?.scope.projectId;
+    if (req.scope.kind === 'org' && judgedIn !== undefined && deps.projects !== undefined) {
+        const project = await deps.projects.get(tenantId, judgedIn);
+        summaryProjectOrgId = project?.orgId;
+    }
+    const result = evaluateGate({
+        spec: policy.spec,
+        promotion: {
+            agentId,
+            version: req.version,
+            pinsDigest: promoted.pinsDigest ?? null,
+            scope: req.scope,
+        },
+        summary,
+        servingVersion,
+        ...(summaryProjectOrgId !== undefined && { summaryProjectOrgId }),
+        now: new Date(),
+    });
+    return { kind: 'ok', result, servingVersion };
+}
+/** Who asked, from the request's principal. */
+function actorOf(c) {
+    const actor = c.get('principal')?.actor;
+    if (actor === undefined)
+        return { kind: 'service', id: 'unknown' };
+    return { kind: actor.kind === 'user' ? 'user' : 'service', id: actor.id };
+}
+/** `?scopeKind=tenant|org|project|segment&scopeId=…&segment=key:value` for the history filter. */
+export function scopeFromQuery(query, segmentValues) {
+    const kind = query('scopeKind');
+    const id = query('scopeId');
+    if (kind === undefined || kind === '') {
+        return id === undefined
+            ? { kind: 'ok' }
+            : { kind: 'err', message: '`scopeId` needs `scopeKind`' };
+    }
+    if (kind === 'tenant')
+        return { kind: 'ok', scope: { kind: 'tenant' } };
+    if (id === undefined || !UUID_RE.test(id)) {
+        return { kind: 'err', message: '`scopeId` must be an org or project id (a UUID)' };
+    }
+    if (kind === 'org')
+        return { kind: 'ok', scope: { kind: 'org', orgId: id } };
+    if (kind === 'project')
+        return { kind: 'ok', scope: { kind: 'project', projectId: id } };
+    if (kind === 'segment') {
+        const path = parseSegmentsQuery(segmentValues);
+        if (path.kind === 'err')
+            return path;
+        if (path.segments === undefined)
+            return { kind: 'err', message: 'A segment scope needs `segment`' };
+        return {
+            kind: 'ok',
+            scope: { kind: 'segment', projectId: id, path: path.segments },
+        };
+    }
+    return { kind: 'err', message: '`scopeKind` must be one of tenant, org, project, segment' };
+}
+export function serializePromotion(p) {
+    return {
+        id: p.id,
+        agentId: p.agentId,
+        scope: liveScopeToWire(p.scope),
+        action: p.action,
+        fromVersion: p.fromVersion,
+        toVersion: p.toVersion,
+        requestedBy: p.requestedBy,
+        ...(p.reason !== undefined && { reason: p.reason }),
+        ...(p.evalRunId !== undefined && { evalRunId: p.evalRunId }),
+        createdAt: p.createdAt,
+        ...(p.status !== undefined && { status: p.status }),
+        ...(p.policy !== undefined && { policy: p.policy }),
+        ...(p.checks !== undefined && { checks: p.checks }),
+        ...(p.approvalId !== undefined && { approvalId: p.approvalId }),
+        ...(p.resolvedAt !== undefined && { resolvedAt: p.resolvedAt }),
+    };
+}
+//# sourceMappingURL=agent-releases.js.map

package/dist/routes/agent-releases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-releases.js","sourceRoot":"","sources":["../../src/routes/agent-releases.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAUjC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAmB,YAAY,EAAE,MAAM,YAAY,CAAC;AAS3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAY;IAC3D,OAAO,MAAM,KAAK,MAAM,IAAI,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtF,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAY;IAC3D,OAAO,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AACjE,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CACrC,CAAe,EACf,QAA8B,EAC9B,QAA8B,EAC9B,OAA6B,EAAE;IAE/B,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,2CAA2C,EAAE,EAC3E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC5B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC/D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,EAAE,EACtE,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YAC3C,QAAQ;YACR,OAAO;YACP,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,SAAsB,EAAE,CAAC;YACrE,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;SACxE,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,OAAO;gBACP,OAAO,EAAE,QAAQ,CAAC,OAA4B;gBAC9C,GAAG,EAAE,MAAM;gBACX,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAkB,EAAE,CAAC,CAAC;QAC7E,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAU,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,OAAO,iBAAiB,EAAE,EAC3E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAA4B,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC/B,OAAO,EAAE,CAAC,CAAC,OAA4B;gBACvC,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,KAAK,EAAE,CAAC,CAAC,KAA0B;aACpC,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG;YACZ,QAAQ;YACR,OAAO;YACP,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;YACzB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YACvB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;SACnF,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,4BAA4B,CAAU,CAAC,CAAC;gBAC3D,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,eAAe,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,qFAAqF;iBACzI,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,+DAA+D;YAC/D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACvE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EACtC,MAAM,CACP,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;YAChD,GAAG,KAAK;YACR,IAAI,EAAE;gBACJ,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;gBAC3E,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC7E,cAAc,EAAE,IAAI,CAAC,cAAwB;aAC9C;SACF,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAChC,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACtD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAU,CAAC,CAAC;YAC5C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,oBAAoB,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,MAAM;qBACpE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;qBAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;qBAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;gBACd,WAAW,EAAE,SAAS,CAAC,EAAE;gBACzB,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI;gBAChC,MAAM;aACP,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EACtC,MAAM,CACP,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACxB,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM;gBACrB,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;oBAC7B,CAAC,CAAC,gBAAgB;oBAClB,CAAC,CAAC,eAAe;YACrB,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;YAC3E,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,6DAA6D,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,EAC7B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EACtB,KAAK,CAAC,KAAK,CACZ,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;YAC1C,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/B,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACxD,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAgB,EAAE,CAAC;SAC/E,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACvC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,CACzC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,EAC7B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAC3B,CAAC;QACF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAU,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,kCAAkC,EAAE,EAC5E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IACE,IAAI,CAAC,SAAS,KAAK,SAAS;YAC5B,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC,EAC7D,CAAC;YACD,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,6CAA6C,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;YACjD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YACvB,GAAG,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAmB,EAAE,CAAC;YAClF,GAAG,IAAI,CAAC,KAAK;SACd,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;YAC9C,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YACvB,GAAG,IAAI,CAAC,KAAK;SACd,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAID,KAAK,UAAU,QAAQ,CAAC,CAAM;IAC5B,IAAI,CAAC;QACH,MAAM,IAAI,GAAY,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzC,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACtE,CAAC,CAAE,IAAgC;YACnC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,CAAM,EAAE,SAAiB;IACxC,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,oCAAoC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,QAAQ,CAAC,CAAM,EAAE,SAAiB,EAAE,OAAe;IAC1D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,MAAM,CAAC,CAAM,EAAE,SAAiB,EAAE,KAAwC;IACjF,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,qFAAqF;AACrF,SAAS,YAAY,CACnB,IAAuC,EACvC,MAA2C;IAI3C,MAAM,KAAK,GAA4C,EAAE,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAChE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,KAAK,6CAA6C,EAAE,CAAC;QAC3F,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,iBAAiB,CAAC,CAAM;IAOrC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;IAC9F,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAiB,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;KAC9E,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,SAAS,CACtB,QAA8B,EAC9B,QAAkB,EAClB,OAAe,EACf,KAAgB;IAEhB,OAAO,QAAQ,CAAC,YAAY,KAAK,SAAS;QACxC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,yEAAyE;AACzE,SAAS,aAAa,CAAC,KAAgB;IACrC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAChC,KAAK,SAAS;YACZ,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACxC,KAAK,SAAS;YACZ,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC;IACpC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAC7E,CAAC,CAAE,OAAmC;QACtC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CACpB,QAA8B,EAC9B,QAA8B,EAC9B,IAA0B,EAC1B,GAMC,EACD,MAAyB;IAKzB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAClC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,EAAE,KAAc;QACpB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KACzB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC;QACzC,QAAQ;QACR,OAAO,EAAE,OAAkB;QAC3B,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC/D,OAAO,GAAG,CAAC,yBAAyB,EAAE,GAAG,OAAO,0BAA0B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7F,IAAI,cAAc,GAAG,IAAI,EAAE,OAAwC,CAAC;IACpE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAkB,EAAE,CAAC,CAAC;QAC7E,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,iBAAiB,EAAE,aAAa,OAAO,iBAAiB,CAAC,CAAC;QAC1F,cAAc,GAAG,MAAM,CAAC,OAA4B,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,CAAC;IAEjG,IAAI,OAAO,GAAmC,IAAI,CAAC;IACnD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,GAAG,GACP,IAAI,CAAC,QAAQ,KAAK,SAAS;YACzB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,SAAkB,EAAE,CAAC,CAAC;QAC3E,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,oBAAoB,EAAE,eAAe,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACnF,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,GAAG,CACR,WAAW,EACX,YAAY,GAAG,CAAC,SAAS,4DAA4D,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,mBAAuC,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1C,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACtF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAqB,CAAC,CAAC;QACzE,mBAAmB,GAAG,OAAO,EAAE,KAAsC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE;YACT,OAAO;YACP,OAAO,EAAE,GAAG,CAAC,OAA4B;YACzC,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI;YACvC,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB;QACD,OAAO;QACP,cAAc;QACd,GAAG,CAAC,mBAAmB,KAAK,SAAS,IAAI,EAAE,mBAAmB,EAAE,CAAC;QACjE,GAAG,EAAE,IAAI,IAAI,EAAE;KAChB,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AAChD,CAAC;AAED,+CAA+C;AAC/C,SAAS,OAAO,CAAC,CAAM;IACrB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACnE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,cAAc,CAC5B,KAA2C,EAC3C,aAAgC;IAEhC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,SAAS;YACrB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAChB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;IACxE,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAW,EAAE,EAAE,CAAC;IACtF,IAAI,IAAI,KAAK,SAAS;QACpB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,EAAe,EAAE,EAAE,CAAC;IAChF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAC7B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;QACrE,OAAO;YACL,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,EAAe,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SAC5E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,CAAY;IAC7C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,WAAW,EAAE,CAAC,CAAC,WAAuC;QACtD,SAAS,EAAE,CAAC,CAAC,SAAqC;QAClD,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;QAC5D,SAAS,EAAE,CAAC,CAAC,SAA8B;QAC3C,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;QAC/D,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAA+B,EAAE,CAAC;KACrF,CAAC;AACJ,CAAC"}

package/dist/routes/agents.d.ts

@@ -1,9 +1,11 @@
 import { Hono } from 'hono';
 import type { AgentRegistryBinding } from '../agent-binding.js';
 import type { BlockRegistryBinding } from '../block-binding.js';
+import type { AgentReleaseBindings } from '../live-version-binding.js';
 import type { Authorizer } from '../middleware/authorize.js';
 import type { ToolRegistryBinding } from '../tool-binding.js';
 import type { AppEnv } from '../types.js';
+import { type AgentReleaseGateDeps } from './agent-releases.js';
 /**
  * Agents resource routes.
  *
@@ -21,5 +23,9 @@ import type { AppEnv } from '../types.js';
  * matches no published version refuses the publish. Without it,
  * versions carry no pins and resolve their ranges per run.
  */
-export declare function agentsRouter(binding: AgentRegistryBinding, authorizer?: Authorizer, toolRegistry?: ToolRegistryBinding, blockRegistry?: BlockRegistryBinding): Hono<AppEnv>;
+export declare function agentsRouter(binding: AgentRegistryBinding, authorizer?: Authorizer, toolRegistry?: ToolRegistryBinding, blockRegistry?: BlockRegistryBinding, 
+/** Live versions per scope and promotions (evals step 4); absent → those routes aren't mounted. */
+releases?: AgentReleaseBindings, 
+/** What a promotion's gate reads besides the releases (evals step 4b). */
+gateDeps?: AgentReleaseGateDeps): Hono<AppEnv>;
 //# sourceMappingURL=agents.d.ts.map

package/dist/routes/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAY1C,OAAO,KAAK,EAAE,oBAAoB,EAAsB,MAAM,qBAAqB,CAAC;AAEpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAQhE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,oBAAoB,EAC7B,UAAU,CAAC,EAAE,UAAU,EACvB,YAAY,CAAC,EAAE,mBAAmB,EAClC,aAAa,CAAC,EAAE,oBAAoB,GACnC,IAAI,CAAC,MAAM,CAAC,CAgbd"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAY1C,OAAO,KAAK,EAAE,oBAAoB,EAAsB,MAAM,qBAAqB,CAAC;AAEpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAQhE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,KAAK,oBAAoB,EAI1B,MAAM,qBAAqB,CAAC;AAK7B;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,oBAAoB,EAC7B,UAAU,CAAC,EAAE,UAAU,EACvB,YAAY,CAAC,EAAE,mBAAmB,EAClC,aAAa,CAAC,EAAE,oBAAoB;AACpC,mGAAmG;AACnG,QAAQ,CAAC,EAAE,oBAAoB;AAC/B,0EAA0E;AAC1E,QAAQ,CAAC,EAAE,oBAAoB,GAC9B,IAAI,CAAC,MAAM,CAAC,CAmdd"}

package/dist/routes/agents.js

@@ -6,6 +6,9 @@ import { ref, tuplesForCreate } from '@kindgi/authz';
 import { resolveAgentPins } from '../agent-pins.js';
 import { deriveAgentVersion, nextFreeAgentVersion, } from '../derive-agent-version.js';
 import { statusFor, toWireError } from '../errors.js';
+import { refuseWritesWhenReadOnly } from '../registry-read-only.js';
+import { isPromotionCheck, isPromotionWrite, mountAgentReleaseRoutes, } from './agent-releases.js';
+import { liveScopeToWire } from './live-scope-wire.js';
 import { clampLimit } from './pagination.js';
 import { parseScopeParams } from './scope-params.js';
 /**
@@ -25,8 +28,15 @@ import { parseScopeParams } from './scope-params.js';
  * matches no published version refuses the publish. Without it,
  * versions carry no pins and resolve their ranges per run.
  */
-export function agentsRouter(binding, authorizer, toolRegistry, blockRegistry) {
+export function agentsRouter(binding, authorizer, toolRegistry, blockRegistry, 
+/** Live versions per scope and promotions (evals step 4); absent → those routes aren't mounted. */
+releases, 
+/** What a promotion's gate reads besides the releases (evals step 4b). */
+gateDeps) {
     const r = new Hono();
+    // A read-only registry (under `kindgi dev`, the pack's files) refuses
+    // every write before anything else runs.
+    r.use('*', refuseWritesWhenReadOnly(() => binding.readOnly));
     // Authorization — check the resource directly (ref('agent', businessId));
     // permissions cascade from the parent project because the
     // AgentRegistryBinding's `publish` writes the `agent:X#parent@project:Y`
@@ -37,6 +47,9 @@ export function agentsRouter(binding, authorizer, toolRegistry, blockRegistry) {
     //   POST /:agentId/versions                        → publish on the agent (derive)
     //   POST /:agentId/versions/:version/unregister    → admin on the agent
     //   POST /:agentId/versions/:version/reinstate     → admin on the agent
+    //   POST /:agentId/promotions, /live/rollback, /live/unpin → promote on the agent
+    //   POST /:agentId/promotions/check                → read on the agent (changes nothing)
+    //   GET /:agentId/live, /live-versions, /promotions[/…]    → read on the agent
     //   GET / (list)                                   → tenant-scoped fetch;
     //                                                    with a project scope
     //                                                    (?scopeKind=project&scopeId=),
@@ -78,8 +91,15 @@ export function agentsRouter(binding, authorizer, toolRegistry, blockRegistry) {
         });
         r.use('/:agentId/*', async (c, next) => {
             // Deriving a version (POST …/versions) is `publish` on the agent;
-            // unregister and reinstate are `admin`.
-            const action = c.req.method === 'GET' ? 'read' : c.req.path.endsWith('/versions') ? 'publish' : 'admin';
+            // changing what's live is its own permission (`promote`, granted to
+            // the agent's admins); unregister and reinstate are `admin`.
+            const action = c.req.method === 'GET' || isPromotionCheck(c.req.method, c.req.path)
+                ? 'read'
+                : isPromotionWrite(c.req.method, c.req.path)
+                    ? 'promote'
+                    : c.req.path.endsWith('/versions')
+                        ? 'publish'
+                        : 'admin';
             const agentId = c.req.param('agentId') ?? '';
             const mw = authorizer.authorize(action, () => ref('agent', agentId));
             return mw(c, next);
@@ -250,7 +270,7 @@ export function agentsRouter(binding, authorizer, toolRegistry, blockRegistry) {
                 c.status(statusFor('invalid-agent'));
                 return c.json(toWireError({
                     code: 'validation-failed',
-                    message: `Agent "${defined.value.id}" uses tool versions that aren't published (${resolved.issues.length} issue${resolved.issues.length === 1 ? '' : 's'})`,
+                    message: `Agent "${defined.value.id}" uses tool or data-block versions it can't pin (${resolved.issues.length} issue${resolved.issues.length === 1 ? '' : 's'})`,
                     issues: resolved.issues,
                 }, requestId));
             }
@@ -328,6 +348,16 @@ export function agentsRouter(binding, authorizer, toolRegistry, blockRegistry) {
         const agentId = c.req.param('agentId');
         const version = c.req.param('version');
         const outcome = await binding.unregister({ tenantId, agentId, version });
+        if (!outcome.unregistered && outcome.live !== undefined && outcome.live.length > 0) {
+            c.status(statusFor('agent-version-live'));
+            return c.json(toWireError({
+                code: 'agent-version-live',
+                message: `${agentId} ${version} is live in ${outcome.live.length === 1 ? 'a scope' : `${outcome.live.length} scopes`}: roll back, unpin, or promote another version there first, then unregister it.`,
+                agentId: agentId,
+                version: version,
+                scopes: outcome.live.map(liveScopeToWire),
+            }, requestId));
+        }
         if (!outcome.unregistered) {
             c.status(statusFor('agent-not-found'));
             return c.json(toWireError({
@@ -370,6 +400,8 @@ export function agentsRouter(binding, authorizer, toolRegistry, blockRegistry) {
             wasTombstoned: outcome.wasTombstoned,
         });
     });
+    if (releases !== undefined)
+        mountAgentReleaseRoutes(r, binding, releases, gateDeps);
     return r;
 }
 /**
@@ -450,6 +482,8 @@ function derived(c, agentId, from, outcome) {
         case 'ok':
             c.status(201);
             return c.json(serializeAgent(outcome.agent));
+        case 'reused':
+            return c.json(serializeAgent(outcome.agent));
         case 'not-found':
             return fail('agent-not-found', {
                 code: 'agent-not-found',