@kindgi/api 0.1.4-rc.0 → 0.1.4-rc.2

package/dist/routes/gate-policies.js

@@ -0,0 +1,191 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Hono } from 'hono';
+import { ref } from '@kindgi/authz';
+import { statusFor, toWireError } from '../errors.js';
+import { scopeFromQuery } from './agent-releases.js';
+import { parseGatePolicySpec } from './gate-policy-spec.js';
+import { serializeGatePolicy } from './gate-policy-wire.js';
+import { parseLiveScopeBody } from './live-scope-wire.js';
+import { clampLimit } from './pagination.js';
+const SEMVER_RE = /^\d+\.\d+\.\d+$/;
+const ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+/**
+ * Gate policies (evals step 4b): what a promotion of an agent must show
+ * before a version goes live for a scope. The same registry shape as
+ * retention policies:
+ *   GET  /                                      each policy's latest active version (?agentId=, scope)
+ *   GET  /:policyId                             its latest active version
+ *   GET  /:policyId/versions[/:version]         every version, or one
+ *   POST /                                      publish {id, version, agentId, scope, spec, description?}
+ *   POST /:policyId/versions/:version/unregister|reinstate
+ *
+ * Writes need `admin` on the tenant: whoever may promote mustn't be able
+ * to loosen the gate on their own promotion.
+ */
+export function gatePoliciesRouter(binding, authorizer) {
+    const r = new Hono();
+    if (authorizer !== undefined) {
+        r.use('*', async (c, next) => {
+            if (c.req.method !== 'POST')
+                return next();
+            const tenantId = c.get('tenantId');
+            return authorizer.authorize('admin', () => ref('tenant', tenantId))(c, next);
+        });
+    }
+    r.get('/', async (c) => {
+        const requestId = c.get('requestId');
+        const scope = scopeFromQuery((n) => c.req.query(n), c.req.queries('segment') ?? []);
+        if (scope.kind === 'err')
+            return badInput(c, requestId, scope.message);
+        const agentId = c.req.query('agentId');
+        const cursor = c.req.query('cursor');
+        const page = await binding.list({
+            tenantId: c.get('tenantId'),
+            limit: clampLimit(c.req.query('limit')),
+            ...(agentId !== undefined && agentId.length > 0 && { agentId }),
+            ...(scope.scope !== undefined && { scope: scope.scope }),
+            ...(cursor !== undefined && cursor.length > 0 && { cursor: cursor }),
+        });
+        return c.json({
+            data: page.data.map(serializeGatePolicy),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    r.get('/:policyId', async (c) => {
+        const found = await binding.get({
+            tenantId: c.get('tenantId'),
+            id: c.req.param('policyId'),
+        });
+        if (found === null)
+            return notFound(c, c.req.param('policyId'));
+        return c.json(serializeGatePolicy(found));
+    });
+    r.get('/:policyId/versions', async (c) => {
+        const versions = await binding.listVersions({
+            tenantId: c.get('tenantId'),
+            id: c.req.param('policyId'),
+        });
+        if (versions.length === 0)
+            return notFound(c, c.req.param('policyId'));
+        return c.json({ data: versions.map(serializeGatePolicy), hasMore: false });
+    });
+    r.get('/:policyId/versions/:version', async (c) => {
+        const found = await binding.getVersion({
+            tenantId: c.get('tenantId'),
+            id: c.req.param('policyId'),
+            version: c.req.param('version'),
+        });
+        if (found === null) {
+            return notFound(c, c.req.param('policyId'), c.req.param('version'));
+        }
+        return c.json(serializeGatePolicy(found));
+    });
+    r.post('/', async (c) => {
+        const requestId = c.get('requestId');
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return badInput(c, requestId, 'Request body must be a JSON object');
+        }
+        const parsed = parsePublishBody(body);
+        if (parsed.kind === 'err') {
+            c.status(statusFor('validation-failed'));
+            return c.json(toWireError({
+                code: 'validation-failed',
+                message: `The gate policy isn't valid: ${parsed.issues.map((i) => `${i.path}: ${i.message}`).join('; ')}`,
+                issues: parsed.issues,
+            }, requestId));
+        }
+        const outcome = await binding.publish({
+            tenantId: c.get('tenantId'),
+            ...parsed.value,
+        });
+        if (outcome.kind === 'err')
+            return failed(c, requestId, outcome.error);
+        c.status(201);
+        return c.json(serializeGatePolicy(outcome.value));
+    });
+    for (const action of ['unregister', 'reinstate']) {
+        r.post(`/:policyId/versions/:version/${action}`, async (c) => {
+            const outcome = await binding[action]({
+                tenantId: c.get('tenantId'),
+                id: c.req.param('policyId'),
+                version: c.req.param('version'),
+            });
+            if (outcome.kind === 'err')
+                return failed(c, c.get('requestId'), outcome.error);
+            return c.json(serializeGatePolicy(outcome.value));
+        });
+    }
+    return r;
+}
+function badInput(c, requestId, message) {
+    c.status(statusFor('bad-input'));
+    return c.json(toWireError({ code: 'bad-input', message }, requestId));
+}
+function notFound(c, policyId, version) {
+    c.status(statusFor('gate-policy-not-found'));
+    return c.json(toWireError({
+        code: 'gate-policy-not-found',
+        message: version === undefined
+            ? `No active gate policy "${policyId}"`
+            : `Gate policy "${policyId}" has no version ${version}`,
+        policyId,
+    }, c.get('requestId')));
+}
+function failed(c, requestId, error) {
+    c.status(statusFor(error.code));
+    return c.json(toWireError({ ...error }, requestId));
+}
+function parsePublishBody(body) {
+    if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+        return { kind: 'err', issues: [{ path: '', message: 'the body must be a JSON object' }] };
+    }
+    const b = body;
+    const issues = [];
+    for (const key of Object.keys(b)) {
+        if (!['id', 'version', 'agentId', 'scope', 'spec', 'description'].includes(key)) {
+            issues.push({ path: `/${key}`, message: `\`${key}\` isn't a gate policy field` });
+        }
+    }
+    if (typeof b.id !== 'string' || !ID_RE.test(b.id)) {
+        issues.push({
+            path: '/id',
+            message: '`id` must be lowercase letters, digits, `.`, `_` or `-` (e.g. "acme.drafting-prod")',
+        });
+    }
+    if (typeof b.version !== 'string' || !SEMVER_RE.test(b.version)) {
+        issues.push({ path: '/version', message: '`version` must be a semver version (e.g. "1.0.0")' });
+    }
+    if (typeof b.agentId !== 'string' || b.agentId === '') {
+        issues.push({ path: '/agentId', message: '`agentId` is required: the agent the policy gates' });
+    }
+    const scope = parseLiveScopeBody(b.scope);
+    if (scope.kind === 'err')
+        issues.push({ path: '/scope', message: scope.message });
+    const spec = parseGatePolicySpec(b.spec);
+    if (spec.kind === 'err')
+        issues.push(...spec.issues);
+    if (b.description !== undefined && (typeof b.description !== 'string' || b.description === '')) {
+        issues.push({ path: '/description', message: '`description` must be a non-empty string' });
+    }
+    if (issues.length > 0 || scope.kind === 'err' || spec.kind === 'err') {
+        return { kind: 'err', issues };
+    }
+    return {
+        kind: 'ok',
+        value: {
+            id: b.id,
+            version: b.version,
+            agentId: b.agentId,
+            scope: scope.scope,
+            spec: spec.spec,
+            ...(typeof b.description === 'string' && { description: b.description }),
+        },
+    };
+}
+//# sourceMappingURL=gate-policies.js.map

package/dist/routes/gate-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-policies.js","sourceRoot":"","sources":["../../src/routes/gate-policies.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAGpC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,MAAM,KAAK,GAAG,8BAA8B,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA0B,EAC1B,UAAuB;IAEvB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC;YACxD,OAAO,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACxD,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAgB,EAAE,CAAC;SAC/E,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACxC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9B,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;YAC1C,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACrC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YAC3B,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,oCAAoC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,gCAAgC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACzG,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACpC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,GAAG,MAAM,CAAC,KAAK;SAChB,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,CAAC,YAAY,EAAE,WAAW,CAAU,EAAE,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC,gCAAgC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC3D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;gBACpC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;gBACvC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC3B,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;aAChC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAChF,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAID,SAAS,QAAQ,CAAC,CAAM,EAAE,SAAiB,EAAE,OAAe;IAC1D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,QAAQ,CAAC,CAAM,EAAE,QAAgB,EAAE,OAAgB;IAC1D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAU,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EACL,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,0BAA0B,QAAQ,GAAG;YACvC,CAAC,CAAC,gBAAgB,QAAQ,oBAAoB,OAAO,EAAE;QAC3D,QAAQ;KACT,EACD,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CACnB,CACF,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,CAAM,EAAE,SAAiB,EAAE,KAAsB;IAC/D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AACtD,CAAC;AAID,SAAS,gBAAgB,CAAC,IAAa;IAMrC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,GAAG,8BAA8B,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK;YACX,OAAO,EACL,qFAAqF;SACxF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/F,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,EAAE,EAAE,CAAC,CAAC,EAAY;YAClB,OAAO,EAAE,CAAC,CAAC,OAAiB;YAC5B,OAAO,EAAE,CAAC,CAAC,OAAiB;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;SACzE;KACF,CAAC;AACJ,CAAC"}

package/dist/routes/gate-policy-spec.d.ts

@@ -0,0 +1,17 @@
+import { type GatePolicySpec } from '../gate-policy-binding.js';
+/**
+ * A gate policy's `spec`, checked strictly: an unknown key is an issue, so
+ * a typo can't leave a check silently off.
+ */
+export interface SpecIssue {
+    readonly path: string;
+    readonly message: string;
+}
+export declare function parseGatePolicySpec(raw: unknown): {
+    kind: 'ok';
+    spec: GatePolicySpec;
+} | {
+    kind: 'err';
+    issues: readonly SpecIssue[];
+};
+//# sourceMappingURL=gate-policy-spec.d.ts.map

package/dist/routes/gate-policy-spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-policy-spec.d.ts","sourceRoot":"","sources":["../../src/routes/gate-policy-spec.ts"],"names":[],"mappings":"AAKA,OAAO,EAAqC,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEnG;;;GAGG;AAEH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AA2ED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,OAAO,GACX;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAA;CAAE,CAwItF"}

package/dist/routes/gate-policy-spec.js

@@ -0,0 +1,192 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { REVIEWER_ROLE_RANK } from '@kindgi/authz';
+import { GATE_METRICS } from '../gate-policy-binding.js';
+const REVIEWER_ROLES = Object.keys(REVIEWER_ROLE_RANK);
+const isObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+/** Keys the policy may not use yet, with why. */
+const LATER = {
+    '/spec/approvals/count': 'one reviewer decides a promotion today; leave `count` out',
+    '/spec/approvals/forRollback': "rollbacks aren't gated yet; leave `forRollback` out",
+};
+function unknownKeys(raw, allowed, at, issues) {
+    for (const key of Object.keys(raw)) {
+        if (allowed.includes(key))
+            continue;
+        const path = `${at}/${key}`;
+        issues.push({
+            path,
+            message: LATER[path] ??
+                `\`${key}\` isn't a gate policy setting here (expected: ${allowed.join(', ')})`,
+        });
+    }
+}
+/** A number in [min, max], when present. */
+function num(raw, key, at, issues, opts) {
+    const v = raw[key];
+    if (v === undefined)
+        return undefined;
+    const ok = typeof v === 'number' &&
+        Number.isFinite(v) &&
+        v >= opts.min &&
+        (opts.max === undefined || v <= opts.max) &&
+        (opts.integer !== true || Number.isInteger(v)) &&
+        (opts.positive !== true || v > 0);
+    if (!ok) {
+        const range = opts.max === undefined ? `at least ${opts.min}` : `${opts.min} to ${opts.max}`;
+        issues.push({
+            path: `${at}/${key}`,
+            message: `\`${key}\` must be ${opts.integer === true ? 'a whole number' : 'a number'}, ${opts.positive === true ? 'above 0' : range}`,
+        });
+        return undefined;
+    }
+    return v;
+}
+function bool(raw, key, at, issues) {
+    const v = raw[key];
+    if (v === undefined)
+        return undefined;
+    if (typeof v !== 'boolean') {
+        issues.push({ path: `${at}/${key}`, message: `\`${key}\` must be true or false` });
+        return undefined;
+    }
+    return v;
+}
+function block(raw, key, issues) {
+    const v = raw[key];
+    if (v === undefined)
+        return undefined;
+    if (!isObject(v)) {
+        issues.push({ path: `/spec/${key}`, message: `\`${key}\` must be an object` });
+        return undefined;
+    }
+    return v;
+}
+export function parseGatePolicySpec(raw) {
+    if (!isObject(raw)) {
+        return { kind: 'err', issues: [{ path: '/spec', message: '`spec` must be an object' }] };
+    }
+    const issues = [];
+    unknownKeys(raw, ['comparison', 'evidence', 'metrics', 'replay', 'approvals', 'onlyRestrictedClasses'], '/spec', issues);
+    const spec = {};
+    const comparison = block(raw, 'comparison', issues);
+    if (comparison !== undefined) {
+        const at = '/spec/comparison';
+        unknownKeys(comparison, ['maxAgeHours', 'suite'], at, issues);
+        const maxAgeHours = num(comparison, 'maxAgeHours', at, issues, { min: 0, positive: true });
+        let suite;
+        if (comparison.suite !== undefined) {
+            const s = comparison.suite;
+            if (!isObject(s) || typeof s.id !== 'string' || s.id === '') {
+                issues.push({ path: `${at}/suite`, message: '`suite` must be `{ id, version? }`' });
+            }
+            else {
+                unknownKeys(s, ['id', 'version'], `${at}/suite`, issues);
+                if (s.version !== undefined && (typeof s.version !== 'string' || s.version === '')) {
+                    issues.push({ path: `${at}/suite/version`, message: '`version` must be a version' });
+                }
+                suite = { id: s.id, ...(typeof s.version === 'string' && { version: s.version }) };
+            }
+        }
+        spec.comparison = {
+            ...(maxAgeHours !== undefined && { maxAgeHours }),
+            ...(suite !== undefined && { suite }),
+        };
+    }
+    const evidence = block(raw, 'evidence', issues);
+    if (evidence !== undefined) {
+        const at = '/spec/evidence';
+        unknownKeys(evidence, ['minCases', 'minWeight'], at, issues);
+        const minCases = num(evidence, 'minCases', at, issues, { min: 0, integer: true });
+        const minWeight = num(evidence, 'minWeight', at, issues, { min: 0 });
+        spec.evidence = {
+            ...(minCases !== undefined && { minCases }),
+            ...(minWeight !== undefined && { minWeight }),
+        };
+    }
+    if (raw.metrics !== undefined) {
+        if (!Array.isArray(raw.metrics)) {
+            issues.push({ path: '/spec/metrics', message: '`metrics` must be a list' });
+        }
+        else {
+            const metrics = [];
+            const seen = new Set();
+            raw.metrics.forEach((m, i) => {
+                const at = `/spec/metrics/${i}`;
+                const before = issues.length;
+                if (!isObject(m)) {
+                    issues.push({ path: at, message: 'each metric must be an object' });
+                    return;
+                }
+                unknownKeys(m, ['name', 'k', 'minCandidate', 'maxDrop'], at, issues);
+                const name = m.name;
+                if (typeof name !== 'string' || !GATE_METRICS.includes(name)) {
+                    issues.push({
+                        path: `${at}/name`,
+                        message: `\`name\` must be one of: ${GATE_METRICS.join(', ')}`,
+                    });
+                    return;
+                }
+                if (seen.has(name)) {
+                    issues.push({ path: `${at}/name`, message: `\`${name}\` is gated twice` });
+                    return;
+                }
+                seen.add(name);
+                if (m.k !== undefined && name !== 'weightedPrecisionAtK') {
+                    issues.push({ path: `${at}/k`, message: '`k` applies to `weightedPrecisionAtK` only' });
+                }
+                const k = num(m, 'k', at, issues, { min: 1, max: 100, integer: true });
+                const minCandidate = num(m, 'minCandidate', at, issues, { min: 0, max: 1 });
+                const maxDrop = num(m, 'maxDrop', at, issues, { min: 0, max: 1 });
+                if (minCandidate === undefined && maxDrop === undefined && issues.length === before) {
+                    issues.push({
+                        path: at,
+                        message: `\`${name}\` needs \`minCandidate\`, \`maxDrop\` or both: what it must reach`,
+                    });
+                }
+                metrics.push({
+                    name: name,
+                    ...(k !== undefined && { k }),
+                    ...(minCandidate !== undefined && { minCandidate }),
+                    ...(maxDrop !== undefined && { maxDrop }),
+                });
+            });
+            spec.metrics = metrics;
+        }
+    }
+    const replay = block(raw, 'replay', issues);
+    if (replay !== undefined) {
+        const at = '/spec/replay';
+        const knobs = ['maxDiverged', 'maxErrors', 'maxRefusedWrites', 'maxStopped'];
+        unknownKeys(replay, knobs, at, issues);
+        const out = {};
+        for (const knob of knobs) {
+            const v = num(replay, knob, at, issues, { min: 0, integer: true });
+            if (v !== undefined)
+                out[knob] = v;
+        }
+        spec.replay = out;
+    }
+    const approvals = block(raw, 'approvals', issues);
+    if (approvals !== undefined) {
+        const at = '/spec/approvals';
+        unknownKeys(approvals, ['role', 'separateApprover'], at, issues);
+        const role = approvals.role;
+        if (role !== undefined && !REVIEWER_ROLES.includes(role)) {
+            issues.push({
+                path: `${at}/role`,
+                message: `\`role\` must be one of: ${REVIEWER_ROLES.join(', ')}`,
+            });
+        }
+        const separateApprover = bool(approvals, 'separateApprover', at, issues);
+        spec.approvals = {
+            ...(typeof role === 'string' && { role: role }),
+            ...(separateApprover !== undefined && { separateApprover }),
+        };
+    }
+    const onlyRestricted = bool(raw, 'onlyRestrictedClasses', '/spec', issues);
+    if (onlyRestricted !== undefined)
+        spec.onlyRestrictedClasses = onlyRestricted;
+    return issues.length > 0 ? { kind: 'err', issues } : { kind: 'ok', spec };
+}
+//# sourceMappingURL=gate-policy-spec.js.map

package/dist/routes/gate-policy-spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-policy-spec.js","sourceRoot":"","sources":["../../src/routes/gate-policy-spec.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,kBAAkB,EAAqB,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,YAAY,EAA4C,MAAM,2BAA2B,CAAC;AAcnG,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAA4B,CAAC;AAElF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpG,iDAAiD;AACjD,MAAM,KAAK,GAAqC;IAC9C,uBAAuB,EAAE,2DAA2D;IACpF,6BAA6B,EAAE,qDAAqD;CACrF,CAAC;AAEF,SAAS,WAAW,CAAC,GAAQ,EAAE,OAA0B,EAAE,EAAU,EAAE,MAAmB;IACxF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI;YACJ,OAAO,EACL,KAAK,CAAC,IAAI,CAAC;gBACX,KAAK,GAAG,kDAAkD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAClF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,4CAA4C;AAC5C,SAAS,GAAG,CACV,GAAQ,EACR,GAAW,EACX,EAAU,EACV,MAAmB,EACnB,IAA0E;IAE1E,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,EAAE,GACN,OAAO,CAAC,KAAK,QAAQ;QACrB,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClB,CAAC,IAAI,IAAI,CAAC,GAAG;QACb,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC;QACzC,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7F,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE;YACpB,OAAO,EAAE,KAAK,GAAG,cAAc,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE;SACtI,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CAAW,CAAC;AACrB,CAAC;AAED,SAAS,IAAI,CAAC,GAAQ,EAAE,GAAW,EAAE,EAAU,EAAE,MAAmB;IAClE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,GAAG,0BAA0B,EAAE,CAAC,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,KAAK,CAAC,GAAQ,EAAE,GAAW,EAAE,MAAmB;IACvD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,GAAG,sBAAsB,EAAE,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,GAAY;IAEZ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,WAAW,CACT,GAAG,EACH,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,CAAC,EACrF,OAAO,EACP,MAAM,CACP,CAAC;IACF,MAAM,IAAI,GAEN,EAAE,CAAC;IAEP,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,kBAAkB,CAAC;QAC9B,WAAW,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,IAAI,KAAmD,CAAC;QACxD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC5D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACzD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;oBACnF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,KAAK,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACrF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,GAAG;YAChB,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,gBAAgB,CAAC;QAC5B,WAAW,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,GAAG;YACd,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC3C,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAqB,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAU,EAAE,CAAS,EAAE,EAAE;gBAC5C,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC;gBAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,WAAW,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;gBACrE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAE,YAAkC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpF,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,GAAG,EAAE,OAAO;wBAClB,OAAO,EAAE,4BAA4B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBAC/D,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,mBAAmB,EAAE,CAAC,CAAC;oBAC3E,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;oBACzD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;gBAC1F,CAAC;gBACD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvE,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC5E,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAClE,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBACpF,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,EAAE;wBACR,OAAO,EAAE,KAAK,IAAI,oEAAoE;qBACvF,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,IAA8B;oBACpC,GAAG,CAAC,CAAC,KAAK,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC7B,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;oBACnD,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;iBAC1C,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,cAAc,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,kBAAkB,EAAE,YAAY,CAAU,CAAC;QACtF,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,GAAG,GAAyD,EAAE,CAAC;QACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,iBAAiB,CAAC;QAC7B,WAAW,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAE,cAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG,EAAE,OAAO;gBAClB,OAAO,EAAE,4BAA4B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS,GAAG;YACf,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,EAAE,IAAI,EAAE,IAAoB,EAAE,CAAC;YAC/D,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3E,IAAI,cAAc,KAAK,SAAS;QAAE,IAAI,CAAC,qBAAqB,GAAG,cAAc,CAAC;IAE9E,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5E,CAAC"}

package/dist/routes/gate-policy-wire.d.ts

@@ -0,0 +1,3 @@
+import type { GatePolicy } from '../gate-policy-binding.js';
+export declare function serializeGatePolicy(p: GatePolicy): Record<string, unknown>;
+//# sourceMappingURL=gate-policy-wire.d.ts.map

package/dist/routes/gate-policy-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-policy-wire.d.ts","sourceRoot":"","sources":["../../src/routes/gate-policy-wire.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAG5D,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAa1E"}

package/dist/routes/gate-policy-wire.js

@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { liveScopeToWire } from './live-scope-wire.js';
+export function serializeGatePolicy(p) {
+    return {
+        id: p.id,
+        version: p.version,
+        agentId: p.agentId,
+        scope: liveScopeToWire(p.scope),
+        spec: p.spec,
+        ...(p.description !== undefined && { description: p.description }),
+        createdAt: p.createdAt,
+        ...(p.unregisteredAt !== undefined && {
+            unregisteredAt: p.unregisteredAt,
+        }),
+    };
+}
+//# sourceMappingURL=gate-policy-wire.js.map

package/dist/routes/gate-policy-wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-policy-wire.js","sourceRoot":"","sources":["../../src/routes/gate-policy-wire.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAGjC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,UAAU,mBAAmB,CAAC,CAAa;IAC/C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,SAAS,EAAE,CAAC,CAAC,SAA8B;QAC3C,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI;YACpC,cAAc,EAAE,CAAC,CAAC,cAAmC;SACtD,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/routes/guardrails.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../src/routes/guardrails.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAU,WAAW,EAAa,QAAQ,EAAU,MAAM,eAAe,CAAC;AAGtF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C;;;;;;;;;;;;GAYG;AACH;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CAAC;CAC1C,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3B,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,wBAAwB,EACjC,UAAU,CAAC,EAAE,UAAU,EACvB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,IAAI,CAAC,MAAM,CAAC,CAgQd"}
+{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../src/routes/guardrails.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAU,WAAW,EAAa,QAAQ,EAAU,MAAM,eAAe,CAAC;AAGtF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C;;;;;;;;;;;;GAYG;AACH;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CAAC;CAC1C,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3B,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,wBAAwB,EACjC,UAAU,CAAC,EAAE,UAAU,EACvB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,IAAI,CAAC,MAAM,CAAC,CAsQd"}

package/dist/routes/guardrails.js

@@ -4,10 +4,14 @@ import { Hono } from 'hono';
 import { ref, tuplesForCreate } from '@kindgi/authz';
 import { validateGuardrailSpec } from '@kindgi/guardrails';
 import { statusFor, toWireError } from '../errors.js';
+import { refuseWritesWhenReadOnly } from '../registry-read-only.js';
 import { clampLimit } from './pagination.js';
 import { parseScopeParams } from './scope-params.js';
 export function guardrailsRouter(binding, authorizer, onWrite) {
     const r = new Hono();
+    // A read-only registry (under `kindgi dev`, the pack's files) refuses
+    // every write before anything else runs.
+    r.use('*', refuseWritesWhenReadOnly(() => binding.readOnly));
     // Authorization (PEP) — mirrors agents. Cascade via `guardrail#parent@project`
     // written in-tx by register; direct check via `ref('guardrail', id)`.
     if (authorizer !== undefined) {

package/dist/routes/guardrails.js.map

@@ -1 +1 @@
-{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/routes/guardrails.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAkB,GAAG,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAkB,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAG3E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA6BrD,MAAM,UAAU,gBAAgB,CAC9B,OAAiC,EACjC,UAAuB,EACvB,OAA4B;IAE5B,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,+EAA+E;IAC/E,sEAAsE;IACtE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;YAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClD,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAChC,MAAM,GAAG,GACP,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;wBACvC,CAAC,CAAE,IAAgC,CAAC,SAAS;wBAC7C,CAAC,CAAC,SAAS,CAAC;oBAChB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;wBAAE,OAAO,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAC5E,CAAC;gBAAC,MAAM,CAAC;oBACP,uCAAuC;gBACzC,CAAC;gBACD,OAAO,GAAG,CAAC,QAAQ,EAAE,QAA6B,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,+DAA+D;YAC/D,gDAAgD;YAChD,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAChD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,EAAE,CAAC;YAClE,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,SAA8B,CAAC;YAC9D,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACzD,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACvC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAU,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ;YACR,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;YACvF,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAC3E,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;YACpE,GAAG,CAAC,WAAW,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;SAC3E,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACvC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAgB,CAAC;QAE9D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAU,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,oCAAoC,WAAgC,GAAG;gBAChF,WAAW,EAAE,WAAgC;aAC9C,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QAED,4CAA4C;QAC5C,kEAAkE;QAClE,8DAA8D;QAC9D,kEAAkE;QAClE,6DAA6D;QAC7D,uBAAuB;QACvB,MAAM,OAAO,GAAG,IAA+B,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;QACvC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,SAAS,CAAC,CAClF,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,YAAyB,CAAC;QAC5C,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,GAAG,OAAO,CAAC;QAE7D,MAAM,SAAS,GAAG,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;QAC9D,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO;gBAChC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAA8C;aACvE,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;QAC9D,MAAM,aAAa,GACjB,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAE,SAAS,CAAC,KAAK,CAAC,EAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;YACrC,QAAQ;YACR,SAAS;YACT,SAAS,EAAE,SAAS,CAAC,KAAK;YAC1B,aAAa,EAAE,CAAC,WAAW,EAAE,EAAE,CAC7B,eAAe,CACb,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,WAA0B,EAAE,QAAQ,EAAE,SAAS,EAAE,EAC1E,aAAa,CACd;SACJ,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC1C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,8BAA8B,CAAU,CAAC,CAAC;YAC7D,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,cAAc,OAAO,CAAC,WAAgC,yBAAyB;gBACxF,WAAW,EAAE,OAAO,CAAC,WAAgC;aACtD,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACzC,6DAA6D;YAC7D,gEAAgE;YAChE,+DAA+D;YAC/D,2DAA2D;YAC3D,4DAA4D;YAC5D,mDAAmD;YACnD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,kBAAkB,OAAO,CAAC,SAA8B,gDAAgD;aAClH,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC;oBACZ,QAAQ;oBACR,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,IAAI,EAAE,UAAU;iBACjB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;gBAC3D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,oBAAoB;YACtB,CAAC;QACH,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,OAAO,CAAC,WAAgC;SACtD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAgB,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAU,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,iBAAiB,WAAgC,iBAAiB;gBAC3E,WAAW,EAAE,WAAgC;aAC9C,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,WAAgC;YAC7C,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAY;IACtC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAuB;QAC7B,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzD,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,CAAC,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;KACrF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/routes/guardrails.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAkB,GAAG,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAkB,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAG3E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA6BrD,MAAM,UAAU,gBAAgB,CAC9B,OAAiC,EACjC,UAAuB,EACvB,OAA4B;IAE5B,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAC7B,sEAAsE;IACtE,yCAAyC;IACzC,CAAC,CAAC,GAAG,CACH,GAAG,EACH,wBAAwB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CACjD,CAAC;IAEF,+EAA+E;IAC/E,sEAAsE;IACtE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;YAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClD,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAChC,MAAM,GAAG,GACP,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;wBACvC,CAAC,CAAE,IAAgC,CAAC,SAAS;wBAC7C,CAAC,CAAC,SAAS,CAAC;oBAChB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;wBAAE,OAAO,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAC5E,CAAC;gBAAC,MAAM,CAAC;oBACP,uCAAuC;gBACzC,CAAC;gBACD,OAAO,GAAG,CAAC,QAAQ,EAAE,QAA6B,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,+DAA+D;YAC/D,gDAAgD;YAChD,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAChD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,EAAE,CAAC;YAClE,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,SAA8B,CAAC;YAC9D,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACzD,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACvC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAU,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ;YACR,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;YACvF,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAC3E,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;YACpE,GAAG,CAAC,WAAW,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;SAC3E,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACvC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAgB,CAAC;QAE9D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAU,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,oCAAoC,WAAgC,GAAG;gBAChF,WAAW,EAAE,WAAgC;aAC9C,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QAED,4CAA4C;QAC5C,kEAAkE;QAClE,8DAA8D;QAC9D,kEAAkE;QAClE,6DAA6D;QAC7D,uBAAuB;QACvB,MAAM,OAAO,GAAG,IAA+B,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;QACvC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,SAAS,CAAC,CAClF,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,YAAyB,CAAC;QAC5C,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,GAAG,OAAO,CAAC;QAE7D,MAAM,SAAS,GAAG,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;QAC9D,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO;gBAChC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAA8C;aACvE,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;QAC9D,MAAM,aAAa,GACjB,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAE,SAAS,CAAC,KAAK,CAAC,EAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;YACrC,QAAQ;YACR,SAAS;YACT,SAAS,EAAE,SAAS,CAAC,KAAK;YAC1B,aAAa,EAAE,CAAC,WAAW,EAAE,EAAE,CAC7B,eAAe,CACb,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,WAA0B,EAAE,QAAQ,EAAE,SAAS,EAAE,EAC1E,aAAa,CACd;SACJ,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC1C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,8BAA8B,CAAU,CAAC,CAAC;YAC7D,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,cAAc,OAAO,CAAC,WAAgC,yBAAyB;gBACxF,WAAW,EAAE,OAAO,CAAC,WAAgC;aACtD,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACzC,6DAA6D;YAC7D,gEAAgE;YAChE,+DAA+D;YAC/D,2DAA2D;YAC3D,4DAA4D;YAC5D,mDAAmD;YACnD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,kBAAkB,OAAO,CAAC,SAA8B,gDAAgD;aAClH,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC;oBACZ,QAAQ;oBACR,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,IAAI,EAAE,UAAU;iBACjB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;gBAC3D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,oBAAoB;YACtB,CAAC;QACH,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,OAAO,CAAC,WAAgC;SACtD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAgB,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAU,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,iBAAiB,WAAgC,iBAAiB;gBAC3E,WAAW,EAAE,WAAgC;aAC9C,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,WAAgC;YAC7C,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAY;IACtC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAuB;QAC7B,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzD,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,CAAC,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;KACrF,CAAC;AACJ,CAAC"}

package/dist/routes/hierarchy-errors.d.ts

@@ -27,9 +27,30 @@ export declare function orgDeleteSlugConflictError(slugs: readonly string[]): {
     readonly resource: "project";
     readonly slugs: readonly string[];
 };
+/**
+ * `404 org-not-found`: the org a project or team would be in isn't the
+ * tenant's (it never existed, or it was deleted). The code and message
+ * `GET /v1/orgs/{id}` answers (T220).
+ */
+export declare function orgNotFoundError(orgId: string): {
+    readonly code: "org-not-found";
+    readonly message: `No org with id "${string}"`;
+    readonly orgId: string;
+};
 /** `409 project-default-already-exists`: the tenant has a Default project. */
 export declare function projectDefaultAlreadyExistsError(): {
     readonly code: "project-default-already-exists";
     readonly message: "The tenant already has a Default project";
 };
+/**
+ * `501 authz-membership-unsupported`: authorization is enforced, but the
+ * tenant-hierarchy binding can't change a membership together with its
+ * authorization tuple (it has no `method`). Nothing is changed: removing
+ * the row alone would leave the user's permission in place.
+ */
+export declare function membershipNotKeptInStepError(method: string): {
+    readonly code: "authz-membership-unsupported";
+    readonly message: `This runtime can't keep permissions in step with a membership change (its tenant-hierarchy binding has no ${string}), so nothing was changed.`;
+    readonly method: string;
+};
 //# sourceMappingURL=hierarchy-errors.d.ts.map

package/dist/routes/hierarchy-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hierarchy-errors.d.ts","sourceRoot":"","sources":["../../src/routes/hierarchy-errors.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AAEH,wDAAwD;AACxD,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM;;;;;EAU1E;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE;;;;;EAQlE;AAED,8EAA8E;AAC9E,wBAAgB,gCAAgC;;;EAK/C"}
+{"version":3,"file":"hierarchy-errors.d.ts","sourceRoot":"","sources":["../../src/routes/hierarchy-errors.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AAEH,wDAAwD;AACxD,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM;;;;;EAU1E;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE;;;;;EAQlE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM;;;;EAE7C;AAED,8EAA8E;AAC9E,wBAAgB,gCAAgC;;;EAK/C;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM;;;;EAM1D"}

package/dist/routes/hierarchy-errors.js

@@ -29,6 +29,14 @@ export function orgDeleteSlugConflictError(slugs) {
         slugs,
     };
 }
+/**
+ * `404 org-not-found`: the org a project or team would be in isn't the
+ * tenant's (it never existed, or it was deleted). The code and message
+ * `GET /v1/orgs/{id}` answers (T220).
+ */
+export function orgNotFoundError(orgId) {
+    return { code: 'org-not-found', message: `No org with id "${orgId}"`, orgId };
+}
 /** `409 project-default-already-exists`: the tenant has a Default project. */
 export function projectDefaultAlreadyExistsError() {
     return {
@@ -36,4 +44,17 @@ export function projectDefaultAlreadyExistsError() {
         message: 'The tenant already has a Default project',
     };
 }
+/**
+ * `501 authz-membership-unsupported`: authorization is enforced, but the
+ * tenant-hierarchy binding can't change a membership together with its
+ * authorization tuple (it has no `method`). Nothing is changed: removing
+ * the row alone would leave the user's permission in place.
+ */
+export function membershipNotKeptInStepError(method) {
+    return {
+        code: 'authz-membership-unsupported',
+        message: `This runtime can't keep permissions in step with a membership change (its tenant-hierarchy binding has no ${method}), so nothing was changed.`,
+        method,
+    };
+}
 //# sourceMappingURL=hierarchy-errors.js.map

package/dist/routes/hierarchy-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"hierarchy-errors.js","sourceRoot":"","sources":["../../src/routes/hierarchy-errors.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAWjC;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA2B,EAAE,IAAY;IACzE,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,EACL,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,4CAA4C,IAAI,+DAA+D;YACjH,CAAC,CAAC,WAAW,QAAQ,gCAAgC,IAAI,GAAG;QAChE,QAAQ;QACR,IAAI;KACI,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAwB;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,6CAA6C,KAAK,4FAA4F;QACvJ,QAAQ,EAAE,SAAS;QACnB,KAAK;KACG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,0CAA0C;KAC3C,CAAC;AACb,CAAC"}
+{"version":3,"file":"hierarchy-errors.js","sourceRoot":"","sources":["../../src/routes/hierarchy-errors.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAWjC;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA2B,EAAE,IAAY;IACzE,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,EACL,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,4CAA4C,IAAI,+DAA+D;YACjH,CAAC,CAAC,WAAW,QAAQ,gCAAgC,IAAI,GAAG;QAChE,QAAQ;QACR,IAAI;KACI,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAwB;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,6CAA6C,KAAK,4FAA4F;QACvJ,QAAQ,EAAE,SAAS;QACnB,KAAK;KACG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,KAAK,GAAG,EAAE,KAAK,EAAW,CAAC;AACzF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,0CAA0C;KAC3C,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,6GAA6G,MAAM,4BAA4B;QACxJ,MAAM;KACE,CAAC;AACb,CAAC"}