@stigmer/server-slim 0.1.0 → 0.1.1

package/main.js

@@ -697,7 +697,7 @@ parentPort.on("message", (job) => {
 `)}async frame(event,data){if(this.frameNow(event,data))return;this.draining=!0;let emitter=this.response;await new Promise(resolve=>{let done=()=>{emitter.off("drain",done),emitter.off("close",done),resolve()};emitter.on("drain",done),emitter.on("close",done)}),this.draining=!1}frameNow(event,data){return this.gone()?!0:this.body.write(`event: ${event}
 data: ${data}
 
-`)}gone(){return this.closed.aborted||this.response.writableEnded}};var MANAGED_AGENTS_VERSION="managed-agents-2026-04-01",SERVED_MANAGED_AGENTS_VERSIONS=new Set([MANAGED_AGENTS_VERSION]),MANAGED_AGENTS_BETA_PREFIX="managed-agents-";function selectManagedAgentsVersion(header){let named=(header??"").split(",").map(beta=>beta.trim()).filter(beta=>beta.startsWith(MANAGED_AGENTS_BETA_PREFIX));if(named.length===0)return{served:!0,version:MANAGED_AGENTS_VERSION};let unserved=named.find(beta=>!SERVED_MANAGED_AGENTS_VERSIONS.has(beta));return unserved!==void 0?{served:!1,message:`this server serves ${MANAGED_AGENTS_VERSION}, not ${unserved}`}:{served:!0,version:named[0]??MANAGED_AGENTS_VERSION}}var ROUTE_SHAPES={events:`${MANAGED_AGENTS_PATH_PREFIX}{id}/events`,stream:`${MANAGED_AGENTS_PATH_PREFIX}{id}/events/stream`},REQUEST_ID_PREFIX="req";function createManagedAgentsLane(options){let clients={sessionQuery:createClient(SessionQueryController,options.transport),sessionCommand:createClient(SessionCommandController,options.transport),runCommand:createClient(RunCommandController,options.transport),fileQuery:createClient(FileQueryController,options.transport)},now=options.now??Date.now,keepAliveMs=options.keepAliveMs??STREAM_KEEPALIVE_MS;return(request3,response)=>{let startedAt=performance.now(),requestId=generateId(REQUEST_ID_PREFIX),path17=(request3.url??"").split("?",1)[0]??"",route=routeOf(path17),fields2={method:request3.method??"",route:route===void 0?"unknown":ROUTE_SHAPES[route.kind],requestId};serve(request3,response,route,requestId,{clients,now,keepAliveMs,...options}).then(status=>{let logged={...fields2,status,durationMs:Math.round(performance.now()-startedAt)};status>=500?options.logger.error("managed agents lane request failed",logged):status===404?options.logger.debug("managed agents lane request found nothing",logged):status>=400?options.logger.warn("managed agents lane client error",logged):options.logger.info("managed agents lane request",logged)}).catch(error3=>{options.logger.error("managed agents lane handler failed",{...fields2,error:error3 instanceof Error?error3.message:String(error3)}),response.headersSent?response.writableEnded||response.end():writeError(response,requestId,laneError(500,"api_error",INTERNAL_ERROR_MESSAGE))})}}async function serve(request3,response,route,requestId,context2){let refuse=(error3,refuseOptions={})=>(writeError(response,requestId,error3,{...refuseOptions,noRetry:request3.method==="POST"}),error3.status);if(route===void 0)return refuse(notFound(`this API serves ${ROUTE_SHAPES.events} (GET, POST) and ${ROUTE_SHAPES.stream} (GET), nothing else under ${MANAGED_AGENTS_PATH_PREFIX}`));let method=request3.method??"",allow=route.kind==="events"?"GET, POST":"GET";if(!allow.split(", ").includes(method))return refuse(laneError(405,"invalid_request_error",`${method} is not served here; this path serves ${allow}`),{allow});let version=selectManagedAgentsVersion(headerOf(request3,"anthropic-beta"));if(!version.served)return refuse(laneError(400,"invalid_request_error",version.message));let headers2=forwardedHeaders(request3,context2.authenticationRequired);if(isLaneError(headers2))return refuse(headers2);let abort=new AbortController;response.on("close",()=>abort.abort());let call={sessionId:route.sessionId,clients:context2.clients,options:{headers:headers2,signal:abort.signal},requestId},params=new URLSearchParams((request3.url??"").split("?",2)[1]??"");try{if(route.kind==="stream"){let query=parseStreamQuery(params);return isLaneError(query)?refuse(query):await serveStream(call,query,response,context2.keepAliveMs)}if(method==="GET"){let query=parseListQuery(params);return isLaneError(query)?refuse(query):await serveList(call,query,response)}let body=await readJsonBody(request3);if(isLaneError(body))return refuse(body);let events=parseSendBody(body.value);if(isLaneError(events))return refuse(events);let unservable=await checkSendFiles(call,events);return unservable!==void 0?refuse(unservable):await serveSend(call,events,response,context2.now)}catch(error3){if(abort.signal.aborted)return 499;let answered=laneErrorOf(error3);return error3 instanceof ConnectError||context2.logger.error("managed agents lane call failed",{requestId,error:error3 instanceof Error?error3.message:String(error3)}),refuse(answered)}}function routeOf(path17){if(!path17.startsWith(MANAGED_AGENTS_PATH_PREFIX))return;let[encodedId,events,stream,...rest]=path17.slice(MANAGED_AGENTS_PATH_PREFIX.length).split("/");if(encodedId===void 0||encodedId===""||events!=="events"||rest.length>0)return;let sessionId;try{sessionId=decodeURIComponent(encodedId)}catch{return}return stream===void 0?{kind:"events",sessionId}:stream==="stream"?{kind:"stream",sessionId}:void 0}function forwardedHeaders(request3,authenticationRequired){let headers2=new Headers,origin=headerOf(request3,"origin");if(origin!==void 0&&headers2.set("origin",origin),!authenticationRequired)return headers2;let authorization=headerOf(request3,"authorization")??"",apiKey=(headerOf(request3,"x-api-key")??"").trim();return apiKey===""?(authorization!==""&&headers2.set("authorization",authorization),headers2):authorization!==""&&parseBearerToken(authorization)!==apiKey?laneError(401,"authentication_error","the X-Api-Key and Authorization headers carry different credentials; send one"):(headers2.set("authorization",`Bearer ${apiKey}`),headers2)}function headerOf(request3,name){let value=request3.headers[name];return Array.isArray(value)?value.join(", "):value}async function readJsonBody(request3){let tooLarge=()=>laneError(413,"invalid_request_error",`the request body exceeds ${10485760} bytes`);if(Number(headerOf(request3,"content-length")??0)>10485760)return tooLarge();let body=request3,read3=await new Promise((resolve,reject2)=>{let chunks=[],size=0,onData=chunk=>{if(size+=chunk.length,size>10485760){body.off("data",onData),resolve("too-large");return}chunks.push(chunk)};body.on("data",onData),body.once("end",()=>resolve(Buffer.concat(chunks))),body.once("error",reject2),body.once("close",()=>reject2(new Error("the client closed the request before its body ended")))});if(read3==="too-large")return tooLarge();try{return{value:JSON.parse(read3.toString("utf8"))}}catch{return laneError(400,"invalid_request_error","the request body must be JSON")}}function newMyVaultDeparture(deps){return async(identityAccountId,organizationId,caller)=>{await deleteMyVaultOf(deps,organizationId,identityAccountId,caller)&&deps.logger.info("my vault deleted with its person's departure",{identityAccountId,organizationId})}}var file_ai_stigmer_platform_github_v1_io=fileDesc("CiZhaS9zdGlnbWVyL3BsYXRmb3JtL2dpdGh1Yi92MS9pby5wcm90bxIdYWkuc3RpZ21lci5wbGF0Zm9ybS5naXRodWIudjEi0gEKEEdpdEh1YlJlcG9zaXRvcnkSCgoCaWQYASABKAMSEQoJZnVsbF9uYW1lGAIgASgJEgwKBG5hbWUYAyABKAkSDQoFb3duZXIYBCABKAkSHQoVb3duZXJfaXNfb3JnYW5pemF0aW9uGAUgASgIEhAKCGh0bWxfdXJsGAYgASgJEhEKCWNsb25lX3VybBgHIAEoCRIWCg5kZWZhdWx0X2JyYW5jaBgIIAEoCRISCgppc19wcml2YXRlGAkgASgIEhIKCnVwZGF0ZWRfYXQYCiABKAkiSgobTGlzdEdpdEh1YlJlcG9zaXRvcmllc0lucHV0EhQKA29yZxgBIAEoCUIHukgEcgIQARIVCgRwYWdlGAIgASgFQge6SAQaAigAImcKHVNlYXJjaEdpdEh1YlJlcG9zaXRvcmllc0lucHV0EhQKA29yZxgBIAEoCUIHukgEcgIQARIZCgVxdWVyeRgCIAEoCUIKukgHcgUQARiAAhIVCgRwYWdlGAMgASgFQge6SAQaAigAIm8KFEdpdEh1YlJlcG9zaXRvcnlMaXN0EkUKDHJlcG9zaXRvcmllcxgBIAMoCzIvLmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkdpdEh1YlJlcG9zaXRvcnkSEAoIaGFzX21vcmUYAiABKAgiiAEKF0xpc3RHaXRIdWJCcmFuY2hlc0lucHV0EhQKA29yZxgBIAEoCUIHukgEcgIQARIrCgVvd25lchgCIAEoCUIcukgZchcQARhkMhFeW0EtWmEtejAtOS5fLV0rJBIqCgRyZXBvGAMgASgJQhy6SBlyFxABGGQyEV5bQS1aYS16MC05Ll8tXSskIiEKEEdpdEh1YkJyYW5jaExpc3QSDQoFbmFtZXMYASADKAkinAEKEkdldEdpdEh1YlRyZWVJbnB1dBIUCgNvcmcYASABKAlCB7pIBHICEAESKwoFb3duZXIYAiABKAlCHLpIGXIXEAEYZDIRXltBLVphLXowLTkuXy1dKyQSKgoEcmVwbxgDIAEoCUIcukgZchcQARhkMhFeW0EtWmEtejAtOS5fLV0rJBIXCgNyZWYYBCABKAlCCrpIB3IFEAEY/wEiQwoPR2l0SHViVHJlZUVudHJ5EgwKBHBhdGgYASABKAkSFAoMaXNfZGlyZWN0b3J5GAIgASgIEgwKBHNpemUYAyABKAMiYAoKR2l0SHViVHJlZRI/CgdlbnRyaWVzGAEgAygLMi4uYWkuc3RpZ21lci5wbGF0Zm9ybS5naXRodWIudjEuR2l0SHViVHJlZUVudHJ5EhEKCXRydW5jYXRlZBgCIAEoCCK9AQoZR2V0R2l0SHViRmlsZUNvbnRlbnRJbnB1dBIUCgNvcmcYASABKAlCB7pIBHICEAESKwoFb3duZXIYAiABKAlCHLpIGXIXEAEYZDIRXltBLVphLXowLTkuXy1dKyQSKgoEcmVwbxgDIAEoCUIcukgZchcQARhkMhFeW0EtWmEtejAtOS5fLV0rJBIXCgNyZWYYBCABKAlCCrpIB3IFEAEY/wESGAoEcGF0aBgFIAEoCUIKukgHcgUQARiAICJFChFHaXRIdWJGaWxlQ29udGVudBIPCgdjb250ZW50GAEgASgMEgwKBHNpemUYAiABKAMSEQoJdG9vX2xhcmdlGAMgASgIYgZwcm90bzM",[file_buf_validate_validate]),GitHubRepositorySchema=messageDesc2(file_ai_stigmer_platform_github_v1_io,0);var GitHubRepositoryListSchema=messageDesc2(file_ai_stigmer_platform_github_v1_io,3);var GitHubBranchListSchema=messageDesc2(file_ai_stigmer_platform_github_v1_io,5);var GitHubTreeEntrySchema=messageDesc2(file_ai_stigmer_platform_github_v1_io,7),GitHubTreeSchema=messageDesc2(file_ai_stigmer_platform_github_v1_io,8);var GitHubFileContentSchema=messageDesc2(file_ai_stigmer_platform_github_v1_io,10);var file_ai_stigmer_platform_github_v1_query=fileDesc("CilhaS9zdGlnbWVyL3BsYXRmb3JtL2dpdGh1Yi92MS9xdWVyeS5wcm90bxIdYWkuc3RpZ21lci5wbGF0Zm9ybS5naXRodWIudjEyzwcKFUdpdEh1YlF1ZXJ5Q29udHJvbGxlchLEAQoQbGlzdFJlcG9zaXRvcmllcxI6LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkxpc3RHaXRIdWJSZXBvc2l0b3JpZXNJbnB1dBozLmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkdpdEh1YlJlcG9zaXRvcnlMaXN0Ij/CuBg7CDMQHiIDb3JnKjB1bmF1dGhvcml6ZWQgdG8gcmVhZCBHaXRIdWIgaW4gdGhpcyBvcmdhbml6YXRpb24SyAEKEnNlYXJjaFJlcG9zaXRvcmllcxI8LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLlNlYXJjaEdpdEh1YlJlcG9zaXRvcmllc0lucHV0GjMuYWkuc3RpZ21lci5wbGF0Zm9ybS5naXRodWIudjEuR2l0SHViUmVwb3NpdG9yeUxpc3QiP8K4GDsIMxAeIgNvcmcqMHVuYXV0aG9yaXplZCB0byByZWFkIEdpdEh1YiBpbiB0aGlzIG9yZ2FuaXphdGlvbhK4AQoMbGlzdEJyYW5jaGVzEjYuYWkuc3RpZ21lci5wbGF0Zm9ybS5naXRodWIudjEuTGlzdEdpdEh1YkJyYW5jaGVzSW5wdXQaLy5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HaXRIdWJCcmFuY2hMaXN0Ij/CuBg7CDMQHiIDb3JnKjB1bmF1dGhvcml6ZWQgdG8gcmVhZCBHaXRIdWIgaW4gdGhpcyBvcmdhbml6YXRpb24SqAEKB2dldFRyZWUSMS5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HZXRHaXRIdWJUcmVlSW5wdXQaKS5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HaXRIdWJUcmVlIj/CuBg7CDMQHiIDb3JnKjB1bmF1dGhvcml6ZWQgdG8gcmVhZCBHaXRIdWIgaW4gdGhpcyBvcmdhbml6YXRpb24SvQEKDmdldEZpbGVDb250ZW50EjguYWkuc3RpZ21lci5wbGF0Zm9ybS5naXRodWIudjEuR2V0R2l0SHViRmlsZUNvbnRlbnRJbnB1dBowLmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkdpdEh1YkZpbGVDb250ZW50Ij/CuBg7CDMQHiIDb3JnKjB1bmF1dGhvcml6ZWQgdG8gcmVhZCBHaXRIdWIgaW4gdGhpcyBvcmdhbml6YXRpb25iBnByb3RvMw",[file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_platform_github_v1_io]),GitHubQueryController=serviceDesc(file_ai_stigmer_platform_github_v1_query,0);var GITHUB_API="https://api.github.com",HTTP_TIMEOUT_MS=1e4,REPOSITORIES_PER_PAGE=100,FILE_CONTENT_CEILING_BYTES=10*1024*1024,GITHUB_RESPONSE_CEILING_BYTES=16*1024*1024,ERROR_BODY_CEILING_BYTES=64*1024,ResponseTooLargeError=class extends Error{ceilingBytes;constructor(ceilingBytes){super(`the answer is larger than ${ceilingBytes} bytes`),this.ceilingBytes=ceilingBytes,this.name="ResponseTooLargeError"}};async function readBoundedText(response,ceilingBytes){let declared=Number(response.headers.get("content-length")??Number.NaN);if(Number.isFinite(declared)&&declared>ceilingBytes)throw await releaseBody(response),new ResponseTooLargeError(ceilingBytes);if(response.body===null||response.body===void 0)return response.text();let reader=response.body.getReader(),chunks=[],read3=0;for(;;){let{done,value}=await reader.read();if(done)break;if(read3+=value.byteLength,read3>ceilingBytes)throw await reader.cancel().catch(()=>{}),new ResponseTooLargeError(ceilingBytes);chunks.push(value)}return Buffer.concat(chunks).toString("utf8")}var RECONNECT_GITHUB="GitHub refused the saved login: reconnect GitHub to refresh it";function newGitHubApi(token,fetchImpl){return{async getJson(path17,what){let response;try{response=await fetchImpl(`${GITHUB_API}${path17}`,{method:"GET",headers:{Accept:"application/vnd.github+json",Authorization:`Bearer ${token}`,"X-GitHub-Api-Version":"2022-11-28"},redirect:"manual",signal:AbortSignal.timeout(HTTP_TIMEOUT_MS)})}catch{throw unavailableError("failed to reach GitHub")}if(!response.ok)throw await refusalOf2(response,what);let body;try{body=JSON.parse(await readBoundedText(response,GITHUB_RESPONSE_CEILING_BYTES))}catch(error3){throw error3 instanceof ResponseTooLargeError?failedPreconditionError(`GitHub's answer for ${what} is larger than the ${error3.ceilingBytes/(1024*1024)} MiB the server reads`):unavailableError(`GitHub answered an unreadable body for ${what}`)}return{body,link:response.headers.get("link")??""}}}}async function refusalOf2(response,what){let status=response.status;if(status===403||status===429){let detail=await readBoundedText(response,ERROR_BODY_CEILING_BYTES).catch(()=>"");return new ConnectError(`GitHub refused the request for ${what} (HTTP ${status})${messageOf2(detail)}`,Code.ResourceExhausted)}return await releaseBody(response),status===401?failedPreconditionError(RECONNECT_GITHUB):status===404?notFoundError("GitHub",what):status>=300&&status<400?failedPreconditionError(`GitHub redirected the request for ${what} (HTTP ${status}); the server does not follow a redirect with your login. If the repository was renamed or moved, use its current name`):unavailableError(`GitHub answered HTTP ${status} for ${what}`)}async function releaseBody(response){await response.body?.cancel().catch(()=>{})}function messageOf2(body){try{let parsed=JSON.parse(body);return typeof parsed.message=="string"&&parsed.message!==""?`: ${parsed.message}`:""}catch{return""}}function hasNextPage(link){return/<[^>]*>;\s*rel="next"/.test(link)}function encodePath(path17){return path17.split("/").map(encodeURIComponent).join("/")}function decodeBase642(content){return new Uint8Array(Buffer.from(content.replace(/\s/g,""),"base64"))}function registerGitHubServices(router,deps){router.service(GitHubQueryController,{listRepositories:(req,ctx)=>listRepositories(deps,req,ctx),searchRepositories:(req,ctx)=>searchRepositories(deps,req,ctx),listBranches:(req,ctx)=>listBranches(deps,req,ctx),getTree:(req,ctx)=>getTree(deps,req,ctx),getFileContent:(req,ctx)=>getFileContent(deps,req,ctx)})}var CONNECT_GITHUB_FIRST="no GitHub login is saved in your My vault in this organization: connect GitHub first";async function githubFor(deps,method,req,ctx){let caller=callerIdentityOf(ctx);await authorizeDirect(method,deps.authorizer,caller,req),await refuseBoundElsewhere(deps.credentialBinding,caller,req.org);let vault=await deps.vaults.findMine(req.org,caller.identityId),token=vault===void 0?"":(await deps.vaults.entries(vault).connections.get(GITHUB_HOST)?.open())?.token??"";if(token==="")throw failedPreconditionError(CONNECT_GITHUB_FIRST);return newGitHubApi(token,deps.fetchImpl??fetch)}function isDotSegment(segment){return segment==="."||segment===".."}function refuseDotSegments(req){for(let[field3,value]of[["owner",req.owner],["repo",req.repo],["ref",req.ref??""]])if(isDotSegment(value))throw invalidArgumentError(`${field3} cannot be '${value}'`);if((req.path??"").split("/").some(isDotSegment))throw invalidArgumentError("path cannot hold a '.' or '..' segment")}function repositoryOf(json2){return create2(GitHubRepositorySchema,{id:BigInt(json2.id??0),fullName:json2.full_name??"",name:json2.name??"",owner:json2.owner?.login??"",ownerIsOrganization:json2.owner?.type==="Organization",htmlUrl:json2.html_url??"",cloneUrl:json2.clone_url??"",defaultBranch:json2.default_branch??"",isPrivate:json2.private===!0,updatedAt:json2.updated_at??""})}function pageOf(page){return page>0?page:1}async function listRepositories(deps,req,ctx){let api=await githubFor(deps,GitHubQueryController.method.listRepositories,req,ctx),page=pageOf(req.page),{body,link}=await api.getJson(`/user/repos?sort=pushed&direction=desc&per_page=${REPOSITORIES_PER_PAGE}&page=${page}`,"your repositories"),repositories=Array.isArray(body)?body.map(repositoryOf):[];return create2(GitHubRepositoryListSchema,{repositories,hasMore:link!==""?hasNextPage(link):repositories.length===REPOSITORIES_PER_PAGE})}async function searchRepositories(deps,req,ctx){let api=await githubFor(deps,GitHubQueryController.method.searchRepositories,req,ctx),page=pageOf(req.page),params=new URLSearchParams({q:req.query,sort:"stars",order:"desc",per_page:String(REPOSITORIES_PER_PAGE),page:String(page)}),{body}=await api.getJson(`/search/repositories?${params.toString()}`,"repository search"),repositories=(body.items??[]).map(repositoryOf);return create2(GitHubRepositoryListSchema,{repositories,hasMore:page*REPOSITORIES_PER_PAGE<(body.total_count??0)})}async function listBranches(deps,req,ctx){refuseDotSegments(req);let api=await githubFor(deps,GitHubQueryController.method.listBranches,req,ctx),repo=`${encodeURIComponent(req.owner)}/${encodeURIComponent(req.repo)}`,names2=[];for(let page=1;page<=MAX_BRANCH_PAGES;page+=1){let{body,link}=await api.getJson(`/repos/${repo}/branches?per_page=${REPOSITORIES_PER_PAGE}&page=${page}`,`${req.owner}/${req.repo}`),batch=Array.isArray(body)?body:[];if(names2.push(...batch.map(branch=>branch.name??"").filter(name=>name!=="")),!(link!==""?hasNextPage(link):batch.length===REPOSITORIES_PER_PAGE))break}return create2(GitHubBranchListSchema,{names:names2})}var MAX_BRANCH_PAGES=10;async function getTree(deps,req,ctx){refuseDotSegments(req);let api=await githubFor(deps,GitHubQueryController.method.getTree,req,ctx),repo=`${encodeURIComponent(req.owner)}/${encodeURIComponent(req.repo)}`,{body}=await api.getJson(`/repos/${repo}/git/trees/${encodeURIComponent(req.ref)}?recursive=1`,`${req.owner}/${req.repo} at ${req.ref}`),entries=(body.tree??[]).filter(node=>node.type==="blob"||node.type==="tree").map(node=>create2(GitHubTreeEntrySchema,{path:node.path??"",isDirectory:node.type==="tree",size:BigInt(node.size??0)}));return create2(GitHubTreeSchema,{entries,truncated:body.truncated===!0})}async function getFileContent(deps,req,ctx){refuseDotSegments(req);let api=await githubFor(deps,GitHubQueryController.method.getFileContent,req,ctx),repo=`${encodeURIComponent(req.owner)}/${encodeURIComponent(req.repo)}`,what=`${req.path} in ${req.owner}/${req.repo} at ${req.ref}`,{body:file}=await api.getJson(`/repos/${repo}/contents/${encodePath(req.path)}?ref=${encodeURIComponent(req.ref)}`,what);if(Array.isArray(file)||file.type!==void 0&&file.type!=="file")throw invalidArgumentError(`${req.path} is not a file`);let size=file.size??0;if(file.encoding==="base64")return create2(GitHubFileContentSchema,{content:decodeBase642(file.content??""),size:BigInt(size)});if(size>FILE_CONTENT_CEILING_BYTES)return create2(GitHubFileContentSchema,{size:BigInt(size),tooLarge:!0});let{body:blob}=await api.getJson(`/repos/${repo}/git/blobs/${encodeURIComponent(file.sha??"")}`,what);return create2(GitHubFileContentSchema,{content:decodeBase642(blob.content??""),size:BigInt(blob.size??size)})}var file_ai_stigmer_agentic_memory_v1_io=fileDesc("CiVhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2lvLnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxIiEKCE1lbW9yeUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEi4wEKE0xpc3RNZW1vcmllc1JlcXVlc3QSFAoDb3JnGAEgASgJQge6SARyAhABEhoKCXBhZ2Vfc2l6ZRgDIAEoBUIHukgEGgIoABIcCgpwYWdlX3Rva2VuGAQgASgJQgi6SAVyAxiACBJNCgZsYWJlbHMYBSADKAsyPS5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLkxpc3RNZW1vcmllc1JlcXVlc3QuTGFiZWxzRW50cnkaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASJcCgpNZW1vcnlMaXN0EjUKB2VudHJpZXMYAiADKAsyJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeRIXCg9uZXh0X3BhZ2VfdG9rZW4YAyABKAkizQIKEVVwZGF0ZU1lbW9yeUlucHV0Ej4KCHJlc291cmNlGAEgASgLMiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlCBrpIA9gBAxI3Cgt1cGRhdGVfbWFzaxgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCBrpIA8gBATq+AbpIugEatwEKF3VwZGF0ZV9uYW1lc19pdHNfdGFyZ2V0EkZyZXNvdXJjZS5tZXRhZGF0YS5pZCBpcyByZXF1aXJlZDogYW4gdXBkYXRlIG5hbWVzIHRoZSBtZW1vcnkgYnkgaXRzIGlkGlRoYXModGhpcy5yZXNvdXJjZSkgJiYgaGFzKHRoaXMucmVzb3VyY2UubWV0YWRhdGEpICYmIHRoaXMucmVzb3VyY2UubWV0YWRhdGEuaWQgIT0gJydiBnByb3RvMw",[file_ai_stigmer_agentic_memory_v1_api,file_buf_validate_validate,file_google_protobuf_field_mask2]),MemoryIdSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,0);var MemoryListSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,2);var file_ai_stigmer_agentic_memory_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEyuQUKF01lbW9yeUNvbW1hbmRDb250cm9sbGVyEloKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5GiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnkiBNC4GAESngEKBnVwZGF0ZRIvLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuVXBkYXRlTWVtb3J5SW5wdXQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSI9wrgYOQgCEDkiFHJlc291cmNlLm1ldGFkYXRhLmlkKh11bmF1dGhvcml6ZWQgdG8gdXBkYXRlIG1lbW9yeRKGAQoGZGVsZXRlEiYuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlJZBokLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5Ii7CuBgqCAMQOSIFdmFsdWUqHXVuYXV0aG9yaXplZCB0byBkZWxldGUgbWVtb3J5EogBCgdjb25maXJtEiYuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlJZBokLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5Ii/CuBgrCAIQOSIFdmFsdWUqHnVuYXV0aG9yaXplZCB0byBjb25maXJtIG1lbW9yeRKGAQoGcmVqZWN0EiYuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlJZBokLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5Ii7CuBgqCAIQOSIFdmFsdWUqHXVuYXV0aG9yaXplZCB0byByZWplY3QgbWVtb3J5GgSg/ys5YgZwcm90bzM",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryCommandController=serviceDesc(file_ai_stigmer_agentic_memory_v1_command,0);var file_ai_stigmer_agentic_memory_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxMosCChVNZW1vcnlRdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIrwrgYJwgBEDkiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IG1lbW9yeRJpCgRsaXN0EjEuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5MaXN0TWVtb3JpZXNSZXF1ZXN0GiguYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlMaXN0IgTQuBgBGgSg/ys5YgZwcm90bzM",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryQueryController=serviceDesc(file_ai_stigmer_agentic_memory_v1_query,0);var MEMORY_CAPTURE_CALLER_MESSAGE="memory can only be captured for a first-party human operator",MEMORY_CAPTURE_CREDENTIAL_KEY="memoryCaptureCredential";function newGuardMemoryCaptureStep(provider){return{name:"GuardMemoryCapture",async execute(ctx){let caller=ctx.callerIdentity;if(isServerComposedRequest(caller))return;let decide4=provider?.authorizeMemoryCapture;if(decide4!==void 0){let org=metadataOf(ctx.newState)?.org??"",decision=await decide4.call(provider,caller,org);switch(decision.verdict){case"admit":ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY,{subjectIdentityAccountId:decision.subjectIdentityAccountId,provedSessionId:decision.provedSessionId});return;case"refuse":throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied);case"no-opinion":break;default:{let exhaustive=decision;throw new Error(`unknown memory capture decision ${JSON.stringify(exhaustive)}`)}}}if(!isFirstPartyHumanOperator(caller))throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied)}}}function memoryCaptureCredentialOf(ctx){let payload=ctx.get(MEMORY_CAPTURE_CREDENTIAL_KEY);if(typeof payload=="object"&&payload!==null&&"subjectIdentityAccountId"in payload&&"provedSessionId"in payload)return payload}var MEMORY_FULL_MESSAGE="memory is full \u2014 review and delete existing memories";function memoryDisabledMessage(org){return`memory is not enabled for organization ${org} \u2014 an organization admin can enable it in organization preferences`}var MEMORY_ACCOUNT_DISABLED_MESSAGE="memory is not enabled for your account \u2014 enable it in account preferences",MEMORY_CONFIRM_REJECTED_MESSAGE="memory was rejected \u2014 delete it and let the agent propose it again",MEMORY_REJECT_CONFIRMED_MESSAGE="memory was confirmed \u2014 delete it to stop it from being recalled",MEMORY_SUBJECT_IMMUTABLE_MESSAGE="spec.subject_identity_account_id is immutable \u2014 it is derived from the capturing credential at create",MEMORY_PROVENANCE_IMMUTABLE_MESSAGE="spec.provenance is immutable \u2014 it records where the fact came from";var LIST_RESULT_KEY4="listResult";function newResolveMemoryDefaultsStep(personAccounts){return{name:"ResolveMemoryDefaults",async execute(ctx){let memory=ctx.newState,metadata=memory.metadata;if((metadata?.org??"")==="")throw invalidArgumentError("metadata.org is required for a memory");if(metadata===void 0)throw internalError(new Error("metadata is nil"),"metadata is nil");assignServerId(ctx,generateId("mem")),metadata.name===""&&metadata.slug===""&&(metadata.name=metadata.id);let spec=memory.spec;if(spec===void 0)throw internalError(new Error("memory spec is nil"),"memory spec is nil");let captureCredential=memoryCaptureCredentialOf(ctx);if(personAccounts===void 0)spec.subjectIdentityAccountId=captureCredential?.subjectIdentityAccountId??"";else{let account2=await resolveSubjectAccount(personAccounts,ctx,captureCredential?.subjectIdentityAccountId);spec.subjectIdentityAccountId=account2?.metadata?.id??"",account2!==void 0&&ctx.set(MEMORY_SUBJECT_ACCOUNT_KEY,account2)}spec.provenance!==void 0&&(spec.provenance.toolCallId=""),captureCredential!==void 0&&(spec.provenance===void 0&&(spec.provenance=create2(MemoryProvenanceSchema,{})),spec.provenance.sessionId=captureCredential.provedSessionId)}}}var MEMORY_SUBJECT_ACCOUNT_KEY="memorySubjectAccount";function memorySubjectAccountOf(ctx){let payload=ctx.get(MEMORY_SUBJECT_ACCOUNT_KEY);return isMessage2(payload,IdentityAccountSchema)?payload:void 0}async function resolveSubjectAccount(personAccounts,ctx,credentialSubject){let account2;try{account2=credentialSubject!==void 0?await accountForStamp(personAccounts,credentialSubject):await accountForCaller(personAccounts,ctx.callerIdentity)}catch(error3){throw internalError(error3,"failed to resolve the identity account a memory is about")}if(account2!==void 0&&(account2.metadata?.id??"")==="")throw internalError(new Error("identity account carries no id"),"failed to resolve the identity account a memory is about");return account2}var MEMORY_CREATE_DENIED_MESSAGE="unauthorized to capture memory in this organization";function resolveMemoryCreateTargets(ctx){return isServerComposedRequest(ctx.callerIdentity)?[]:[{permission:IamPermission.can_create_session,resourceKind:ApiResourceKind.organization,resourceId:ctx.newState.metadata?.org??"",deniedMessage:MEMORY_CREATE_DENIED_MESSAGE}]}function newCheckMemoryEnablementStep(store,personAccounts){return{name:"CheckMemoryEnablement",async execute(ctx){let orgID=ctx.newState.metadata?.org??"",org;try{org=await store.getResource(ApiResourceKind.organization,orgID,OrganizationSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Organization",orgID):internalError(error3,"failed to load organization for memory enablement check")}if(org.spec?.preferences?.memoryEnabled!==!0)throw failedPreconditionError(memoryDisabledMessage(orgID));if(personAccounts===void 0)return;if(memorySubjectAccountOf(ctx)?.spec?.preferences?.memoryEnabled!==!0)throw failedPreconditionError(MEMORY_ACCOUNT_DISABLED_MESSAGE)}}}function newCheckMemoryCapStep(store){return{name:"CheckMemoryCap",async execute(ctx){let newState=ctx.newState,org=newState.metadata?.org??"",subject=newState.spec?.subjectIdentityAccountId??"",count2;try{count2=(await listSubjectMemories(store,org,subject)).length}catch(error3){throw internalError(error3,"failed to count memories for cap check")}if(count2>=100)throw failedPreconditionError(MEMORY_FULL_MESSAGE)}}}function newInitializeMemoryLifecycleStep(){return{name:"InitializeMemoryLifecycle",execute(ctx){let memory=ctx.newState;memory.status===void 0&&(memory.status=create2(MemoryStatusSchema,{})),memory.status.lifecycleState=MemoryLifecycleState.lifecycle_state_proposed,memory.status.stateChangedAt=timestampNow()}}}function newValidateMemoryUpdateStep(){return{name:"ValidateMemoryUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing memory not found in context"),"existing memory not found in context");let newState=ctx.newState;if((newState.spec?.subjectIdentityAccountId??"")!==(existing.spec?.subjectIdentityAccountId??""))throw failedPreconditionError(MEMORY_SUBJECT_IMMUTABLE_MESSAGE);let newProvenance=newState.spec?.provenance,existingProvenance=existing.spec?.provenance;if(!(newProvenance===void 0||existingProvenance===void 0?newProvenance===existingProvenance:equals(MemoryProvenanceSchema,newProvenance,existingProvenance)))throw failedPreconditionError(MEMORY_PROVENANCE_IMMUTABLE_MESSAGE)}}}function newPersistMemoryUpdateStep(store){return{name:"PersistMemoryUpdate",async execute(ctx){await swapOntoLoadedRow(store,ctx,"failed to persist memory update")}}}function newTransitionMemoryLifecycleStep(store,target,blockedMessage){return{name:"TransitionMemoryLifecycle",async execute(ctx){let memoryId=ctx.get(EXISTING_RESOURCE_KEY).metadata?.id??"",transitionNoOp=new Error("memory already in target state"),blocked,live;try{live=await store.updateResource(ApiResourceKind.memory,memoryId,MemorySchema,row=>{live=row;let current=row.status?.lifecycleState??MemoryLifecycleState.lifecycle_state_unspecified;if(current===target)throw transitionNoOp;if(current!==MemoryLifecycleState.lifecycle_state_proposed&&current!==MemoryLifecycleState.lifecycle_state_unspecified)throw blocked=failedPreconditionError(blockedMessage),blocked;row.status===void 0&&(row.status=create2(MemoryStatusSchema,{})),row.status.lifecycleState=target,row.status.stateChangedAt=timestampNow(),setAuditFieldsForUpdate(MemorySchema,row,"status_audit",ctx.callerIdentity)})}catch(error3){if(error3!==transitionNoOp)throw blocked!==void 0&&error3===blocked?blocked:error3 instanceof ResourceNotFoundError?notFoundError("Memory",memoryId):internalError(error3,"failed to transition memory lifecycle")}if(live===void 0)throw internalError(new Error("transition closure did not observe the row"),"failed to transition memory lifecycle");ctx.set(EXISTING_RESOURCE_KEY,live)}}}function newListMemoriesByOrgStep(store,listReadScope){return{name:"ListMemoriesByOrg",async execute(ctx){let org=ctx.input.org,page=await readListPage({store,declaration:memoryListIndex,query:{org},request:ctx.input,fingerprint:listPageFingerprint({lane:"memory.list",org,labels:sortedLabels(ctx.input.labels)}),decode:decodeOrSkip(MemorySchema),keep:memory=>matchesAllLabels(memory.metadata?.labels??{},ctx.input.labels),scope:memories=>restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.memory,memories,""),failure:"failed to list memories"});ctx.set(LIST_RESULT_KEY4,create2(MemoryListSchema,{entries:page.entries,nextPageToken:page.nextPageToken}))}}}function registerMemoryServices(router,deps){router.service(MemoryCommandController,{create:(memory,ctx)=>createMemory(deps,memory,ctx),update:(input,ctx)=>update9(deps,input,ctx),delete:(id,ctx)=>deleteMemory(deps,id,ctx),confirm:(id,ctx)=>confirm(deps,id,ctx),reject:(id,ctx)=>reject(deps,id,ctx)}),router.service(MemoryQueryController,{get:(id,ctx)=>get12(deps,id,ctx),list:(req,ctx)=>list11(deps,req,ctx)})}function kindOf12(ctx){return ctx.values.get(apiResourceKindKey)}async function createMemory(deps,memory,ctx){let reqCtx=new RequestContext(MemorySchema,memory,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("memory-create",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider)).addStep(newValidateVisibilityStep()).addStep(newResolveMemoryDefaultsStep(deps.personAccounts)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveMemoryCreateTargets)).addStep(newCheckMemoryEnablementStep(deps.store,deps.personAccounts)).addStep(newCheckMemoryCapStep(deps.store)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newInitializeMemoryLifecycleStep()).addStep(newClaimNameStep(deps.store,ApiResourceKind.memory)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx).catch(releaseNameOnFailure(deps.store,deps.logger,reqCtx)),reqCtx.newState}async function update9(deps,input,ctx){return runGuardedWrite(async()=>{let reqCtx=updateContext(MemorySchema,input,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("memory-update",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.update,deps.authorizer,input)).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newValidateProtoStep({of:"state"})).addStep(newValidateMemoryUpdateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistMemoryUpdateStep(deps.store)).build().execute(reqCtx),reqCtx.newState})}async function confirm(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-confirm",MemoryCommandController.method.confirm,MemoryLifecycleState.lifecycle_state_confirmed,MEMORY_CONFIRM_REJECTED_MESSAGE)}async function reject(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-reject",MemoryCommandController.method.reject,MemoryLifecycleState.lifecycle_state_rejected,MEMORY_REJECT_CONFIRMED_MESSAGE)}async function runTransition(deps,memoryId,ctx,name,method,target,blockedMessage){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline(name,deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newTransitionMemoryLifecycleStep(deps.store,target,blockedMessage)).build().execute(reqCtx);let transitioned=reqCtx.get(EXISTING_RESOURCE_KEY);if(transitioned===void 0)throw internalError(new Error("transitioned memory not found in context"),"transitioned memory not found in context");return transitioned}async function deleteMemory(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("memory-delete",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newReleaseNamesStep(deps.store,deps.logger,ApiResourceKind.memory)).addStep(newCleanupGrantsStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted memory not found in context"),"deleted memory not found in context");return deleted}async function get12(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("memory-get",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,MemorySchema)).build().execute(reqCtx);let target=reqCtx.get(TARGET_RESOURCE_KEY);if(target===void 0)throw internalError(new Error("target memory not found in context"),"target memory not found in context");return target}async function list11(deps,req,ctx){let reqCtx=new RequestContext(MemoryQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("memory-list",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListMemoriesByOrgStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY4);if(result===void 0)throw internalError(new Error("memory list not found in context"),"memory list not found in context");return result}var file_ai_stigmer_agentic_scoringrule_v1_io=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvc2NvcmluZ3J1bGUvdjEvaW8ucHJvdG8SIWFpLnN0aWdtZXIuYWdlbnRpYy5zY29yaW5ncnVsZS52MSIrCg1TY29yaW5nUnVsZUlkEhoKBXZhbHVlGAEgASgJQgu6SAjIAQFyAxiAASI8ChxHZXRTY29yaW5nUnVsZUJ5QWdlbnRSZXF1ZXN0EhwKCGFnZW50X2lkGAEgASgJQgq6SAdyBRABGIABIuICChZVcGRhdGVTY29yaW5nUnVsZUlucHV0EkgKCHJlc291cmNlGAEgASgLMi4uYWkuc3RpZ21lci5hZ2VudGljLnNjb3JpbmdydWxlLnYxLlNjb3JpbmdSdWxlQga6SAPYAQMSNwoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQga6SAPIAQE6xAG6SMABGr0BChd1cGRhdGVfbmFtZXNfaXRzX3RhcmdldBJMcmVzb3VyY2UubWV0YWRhdGEuaWQgaXMgcmVxdWlyZWQ6IGFuIHVwZGF0ZSBuYW1lcyB0aGUgc2NvcmluZyBydWxlIGJ5IGl0cyBpZBpUaGFzKHRoaXMucmVzb3VyY2UpICYmIGhhcyh0aGlzLnJlc291cmNlLm1ldGFkYXRhKSAmJiB0aGlzLnJlc291cmNlLm1ldGFkYXRhLmlkICE9ICcnYgZwcm90bzM",[file_ai_stigmer_agentic_scoringrule_v1_api,file_buf_validate_validate,file_google_protobuf_field_mask2]),ScoringRuleIdSchema=messageDesc2(file_ai_stigmer_agentic_scoringrule_v1_io,0);var file_ai_stigmer_agentic_scoringrule_v1_command=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvc2NvcmluZ3J1bGUvdjEvY29tbWFuZC5wcm90bxIhYWkuc3RpZ21lci5hZ2VudGljLnNjb3JpbmdydWxlLnYxMvIDChxTY29yaW5nUnVsZUNvbW1hbmRDb250cm9sbGVyEm4KBmNyZWF0ZRIuLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yaW5ncnVsZS52MS5TY29yaW5nUnVsZRouLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yaW5ncnVsZS52MS5TY29yaW5nUnVsZSIE0LgYARK4AQoGdXBkYXRlEjkuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JpbmdydWxlLnYxLlVwZGF0ZVNjb3JpbmdSdWxlSW5wdXQaLi5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmluZ3J1bGUudjEuU2NvcmluZ1J1bGUiQ8K4GD8IAhA+IhRyZXNvdXJjZS5tZXRhZGF0YS5pZCojdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBzY29yaW5nIHJ1bGUSoAEKBmRlbGV0ZRIwLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yaW5ncnVsZS52MS5TY29yaW5nUnVsZUlkGi4uYWkuc3RpZ21lci5hZ2VudGljLnNjb3JpbmdydWxlLnYxLlNjb3JpbmdSdWxlIjTCuBgwCAMQPiIFdmFsdWUqI3VuYXV0aG9yaXplZCB0byBkZWxldGUgc2NvcmluZyBydWxlGgSg/ys+YgZwcm90bzM",[file_ai_stigmer_agentic_scoringrule_v1_api,file_ai_stigmer_agentic_scoringrule_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ScoringRuleCommandController=serviceDesc(file_ai_stigmer_agentic_scoringrule_v1_command,0);var file_ai_stigmer_agentic_scoringrule_v1_query=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvc2NvcmluZ3J1bGUvdjEvcXVlcnkucHJvdG8SIWFpLnN0aWdtZXIuYWdlbnRpYy5zY29yaW5ncnVsZS52MTKCAwoaU2NvcmluZ1J1bGVRdWVyeUNvbnRyb2xsZXISmgEKA2dldBIwLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yaW5ncnVsZS52MS5TY29yaW5nUnVsZUlkGi4uYWkuc3RpZ21lci5hZ2VudGljLnNjb3JpbmdydWxlLnYxLlNjb3JpbmdSdWxlIjHCuBgtCAEQPiIFdmFsdWUqIHVuYXV0aG9yaXplZCB0byBnZXQgc2NvcmluZyBydWxlEsABCgpnZXRCeUFnZW50Ej8uYWkuc3RpZ21lci5hZ2VudGljLnNjb3JpbmdydWxlLnYxLkdldFNjb3JpbmdSdWxlQnlBZ2VudFJlcXVlc3QaLi5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmluZ3J1bGUudjEuU2NvcmluZ1J1bGUiQcK4GD0IARAoIghhZ2VudF9pZCotdW5hdXRob3JpemVkIHRvIGdldCB0aGUgc2NvcmluZyBydWxlIG9mIGFnZW50GgSg/ys+YgZwcm90bzM",[file_ai_stigmer_agentic_scoringrule_v1_api,file_ai_stigmer_agentic_scoringrule_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ScoringRuleQueryController=serviceDesc(file_ai_stigmer_agentic_scoringrule_v1_query,0);var file_ai_stigmer_agentic_score_v1_io=fileDesc("CiRhaS9zdGlnbWVyL2FnZW50aWMvc2NvcmUvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MSIgCgdTY29yZUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEi6wEKFkxpc3RTY29yZXNCeVJ1blJlcXVlc3QSFwoGcnVuX2lkGAEgASgJQge6SARyAhABEhoKCXBhZ2Vfc2l6ZRgCIAEoBUIHukgEGgIoABIcCgpwYWdlX3Rva2VuGAMgASgJQgi6SAVyAxiACBJPCgZsYWJlbHMYBCADKAsyPy5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuTGlzdFNjb3Jlc0J5UnVuUmVxdWVzdC5MYWJlbHNFbnRyeRotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIvcBChpMaXN0U2NvcmVzQnlTZXNzaW9uUmVxdWVzdBIbCgpzZXNzaW9uX2lkGAEgASgJQge6SARyAhABEhoKCXBhZ2Vfc2l6ZRgCIAEoBUIHukgEGgIoABIcCgpwYWdlX3Rva2VuGAMgASgJQgi6SAVyAxiACBJTCgZsYWJlbHMYBCADKAsyQy5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuTGlzdFNjb3Jlc0J5U2Vzc2lvblJlcXVlc3QuTGFiZWxzRW50cnkaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASJZCglTY29yZUxpc3QSMwoHZW50cmllcxgCIAMoCzIiLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5TY29yZRIXCg9uZXh0X3BhZ2VfdG9rZW4YAyABKAkiaAocR2V0QWdlbnRRdWFsaXR5UmVwb3J0UmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESGQoIYWdlbnRfaWQYAiABKAlCB7pIBHICEAESFwoEZGF5cxgDIAEoBUIJukgGGgQYWigAIqoCChJBZ2VudFF1YWxpdHlSZXBvcnQSEQoJZnJvbV9kYXRlGAEgASgJEg8KB3RvX2RhdGUYAiABKAkSOgoFdG90YWwYAyABKAsyKy5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuUXVhbGl0eVN1bW1hcnkSNQoEZGF5cxgEIAMoCzInLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5RdWFsaXR5RGF5Ej0KCHZlcnNpb25zGAUgAygLMisuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLlF1YWxpdHlWZXJzaW9uEj4KCWFncmVlbWVudBgGIAMoCzIrLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5KdWRnZUFncmVlbWVudCKVAQoOSnVkZ2VBZ3JlZW1lbnQSGQoRZXZhbHVhdG9yX3ZlcnNpb24YASABKAkSDAoEcnVucxgCIAEoBRIfChd0aHVtYnNfZG93bl9ub25lX2ZhaWxlZBgDIAEoBRI5CgVydWxlcxgEIAMoCzIqLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5SdWxlQWdyZWVtZW50IokBCg1SdWxlQWdyZWVtZW50EgwKBG5hbWUYASABKAkSGgoSZmFpbGVkX3RodW1ic19kb3duGAIgASgFEhgKEGZhaWxlZF90aHVtYnNfdXAYAyABKAUSGgoScGFzc2VkX3RodW1ic19kb3duGAQgASgFEhgKEHBhc3NlZF90aHVtYnNfdXAYBSABKAUiWQoOUXVhbGl0eVN1bW1hcnkSDAoEcnVucxgBIAEoBRI5CgdtZXRyaWNzGAIgAygLMiguYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLk1ldHJpY1RhbGx5IrwBCgtNZXRyaWNUYWxseRIOCgZtZXRyaWMYASABKAkSGQoRZXZhbHVhdG9yX3ZlcnNpb24YAiABKAkSDgoGcGFzc2VkGAMgASgFEg4KBmZhaWxlZBgEIAEoBRISCgpub3RfZ3JhZGVkGAUgASgFEg8KB3BlbmRpbmcYBiABKAUSPQoIY3JpdGVyaWEYByADKAsyKy5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuQ3JpdGVyaW9uVGFsbHkiVgoOQ3JpdGVyaW9uVGFsbHkSDAoEbmFtZRgBIAEoCRIOCgZwYXNzZWQYAiABKAUSDgoGZmFpbGVkGAMgASgFEhYKDm5vdF9hcHBsaWNhYmxlGAQgASgFIlgKClF1YWxpdHlEYXkSDAoEZGF0ZRgBIAEoCRI8CgdzdW1tYXJ5GAIgASgLMisuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLlF1YWxpdHlTdW1tYXJ5IpEBCg5RdWFsaXR5VmVyc2lvbhIaChJhZ2VudF92ZXJzaW9uX2hhc2gYASABKAkSEgoKZmlyc3RfZGF0ZRgCIAEoCRIRCglsYXN0X2RhdGUYAyABKAkSPAoHc3VtbWFyeRgEIAEoCzIrLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5RdWFsaXR5U3VtbWFyeSKuAgofTGlzdEZsYWdnZWRTY29yZXNCeUFnZW50UmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESGQoIYWdlbnRfaWQYAiABKAlCB7pIBHICEAESFwoEZGF5cxgDIAEoBUIJukgGGgQYWigAEhoKCXBhZ2Vfc2l6ZRgEIAEoBUIHukgEGgIoABIcCgpwYWdlX3Rva2VuGAUgASgJQgi6SAVyAxiACBJYCgZsYWJlbHMYBiADKAsySC5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuTGlzdEZsYWdnZWRTY29yZXNCeUFnZW50UmVxdWVzdC5MYWJlbHNFbnRyeRotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIskCChBVcGRhdGVTY29yZUlucHV0EjwKCHJlc291cmNlGAEgASgLMiIuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLlNjb3JlQga6SAPYAQMSNwoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQga6SAPIAQE6vQG6SLkBGrYBChd1cGRhdGVfbmFtZXNfaXRzX3RhcmdldBJFcmVzb3VyY2UubWV0YWRhdGEuaWQgaXMgcmVxdWlyZWQ6IGFuIHVwZGF0ZSBuYW1lcyB0aGUgc2NvcmUgYnkgaXRzIGlkGlRoYXModGhpcy5yZXNvdXJjZSkgJiYgaGFzKHRoaXMucmVzb3VyY2UubWV0YWRhdGEpICYmIHRoaXMucmVzb3VyY2UubWV0YWRhdGEuaWQgIT0gJydiBnByb3RvMw",[file_ai_stigmer_agentic_score_v1_api,file_buf_validate_validate,file_google_protobuf_field_mask2]),ScoreIdSchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,0);var ScoreListSchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,3);var AgentQualityReportSchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,5),JudgeAgreementSchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,6),RuleAgreementSchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,7),QualitySummarySchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,8),MetricTallySchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,9),CriterionTallySchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,10),QualityDaySchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,11),QualityVersionSchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,12);var file_ai_stigmer_agentic_score_v1_command=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvc2NvcmUvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxMpYDChZTY29yZUNvbW1hbmRDb250cm9sbGVyElYKBmNyZWF0ZRIiLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5TY29yZRoiLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5TY29yZSIE0LgYARKZAQoGdXBkYXRlEi0uYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLlVwZGF0ZVNjb3JlSW5wdXQaIi5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuU2NvcmUiPMK4GDgIAhA9IhRyZXNvdXJjZS5tZXRhZGF0YS5pZCocdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBzY29yZRKBAQoGZGVsZXRlEiQuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLlNjb3JlSWQaIi5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuU2NvcmUiLcK4GCkIAxA9IgV2YWx1ZSocdW5hdXRob3JpemVkIHRvIGRlbGV0ZSBzY29yZRoEoP8rPWIGcHJvdG8z",[file_ai_stigmer_agentic_score_v1_api,file_ai_stigmer_agentic_score_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ScoreCommandController=serviceDesc(file_ai_stigmer_agentic_score_v1_command,0);var file_ai_stigmer_agentic_score_v1_query=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvc2NvcmUvdjEvcXVlcnkucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MTLlBgoUU2NvcmVRdWVyeUNvbnRyb2xsZXISewoDZ2V0EiQuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLlNjb3JlSWQaIi5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuU2NvcmUiKsK4GCYIARA9IgV2YWx1ZSoZdW5hdXRob3JpemVkIHRvIGdldCBzY29yZRKeAQoJbGlzdEJ5UnVuEjMuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLkxpc3RTY29yZXNCeVJ1blJlcXVlc3QaJi5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuU2NvcmVMaXN0IjTCuBgwCAEQKSIGcnVuX2lkKiJ1bmF1dGhvcml6ZWQgdG8gbGlzdCBzY29yZXMgb2YgcnVuEq4BCg1saXN0QnlTZXNzaW9uEjcuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLkxpc3RTY29yZXNCeVNlc3Npb25SZXF1ZXN0GiYuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLlNjb3JlTGlzdCI8wrgYOAgBECoiCnNlc3Npb25faWQqJnVuYXV0aG9yaXplZCB0byBsaXN0IHNjb3JlcyBvZiBzZXNzaW9uEr0BChVnZXRBZ2VudFF1YWxpdHlSZXBvcnQSOS5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuR2V0QWdlbnRRdWFsaXR5UmVwb3J0UmVxdWVzdBovLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5BZ2VudFF1YWxpdHlSZXBvcnQiOMK4GDQIARAeIgNvcmcqKXVuYXV0aG9yaXplZCB0byB2aWV3IGFnZW50IHF1YWxpdHkgcmVwb3J0ErcBChJsaXN0RmxhZ2dlZEJ5QWdlbnQSPC5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuTGlzdEZsYWdnZWRTY29yZXNCeUFnZW50UmVxdWVzdBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5TY29yZUxpc3QiO8K4GDcIARAeIgNvcmcqLHVuYXV0aG9yaXplZCB0byBsaXN0IGZsYWdnZWQgc2NvcmVzIG9mIGFnZW50GgSg/ys9YgZwcm90bzM",[file_ai_stigmer_agentic_score_v1_api,file_ai_stigmer_agentic_score_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ScoreQueryController=serviceDesc(file_ai_stigmer_agentic_score_v1_query,0);var QUALITY_DEFAULT_DAYS=30,QUALITY_REPORT_BATCH=1e4,QUALITY_REPORT_MAX_SCORES=5e4,DAY_MILLIS=864e5,QUALITY_AGENT_DENIED_MESSAGE="unauthorized to view agent quality report";function qualityReportTooLargeMessage(days){let shorter=Math.max(1,Math.floor(days/3));return`this agent has more than ${QUALITY_REPORT_MAX_SCORES.toLocaleString("en-US")} grades in the last ${days} days; ask for a shorter window, for example ${shorter} days`}function qualityWindowOf(days,now){let count2=days===0?QUALITY_DEFAULT_DAYS:days,today=Date.UTC(now.getUTCFullYear(),now.getUTCMonth(),now.getUTCDate()),first=today-(count2-1)*DAY_MILLIS;return{days:count2,fromDate:new Date(first).toISOString().slice(0,10),toDate:new Date(today).toISOString().slice(0,10),since:listIndexInstantOfMillis(first)}}function createdInstantOf(score){let created=score.status?.audit?.specAudit?.createdAt;if(created===void 0)return;let millis=Number(created.seconds)*1e3+Math.floor(created.nanos/1e6);return new Date(millis).toISOString()}var OUTCOME_OF_STATE={[ScoreState.unspecified]:()=>{},[ScoreState.graded]:passed2=>passed2?"passed":"failed",[ScoreState.not_graded]:()=>"notGraded",[ScoreState.pending]:()=>"pending"},FIELD_OF_CRITERION_RESULT={[CriterionResult.unspecified]:void 0,[CriterionResult.passed]:"passed",[CriterionResult.failed]:"failed",[CriterionResult.not_applicable]:"notApplicable"},SummaryCounts=class{runs=new Set;metrics=new Map;add(score,instant){let spec=score.spec;if(spec===void 0)return;this.runs.add(spec.runId);let key=`${spec.metric}\0${spec.evaluatorVersion}`,counts=this.metrics.get(key);counts===void 0&&(counts={metric:spec.metric,evaluatorVersion:spec.evaluatorVersion,passed:0,failed:0,notGraded:0,pending:0,lastSeen:instant,criteria:new Map},this.metrics.set(key,counts)),instant>counts.lastSeen&&(counts.lastSeen=instant);let outcome2=OUTCOME_OF_STATE[score.status?.state??ScoreState.unspecified](spec.value.case==="passed"&&spec.value.value);outcome2!==void 0&&(counts[outcome2]+=1);for(let criterion of spec.criteria){let tally=counts.criteria.get(criterion.name);tally===void 0&&(tally={passed:0,failed:0,notApplicable:0},counts.criteria.set(criterion.name,tally));let field3=FIELD_OF_CRITERION_RESULT[criterion.result];field3!==void 0&&(tally[field3]+=1)}}build(){let metrics2=[...this.metrics.values()].sort((a5,b7)=>a5.metric!==b7.metric?a5.metric<b7.metric?-1:1:a5.lastSeen!==b7.lastSeen?a5.lastSeen>b7.lastSeen?-1:1:a5.evaluatorVersion<b7.evaluatorVersion?-1:1);return create2(QualitySummarySchema,{runs:this.runs.size,metrics:metrics2.map(m3=>create2(MetricTallySchema,{metric:m3.metric,evaluatorVersion:m3.evaluatorVersion,passed:m3.passed,failed:m3.failed,notGraded:m3.notGraded,pending:m3.pending,criteria:[...m3.criteria.entries()].sort(([a5],[b7])=>a5<b7?-1:a5>b7?1:0).map(([name,c5])=>create2(CriterionTallySchema,{name,passed:c5.passed,failed:c5.failed,notApplicable:c5.notApplicable}))}))})}},AgreementCounts=class{judged=new Map;thumbs=new Map;add(score,instant){let spec=score.spec;if(!(spec===void 0||score.status?.state!==ScoreState.graded||spec.value.case!=="passed")){if(spec.metric===FEEDBACK_METRIC&&spec.source===ScoreSource.human){let runThumbs=this.thumbs.get(spec.runId)??[];runThumbs.push(spec.value.value),this.thumbs.set(spec.runId,runThumbs);return}if(spec.metric===JUDGE_METRIC&&spec.source===ScoreSource.judge){let grades=this.judged.get(spec.runId)??[];grades.push({version:spec.evaluatorVersion,instant,failed:spec.criteria.filter(c5=>c5.result===CriterionResult.failed).map(c5=>c5.name),passed:spec.criteria.filter(c5=>c5.result===CriterionResult.passed).map(c5=>c5.name)}),this.judged.set(spec.runId,grades)}}}build(){let versions2=new Map;for(let[runId,grades]of this.judged){let runThumbs=this.thumbs.get(runId);if(runThumbs!==void 0)for(let grade of grades){let version=versions2.get(grade.version);version===void 0&&(version={runs:0,thumbsDownNoneFailed:0,lastSeen:grade.instant,rules:new Map},versions2.set(grade.version,version)),grade.instant>version.lastSeen&&(version.lastSeen=grade.instant),version.runs+=1,grade.failed.length===0&&runThumbs.some(up=>!up)&&(version.thumbsDownNoneFailed+=1);for(let up of runThumbs){for(let name of grade.failed)ruleOf2(version,name)[up?"failedThumbsUp":"failedThumbsDown"]+=1;for(let name of grade.passed)ruleOf2(version,name)[up?"passedThumbsUp":"passedThumbsDown"]+=1}}}return[...versions2.entries()].sort(([a5,x3],[b7,y])=>x3.lastSeen!==y.lastSeen?x3.lastSeen>y.lastSeen?-1:1:a5<b7?-1:1).map(([evaluatorVersion,v])=>create2(JudgeAgreementSchema,{evaluatorVersion,runs:v.runs,thumbsDownNoneFailed:v.thumbsDownNoneFailed,rules:[...v.rules.entries()].sort(([a5],[b7])=>a5<b7?-1:a5>b7?1:0).map(([name,r5])=>create2(RuleAgreementSchema,{name,...r5}))}))}};function ruleOf2(version,name){let rule=version.rules.get(name);return rule===void 0&&(rule={failedThumbsDown:0,failedThumbsUp:0,passedThumbsDown:0,passedThumbsUp:0},version.rules.set(name,rule)),rule}var QualityTally=class{window;total=new SummaryCounts;agreement=new AgreementCounts;days=new Map;versions=new Map;constructor(window2){this.window=window2}add(score){if(score.spec?.source===ScoreSource.eval)return;let instant=createdInstantOf(score);if(instant===void 0)return;let date2=instant.slice(0,10);if(date2<this.window.fromDate)return;this.total.add(score,instant),this.agreement.add(score,instant);let day=this.days.get(date2);day===void 0&&(day=new SummaryCounts,this.days.set(date2,day)),day.add(score,instant);let hash=score.status?.agentVersionHash??"",version=this.versions.get(hash);version===void 0&&(version={summary:new SummaryCounts,firstSeen:instant,lastSeen:instant},this.versions.set(hash,version)),instant<version.firstSeen&&(version.firstSeen=instant),instant>version.lastSeen&&(version.lastSeen=instant),version.summary.add(score,instant)}build(){return create2(AgentQualityReportSchema,{fromDate:this.window.fromDate,toDate:this.window.toDate,total:this.total.build(),days:[...this.days.entries()].sort(([a5],[b7])=>a5<b7?-1:a5>b7?1:0).map(([date2,summary])=>create2(QualityDaySchema,{date:date2,summary:summary.build()})),versions:[...this.versions.entries()].sort(([,a5],[,b7])=>a5.lastSeen>b7.lastSeen?-1:a5.lastSeen<b7.lastSeen?1:0).map(([hash,v])=>create2(QualityVersionSchema,{agentVersionHash:hash,firstDate:v.firstSeen.slice(0,10),lastDate:v.lastSeen.slice(0,10),summary:v.summary.build()})),agreement:this.agreement.build()})}},QUALITY_REPORT_KEY="agentQualityReport",FLAGGED_SCORES_KEY="flaggedScores";function resolveQualityAgentTarget(ctx){return[{permission:IamPermission.can_view,resourceKind:ApiResourceKind.agent,resourceId:ctx.input.agentId,deniedMessage:QUALITY_AGENT_DENIED_MESSAGE}]}function agentScoresQuery(org,agentId,window2){return{org,anyKey:[{name:"agent",value:agentId}],withoutKeys:["eval_run"],createdAtOrAfter:window2.since}}function decodeScore(data,logger2){try{return fromBinary2(ScoreSchema,data)}catch(error3){logger2.warn("Failed to unmarshal score, skipping",{error:error3 instanceof Error?error3.message:String(error3)});return}}function newTallyAgentQualityStep(deps){return{name:"TallyAgentQuality",async execute(ctx){let window2=qualityWindowOf(ctx.input.days,deps.now()),query=agentScoresQuery(ctx.input.org,ctx.input.agentId,window2),tally=new QualityTally(window2),after,read3=0;for(;;){let rows;try{rows=await deps.store.queryResources(scoreListIndex,{...query,...after===void 0?{}:{after},limit:QUALITY_REPORT_BATCH})}catch(error3){throw internalError(error3,"failed to read the agent's scores")}if(read3+=rows.length,read3>QUALITY_REPORT_MAX_SCORES)throw failedPreconditionError(qualityReportTooLargeMessage(window2.days));for(let row of rows){let score=decodeScore(row.data,deps.logger);score!==void 0&&tally.add(score)}let last=rows[rows.length-1];if(rows.length<QUALITY_REPORT_BATCH||last===void 0)break;after=last.cursor}ctx.set(QUALITY_REPORT_KEY,tally.build())}}}function isFlagged(score){let spec=score.spec;return spec!==void 0&&spec.source!==ScoreSource.eval&&score.status?.state===ScoreState.graded&&spec.value.case==="passed"&&!spec.value.value&&createdInstantOf(score)!==void 0}function newListFlaggedScoresStep(deps){return{name:"ListFlaggedScores",async execute(ctx){let input=ctx.input,window2=qualityWindowOf(input.days,deps.now()),bySession=sessionReadScope(deps.store,deps.logger,deps.listReadScope,ctx.callerIdentity),page=await readListPage({store:deps.store,declaration:scoreListIndex,query:agentScoresQuery(input.org,input.agentId,window2),request:input,fingerprint:listPageFingerprint({lane:"score.listFlaggedByAgent",org:input.org,agentId:input.agentId,days:window2.days,labels:sortedLabels(input.labels)}),decode:data=>decodeScore(data,deps.logger),keep:score=>isFlagged(score)&&matchesAllLabels(score.metadata?.labels??{},input.labels),scope:bySession,failure:"failed to list the agent's flagged scores"});ctx.set(FLAGGED_SCORES_KEY,create2(ScoreListSchema,{entries:page.entries,nextPageToken:page.nextPageToken}))}}}function sessionReadScope(store,logger2,scope,caller){let decided=new Map;return async scores=>{if(scope===void 0||caller.callerClass==="internal")return scores;let unread=[...new Set(scores.map(score=>score.spec?.sessionId??"").filter(id=>!decided.has(id)))];if(unread.length>0){let sessions=[];await Promise.all(unread.map(async id=>{let session=await readSession(store,logger2,id);session===void 0?decided.set(id,!1):sessions.push(session)}));let kept=new Set((await restrictListByReadScope(scope,caller,ApiResourceKind.session,sessions,"")).map(session=>session.metadata?.id??""));for(let session of sessions){let id=session.metadata?.id??"";decided.set(id,kept.has(id))}}return scores.filter(score=>decided.get(score.spec?.sessionId??"")===!0)}}async function readSession(store,logger2,id){if(id!=="")try{return await store.getResource(ApiResourceKind.session,id,SessionSchema)}catch(error3){if(error3 instanceof ResourceNotFoundError){logger2.debug("Flagged score's session is gone, dropping",{sessionId:id});return}throw internalError(error3,"failed to read a flagged score's session")}}var LIST_RESULT_KEY5="listResult",SCORED_RUN_KEY="scoredRun",NOT_GRADED_REASON_KEY="notGradedReason",PENDING_REQUESTED_KEY="pendingRequested",SCORE_EXISTS_REASON="SCORE_EXISTS";function newGuardScoreSourceStep(){return{name:"GuardScoreSource",execute(ctx){let source=ctx.newState.spec?.source??ScoreSource.unspecified;if(source===ScoreSource.unspecified)throw invalidArgumentError("spec.source is required");let rule=SOURCE_RULES[source];if(!rule.admits(ctx.callerIdentity))throw permissionDeniedError(rule.refusal)}}}var SOURCE_RULES={[ScoreSource.human]:{admits:isFirstPartyHumanOperator,refusal:HUMAN_SOURCE_REFUSED_MESSAGE},[ScoreSource.check]:{admits:caller=>caller.callerClass==="internal",refusal:CHECK_SOURCE_REFUSED_MESSAGE},[ScoreSource.judge]:{admits:caller=>caller.callerClass==="internal",refusal:JUDGE_SOURCE_REFUSED_MESSAGE},[ScoreSource.eval]:{admits:caller=>caller.callerClass==="internal",refusal:EVAL_SOURCE_REFUSED_MESSAGE}},SOURCE_METRICS={[ScoreSource.human]:FEEDBACK_METRIC,[ScoreSource.check]:RUN_HEALTH_METRIC,[ScoreSource.judge]:JUDGE_METRIC,[ScoreSource.eval]:EVAL_METRIC};function resolveScoreCreateTargets(ctx){return isServerComposedRequest(ctx.callerIdentity)?[]:[{permission:IamPermission.can_view,resourceKind:ApiResourceKind.run,resourceId:ctx.newState.spec?.runId??"",deniedMessage:SCORE_CREATE_DENIED_MESSAGE}]}function newLoadScoredRunStep(store){return{name:"LoadScoredRun",async execute(ctx){let runId=ctx.newState.spec?.runId??"",run;try{run=await store.getResource(ApiResourceKind.run,runId,RunSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Run",runId):internalError(error3,"failed to load the run to score")}ctx.set(SCORED_RUN_KEY,run)}}}function scoredRunOf(ctx){let run=ctx.get(SCORED_RUN_KEY);if(run===void 0)throw internalError(new Error("scored run not found in context"),"scored run not found in context");return run}function newResolveScoreDefaultsStep(){return{name:"ResolveScoreDefaults",execute(ctx){let score=ctx.newState,metadata=score.metadata,spec=score.spec;if(metadata===void 0||metadata.org==="")throw invalidArgumentError("metadata.org is required for a score");if(spec===void 0)throw internalError(new Error("score spec is nil"),"score spec is nil");let run=scoredRunOf(ctx),runOrg=run.metadata?.org??"";if(metadata.org!==runOrg)throw failedPreconditionError(scoreOrgMismatchMessage(runOrg));let phase=run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED;if(!(spec.source===ScoreSource.eval?isTerminalExecutionPhase(phase):phase===RunPhase.RUN_COMPLETED))throw failedPreconditionError(runNotCompletedMessage(spec.runId));let human=spec.source===ScoreSource.human;if(spec.source===ScoreSource.unspecified||spec.metric!==SOURCE_METRICS[spec.source])throw invalidArgumentError(SCORE_METRIC_SOURCE_MISMATCH_MESSAGE);if(!human&&spec.comment!=="")throw invalidArgumentError(SCORE_COMMENT_HUMAN_ONLY_MESSAGE);if(spec.source!==ScoreSource.judge&&spec.judgeModel!=="")throw invalidArgumentError(SCORE_JUDGE_MODEL_JUDGE_ONLY_MESSAGE);if(human&&spec.value.case===void 0)throw invalidArgumentError(FEEDBACK_VALUE_REQUIRED_MESSAGE);if(human&&spec.criteria.length>0)throw invalidArgumentError(SCORE_CRITERIA_NOT_HUMAN_MESSAGE);if(human&&spec.evaluatorVersion!=="")throw invalidArgumentError(SCORE_EVALUATOR_VERSION_NOT_HUMAN_MESSAGE);spec.sessionId=sessionIdOf(run.spec),assignServerId(ctx,generateId("scr")),metadata.name===""&&metadata.slug===""&&(metadata.name=metadata.id),!human&&spec.value.case===void 0&&(ctx.set(NOT_GRADED_REASON_KEY,score.status?.notGradedReason??""),ctx.set(PENDING_REQUESTED_KEY,score.status?.state===ScoreState.pending))}}}function newCheckScoreUniqueStep(store,logger2){return{name:"CheckScoreUnique",async execute(ctx){let spec=ctx.newState.spec;if(spec===void 0)throw internalError(new Error("score spec is nil"),"score spec is nil");let existing;try{existing=await listRunScores(store,logger2,spec.runId)}catch(error3){throw internalError(error3,"failed to read the run's scores")}let caller=auditActorFor(ctx.callerIdentity).id;for(let score of existing){let other=score.spec;if(other===void 0||other.metric!==spec.metric)continue;let id=score.metadata?.id??"";if(spec.source===ScoreSource.human&&other.source===ScoreSource.human&&creatorOf2(score)===caller)throw alreadyExistsWithReasonError(feedbackExistsMessage(id),{reason:SCORE_EXISTS_REASON,metadata:{score_id:id}});if(spec.source===ScoreSource.check&&other.source===ScoreSource.check&&other.evaluatorVersion===spec.evaluatorVersion)throw alreadyExistsWithReasonError(runHealthExistsMessage(id),{reason:SCORE_EXISTS_REASON,metadata:{score_id:id}});if(spec.source===ScoreSource.judge&&other.source===ScoreSource.judge&&other.evaluatorVersion===spec.evaluatorVersion)throw alreadyExistsWithReasonError(judgeExistsMessage(id),{reason:SCORE_EXISTS_REASON,metadata:{score_id:id}});if(spec.source===ScoreSource.eval&&other.source===ScoreSource.eval&&other.evaluatorVersion===spec.evaluatorVersion)throw alreadyExistsWithReasonError(evalExistsMessage(id),{reason:SCORE_EXISTS_REASON,metadata:{score_id:id}})}}}}function creatorOf2(score){return score.status?.audit?.specAudit?.createdBy?.id??""}function newStampScoredRunStep(){return{name:"StampScoredRun",execute(ctx){let run=scoredRunOf(ctx),score=ctx.newState,status=score.status??create2(ScoreStatusSchema,{});status.agentId=run.status?.agentId??"",status.agentVersionHash=run.status?.agentVersionHash??"",score.status=status;let evalLabel=run.metadata?.labels[EVAL_RUN_LABEL];evalLabel!==void 0&&score.metadata!==void 0&&(score.metadata.labels[EVAL_RUN_LABEL]=evalLabel)}}}function newInitializeScoreStateStep(){return{name:"InitializeScoreState",execute(ctx){let score=ctx.newState;if(score.status===void 0&&(score.status=create2(ScoreStatusSchema,{})),score.spec?.value.case!==void 0){score.status.state=ScoreState.graded,score.status.notGradedReason="";return}if(ctx.get(PENDING_REQUESTED_KEY)===!0){score.status.state=ScoreState.pending,score.status.notGradedReason="";return}score.status.state=ScoreState.not_graded,score.status.notGradedReason=ctx.get(NOT_GRADED_REASON_KEY)??""}}}function newValidateScoreUpdateStep(){return{name:"ValidateScoreUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing score not found in context"),"existing score not found in context");let before=existing.spec,after=ctx.newState.spec;if(before===void 0||before.source!==ScoreSource.human)throw failedPreconditionError(SCORE_UPDATE_HUMAN_ONLY_MESSAGE);if(after===void 0||after.runId!==before.runId||after.sessionId!==before.sessionId||after.metric!==before.metric||after.source!==before.source||after.evaluatorVersion!==before.evaluatorVersion||after.criteria.length!==0||ctx.newState.metadata?.name!==existing.metadata?.name||!sameLabels2(ctx.newState.metadata?.labels,existing.metadata?.labels))throw failedPreconditionError(SCORE_UPDATE_FIELDS_MESSAGE);if(after.value.case===void 0)throw invalidArgumentError(FEEDBACK_VALUE_REQUIRED_MESSAGE)}}}function sameLabels2(a5,b7){let left=Object.entries(a5??{});return left.length===Object.keys(b7??{}).length&&left.every(([key,value])=>(b7??{})[key]===value)}function newListScoresByRunStep(store,logger2){return{name:"ListScoresByRun",async execute(ctx){let runId=ctx.input.runId;ctx.set(LIST_RESULT_KEY5,await readParentScorePage(store,logger2,ctx.input,{key:"run",value:runId,keep:score=>score.spec?.runId===runId,lane:"score.listByRun",failure:"failed to list the run's scores"}))}}}function newListScoresBySessionStep(store,logger2){return{name:"ListScoresBySession",async execute(ctx){let sessionId=ctx.input.sessionId;ctx.set(LIST_RESULT_KEY5,await readParentScorePage(store,logger2,ctx.input,{key:"session",value:sessionId,keep:score=>score.spec?.sessionId===sessionId,lane:"score.listBySession",failure:"failed to list the session's scores"}))}}}async function readParentScorePage(store,logger2,request3,parent){let page=await readListPage({store,declaration:scoreListIndex,query:{anyKey:[{name:parent.key,value:parent.value}]},request:request3,fingerprint:listPageFingerprint({lane:parent.lane,[parent.key]:parent.value,labels:sortedLabels(request3.labels)}),decode:decodeOrSkip(ScoreSchema,{logger:logger2,message:"Failed to unmarshal score, skipping",fields:{[parent.key]:parent.value}}),keep:score=>parent.keep(score)&&matchesAllLabels(score.metadata?.labels??{},request3.labels),scope:scores=>Promise.resolve(scores),failure:parent.failure});return create2(ScoreListSchema,{entries:page.entries,nextPageToken:page.nextPageToken})}function registerScoreServices(router,deps){router.service(ScoreCommandController,{create:(score,ctx)=>createScore(deps,score,ctx),update:(input,ctx)=>updateScore(deps,input,ctx),delete:(id,ctx)=>deleteScore2(deps,id,ctx)}),router.service(ScoreQueryController,{get:(id,ctx)=>getScore(deps,id,ctx),listByRun:(req,ctx)=>listByRun(deps,req,ctx),listBySession:(req,ctx)=>listBySession2(deps,req,ctx),getAgentQualityReport:(req,ctx)=>getAgentQualityReport(deps,req,ctx),listFlaggedByAgent:(req,ctx)=>listFlaggedByAgent(deps,req,ctx)})}function kindOf13(ctx){return ctx.values.get(apiResourceKindKey)}async function createScore(deps,score,ctx){let reqCtx=new RequestContext(ScoreSchema,score,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-create",deps.logger).addStep(newAuthorizeStep(ScoreCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newGuardScoreSourceStep()).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveScoreCreateTargets)).addStep(newLoadScoredRunStep(deps.store)).addStep(newResolveScoreDefaultsStep()).addStep(newCheckScoreUniqueStep(deps.store,deps.logger)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newStampScoredRunStep()).addStep(newInitializeScoreStateStep()).addStep(newClaimNameStep(deps.store,ApiResourceKind.score)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx).catch(releaseNameOnFailure(deps.store,deps.logger,reqCtx)),reqCtx.newState}async function updateScore(deps,input,ctx){return runGuardedWrite(async()=>{let reqCtx=updateContext(ScoreSchema,input,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-update",deps.logger).addStep(newAuthorizeStep(ScoreCommandController.method.update,deps.authorizer,input)).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newValidateProtoStep({of:"state"})).addStep(newValidateScoreUpdateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store,deps.credentialBinding)).build().execute(reqCtx),reqCtx.newState})}async function deleteScore2(deps,id,ctx){let reqCtx=new RequestContext(ScoreIdSchema,id,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-delete",deps.logger).addStep(newAuthorizeStep(ScoreCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,ScoreSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newReleaseNamesStep(deps.store,deps.logger,ApiResourceKind.score)).addStep(newCleanupGrantsStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(EXISTING_RESOURCE_KEY),"deleted score")}async function getScore(deps,id,ctx){let reqCtx=new RequestContext(ScoreIdSchema,id,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-get",deps.logger).addStep(newAuthorizeStep(ScoreQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,ScoreSchema)).build().execute(reqCtx),chainResult2(reqCtx.get(TARGET_RESOURCE_KEY),"target score")}async function listByRun(deps,req,ctx){let input=ScoreQueryController.method.listByRun.input,reqCtx=new RequestContext(input,req,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-list-by-run",deps.logger).addStep(newAuthorizeStep(ScoreQueryController.method.listByRun,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListScoresByRunStep(deps.store,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(LIST_RESULT_KEY5),"score list")}async function listBySession2(deps,req,ctx){let input=ScoreQueryController.method.listBySession.input,reqCtx=new RequestContext(input,req,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-list-by-session",deps.logger).addStep(newAuthorizeStep(ScoreQueryController.method.listBySession,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListScoresBySessionStep(deps.store,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(LIST_RESULT_KEY5),"score list")}async function getAgentQualityReport(deps,req,ctx){let input=ScoreQueryController.method.getAgentQualityReport.input,reqCtx=new RequestContext(input,req,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-agent-quality-report",deps.logger).addStep(newAuthorizeStep(ScoreQueryController.method.getAgentQualityReport,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveQualityAgentTarget)).addStep(newTallyAgentQualityStep(qualityDepsOf(deps))).build().execute(reqCtx),chainResult2(reqCtx.get(QUALITY_REPORT_KEY),"agent quality report")}async function listFlaggedByAgent(deps,req,ctx){let input=ScoreQueryController.method.listFlaggedByAgent.input,reqCtx=new RequestContext(input,req,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-list-flagged-by-agent",deps.logger).addStep(newAuthorizeStep(ScoreQueryController.method.listFlaggedByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveQualityAgentTarget)).addStep(newListFlaggedScoresStep(qualityDepsOf(deps))).build().execute(reqCtx),chainResult2(reqCtx.get(FLAGGED_SCORES_KEY),"flagged score list")}function qualityDepsOf(deps){return{store:deps.store,logger:deps.logger,listReadScope:deps.listReadScope,now:deps.now??(()=>new Date)}}function chainResult2(value,what){if(value===void 0)throw internalError(new Error(`${what} not found in context`),`${what} not found in context`);return value}var SCORING_RULE_EXISTS_REASON="SCORING_RULE_EXISTS",SCORING_RULE_CREATE_DENIED_MESSAGE="unauthorized to configure grading for agent";function scoringRuleExistsMessage(scoringRuleId){return`this agent already has a scoring rule (scoring rule ${scoringRuleId}); update that scoring rule instead`}function scoringRuleOrgMismatchMessage(agentOrg){return`metadata.org must be the agent's organization (${agentOrg})`}var SCORING_RULE_AGENT_IMMUTABLE_MESSAGE="spec.agent_id of a scoring rule cannot change; delete it and create one for the other agent";function noScoringRuleMessage(agentId){return`agent ${agentId} has no scoring rule: AI grading is off`}var EVALUATED_AGENT_KEY="evaluatedAgent",SCORING_RULE_RESULT_KEY="scoringRuleResult";function resolveScoringRuleCreateTargets(ctx){return isServerComposedRequest(ctx.callerIdentity)?[]:[{permission:IamPermission.can_edit,resourceKind:ApiResourceKind.agent,resourceId:ctx.newState.spec?.agentId??"",deniedMessage:SCORING_RULE_CREATE_DENIED_MESSAGE}]}function newLoadEvaluatedAgentStep(store){return{name:"LoadEvaluatedAgent",async execute(ctx){let agentId=ctx.newState.spec?.agentId??"",agent;try{agent=await store.getResource(ApiResourceKind.agent,agentId,AgentSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Agent",agentId):internalError(error3,"failed to load the agent to grade")}ctx.set(EVALUATED_AGENT_KEY,agent)}}}function newResolveScoringRuleDefaultsStep(){return{name:"ResolveScoringRuleDefaults",execute(ctx){let metadata=ctx.newState.metadata;if(metadata===void 0||metadata.org==="")throw invalidArgumentError("metadata.org is required for a scoring rule");let agent=ctx.get(EVALUATED_AGENT_KEY);if(agent===void 0)throw internalError(new Error("evaluated agent not found in context"),"evaluated agent not found in context");let agentOrg=agent.metadata?.org??"";if(metadata.org!==agentOrg)throw failedPreconditionError(scoringRuleOrgMismatchMessage(agentOrg));assignServerId(ctx,generateId("srl")),metadata.name===""&&metadata.slug===""&&(metadata.name=metadata.id)}}}function newCheckScoringRuleUniqueStep(store,logger2){return{name:"CheckScoringRuleUnique",async execute(ctx){let agentId=ctx.newState.spec?.agentId??"",existing;try{existing=await listAgentScoringRules(store,logger2,agentId)}catch(error3){throw internalError(error3,"failed to read the agent's scoring rule")}let first=existing[0];if(first!==void 0){let id=first.metadata?.id??"";throw alreadyExistsWithReasonError(scoringRuleExistsMessage(id),{reason:SCORING_RULE_EXISTS_REASON,metadata:{scoring_rule_id:id}})}}}}function newValidateScoringRuleUpdateStep(){return{name:"ValidateScoringRuleUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing scoring rule not found in context"),"existing scoring rule not found in context");if(ctx.newState.spec?.agentId!==existing.spec?.agentId)throw failedPreconditionError(SCORING_RULE_AGENT_IMMUTABLE_MESSAGE)}}}function newPersistScoringRuleSettingsStep(store,binding){return{name:"PersistScoringRuleSettings",async execute(ctx){await refuseBoundElsewhere(binding,ctx.callerIdentity,ctx.newState.metadata?.org??""),await swapOntoLoadedRow(store,ctx,"failed to save the scoring rule")}}}function newGetScoringRuleByAgentStep(store,logger2){return{name:"GetScoringRuleByAgent",async execute(ctx){let agentId=ctx.input.agentId,scoringRules;try{scoringRules=await listAgentScoringRules(store,logger2,agentId)}catch(error3){throw internalError(error3,"failed to read the agent's scoring rule")}let scoringRule=scoringRules[0];if(scoringRule===void 0)throw new ConnectError(noScoringRuleMessage(agentId),Code.NotFound);ctx.set(SCORING_RULE_RESULT_KEY,scoringRule)}}}function registerScoringRuleServices(router,deps){router.service(ScoringRuleCommandController,{create:(scoringRule,ctx)=>createScoringRule(deps,scoringRule,ctx),update:(input,ctx)=>updateScoringRule(deps,input,ctx),delete:(id,ctx)=>deleteScoringRule(deps,id,ctx)}),router.service(ScoringRuleQueryController,{get:(id,ctx)=>getScoringRule(deps,id,ctx),getByAgent:(req,ctx)=>getByAgent(deps,req,ctx)})}function kindOf14(ctx){return ctx.values.get(apiResourceKindKey)}async function createScoringRule(deps,scoringRule,ctx){let reqCtx=new RequestContext(ScoringRuleSchema,scoringRule,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("scoring-rule-create",deps.logger).addStep(newAuthorizeStep(ScoringRuleCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveScoringRuleCreateTargets)).addStep(newLoadEvaluatedAgentStep(deps.store)).addStep(newResolveScoringRuleDefaultsStep()).addStep(newCheckScoringRuleUniqueStep(deps.store,deps.logger)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newClaimNameStep(deps.store,ApiResourceKind.scoring_rule)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx).catch(releaseNameOnFailure(deps.store,deps.logger,reqCtx)),reqCtx.newState}async function updateScoringRule(deps,input,ctx){return runGuardedWrite(async()=>{let reqCtx=updateContext(ScoringRuleSchema,input,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("scoring-rule-update",deps.logger).addStep(newAuthorizeStep(ScoringRuleCommandController.method.update,deps.authorizer,input)).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newValidateProtoStep({of:"state"})).addStep(newValidateScoringRuleUpdateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistScoringRuleSettingsStep(deps.store,deps.credentialBinding)).build().execute(reqCtx),reqCtx.newState})}async function deleteScoringRule(deps,id,ctx){let reqCtx=new RequestContext(ScoringRuleIdSchema,id,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("scoring-rule-delete",deps.logger).addStep(newAuthorizeStep(ScoringRuleCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,ScoringRuleSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newReleaseNamesStep(deps.store,deps.logger,ApiResourceKind.scoring_rule)).addStep(newCleanupGrantsStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(EXISTING_RESOURCE_KEY),"deleted scoring rule")}async function getScoringRule(deps,id,ctx){let reqCtx=new RequestContext(ScoringRuleIdSchema,id,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("scoring-rule-get",deps.logger).addStep(newAuthorizeStep(ScoringRuleQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,ScoringRuleSchema)).build().execute(reqCtx),chainResult2(reqCtx.get(TARGET_RESOURCE_KEY),"target scoring rule")}async function getByAgent(deps,req,ctx){let input=ScoringRuleQueryController.method.getByAgent.input,reqCtx=new RequestContext(input,req,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("scoring-rule-get-by-agent",deps.logger).addStep(newAuthorizeStep(ScoringRuleQueryController.method.getByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newGetScoringRuleByAgentStep(deps.store,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(SCORING_RULE_RESULT_KEY),"scoring rule")}var file_ai_stigmer_agentic_evalrun_v1_command=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvZXZhbHJ1bi92MS9jb21tYW5kLnByb3RvEh1haS5zdGlnbWVyLmFnZW50aWMuZXZhbHJ1bi52MTKeAwoYRXZhbFJ1bkNvbW1hbmRDb250cm9sbGVyEl4KBmNyZWF0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFscnVuLnYxLkV2YWxSdW4aJi5haS5zdGlnbWVyLmFnZW50aWMuZXZhbHJ1bi52MS5FdmFsUnVuIgTQuBgBEowBCgZjYW5jZWwSKC5haS5zdGlnbWVyLmFnZW50aWMuZXZhbHJ1bi52MS5FdmFsUnVuSWQaJi5haS5zdGlnbWVyLmFnZW50aWMuZXZhbHJ1bi52MS5FdmFsUnVuIjDCuBgsCAIQQSIFdmFsdWUqH3VuYXV0aG9yaXplZCB0byBjYW5jZWwgZXZhbCBydW4SjAEKBmRlbGV0ZRIoLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFscnVuLnYxLkV2YWxSdW5JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFscnVuLnYxLkV2YWxSdW4iMMK4GCwIAxBBIgV2YWx1ZSofdW5hdXRob3JpemVkIHRvIGRlbGV0ZSBldmFsIHJ1bhoEoP8rQWIGcHJvdG8z",[file_ai_stigmer_agentic_evalrun_v1_api,file_ai_stigmer_agentic_evalrun_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EvalRunCommandController=serviceDesc(file_ai_stigmer_agentic_evalrun_v1_command,0);var file_ai_stigmer_agentic_evalrun_v1_query=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvZXZhbHJ1bi92MS9xdWVyeS5wcm90bxIdYWkuc3RpZ21lci5hZ2VudGljLmV2YWxydW4udjEykwQKFkV2YWxSdW5RdWVyeUNvbnRyb2xsZXIShgEKA2dldBIoLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFscnVuLnYxLkV2YWxSdW5JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFscnVuLnYxLkV2YWxSdW4iLcK4GCkIARBBIgV2YWx1ZSocdW5hdXRob3JpemVkIHRvIGdldCBldmFsIHJ1bhKxAQoLbGlzdEJ5QWdlbnQSOS5haS5zdGlnbWVyLmFnZW50aWMuZXZhbHJ1bi52MS5MaXN0RXZhbFJ1bnNCeUFnZW50UmVxdWVzdBoqLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFscnVuLnYxLkV2YWxSdW5MaXN0IjvCuBg3CAEQKCIIYWdlbnRfaWQqJ3VuYXV0aG9yaXplZCB0byBsaXN0IGV2YWwgcnVucyBvZiBhZ2VudBK1AQoMbGlzdEJ5UGx1Z2luEjouYWkuc3RpZ21lci5hZ2VudGljLmV2YWxydW4udjEuTGlzdEV2YWxSdW5zQnlQbHVnaW5SZXF1ZXN0GiouYWkuc3RpZ21lci5hZ2VudGljLmV2YWxydW4udjEuRXZhbFJ1bkxpc3QiPcK4GDkIARA6IglwbHVnaW5faWQqKHVuYXV0aG9yaXplZCB0byBsaXN0IGV2YWwgcnVucyBvZiBwbHVnaW4aBKD/K0FiBnByb3RvMw",[file_ai_stigmer_agentic_evalrun_v1_api,file_ai_stigmer_agentic_evalrun_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EvalRunQueryController=serviceDesc(file_ai_stigmer_agentic_evalrun_v1_query,0);var EVAL_RUN_VAULT_ATTACHMENTS={surface:"an eval run, whose tries every viewer of its agent or plugin can read",allowsOwnersMyVault:!1,attachers:{get:row=>row.status?.vaultAttachers,set:(row,attachers)=>{(row.status??=create2(EvalRunStatusSchema)).vaultAttachers=attachers}}};function registerEvalRunServices(router,deps){router.service(EvalRunCommandController,{create:(evalRun,ctx)=>createEvalRun(deps,evalRun,ctx),cancel:(id,ctx)=>cancelEvalRun(deps,id,ctx),delete:(id,ctx)=>deleteEvalRun2(deps,id,ctx)}),router.service(EvalRunQueryController,{get:(id,ctx)=>getEvalRun(deps,id,ctx),listByAgent:(req,ctx)=>listByAgent3(deps,req,ctx),listByPlugin:(req,ctx)=>listByPlugin(deps,req,ctx)})}function evalRunHarnesses(run){return(run.spec?.targets??[]).map((target,index2)=>({field:`spec.targets[${index2}].harness`,harness:target.harness}))}function kindOf15(ctx){return ctx.values.get(apiResourceKindKey)}async function createEvalRun(deps,evalRun,ctx){let reqCtx=new RequestContext(EvalRunSchema,evalRun,callerIdentityOf(ctx),kindOf15(ctx));return await newPipeline("eval-run-create",deps.logger).addStep(newAuthorizeStep(EvalRunCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newNormalizeReferencesStep(deps.store)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveEvalRunCreateTargets)).addStep(newLoadEvalRunSubjectStep(deps.store)).addStep(newResolveEvalRunDefaultsStep(deps.store,deps.authorizer)).addStep(newRefuseUnofferedHarnessStep(evalRunHarnesses)).addStep(newValidateEvalRunTargetsStep(deps.modelCatalog)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newValidateReferencesStep(deps.store,deps.authorizer)).addStep(newVaultAttachmentsStep(deps.store,deps.authorizer,EVAL_RUN_VAULT_ATTACHMENTS)).addStep(newPlanEvalRunStep(deps.suites,deps.modelCatalog)).addStep(newClaimNameStep(deps.store,ApiResourceKind.eval_run)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newEnsureEvalRunSubjectStillExistsStep(deps.store,deps.authorizationLifecycle,deps.logger)).addStep(newStartEvalRunWorkflowStep(deps.store,deps.workflows,deps.logger)).build().execute(reqCtx).catch(releaseNameOnFailure(deps.store,deps.logger,reqCtx)),reqCtx.newState}async function cancelEvalRun(deps,id,ctx){let reqCtx=new RequestContext(EvalRunIdSchema,id,callerIdentityOf(ctx),kindOf15(ctx));return await newPipeline("eval-run-cancel",deps.logger).addStep(newAuthorizeStep(EvalRunCommandController.method.cancel,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,EvalRunSchema)).addStep(newCancelEvalRunStep(deps.store,deps.workflows)).build().execute(reqCtx),chainResult2(reqCtx.get(EVAL_RUN_RESULT_KEY),"cancelled eval run")}async function deleteEvalRun2(deps,id,ctx){let reqCtx=new RequestContext(EvalRunIdSchema,id,callerIdentityOf(ctx),kindOf15(ctx));return await newPipeline("eval-run-delete",deps.logger).addStep(newAuthorizeStep(EvalRunCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,EvalRunSchema)).addStep(newRefuseActiveEvalRunDeleteStep()).addStep(newDeleteEvalRunTriesStep(deps.store,deps.sessions,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newReleaseNamesStep(deps.store,deps.logger,ApiResourceKind.eval_run)).addStep(newCleanupGrantsStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(EXISTING_RESOURCE_KEY),"deleted eval run")}async function getEvalRun(deps,id,ctx){let reqCtx=new RequestContext(EvalRunIdSchema,id,callerIdentityOf(ctx),kindOf15(ctx));return await newPipeline("eval-run-get",deps.logger).addStep(newAuthorizeStep(EvalRunQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,EvalRunSchema)).addStep(newSettleEndedEvalRunStep(deps.store)).build().execute(reqCtx),chainResult2(reqCtx.get(TARGET_RESOURCE_KEY),"target eval run")}async function listByAgent3(deps,req,ctx){let input=EvalRunQueryController.method.listByAgent.input,reqCtx=new RequestContext(input,req,callerIdentityOf(ctx),kindOf15(ctx));return await newPipeline("eval-run-list-by-agent",deps.logger).addStep(newAuthorizeStep(EvalRunQueryController.method.listByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListEvalRunsBySubjectStep("agent",deps.store,deps.authorizer,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(EVAL_RUN_RESULT_KEY),"eval runs of agent")}async function listByPlugin(deps,req,ctx){let input=EvalRunQueryController.method.listByPlugin.input,reqCtx=new RequestContext(input,req,callerIdentityOf(ctx),kindOf15(ctx));return await newPipeline("eval-run-list-by-plugin",deps.logger).addStep(newAuthorizeStep(EvalRunQueryController.method.listByPlugin,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListEvalRunsBySubjectStep("plugin",deps.store,deps.authorizer,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(EVAL_RUN_RESULT_KEY),"eval runs of plugin")}var import_client77=__toESM(require_lib3(),1);var GRADING_START_DEADLINE_MS=2e3,GRADE_RUN_EXECUTION_TIMEOUT="60 minutes";function newGradingObserver(deps){let deadlineMs=deps.startDeadlineMs??GRADING_START_DEADLINE_MS;return async({run,newPhase})=>{if(newPhase!==RunPhase.RUN_COMPLETED||isJudgeRun(run)||isEvalRun(run)||run.spec?.reconcileFileReview===!0)return;let runId=run.metadata?.id??"",client=deps.client();if(client===void 0){await recordNotStarted(deps,run,"no engine connection");return}try{await client.connection.withDeadline(Date.now()+deadlineMs,()=>client.workflow.start(GRADE_RUN_WORKFLOW_TYPE,{workflowId:gradeRunWorkflowId(runId),taskQueue:deps.config.stigmerQueue,workflowIdReusePolicy:"REJECT_DUPLICATE",workflowExecutionTimeout:GRADE_RUN_EXECUTION_TIMEOUT,args:[runId]}))}catch(error3){if(error3 instanceof import_client77.WorkflowExecutionAlreadyStartedError)return;await recordNotStarted(deps,run,error3 instanceof Error?error3.message:String(error3))}}}async function recordNotStarted(deps,run,cause){deps.logger.warn("grading could not start; recording the run as not graded",{runId:run.metadata?.id??"",cause}),await recordRunHealth(deps.recorder(),notGradedRunHealthScore(run,GRADING_NOT_STARTED_REASON))}var file_ai_stigmer_iam_oauthapp_v1_io=fileDesc("CiNhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9pby5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEiJgoKT0F1dGhBcHBJZBIYCgV2YWx1ZRgBIAEoCUIJukgGcgQQARhAIlsKCU9BdXRoQXBwcxI1CgdlbnRyaWVzGAEgAygLMiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHASFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJIt8BChJMaXN0T0F1dGhBcHBzSW5wdXQSFAoDb3JnGAEgASgJQge6SARyAhABEhoKCXBhZ2Vfc2l6ZRgCIAEoBUIHukgEGgIoABIcCgpwYWdlX3Rva2VuGAMgASgJQgi6SAVyAxiACBJKCgZsYWJlbHMYBCADKAsyOi5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5MaXN0T0F1dGhBcHBzSW5wdXQuTGFiZWxzRW50cnkaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASLSAgoTVXBkYXRlT0F1dGhBcHBJbnB1dBI+CghyZXNvdXJjZRgBIAEoCzIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwQga6SAPYAQMSNwoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQga6SAPIAQE6wQG6SL0BGroBChd1cGRhdGVfbmFtZXNfaXRzX3RhcmdldBJJcmVzb3VyY2UubWV0YWRhdGEuaWQgaXMgcmVxdWlyZWQ6IGFuIHVwZGF0ZSBuYW1lcyB0aGUgT0F1dGggYXBwIGJ5IGl0cyBpZBpUaGFzKHRoaXMucmVzb3VyY2UpICYmIGhhcyh0aGlzLnJlc291cmNlLm1ldGFkYXRhKSAmJiB0aGlzLnJlc291cmNlLm1ldGFkYXRhLmlkICE9ICcnYgZwcm90bzM",[file_ai_stigmer_iam_oauthapp_v1_api,file_buf_validate_validate,file_google_protobuf_field_mask2]);var OAuthAppsSchema=messageDesc2(file_ai_stigmer_iam_oauthapp_v1_io,1);var UpdateOAuthAppInputSchema=messageDesc2(file_ai_stigmer_iam_oauthapp_v1_io,3);var file_ai_stigmer_iam_oauthapp_v1_command=fileDesc("CihhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9jb21tYW5kLnByb3RvEhphaS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MTL5BQoZT0F1dGhBcHBDb21tYW5kQ29udHJvbGxlchJTCgVhcHBseRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHASowEKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiTcK4GEkIFxAeIgxtZXRhZGF0YS5vcmcqNXVuYXV0aG9yaXplZCB0byBjcmVhdGUgb2F1dGggYXBwIGluIHRoaXMgb3JnYW5pemF0aW9uEqEBCgZ1cGRhdGUSLy5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5VcGRhdGVPQXV0aEFwcElucHV0GiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiQMK4GDwIAhAWIhRyZXNvdXJjZS5tZXRhZGF0YS5pZCogdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBvYXV0aCBhcHASlAEKBnJlbmFtZRIrLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5SZW5hbWVJbnB1dBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAMQFiILcmVzb3VyY2VfaWQqIHVuYXV0aG9yaXplZCB0byByZW5hbWUgT0F1dGggYXBwEp8BCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAMQFiILcmVzb3VyY2VfaWQqIHVuYXV0aG9yaXplZCB0byBkZWxldGUgb2F1dGggYXBwGgSg/ysWYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api,file_ai_stigmer_iam_oauthapp_v1_io]),OAuthAppCommandController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_command,0);var file_ai_stigmer_iam_oauthapp_v1_query=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9xdWVyeS5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEyxgMKF09BdXRoQXBwUXVlcnlDb250cm9sbGVyEosBCgNnZXQSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIi/CuBgrCAEQFiIFdmFsdWUqHnVuYXV0aG9yaXplZCB0byB2aWV3IG9hdXRoIGFwcBJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIgTQuBgBEqIBCgRsaXN0Ei4uYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuTGlzdE9BdXRoQXBwc0lucHV0GiUuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHBzIkPCuBg/CAEQHiIDb3JnKjR1bmF1dGhvcml6ZWQgdG8gbGlzdCBvYXV0aCBhcHBzIGluIHRoaXMgb3JnYW5pemF0aW9uGgSg/ysWYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api,file_ai_stigmer_iam_oauthapp_v1_io]),OAuthAppQueryController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_query,0);var DROPPED_ADDRESSES_KEY="oauthapp.droppedAddresses";function newNormalizeAddressesStep(){return{name:"NormalizeAddresses",execute(ctx){let spec=ctx.newState.spec,normalized=[];for(let[index2,address]of(spec?.addresses??[]).entries()){let value;try{value=normalizeAddress(address)}catch(error3){throw error3 instanceof InvalidAddressError?invalidArgumentError(`spec.addresses[${index2}]: ${error3.message}`):error3}if(normalized.includes(value))throw invalidArgumentError(`spec.addresses[${index2}] is the same address as an earlier one once normalized: list each address once`);normalized.push(value)}spec!==void 0&&(spec.addresses=normalized)}}}function newClaimAddressesStep(store,mode){return{name:"ClaimAddresses",async execute(ctx){let app=ctx.newState,before=(mode==="update"?ctx.get(EXISTING_RESOURCE_KEY):void 0)?.spec?.addresses??[],after=app.spec?.addresses??[],added=after.filter(address=>!before.includes(address));ctx.set(DROPPED_ADDRESSES_KEY,before.filter(address=>!after.includes(address)));let org=app.metadata?.org??"",id=app.metadata?.id??"",claimed=[];for(let address of added){if(!await claimAddress(store,org,id,address)){for(let done of claimed)await store.resourceNames.releaseName(oauthAppAddressKey(org,done),id);throw new ConnectError(`the address ${address} already belongs to another login app in this organization: remove it there first`,Code.AlreadyExists)}claimed.push(address)}}}}function newReleaseDroppedAddressesStep(store,logger2){return{name:"ReleaseDroppedAddresses",async execute(ctx){let dropped=ctx.get(DROPPED_ADDRESSES_KEY)??[],org=ctx.newState.metadata?.org??"",id=ctx.newState.metadata?.id??"";for(let address of dropped)try{await store.resourceNames.releaseName(oauthAppAddressKey(org,address),id)}catch(error3){logger2.warn("an address a login app dropped could not be released",{oauthAppId:id,error:error3 instanceof Error?error3.message:String(error3)})}}}}function newReleaseAddressesStep(store,logger2){return{name:"ReleaseAddresses",async execute(ctx){let app=ctx.get(EXISTING_RESOURCE_KEY),id=app?.metadata?.id??"";try{await store.resourceNames.release(OAUTH_APP_ADDRESS_NAME_KIND,app?.metadata?.org??"",id)}catch(error3){logger2.warn("a deleted login app's addresses could not be released",{oauthAppId:id,error:error3 instanceof Error?error3.message:String(error3)})}}}}async function claimAddress(store,org,id,address){return(await claimName(store,oauthAppAddressKey(org,address),id,new Date,{holds:async()=>await findOrganizationApp(store,org,address)!==void 0})).claimed}var REDACTED_MARKER3="***REDACTED***",MARKER_ON_CREATE_MESSAGE="cannot use the redaction marker as client_secret on create",PRESERVE_NO_EXISTING_SECRET_MESSAGE="cannot preserve client_secret: no existing secret value found",CIPHERTEXT_SHAPED_SECRET_MESSAGE="client_secret must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients";function newCheckLoginEndpointsStep(){return{name:"CheckLoginEndpoints",execute(ctx){let spec=ctx.newState.spec;for(let[field3,value]of[["authorization_url",spec?.authorizationUrl??""],["token_url",spec?.tokenUrl??""],["userinfo_url",spec?.userinfoUrl??""]]){let problem=value===""?void 0:loginEndpointProblem(value);if(problem!==void 0)throw invalidArgumentError(`spec.${field3} ${problem}`)}}}}function redactOAuthApp(app){app.spec!==void 0&&app.spec.clientSecret!==""&&(app.spec.clientSecret=REDACTED_MARKER3)}function newEncryptClientSecretForCreateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!0)}function newEncryptClientSecretForUpdateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!1)}function newEncryptClientSecretStep(secretService,logger2,isCreate){return{name:"EncryptClientSecret",async execute(ctx){let app=ctx.newState;if(app.spec===void 0)return;let clientSecret=app.spec.clientSecret;if(clientSecret==="")return;if(clientSecret===REDACTED_MARKER3){preserveExistingSecret(ctx,app,isCreate,logger2);return}let existing=ctx.get(EXISTING_RESOURCE_KEY);if(!(!isCreate&&clientSecret===existing?.spec?.clientSecret)){if(isCiphertextShaped(clientSecret))throw invalidArgumentError(CIPHERTEXT_SHAPED_SECRET_MESSAGE);if(!secretService.isEnabled()){logger2.warn("encryption disabled: client_secret will be stored in plaintext");return}try{app.spec.clientSecret=await secretService.encrypt(clientSecret,EncryptionScope.forOrganization(app.metadata?.org??""))}catch(error3){throw internalError(error3,"failed to encrypt client_secret")}}}}}function preserveExistingSecret(ctx,app,isCreate,logger2){if(isCreate)throw invalidArgumentError(MARKER_ON_CREATE_MESSAGE);let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not loaded"),"cannot preserve client_secret: existing resource not loaded");let existingSecret=existing.spec?.clientSecret??"";if(existingSecret==="")throw invalidArgumentError(PRESERVE_NO_EXISTING_SECRET_MESSAGE);app.spec!==void 0&&(app.spec.clientSecret=existingSecret),logger2.debug("preserved existing encrypted client_secret",{oauthAppId:app.metadata?.id??""})}var oauthAppListIndex=declareListIndex({kind:ApiResourceKind.oauth_app,schema:OAuthAppSchema,revision:1,keys:{}});function registerOAuthAppServices(router,deps){router.service(OAuthAppCommandController,{apply:(app,ctx)=>apply7(deps,app,ctx),create:(app,ctx)=>createOAuthApp(deps,app,ctx),update:(input,ctx)=>update10(deps,input,ctx),rename:(input,ctx)=>rename7(deps,input,ctx),delete:(input,ctx)=>deleteOAuthApp(deps,input,ctx)}),router.service(OAuthAppQueryController,{get:(id,ctx)=>get13(deps,id,ctx),getByReference:(ref,ctx)=>getByReference7(deps,ref,ctx),list:(req,ctx)=>list12(deps,req,ctx)})}function kindOf16(ctx){return ctx.values.get(apiResourceKindKey)}async function createOAuthApp(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("oauthapp-create",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEncryptClientSecretForCreateStep(deps.secretService,deps.logger)).addStep(newBuildNewStateStep()).addStep(newCheckLoginEndpointsStep()).addStep(newNormalizeAddressesStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newClaimNameStep(deps.store,ApiResourceKind.oauth_app)).addStep(newClaimAddressesStep(deps.store,"create")).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx).catch(releaseNameOnFailure(deps.store,deps.logger,reqCtx));let result=reqCtx.newState;return redactOAuthApp(result),result}async function update10(deps,input,ctx){return runGuardedWrite(async()=>{let reqCtx=updateContext(OAuthAppSchema,input,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("oauthapp-update",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.update,deps.authorizer,input)).addStep(newResolveSlugStep({update:!0})).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newValidateProtoStep({of:"state"})).addStep(newCheckLoginEndpointsStep()).addStep(newNormalizeAddressesStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newEncryptClientSecretForUpdateStep(deps.secretService,deps.logger)).addStep(newClaimAddressesStep(deps.store,"update")).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newReleaseDroppedAddressesStep(deps.store,deps.logger)).build().execute(reqCtx);let result=reqCtx.newState;return redactOAuthApp(result),result})}async function rename7(deps,input,ctx){let renamed=await renameResource({method:OAuthAppCommandController.method.rename,names:deps.store,rows:storeRenameRows(deps.store,ApiResourceKind.oauth_app,OAuthAppSchema),authorizer:deps.authorizer,credentialBinding:deps.credentialBinding,logger:deps.logger},input,callerIdentityOf(ctx),kindOf16(ctx));return redactOAuthApp(renamed),renamed}async function apply7(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("oauthapp-apply",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOAuthApp(deps,app,ctx):update10(deps,everyPathUpdate(UpdateOAuthAppInputSchema,withResolvedApplyId(OAuthAppSchema,app,reqCtx)),ctx)}async function deleteOAuthApp(deps,input,ctx){let reqCtx=new RequestContext(OAuthAppCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf16(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("oauthapp-delete",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,OAuthAppSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newReleaseNamesStep(deps.store,deps.logger,ApiResourceKind.oauth_app)).addStep(newReleaseAddressesStep(deps.store,deps.logger)).addStep(newCleanupGrantsStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,app2=>app2.spec===void 0?[]:[app2.spec.clientSecret])).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted OAuthApp not found in context"),"deleted OAuthApp not found in context");let app=deleted;return redactOAuthApp(app),app}async function get13(deps,id,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("oauthapp-get",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OAuthAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}async function getByReference7(deps,ref,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("oauthapp-get-by-reference",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,OAuthAppSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(OAuthAppQueryController.method.get))).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}var LIST_RESULT_KEY6="listResult";async function list12(deps,req,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("oauthapp-list",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListStep3(deps.store,deps.listReadScope,deps.logger)).build().execute(reqCtx);let list18=reqCtx.get(LIST_RESULT_KEY6);if(list18===void 0)throw internalError(new Error("list result missing from pipeline context"),"OAuthApp list not found in context");return list18}function newListStep3(store,listReadScope,logger2){return{name:"ListByOrg",async execute(ctx){let org=ctx.input.org,page=await readListPage({store,declaration:oauthAppListIndex,query:{org},request:{pageSize:ctx.input.pageSize,pageToken:ctx.input.pageToken},fingerprint:listPageFingerprint({org,labels:sortedLabels(ctx.input.labels)}),decode:decodeOrSkip(OAuthAppSchema,{logger:logger2,message:"failed to unmarshal OAuthApp, skipping"}),keep:app=>(app.metadata?.org??"")===org&&matchesAllLabels(app.metadata?.labels??{},ctx.input.labels),scope:rows=>restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.oauth_app,rows,""),failure:"failed to list OAuthApps"});for(let app of page.entries)redactOAuthApp(app);ctx.set(LIST_RESULT_KEY6,create2(OAuthAppsSchema,{entries:page.entries,nextPageToken:page.nextPageToken}))}}}var file_ai_stigmer_iam_token_v1_token=fileDesc("CiNhaS9zdGlnbWVyL2lhbS90b2tlbi92MS90b2tlbi5wcm90bxIXYWkuc3RpZ21lci5pYW0udG9rZW4udjEihgEKFE1pbnRVc2VyVG9rZW5SZXF1ZXN0EhYKA29yZxgBIAEoCUIJukgGcgQQARhAEhsKB3VzZXJfaWQYAiABKAlCCrpIB3IFEAEYgAISHAoKdXNlcl9lbWFpbBgDIAEoCUIIukgFcgMYwAISGwoJdXNlcl9uYW1lGAQgASgJQgi6SAVyAxiAAiJVChVNaW50VXNlclRva2VuUmVzcG9uc2USFAoMYWNjZXNzX3Rva2VuGAEgASgJEhIKCnRva2VuX3R5cGUYAiABKAkSEgoKZXhwaXJlc19pbhgDIAEoBSK8AwoVTWludEd1ZXN0VG9rZW5SZXF1ZXN0Eh4KCmNoYW5uZWxfaWQYASABKAlCCrpIB3IFEAEYgAESFwoPZ3Vlc3RfY29va2llX2lkGAIgASgJEssCCgxlbWJlZF9vcmlnaW4YAyABKAlCtAK6SLACugGsAgoTZW1iZWRfb3JpZ2luLmZvcm1hdBJ3ZW1iZWRfb3JpZ2luIG11c3QgYmUgZW1wdHksICJudWxsIiwgb3IgYW4gZXhhY3Qgd2ViIG9yaWdpbiBsaWtlIGh0dHBzOi8vZXhhbXBsZS5jb20gKG5vIHBhdGgsIHF1ZXJ5LCBvciB0cmFpbGluZyBzbGFzaCkamwF0aGlzID09ICcnIHx8IHRoaXMgPT0gJ251bGwnIHx8IHRoaXMubWF0Y2hlcygnXmh0dHBzPzovL1tBLVphLXowLTldKFtBLVphLXowLTktXSpbQS1aYS16MC05XSk/KFxcLltBLVphLXowLTldKFtBLVphLXowLTktXSpbQS1aYS16MC05XSk/KSooOlswLTldezEsNX0pPyQnKRIcCgpsaW5rX3Rva2VuGAQgASgJQgi6SAVyAxiAASJvChZNaW50R3Vlc3RUb2tlblJlc3BvbnNlEhQKDGFjY2Vzc190b2tlbhgBIAEoCRISCgp0b2tlbl90eXBlGAIgASgJEhIKCmV4cGlyZXNfaW4YAyABKAUSFwoPZ3Vlc3RfY29va2llX2lkGAQgASgJMr8CCgxUb2tlblNlcnZpY2UStQEKDW1pbnRVc2VyVG9rZW4SLS5haS5zdGlnbWVyLmlhbS50b2tlbi52MS5NaW50VXNlclRva2VuUmVxdWVzdBouLmFpLnN0aWdtZXIuaWFtLnRva2VuLnYxLk1pbnRVc2VyVG9rZW5SZXNwb25zZSJFwrgYQQg5EB4iA29yZyo2dW5hdXRob3JpemVkIHRvIG1pbnQgdXNlciB0b2tlbnMgZm9yIHRoaXMgb3JnYW5pemF0aW9uEncKDm1pbnRHdWVzdFRva2VuEi4uYWkuc3RpZ21lci5pYW0udG9rZW4udjEuTWludEd1ZXN0VG9rZW5SZXF1ZXN0Gi8uYWkuc3RpZ21lci5pYW0udG9rZW4udjEuTWludEd1ZXN0VG9rZW5SZXNwb25zZSIEyLgYAWIGcHJvdG8z",[file_ai_stigmer_commons_rpc_method_options,file_buf_validate_validate]);var MintUserTokenResponseSchema=messageDesc2(file_ai_stigmer_iam_token_v1_token,1);var TokenService=serviceDesc(file_ai_stigmer_iam_token_v1_token,0);var import_node_crypto38=require("node:crypto");var PLATFORM_TOKEN_KEY_ENV_VAR="STIGMER_PLATFORM_TOKEN_KEY",PLATFORM_TOKEN_KEY_FILE_NAME="platform-token.key",DEFAULT_PLATFORM_TOKEN_TTL_SECONDS=900,MIN_RSA_MODULUS_BITS=2048;function canSign(ring){return ring.signer!==void 0}function resolvePlatformTokenKeys(input){if(input.requireAuthentication){if(input.supplied!==void 0)return input.supplied;if(input.edition!==ServerEdition.oss)throw new Error(`the ${ServerEdition[input.edition]} edition requires authentication but registers no platform-token key ring \u2014 register drivers.platformTokenKeys; only open source generates its own key`);return openSourcePlatformTokenKeyRing(input.options)}}function openSourcePlatformTokenKeyRing(options={}){let privateKey=getOrCreateKey(RSA_PRIVATE_KEY,PLATFORM_TOKEN_KEY_ENV_VAR,PLATFORM_TOKEN_KEY_FILE_NAME,options);return{signer:{key:privateKey,kid:kidOf(privateKey)},verificationKeys:[(0,import_node_crypto38.createPublicKey)(privateKey)],audience:"",ttlSeconds:DEFAULT_PLATFORM_TOKEN_TTL_SECONDS}}var RSA_PRIVATE_KEY={fromEnv(envVar,decoded){let key=parseKey2(()=>(0,import_node_crypto38.createPrivateKey)(decoded.toString("utf8")),envVar);return requireRsa(key,envVar)},fromFile(content){try{let key=(0,import_node_crypto38.createPrivateKey)(content.toString("utf8"));return isUsableRsa(key)?key:void 0}catch{return}},generate(){return(0,import_node_crypto38.generateKeyPairSync)("rsa",{modulusLength:MIN_RSA_MODULUS_BITS}).privateKey},toFile(key){return Buffer.from(key.export({format:"pem",type:"pkcs8"}))}};function kidOf(key){let publicKey=key.type==="private"?(0,import_node_crypto38.createPublicKey)(key):key;return(0,import_node_crypto38.createHash)("sha256").update(spkiOf(publicKey)).digest("base64url").slice(0,16)}function spkiOf(publicKey){return publicKey.export({format:"der",type:"spki"})}function parseKey2(parse5,what){try{return parse5()}catch(error3){throw new Error(`${what} is not a readable PEM key: ${error3 instanceof Error?error3.message:String(error3)}`)}}function requireRsa(key,what){if(!isUsableRsa(key))throw new Error(`${what} must be an RSA key of at least ${MIN_RSA_MODULUS_BITS} bits`);return key}function isUsableRsa(key){return key.asymmetricKeyType==="rsa"&&(key.asymmetricKeyDetails?.modulusLength??0)>=MIN_RSA_MODULUS_BITS}var EMBEDDING_ORGANIZATION_KEY="embeddingOrganization";function isGrantableSignInRole(role){return role===IamRole.iam_role_unspecified||grantableRolesFor(ApiResourceKind.organization).includes(role)}var EMBEDDING_VAULT_ATTACHMENTS={surface:"an organization's embedding settings",attachers:{get:row=>row.status?.embeddingVaultAttachers,set:(row,attachers)=>{(row.status??=create2(OrganizationStatusSchema)).embeddingVaultAttachers=attachers}}};function embeddingContext(input,caller){return new RequestContext(OrganizationSchema,create2(OrganizationSchema,{metadata:{id:input.orgId},spec:{embedding:clone(OrganizationEmbeddingSchema,input.embedding??create2(OrganizationEmbeddingSchema))}}),caller,ApiResourceKind.organization)}function newClearEmbeddingStep(){return{name:"ClearEmbedding",execute(ctx){ctx.newState.spec!==void 0&&(ctx.newState.spec.embedding=void 0)}}}function newPreserveEmbeddingStep(){return{name:"PreserveEmbedding",execute(ctx){let existing=storedOrganizationOf(ctx,"PreserveEmbedding"),spec=ctx.newState.spec??=create2(OrganizationSpecSchema),stored=existing.spec?.embedding;spec.embedding=stored===void 0?void 0:clone(OrganizationEmbeddingSchema,stored);let status=ctx.newState.status??=create2(OrganizationStatusSchema);status.embeddingVaultAttachers={...existing.status?.embeddingVaultAttachers??{}}}}}function newBuildEmbeddingStateStep(){return{name:"BuildEmbeddingState",execute(ctx){let existing=storedOrganizationOf(ctx,"BuildEmbeddingState"),requested=ctx.newState.spec?.embedding??create2(OrganizationEmbeddingSchema),next=clone(OrganizationSchema,existing);(next.spec??=create2(OrganizationSpecSchema)).embedding=clone(OrganizationEmbeddingSchema,requested),ctx.setNewState(next)}}}function newValidateSignInRoleStep(){return{name:"ValidateSignInRole",execute(ctx){let role=ctx.newState.spec?.embedding?.signInRole??IamRole.iam_role_unspecified;if(!isGrantableSignInRole(role))throw invalidArgumentError(signInRoleNotGrantableMessage(role))}}}function newPersistEmbeddingStep(store){return{name:"PersistEmbedding",async execute(ctx){let id=ctx.newState.metadata?.id??"",embedding=ctx.newState.spec?.embedding,attachers={...ctx.newState.status?.embeddingVaultAttachers??{}};try{let written=await store.updateResource(ApiResourceKind.organization,id,OrganizationSchema,live=>{(live.spec??=create2(OrganizationSpecSchema)).embedding=embedding===void 0?void 0:clone(OrganizationEmbeddingSchema,embedding),(live.status??=create2(OrganizationStatusSchema)).embeddingVaultAttachers=attachers,setAuditFieldsForUpdate(OrganizationSchema,live,"spec_audit",ctx.callerIdentity)});ctx.set(EMBEDDING_ORGANIZATION_KEY,written)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Organization",id):internalError(error3,"failed to save organization")}}}}function storedOrganizationOf(ctx,step){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error(`organization chain reached ${step} without its loaded row`),"failed to update organization");return existing}var SUBJECT_SEPARATOR="|";async function mintUserToken(deps,request3,caller){let keys=deps.keys;if(keys===void 0)throw new ConnectError(MINTING_REQUIRES_AUTHENTICATION_MESSAGE,Code.FailedPrecondition);if(!canSign(keys))throw new ConnectError(MINTING_DISABLED_MESSAGE,Code.FailedPrecondition);let minter=mintingAccountOf(caller);await authorizeDirect(TokenService.method.mintUserToken,deps.authorizer,caller,request3);let embedding=await embeddingOf(deps,minter.org),tokenOrg=request3.org,user={externalUserId:request3.userId,email:request3.userEmail,name:request3.userName},accountId=await resolveOrProvisionAccount(deps,minter.id,embedding,tokenOrg,user),signed=signPlatformToken(keys,{[USER_TOKEN_CLAIMS.subject]:accountId,[USER_TOKEN_CLAIMS.externalUserId]:user.externalUserId,[USER_TOKEN_CLAIMS.email]:user.email,[USER_TOKEN_CLAIMS.name]:user.name,[USER_TOKEN_CLAIMS.org]:tokenOrg,[USER_TOKEN_CLAIMS.mintedBy]:minter.id},{now:deps.now()});return create2(MintUserTokenResponseSchema,{accessToken:signed.token,tokenType:BEARER_TOKEN_TYPE,expiresIn:keys.ttlSeconds})}function mintingAccountOf(caller){let org=boundOrgOf(caller);if(!isServiceAccountCaller(caller)||org===void 0)throw new ConnectError(MINT_REQUIRES_SERVICE_ACCOUNT_MESSAGE,Code.PermissionDenied);return{id:caller.identityId,org}}async function embeddingOf(deps,org){try{return(await deps.store.getResource(ApiResourceKind.organization,org,OrganizationSchema)).spec?.embedding}catch(error3){throw error3 instanceof ResourceNotFoundError?new ConnectError(MINT_REQUIRES_SERVICE_ACCOUNT_MESSAGE,Code.PermissionDenied):internalError(error3,"failed to read the organization's embedding settings")}}async function resolveOrProvisionAccount(deps,minterId,embedding,org,user){let idpId=appUserSubject(org,user.externalUserId),existing=await findAccount(deps,idpId);if(existing!==void 0)return await appUserAccountId(deps,existing,user,org);if(embedding?.createAccountsOnSignIn!==!0)throw new ConnectError(noAccountMessage(user.externalUserId,await organizationForPeople(deps,org)),Code.FailedPrecondition);let input=accountInput(idpId,org,user),actor=serverActingFor(minterId);embedding.signInRole!==IamRole.iam_role_unspecified&&await grantSignInRole(deps,embedding.signInRole,org,accountIdFor(idpId),actor);try{return(await deps.createAccount(input,actor)).metadata?.id??""}catch(error3){let winner=await resolveCreateRace(error3,()=>deps.accounts.findByIdpId(idpId));return await appUserAccountId(deps,winner,user,org)}}async function findAccount(deps,idpId){try{return await deps.accounts.findByIdpId(idpId)}catch(error3){throw internalError(error3,"failed to resolve the app user")}}async function organizationForPeople(deps,org){try{return await organizationNameForPeople(deps.store,org)}catch(error3){throw internalError(error3,"failed to read the organization's name")}}async function appUserAccountId(deps,account2,user,org){if(account2.spec?.provisioningMode!==IdentityAccountProvisioningMode.app_user)throw new ConnectError(foreignAccountMessage(user.externalUserId,await organizationForPeople(deps,org)),Code.FailedPrecondition);return account2.metadata?.id??""}function accountInput(idpId,org,user){let input={name:fittedName(user.email!==""?user.email:user.externalUserId),spec:create2(IdentityAccountSpecSchema,{idpId,email:user.email,...splitName(user.name,user.email)}),provisioning:{mode:"app_user",org}},result=validator().validate(IdentityAccountSchema,create2(IdentityAccountSchema,{apiVersion:"iam.stigmer.ai/v1",kind:"IdentityAccount",metadata:{name:input.name,org},spec:input.spec}));if(result.kind==="invalid")throw new ConnectError(result.error.message,Code.InvalidArgument);if(result.kind==="error")throw new ConnectError(`validation could not run: ${result.error.message}`,Code.Internal);return input}async function grantSignInRole(deps,role,org,accountId,actor){if(role===IamRole.owner)throw new ConnectError(OWNER_SIGN_IN_ROLE_MESSAGE,Code.InvalidArgument);if(!isGrantableSignInRole(role))throw new ConnectError(signInRoleNotGrantableMessage(role),Code.InvalidArgument);try{await deps.grantPath.grant(organizationRole(accountId,role,org),actor,"grant")}catch(error3){throw deps.logger.error("app user sign-in role grant failed; nothing was provisioned",{accountId,mintedBy:actor.identityId,error:error3 instanceof Error?error3.message:String(error3)}),new ConnectError(PROVISIONING_FAILED_MESSAGE,Code.Internal)}}function appUserSubject(org,externalUserId){return requireSubjectPart("org",org),requireSubjectPart("externalUserId",externalUserId),`${APP_USER_SUBJECT_PREFIX}${org}${SUBJECT_SEPARATOR}${externalUserId}`}function requireSubjectPart(part,value){if(value.trim()==="")throw new ConnectError(blankSubjectPartMessage(part),Code.InvalidArgument);if(value.includes(SUBJECT_SEPARATOR))throw new ConnectError(subjectSeparatorMessage(part,value),Code.InvalidArgument)}function splitName(name,email){if(name!==""){let space=name.indexOf(" ");return space>0?{firstName:name.slice(0,space),lastName:name.slice(space+1)}:{firstName:name,lastName:""}}let at2=email.indexOf("@");return{firstName:at2>=0?email.slice(0,at2):email,lastName:""}}function registerTokenService(router,deps){router.service(TokenService,{mintUserToken:(request3,ctx)=>mintUserToken(deps.mint,request3,callerIdentityOf(ctx)),mintGuestToken:(request3,ctx)=>{if(deps.guestTokenMinting===void 0)throw new ConnectError(GUEST_MINT_UNIMPLEMENTED_MESSAGE,Code.Unimplemented);return deps.guestTokenMinting.mintGuestToken(request3,ctx.requestHeader)}})}var OPAQUE_ORIGIN="null";function newEmbeddingOriginGuard(deps){return{name:"embedding-origin",async guard(caller,method,headers2){let origin=headers2.get("origin")??"";if(origin.trim()==="")return;let mintedBy=mintingAccountOf2(caller);if(mintedBy===void 0)return;let allowed=await allowedOriginsOf(deps,mintedBy);if(!originAllowed(origin,allowed))throw deps.logger.warn("origin refusal: origin not in allowed_origins",{procedure:`/${method.parent.typeName}/${method.name}`,mintedBy,origin}),new ConnectError(originRefusalMessage(origin),Code.PermissionDenied)}}}function mintingAccountOf2(caller){let payload=decodeVerifiedPlatformTokenPayload(caller.rawToken);if(!(payload===void 0||stringClaim(payload,TOKEN_TYPE_CLAIM)!==void 0))return stringClaim(payload,USER_TOKEN_CLAIMS.mintedBy)}async function allowedOriginsOf(deps,mintedBy){let minter=await deps.accounts.findById(mintedBy),org=minter?.metadata?.org??"";if(minter===void 0||org==="")throw new ConnectError(DELETED_MINTER_MESSAGE,Code.Unauthenticated);try{return(await deps.store.getResource(ApiResourceKind.organization,org,OrganizationSchema)).spec?.embedding?.allowedOrigins??[]}catch(error3){throw error3 instanceof ResourceNotFoundError?new ConnectError(DELETED_MINTER_MESSAGE,Code.Unauthenticated):error3}}function originAllowed(origin,allowed){if(allowed.length===0)return!0;if(origin===OPAQUE_ORIGIN)return!1;let presented=origin.toLowerCase();return allowed.some(entry=>entry.toLowerCase()===presented)}function newUserTokenVerifier(deps){return{name:"user-token",async verify(token){let result=verifyPlatformToken(deps.keys,token,deps.now?.());switch(result.outcome){case"foreign":return null;case"refused":throw platformTokenRefusalError(result.refusal);case"verified":break;default:{let exhaustive=result;throw new Error(`unknown verification ${JSON.stringify(exhaustive)}`)}}let verified=result.token;if(verified.tokenType!==void 0)return null;let mintedBy=stringClaim(verified.payload,USER_TOKEN_CLAIMS.mintedBy);if(mintedBy===void 0||mintedBy==="")throw new ConnectError(TOKEN_NAMES_NO_MINTER_MESSAGE,Code.Unauthenticated);let minter=await deps.accounts.findById(mintedBy);if(minter===void 0||minter.spec?.provisioningMode!==IdentityAccountProvisioningMode.service_account)throw new ConnectError(DELETED_MINTER_MESSAGE,Code.Unauthenticated);let boundOrg=stringClaim(verified.payload,USER_TOKEN_CLAIMS.org),minterOrg=minter.metadata?.org??"";if(boundOrg===void 0||boundOrg===""||boundOrg!==minterOrg&&!await isChildOf(deps.store,boundOrg,minterOrg))throw new ConnectError(TOKEN_ORGANIZATION_MISMATCH_MESSAGE,Code.Unauthenticated);let email=stringClaim(verified.payload,USER_TOKEN_CLAIMS.email),displayName=stringClaim(verified.payload,USER_TOKEN_CLAIMS.name);return{identityId:verified.subject,callerClass:"user",issuer:PLATFORM_TOKEN_ISSUER,rawToken:token,...email!==void 0?{email}:{},...displayName!==void 0?{displayName}:{},mintedBy,boundOrg}}}}var file_ai_stigmer_tenancy_organization_v1_io=fileDesc("CithaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2lvLnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxImsKDU9yZ2FuaXphdGlvbnMSQQoHZW50cmllcxgBIAMoCzIwLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCSLdAQoYTGlzdE15T3JnYW5pemF0aW9uc0lucHV0EhoKCXBhZ2Vfc2l6ZRgBIAEoBUIHukgEGgIoABIcCgpwYWdlX3Rva2VuGAIgASgJQgi6SAVyAxiACBJYCgZsYWJlbHMYAyADKAsySC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLkxpc3RNeU9yZ2FuaXphdGlvbnNJbnB1dC5MYWJlbHNFbnRyeRotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIioKDk9yZ2FuaXphdGlvbklkEhgKBXZhbHVlGAEgASgJQgm6SAZyBBABGEAiXAoaT3JnYW5pemF0aW9uRXh0ZXJuYWxMb29rdXASHwoLZXh0ZXJuYWxfaWQYAiABKAlCCrpIB3IFEAEYgAISHQoKcGFyZW50X29yZxgDIAEoCUIJukgGcgQQARhAIukBChJMaXN0Q2hpbGRPcmdzSW5wdXQSFgoDb3JnGAEgASgJQgm6SAZyBBABGEASGgoJcGFnZV9zaXplGAIgASgFQge6SAQaAigAEhwKCnBhZ2VfdG9rZW4YAyABKAlCCLpIBXIDGIAIElIKBmxhYmVscxgEIAMoCzJCLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuTGlzdENoaWxkT3Jnc0lucHV0LkxhYmVsc0VudHJ5Gi0KC0xhYmVsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiagoMQ2hpbGRPcmdMaXN0EkEKB2VudHJpZXMYASADKAsyMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkikAEKH1VwZGF0ZU9yZ2FuaXphdGlvblBvbGljaWVzSW5wdXQSGQoGb3JnX2lkGAEgASgJQgm6SAZyBBABGEASUgoIcG9saWNpZXMYAiABKAsyOC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvblBvbGljaWVzQga6SAPIAQEikwEKIFVwZGF0ZU9yZ2FuaXphdGlvbkVtYmVkZGluZ0lucHV0EhkKBm9yZ19pZBgBIAEoCUIJukgGcgQQARhAElQKCWVtYmVkZGluZxgCIAEoCzI5LmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uRW1iZWRkaW5nQga6SAPIAQEi5QIKF1VwZGF0ZU9yZ2FuaXphdGlvbklucHV0EkoKCHJlc291cmNlGAEgASgLMjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb25CBrpIA9gBAxI3Cgt1cGRhdGVfbWFzaxgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCBrpIA8gBATrEAbpIwAEavQEKF3VwZGF0ZV9uYW1lc19pdHNfdGFyZ2V0EkxyZXNvdXJjZS5tZXRhZGF0YS5pZCBpcyByZXF1aXJlZDogYW4gdXBkYXRlIG5hbWVzIHRoZSBvcmdhbml6YXRpb24gYnkgaXRzIGlkGlRoYXModGhpcy5yZXNvdXJjZSkgJiYgaGFzKHRoaXMucmVzb3VyY2UubWV0YWRhdGEpICYmIHRoaXMucmVzb3VyY2UubWV0YWRhdGEuaWQgIT0gJydiBnByb3RvMw",[file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_spec,file_buf_validate_validate,file_google_protobuf_field_mask2]),OrganizationsSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,0);var ChildOrgListSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,5);var UpdateOrganizationInputSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,8);var file_ai_stigmer_tenancy_organization_v1_command=fileDesc("CjBhaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2NvbW1hbmQucHJvdG8SImFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEysgkKHU9yZ2FuaXphdGlvbkNvbW1hbmRDb250cm9sbGVyEmsKBWFwcGx5EjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24aMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhJyCgZjcmVhdGUSMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhowLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIgTQuBgBErwBCgZ1cGRhdGUSOy5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLlVwZGF0ZU9yZ2FuaXphdGlvbklucHV0GjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iQ8K4GD8IAhAeIhRyZXNvdXJjZS5tZXRhZGF0YS5pZCojdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBvcmdhbml6YXRpb24SxwEKDnVwZGF0ZVBvbGljaWVzEkMuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5VcGRhdGVPcmdhbml6YXRpb25Qb2xpY2llc0lucHV0GjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iPsK4GDoIAhAeIgZvcmdfaWQqLHVuYXV0aG9yaXplZCB0byB1cGRhdGUgb3JnYW5pemF0aW9uIHBvbGljaWVzEtMBCg91cGRhdGVFbWJlZGRpbmcSRC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLlVwZGF0ZU9yZ2FuaXphdGlvbkVtYmVkZGluZ0lucHV0GjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iSMK4GEQIAhAeIgZvcmdfaWQqNnVuYXV0aG9yaXplZCB0byB1cGRhdGUgb3JnYW5pemF0aW9uIGVtYmVkZGluZyBzZXR0aW5ncxKjAQoGcmVuYW1lEisuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlJlbmFtZUlucHV0GjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iOsK4GDYIAxAeIgtyZXNvdXJjZV9pZCojdW5hdXRob3JpemVkIHRvIHJlbmFtZSBvcmdhbml6YXRpb24SpAEKBmRlbGV0ZRIyLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uSWQaMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbiI0wrgYMAgDEB4iBXZhbHVlKiN1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG9yZ2FuaXphdGlvbhoEoP8rHmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io]),OrganizationCommandController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_command,0);var file_ai_stigmer_tenancy_organization_v1_query=fileDesc("Ci5haS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL3F1ZXJ5LnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxMvAFChtPcmdhbml6YXRpb25RdWVyeUNvbnRyb2xsZXISnwEKA2dldBIyLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uSWQaMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbiIywrgYLggyEB4iBXZhbHVlKiF1bmF1dGhvcml6ZWQgdG8gdmlldyBvcmdhbml6YXRpb24SgQEKCGxpc3RNaW5lEjwuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5MaXN0TXlPcmdhbml6YXRpb25zSW5wdXQaMS5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbnMiBNC4GAES2QEKD2dldEJ5RXh0ZXJuYWxJZBI+LmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uRXh0ZXJuYWxMb29rdXAaMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbiJUwrgYUAgxEB4iCnBhcmVudF9vcmcqPnVuYXV0aG9yaXplZCB0byBtYW5hZ2UgdGhpcyBvcmdhbml6YXRpb24ncyBjaGlsZCBvcmdhbml6YXRpb25zEsgBCg1saXN0Q2hpbGRPcmdzEjYuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5MaXN0Q2hpbGRPcmdzSW5wdXQaMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLkNoaWxkT3JnTGlzdCJNwrgYSQgxEB4iA29yZyo+dW5hdXRob3JpemVkIHRvIG1hbmFnZSB0aGlzIG9yZ2FuaXphdGlvbidzIGNoaWxkIG9yZ2FuaXphdGlvbnMaBKD/Kx5iBnByb3RvMw",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io]),OrganizationQueryController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_query,0);var POLICIES_ORGANIZATION_KEY="policiesOrganization";function defaultOrganizationPolicies(){return create2(OrganizationPoliciesSchema,{membersCanCreateAgents:!0})}function opensAgentCreation(before,after){return after.membersCanCreateAgents&&before?.membersCanCreateAgents!==!0}function closesAgentCreation(before,after){return!after.membersCanCreateAgents&&before?.membersCanCreateAgents!==!1}async function announce(lifecycle,organizationId,before,after){if(lifecycle?.onOrganizationPoliciesChanged!==void 0)try{await lifecycle.onOrganizationPoliciesChanged({organizationId,before,after})}catch(error3){throw internalError(error3,"failed to apply the organization's policies")}}function newDefaultOrganizationPoliciesStep(){return{name:"DefaultOrganizationPolicies",execute(ctx){let spec=ctx.newState.spec??=create2(OrganizationSpecSchema);spec.policies??=defaultOrganizationPolicies()}}}function newAnnounceCreatedOrganizationPoliciesStep(lifecycle){return{name:"AnnounceCreatedOrganizationPolicies",async execute(ctx){let after=ctx.newState.spec?.policies??defaultOrganizationPolicies();after.membersCanCreateAgents&&await announce(lifecycle,ctx.newState.metadata?.id??"",void 0,after)}}}function newPreservePoliciesStep(){return{name:"PreservePolicies",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("organization update reached PreservePolicies without its loaded row"),"failed to update organization");let stored=existing.spec?.policies;if(stored===void 0){ctx.newState.spec!==void 0&&(ctx.newState.spec.policies=void 0);return}let spec=ctx.newState.spec??=create2(OrganizationSpecSchema);spec.policies=clone(OrganizationPoliciesSchema,stored)}}}function newLoadOrganizationForPoliciesStep(store){return{name:"LoadOrganizationForPolicies",async execute(ctx){let organization;try{organization=await store.getResource(ApiResourceKind.organization,ctx.input.orgId,OrganizationSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Organization",ctx.input.orgId):internalError(error3,"failed to load organization")}ctx.set(POLICIES_ORGANIZATION_KEY,organization)}}}function newChangeOrganizationPoliciesStep(store,lifecycle){return{name:"ChangeOrganizationPolicies",async execute(ctx){let organization=ctx.get(POLICIES_ORGANIZATION_KEY),id=organization.metadata?.id??"",before=organization.spec?.policies,after=clone(OrganizationPoliciesSchema,ctx.input.policies??create2(OrganizationPoliciesSchema));if(before!==void 0&&before.membersCanCreateAgents===after.membersCanCreateAgents){await announce(lifecycle,id,before,after);return}closesAgentCreation(before,after)&&await announce(lifecycle,id,before,after);try{let written=await store.updateResource(ApiResourceKind.organization,id,OrganizationSchema,live=>{(live.spec??=create2(OrganizationSpecSchema)).policies=clone(OrganizationPoliciesSchema,after),setAuditFieldsForUpdate(OrganizationSchema,live,"spec_audit",ctx.callerIdentity)});ctx.set(POLICIES_ORGANIZATION_KEY,written)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Organization",id):internalError(error3,"failed to save organization")}opensAgentCreation(before,after)&&await announce(lifecycle,id,before,after)}}}var organizationSearchExtractor={kind:ApiResourceKind.organization,schema:OrganizationSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let org=resource;return buildSearchResult({kind:ApiResourceKind.organization,metadata:org.metadata,summary:org.spec?.description??"",score,createdAt:org.status?.audit?.specAudit?.createdAt,updatedAt:org.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let org=resource,metadata=org.metadata;if(metadata!==void 0)return{name:metadata.name,description:org.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(org.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var ORGANIZATION_PARENT_DELETING="ORGANIZATION_PARENT_DELETING",MARKED_KEY="organizationDeletionMarked",ACCEPTED_KEY="organizationDeletionAccepted",ORGANIZATION3="Organization";function loadedOrganizationId(ctx,step){let id=ctx.get(EXISTING_RESOURCE_KEY)?.metadata?.id??"";if(id==="")throw internalError(new Error(`organization delete reached ${step} without its loaded row`),"failed to delete organization");return id}function newMarkDeletingStep(store){return{name:"MarkDeleting",async execute(ctx){let id=loadedOrganizationId(ctx,"MarkDeleting"),marked;try{marked=await store.organizationDeletions.mark(id,new Date().toISOString())}catch(error3){throw internalError(error3,"failed to delete organization")}if(!marked)throw notFoundError(ORGANIZATION3,id);ctx.set(MARKED_KEY,!0)}}}function newAcceptPurgeStep(store,purge){return{name:"AcceptPurge",async execute(ctx){let id=loadedOrganizationId(ctx,"AcceptPurge"),accepted;try{accepted=await store.organizationDeletions.accept(id,new Date().toISOString())}catch(error3){throw internalError(error3,"failed to delete organization")}if(!accepted)throw internalError(new Error(`the deletion mark of ${id} was no longer pending`),"failed to delete organization");ctx.set(ACCEPTED_KEY,!0),purge.kick(id)}}}async function unmarkAfterFailure(store,logger2,ctx){if(ctx.get(MARKED_KEY)!==!0||ctx.get(ACCEPTED_KEY)===!0)return;let id=ctx.get(EXISTING_RESOURCE_KEY)?.metadata?.id??"";try{await store.organizationDeletions.unmark(id)}catch(error3){logger2.error("organization delete failed and its deletion mark could not be removed; the purge runner removes it once it is stale",{org:id,error:error3 instanceof Error?error3.message:String(error3)})}}function newRefuseParentDeletingStep(store,purge){return{name:"RefuseParentDeleting",async execute(ctx){let parentId=parentOrgOf(ctx.newState);if(parentId==="")return;let id=metadataOf(ctx.newState)?.id??"";try{if(!await store.organizationDeletions.isDeleting(parentId))return;let now=new Date().toISOString();await store.organizationDeletions.mark(id,now),await store.organizationDeletions.accept(id,now)}catch(error3){throw internalError(error3,"failed to create organization")}throw purge.kick(id),failedPreconditionError("the parent organization is being deleted",{reason:ORGANIZATION_PARENT_DELETING,metadata:{parent_org:parentId}})}}}var ORGANIZATION_SLUG_RESERVED="ORGANIZATION_SLUG_RESERVED",RENAMED_SLUG_HOLD_MS=RENAMED_NAME_HOLD_MS;var ORGANIZATION_NAME_KIND=ApiResourceKind[ApiResourceKind.organization],CLAIMED_NAME_KEY2="organizationNameClaim";function organizationNameKey(slug){return{kind:ORGANIZATION_NAME_KIND,org:"",name:slug}}function organizationSlugReservedMessage(slug){return`Organization slug '${slug}' was recently another organization's, and still leads to it`}function refusalForHeldName(entry){return entry.state==="previous"?alreadyExistsWithReasonError(organizationSlugReservedMessage(entry.name),{reason:ORGANIZATION_SLUG_RESERVED,metadata:{slug:entry.name}}):alreadyExistsError("Organization",`slug '${entry.name}'`)}async function nameHolderIsGone(store,entry,now){return holderIsGone(entry,now,organizationHolder(store))}function organizationHolder(store){return storedRowHolder(store,ApiResourceKind.organization,OrganizationSchema)}async function liveOrganizationName(store,slug,now){let entry=await store.resourceNames.resolve(organizationNameKey(slug),now.toISOString());if(!(entry===void 0||await nameHolderIsGone(store,entry,now)))return entry}function newClaimOrganizationSlugStep(store){return{name:"ClaimOrganizationSlug",async execute(ctx){let metadata=metadataOf(ctx.newState),slug=metadata?.slug??"",id=metadata?.id??"";if(slug===""||id==="")throw internalError(new Error("organization slug or id is empty"),"failed to claim the organization slug");let claim;try{claim=await claimFreeingGoneHolder(store,slug,id,new Date)}catch(error3){throw internalError(error3,"failed to claim the organization slug")}if(!claim.claimed)throw refusalForHeldName(claim.entry);ctx.set(CLAIMED_NAME_KEY2,claim.entry)}}}async function claimFreeingGoneHolder(store,slug,id,now){return claimName(store,organizationNameKey(slug),id,now,organizationHolder(store))}async function releaseSlugClaimAfterFailure(store,logger2,ctx){let entry=ctx.get(CLAIMED_NAME_KEY2);if(entry!==void 0){try{await store.getResource(ApiResourceKind.organization,entry.id,OrganizationSchema);return}catch(error3){if(!(error3 instanceof ResourceNotFoundError)){logger2.error("organization create failed and its slug claim could not be checked; the slug stays claimed",{slug:entry.name,error:error3 instanceof Error?error3.message:String(error3)});return}}try{await store.resourceNames.release(entry.kind,entry.org,entry.id)}catch(error3){logger2.error("organization create failed and its slug claim could not be released; the slug stays claimed",{slug:entry.name,error:error3 instanceof Error?error3.message:String(error3)})}}}function newRetireOrganizationSlugStep(store,logger2){return{name:"RetireOrganizationSlug",async execute(ctx){let id=ctx.get(EXISTING_RESOURCE_KEY)?.metadata?.id??"";if(id==="")throw internalError(new Error("organization delete reached RetireOrganizationSlug without its loaded row"),"failed to release the organization slug");try{await store.resourceNames.release(ORGANIZATION_NAME_KIND,"",id)}catch(error3){logger2.error("organization deleted but its names could not be released; a later claim frees them",{org:id,error:error3 instanceof Error?error3.message:String(error3)})}}}}function newOrganizationNameResolver(store){return{async resolve(name){return(await store.resourceNames.resolve(organizationNameKey(name),new Date().toISOString()))?.id}}}async function settleOrganizationSlug(store,organization,logger2){let metadata=organization.metadata;if(!(metadata===void 0||metadata.id===""))try{for(let attempt=0;attempt<SETTLE_ATTEMPTS;attempt++){let current=await store.resourceNames.current(ORGANIZATION_NAME_KIND,"",metadata.id);if(current===void 0||current.name===metadata.slug)return;metadata.slug=current.name,await store.updateResource(ApiResourceKind.organization,metadata.id,OrganizationSchema,row=>{row.metadata!==void 0&&(row.metadata.slug=current.name)})}}catch(error3){logger2.warn("organization row left behind its current name; the next rename settles it",{org:metadata.id,error:error3 instanceof Error?error3.message:String(error3)})}}var SETTLE_ATTEMPTS=3;var RENAMED_ORGANIZATION_KEY="renamedOrganization",NAME_MOVE_KEY2="organizationNameMove";function newLoadOrganizationForRenameStep(store){return{name:"LoadOrganizationForRename",async execute(ctx){let organization;try{organization=await store.getResource(ApiResourceKind.organization,ctx.input.resourceId,OrganizationSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Organization",ctx.input.resourceId):internalError(error3,"failed to load organization")}ctx.set(RENAMED_ORGANIZATION_KEY,organization)}}}function newRenameOrganizationSlugStep(store){return{name:"RenameOrganizationSlug",async execute(ctx){let metadata=ctx.get(RENAMED_ORGANIZATION_KEY).metadata;if(metadata===void 0||metadata.id===""||metadata.slug==="")throw internalError(new Error("organization row has no id or slug"),"failed to rename the organization");let current;try{current=await store.resourceNames.current(ORGANIZATION_NAME_KIND,"",metadata.id)}catch(error3){throw internalError(error3,"failed to rename the organization")}let from2=current?.name??metadata.slug;if(from2===ctx.input.slug){metadata.slug=from2;return}let now=new Date,move={kind:ORGANIZATION_NAME_KIND,org:"",id:metadata.id,from:from2,to:ctx.input.slug,fromExpiresAt:new Date(now.getTime()+RENAMED_SLUG_HOLD_MS).toISOString(),now:now.toISOString()},moved;try{moved=await moveName(store,move,organizationHolder(store))}catch(error3){throw internalError(error3,"failed to rename the organization")}if(!moved.claimed)throw refusalForHeldName(moved.entry);let recorded={move,undo:moved};ctx.set(NAME_MOVE_KEY2,recorded)}}}function newPersistRenamedOrganizationStep(store,logger2){return{name:"PersistRenamedOrganization",async execute(ctx){let recorded=ctx.get(NAME_MOVE_KEY2);if(recorded===void 0)return;let{move,undo}=recorded,identity2=ctx.callerIdentity,organization;try{organization=await store.updateResource(ApiResourceKind.organization,move.id,OrganizationSchema,row=>{row.metadata!==void 0&&(row.metadata.slug=move.to),setAuditFieldsForUpdate(OrganizationSchema,row,"spec_audit",identity2,"renamed")})}catch(error3){try{await store.resourceNames.revertRename(move,undo)}catch(revertError){logger2.error("organization rename failed and its names could not be moved back; both slugs lead to the organization until a retry",{org:move.id,from:move.from,to:move.to,error:revertError instanceof Error?revertError.message:String(revertError)})}throw error3 instanceof ResourceNotFoundError?notFoundError("Organization",move.id):internalError(error3,"failed to save organization")}ctx.set(RENAMED_ORGANIZATION_KEY,organization),await settleOrganizationSlug(store,organization,logger2)}}}function newIndexOrganizationAfterRenameStep(store,logger2){return{name:"IndexOrganizationAfterRename",async execute(ctx){if(ctx.get(NAME_MOVE_KEY2)===void 0)return;let organization=ctx.get(RENAMED_ORGANIZATION_KEY),id=organization.metadata?.id??"",entry=organizationSearchExtractor.getSearchIndexEntry(organization);if(entry!==void 0)try{await store.upsertSearchIndex(ApiResourceKind.organization,id,entry)}catch(error3){logger2.warn("IndexOrganizationAfterRename: failed (best-effort)",{id,error:error3 instanceof Error?error3.message:String(error3)})}}}}function newCheckOrgDuplicateStep(store){return{name:"CheckDuplicate",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("organization metadata is nil"),"duplicate check");if(metadata.slug==="")throw internalError(new Error("organization slug is empty"),"duplicate check");let entry;try{entry=await liveOrganizationName(store,metadata.slug,new Date)}catch(error3){throw internalError(error3,"failed to check for duplicate organization")}if(entry!==void 0)throw refusalForHeldName(entry)}}}var BOUND_CREDENTIAL_CREATES_NO_ORGANIZATION_MESSAGE="this credential is limited to one organization and cannot create another, except a child of that organization; sign in as yourself to create an organization";function newRefuseBoundCredentialStep(){return{name:"RefuseBoundCredential",execute(ctx){let bound2=boundOrgOf(ctx.callerIdentity);if(bound2!==void 0&&parentOrgRequested(ctx.input)!==bound2)throw new ConnectError(BOUND_CREDENTIAL_CREATES_NO_ORGANIZATION_MESSAGE,Code.PermissionDenied)}}}function parentOrgRequested(input){return isMessage2(input,OrganizationSchema)?input.spec?.parentOrg??"":""}function newRefuseOrganizationOrgStep(resolver){return{name:"RefuseOrganizationOrg",async execute(ctx){let metadata=metadataOf(ctx.newState),org=metadata?.org??"";if(metadata!==void 0&&org!==""&&(org===metadata.id||org===metadata.slug||metadata.slug!==""&&org===await resolver.resolve(metadata.slug))){metadata.org="";return}if(org!=="")throw invalidArgumentError("an organization belongs to no organization: metadata.org must be empty")}}}async function readOrganization(store,id){try{return await store.readResourceForWrite(ApiResourceKind.organization,id,OrganizationSchema)}catch(error3){if(error3 instanceof ResourceNotFoundError)return;throw error3}}async function organizationBySlug(store,slug){let entry=await liveOrganizationName(store,slug,new Date);if(entry?.state==="previous")throw slugRenamedError(ApiResourceKind.organization,slug);return entry===void 0?void 0:readOrganization(store,entry.id)}async function organizationForApply(store,id,slug){let byId=id===""?void 0:await readOrganization(store,id);return byId!==void 0||slug===""?byId:organizationBySlug(store,slug)}function newLoadOrganizationForApplyStep(store){return{name:"LoadForApply",async execute(ctx){let metadata=metadataOf(ctx.newState),existing=metadata===void 0?void 0:(await organizationForApply(store,metadata.id,metadata.slug))?.resource;if(existing===void 0){ctx.set(EXISTS_IN_DATABASE_KEY,!1),ctx.set(SHOULD_CREATE_KEY,!0);return}ctx.set(EXISTING_RESOURCE_KEY,existing),ctx.set(EXISTS_IN_DATABASE_KEY,!0),ctx.set(SHOULD_CREATE_KEY,!1),metadata!==void 0&&(metadata.id=existing.metadata?.id??"")}}}function newLoadExistingOrganizationStep(store){return{name:"LoadExisting",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"load existing");if(metadata.id===""&&metadata.slug==="")throw invalidArgumentError("resource id or slug is required for update");let read3=metadata.id!==""?await readOrganization(store,metadata.id):await organizationBySlug(store,metadata.slug);if(read3===void 0)throw notFoundError("Organization",metadata.id!==""?metadata.id:metadata.slug);metadata.id=read3.resource.metadata?.id??"",ctx.set(EXISTING_RESOURCE_KEY,read3.resource),ctx.set(EXISTING_RESOURCE_BYTES_KEY,read3.bytes)}}}function newRevokeOrganizationGrantsStep(grantPath){return{name:"RevokeOrganizationGrants",async execute(ctx){let id=ctx.get(EXISTING_RESOURCE_KEY)?.metadata?.id??"";if(id==="")throw internalError(new Error("organization delete reached RevokeOrganizationGrants without its loaded row"),"failed to remove the organization's grants");try{await grantPath.cleanupResource(create2(ApiResourceRefSchema,{kind:ApiResourceKind[ApiResourceKind.organization],id}),ctx.callerIdentity)}catch(error3){throw internalError(error3,"failed to remove the organization's grants")}}}}function registerOrganizationServices(router,deps){router.service(OrganizationCommandController,{apply:(org,ctx)=>apply8(deps,org,ctx),create:(org,ctx)=>createOrganization(deps,org,ctx),update:(input,ctx)=>update11(deps,input,ctx),updatePolicies:(input,ctx)=>updatePolicies(deps,input,ctx),updateEmbedding:(input,ctx)=>updateEmbedding(deps,input,ctx),rename:(input,ctx)=>rename8(deps,input,ctx),delete:(orgId,ctx)=>deleteOrganization(deps,orgId,ctx)}),router.service(OrganizationQueryController,{get:(orgId,ctx)=>get14(deps,orgId,ctx),listMine:(input,ctx)=>listMine(deps,input,ctx),getByExternalId:(lookup3,ctx)=>getByExternalId2(deps,lookup3,ctx),listChildOrgs:(input,ctx)=>listChildOrgs(deps,input,ctx)})}function kindOf17(ctx){return ctx.values.get(apiResourceKindKey)}async function createOrganization(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx)),builder2=newPipeline("organization-create",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.create,deps.authorizer)).addStep(newRefuseServiceAccountCallerStep("create organizations",deps.accounts)).addStep(newRefuseBoundCredentialStep()).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newRefuseOrganizationOrgStep(newOrganizationNameResolver(deps.store))).addStep(newValidateVisibilityStep()).addStep(newDefaultOrganizationPoliciesStep()).addStep(newClearEmbeddingStep()).addStep(newCheckOrgDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newValidateChildOrganizationStep(deps.store,deps.authorizer)).addStep(newNormalizeReferencesStep(deps.store)).addStep(newValidateReferencesStep(deps.store,deps.authorizer));deps.orgLimit!==void 0&&builder2.addStep(newOrganizationLimitStep(deps.store,deps.orgLimit));for(let step of stepsForSlot(deps.gateSteps,"org-create:pre-side-effect-gate"))builder2.addStep(step);builder2.addStep(newClaimOrganizationSlugStep(deps.store)).addStep(newClaimExternalIdStep(deps.store)).addStep(newLinkChildOrganizationStep(deps.authorizationLifecycle)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newRefuseParentDeletingStep(deps.store,deps.purge)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger,childOwnerAttribution)).addStep(newAnnounceCreatedOrganizationPoliciesStep(deps.authorizationLifecycle));for(let step of stepsForSlot(deps.gateSteps,"org-create:post-persist"))builder2.addStep(step);let pipeline2=builder2.addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build();try{await pipeline2.execute(reqCtx)}catch(error3){throw await releaseSlugClaimAfterFailure(deps.store,deps.logger,reqCtx),await releaseExternalIdClaimAfterFailure(deps.store,deps.logger,reqCtx),error3}return reqCtx.newState}var ORGANIZATION_REFUSED_UPDATE_PATHS=[{path:"spec.policies",writtenBy:"updatePolicies"},{path:"spec.embedding",writtenBy:"updateEmbedding"},{path:"spec.parent_org",writtenBy:"create"},{path:"spec.external_id",writtenBy:"create"}];async function update11(deps,input,ctx){return runGuardedWrite(async()=>{let reqCtx=updateContext(OrganizationSchema,input,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-update",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.update,deps.authorizer,input)).addStep(newResolveSlugStep({update:!0})).addStep(newLoadExistingOrganizationStep(deps.store)).addStep(newBuildUpdateStateStep({refused:ORGANIZATION_REFUSED_UPDATE_PATHS})).addStep(newValidateProtoStep({of:"state"})).addStep(newPreserveChildLinkStep()).addStep(newPreservePoliciesStep()).addStep(newPreserveEmbeddingStep()).addStep(newNormalizeReferencesStep(deps.store)).addStep(newValidateReferencesStep(deps.store,deps.authorizer,{judge:"introduced"})).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState})}async function updatePolicies(deps,input,ctx){let reqCtx=new RequestContext(OrganizationCommandController.method.updatePolicies.input,input,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-update-policies",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.updatePolicies,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadOrganizationForPoliciesStep(deps.store)).addStep(newChangeOrganizationPoliciesStep(deps.store,deps.authorizationLifecycle)).build().execute(reqCtx),reqCtx.get(POLICIES_ORGANIZATION_KEY)}var EMBEDDING_ACT="change the organization's embedding settings";async function updateEmbedding(deps,input,ctx){let reqCtx=embeddingContext(input,callerIdentityOf(ctx));return await newPipeline("organization-update-embedding",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.updateEmbedding,deps.authorizer,input)).addStep(newRefuseServiceAccountCallerStep(EMBEDDING_ACT,deps.accounts)).addStep(newLoadExistingOrganizationStep(deps.store)).addStep(newBuildEmbeddingStateStep()).addStep(newValidateProtoStep({of:"state"})).addStep(newValidateSignInRoleStep()).addStep(newNormalizeReferencesStep(deps.store)).addStep(newValidateReferencesStep(deps.store,deps.authorizer)).addStep(newVaultAttachmentsStep(deps.store,deps.authorizer,EMBEDDING_VAULT_ATTACHMENTS)).addStep(newPersistEmbeddingStep(deps.store)).build().execute(reqCtx),reqCtx.get(EMBEDDING_ORGANIZATION_KEY)}async function rename8(deps,input,ctx){let reqCtx=new RequestContext(OrganizationCommandController.method.rename.input,input,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-rename",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.rename,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadOrganizationForRenameStep(deps.store)).addStep(newRenameOrganizationSlugStep(deps.store)).addStep(newPersistRenamedOrganizationStep(deps.store,deps.logger)).addStep(newIndexOrganizationAfterRenameStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(RENAMED_ORGANIZATION_KEY)}async function apply8(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx));await newPipeline("organization-apply",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newRefuseOrganizationOrgStep(newOrganizationNameResolver(deps.store))).addStep(newLoadOrganizationForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOrganization(deps,org,ctx):update11(deps,everyPathUpdate(UpdateOrganizationInputSchema,withResolvedApplyId(OrganizationSchema,org,reqCtx)),ctx)}async function deleteOrganization(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationCommandController.method.delete.input,orgId,callerIdentityOf(ctx),kindOf17(ctx)),builder2=newPipeline("organization-delete",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.delete,deps.authorizer)).addStep(newRefuseServiceAccountCallerStep("delete organizations",deps.accounts)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,OrganizationSchema));deps.orgLimit===1&&builder2.addStep(newRefuseDeletingSingleOrganizationStep(deps.store)),builder2.addStep(newRefuseDeletingParentStep(deps.store)).addStep(newMarkDeletingStep(deps.store)).addStep(newRefuseDeletingParentStep(deps.store));for(let step of stepsForSlot(deps.gateSteps,"org-delete:pre-delete"))builder2.addStep(step);let pipeline2=builder2.addStep(newRevokeOrganizationGrantsStep(deps.grantPath)).addStep(newAcceptPurgeStep(deps.store,deps.purge)).build();try{await pipeline2.execute(reqCtx)}catch(error3){throw await unmarkAfterFailure(deps.store,deps.logger,reqCtx),error3}let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted organization not found in context"),"delete operation lost its loaded resource");return deleted}async function get14(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.get.input,orgId,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-get",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OrganizationSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function listMine(deps,input,ctx){let deleting;try{deleting=await deletingOrganizationIds(deps.store)}catch(error3){throw internalError(error3,"failed to list organizations")}let request3={pageSize:input.pageSize,pageToken:input.pageToken},keep=org=>!deleting.has(org.metadata?.id??"")&&matchesAllLabels(org.metadata?.labels??{},input.labels),fingerprint=listPageFingerprint({labels:sortedLabels(input.labels)}),directory=deps.organizationDirectory;if(directory!==void 0){let authorized=await directory.listMyOrganizationIds(callerIdentityOf(ctx));if(authorized!=="all"){let loaded=[];for(let id of authorized)if(!deleting.has(id))try{loaded.push(await deps.store.getResource(ApiResourceKind.organization,id,OrganizationSchema))}catch(error3){if(error3 instanceof ResourceNotFoundError)continue;throw internalError(error3,"failed to list organizations")}let page2=await readPage({source:inHandListPageSource(OrganizationSchema,loaded),request:request3,fingerprint,decode:decodeOrganization,keep,scope:rows=>Promise.resolve(rows),failure:"failed to list organizations"});return create2(OrganizationsSchema,{entries:page2.entries,nextPageToken:page2.nextPageToken})}}let page=await readListPage({store:deps.store,declaration:organizationListIndex,query:{},request:request3,fingerprint,decode:decodeOrganization,keep,scope:rows=>Promise.resolve(rows),failure:"failed to list organizations"});return create2(OrganizationsSchema,{entries:page.entries,nextPageToken:page.nextPageToken})}async function deletingOrganizationIds(store){return new Set((await store.organizationDeletions.list()).map(row=>row.org))}async function getByExternalId2(deps,input,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.getByExternalId.input,input,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-get-by-external-id",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.getByExternalId,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx),getChildByExternalId(deps.store,input.parentOrg,input.externalId)}async function listChildOrgs(deps,input,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.listChildOrgs.input,input,callerIdentityOf(ctx),kindOf17(ctx));await newPipeline("organization-list-child-orgs",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.listChildOrgs,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx);let deleting;try{deleting=await deletingOrganizationIds(deps.store)}catch(error3){throw internalError(error3,"failed to list child organizations")}let page=await readListPage({store:deps.store,declaration:organizationListIndex,query:{anyKey:[{name:"parent_org",value:input.org}]},request:{pageSize:input.pageSize,pageToken:input.pageToken},fingerprint:listPageFingerprint({org:input.org,labels:sortedLabels(input.labels)}),decode:decodeOrganization,keep:child=>parentOrgOf(child)===input.org&&!deleting.has(child.metadata?.id??"")&&matchesAllLabels(child.metadata?.labels??{},input.labels),scope:rows=>Promise.resolve(rows),failure:"failed to list child organizations"});return create2(ChildOrgListSchema,{entries:page.entries,nextPageToken:page.nextPageToken})}var QUIESCE_STAGE="quiesce",CONTENT_STAGE="content",SHRED_STAGE="shred",CHILDREN_STAGE="children",FINAL_STAGE="final",PURGE_TERMINATION_REASON="its organization was deleted",ENGINE_UNREACHABLE_FOR_PURGE="the execution engine is unreachable, and the organization has runs that may still be live",EXECUTION_PAGE=200,DONE={more:!1},MORE={more:!0};function newQuiesceStage(deps){return{name:QUIESCE_STAGE,async run(context2){return(await deps.routinePurge.purge(context2.org,context2.caller)).more?MORE:(await terminateAgentExecutions(deps,context2),await deprovisionSandboxes(deps,context2),await deps.store.pendingOAuthStates.deleteByOrg(context2.org.id),await deps.store.connectLinks.deleteByOrg(context2.org.id),await deps.store.connectAttempts.deleteByOrg(context2.org.id),DONE)}}}async function*organizationRows(store,declaration,org){let after;for(;;){let rows=await store.queryResources(declaration,{org,limit:EXECUTION_PAGE,...after===void 0?{}:{after}});for(let row of rows)yield row.data;if(rows.length<EXECUTION_PAGE)return;after=rows[rows.length-1].cursor}}async function terminateAgentExecutions(deps,context2){for await(let data of organizationRows(deps.store,agentExecutionListIndex,context2.org.id)){let execution=fromBinary2(RunSchema,data);if(isTerminalExecutionPhase(execution.status?.phase??0))continue;let state2=deps.agentEngine();if(!state2.connected)throw new Error(ENGINE_UNREACHABLE_FOR_PURGE);let id=execution.metadata?.id??"";try{await state2.engine.terminateWorkflow(id,PURGE_TERMINATION_REASON)}catch(error3){if(!(error3 instanceof EngineWorkflowNotFoundError))throw error3}}}async function deprovisionSandboxes(deps,context2){let lane=deps.sandboxLane;if(lane.enabled)for await(let data of organizationRows(deps.store,sessionListIndex,context2.org.id)){let id=fromBinary2(SessionSchema,data).metadata?.id??"";id!==""&&await lane.provisioner.deprovisionSessionSandbox(id)}}function newContentStage(purges){return{name:CONTENT_STAGE,async run(context2){for(let purge of purges)if((await purge.purge(context2.org,context2.caller)).more)return MORE;return DONE}}}function newShredStage(secrets){return{name:SHRED_STAGE,async run(context2){return await secrets.destroyOrganization(context2.org.id),DONE}}}function newChildrenStage(store){return{name:CHILDREN_STAGE,async run(context2){let children=await store.queryResources(organizationListIndex,{anyKey:[{name:"parent_org",value:context2.org.id}]});if(children.length===0)return DONE;let now=new Date().toISOString();for(let child of children)await store.organizationDeletions.isDeleting(child.id)||(await store.organizationDeletions.mark(child.id,now),await store.organizationDeletions.accept(child.id,now));return{more:!0,wait:!0}}}}function newFinalStage(deps){return{name:FINAL_STAGE,async run(context2){for(let sweep of deps.sweepFirst??[])for(;;){let progress=await sweep.run(context2);if(!progress.more)break;if(progress.wait===!0)return progress}let id=context2.org.id,organization=await loadOrganization2(deps.store,id)??create2(OrganizationSchema,{metadata:{id},spec:{parentOrg:context2.org.parentOrg}});deps.lifecycle!==void 0&&await deps.lifecycle.onResourceDeleted({kind:ApiResourceKind.organization,resourceId:id,orgId:"",caller:context2.caller});let ctx=new RequestContext(OrganizationCommandController.method.delete.input,create2(OrganizationCommandController.method.delete.input,{value:id}),context2.caller,ApiResourceKind.organization);return ctx.set(RESOURCE_ID_KEY,id),ctx.set(EXISTING_RESOURCE_KEY,organization),await deps.store.deleteSearchIndexByOrg(id),await deps.store.deleteRoutineFiresByOrg(id),await deps.store.sessionEvents.deleteByOrg(id),await newPipeline("organization-purge-final",deps.logger).addStep(newRevokeOrganizationGrantsStep(deps.grantPath)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newRetireOrganizationSlugStep(deps.store,deps.logger)).addStep(newReleaseExternalIdStep(deps.store,deps.logger)).build().execute(ctx),await deps.store.organizationDeletions.release(id),DONE}}}async function loadOrganization2(store,id){try{return await store.getResource(ApiResourceKind.organization,id,OrganizationSchema)}catch(error3){if(error3 instanceof ResourceNotFoundError)return;throw error3}}var SCAN_PAGE=500,REFUSED_KINDS=new Set([ApiResourceKind.api_key,ApiResourceKind.grant,ApiResourceKind.identity_account]);function tokenOf(kind,read3,id,createdAt=""){let token={kind:kindEnumName(kind),read:read3,id,createdAt};return JSON.stringify(token)}function positionOf(kind,read3,after){let parsed;try{parsed=JSON.parse(after)}catch{parsed=void 0}let token=parsed;if(token?.kind!==kindEnumName(kind)||token.read!==read3||typeof token.id!="string"||typeof token.createdAt!="string")throw new Error(`organization rows: \`after\` is not a page's \`next\` from the ${kindEnumName(kind)} reader`);return{kind:token.kind,read:read3,id:token.id,createdAt:token.createdAt}}function newOrganizationRows(store,listIndexes,org){let indexOf2=new Map(listIndexes.map(index2=>[index2.kind,index2])),orgOf2=(schema2,data)=>metadataOf(fromBinary2(schema2,data))?.org??"";async function indexed(index2,schema2,after,limit){let from2=after===""?void 0:positionOf(index2.kind,"index",after),rows=await store.queryResources(index2,{org,limit,...from2===void 0?{}:{after:{createdAt:from2.createdAt,id:from2.id}}}),last=rows[rows.length-1];return{ids:rows.filter(row=>orgOf2(schema2,row.data)===org).map(row=>row.id),next:rows.length<limit||last===void 0?void 0:tokenOf(index2.kind,"index",last.cursor.id,last.cursor.createdAt)}}async function scanned(kind,schema2,after,limit){let ids=[],from2=after===""?"":positionOf(kind,"scan",after).id;for(;;){let page=await store.findResourcesRawOrderedAfter(kind,from2,SCAN_PAGE);for(let raw of page)if(orgOf2(schema2,raw.data)===org&&(ids.push(raw.id),ids.length>=limit))return{ids,next:tokenOf(kind,"scan",raw.id)};if(page.length<SCAN_PAGE)return{ids,next:void 0};from2=page[page.length-1].id}}return{async ids(kind,schema2,{after,limit}){if(REFUSED_KINDS.has(kind))throw new Error(`organization rows: ${kindEnumName(kind)} rows do not name their organization in metadata.org`);if(!Number.isInteger(limit)||limit<=0)throw new Error(`organization rows: a page's limit is a positive integer, not ${limit}`);let index2=indexOf2.get(kind);return index2===void 0?scanned(kind,schema2,after,limit):indexed(index2,schema2,after,limit)}}}var PURGE_PASS_INTERVAL_MS=30*1e3,STALE_HEARTBEAT_MS=300*1e3,STALE_PENDING_MS=600*1e3,RETRY_BASE_MS=30*1e3,RETRY_MAX_MS=900*1e3,PURGE_FAULT_MESSAGE="the purge stage failed; it will be retried";var OrganizationPurgeRunner=class{deps;now;caller=serverActingFor(PURGE_ACTOR);running=new Set;owned=new Set;backoff=new Map;timer;pass;queued=!1;stopped=!1;constructor(deps){this.deps=deps,this.now=deps.now??(()=>new Date);let names2=new Set;for(let stage of deps.stages){if(names2.has(stage.name))throw new Error(`organization purge stage '${stage.name}' is composed twice \u2014 stage names are unique`);names2.add(stage.name)}}start(){this.timer!==void 0||this.stopped||(this.timer=setInterval(()=>this.schedulePass(),this.deps.intervalMs??PURGE_PASS_INTERVAL_MS),this.timer.unref(),this.schedulePass())}kick(_org){this.timer===void 0||this.stopped||this.schedulePass()}async stop(){this.stopped=!0,this.timer!==void 0&&(clearInterval(this.timer),this.timer=void 0),await this.pass}schedulePass(){if(this.pass!==void 0){this.queued=!0;return}this.pass=this.runPass().finally(()=>{this.pass=void 0,this.queued&&!this.stopped&&(this.queued=!1,this.schedulePass())})}async runPass(){let deletions;try{deletions=await this.deps.store.organizationDeletions.list()}catch(error3){this.deps.logger.warn("organization purge pass could not read the deletion table",{error:errorText2(error3)});return}let nowMs=this.now().getTime();for(let deletion of deletions){if(this.stopped)return;if(deletion.phase==="pending"){await this.recoverStalePending(deletion,nowMs);continue}if(!(this.running.has(deletion.org)||!this.isDue(deletion,nowMs))){this.running.add(deletion.org);try{await this.purge(deletion)}finally{this.running.delete(deletion.org)}}}}isDue(deletion,nowMs){let held=this.backoff.get(deletion.org);return held!==void 0&&nowMs<held.until?!1:deletion.heartbeatAt===""||this.owned.has(deletion.org)?!0:nowMs-Date.parse(deletion.heartbeatAt)>=STALE_HEARTBEAT_MS}async recoverStalePending(deletion,nowMs){if(!(nowMs-Date.parse(deletion.markedAt)<STALE_PENDING_MS))try{await this.deps.store.organizationDeletions.unmark(deletion.org)&&this.deps.logger.warn("an organization delete left its mark behind; the organization is live again",{org:deletion.org,markedAt:deletion.markedAt})}catch(error3){this.deps.logger.warn("could not remove a stale organization delete mark",{org:deletion.org,error:errorText2(error3)})}}async purge(deletion){let deletions=this.deps.store.organizationDeletions,stages=this.deps.stages,resumeAt=Math.max(0,stages.findIndex(stage=>stage.name===deletion.stage)),stageName=stages[resumeAt]?.name??"";this.owned.add(deletion.org);try{let org=await this.target(deletion.org),rows=newOrganizationRows(this.deps.store,this.deps.listIndexes??[],org.id);for(let index2=resumeAt;index2<stages.length;index2++){let stage=stages[index2];for(stageName=stage.name,await deletions.heartbeat(deletion.org,stage.name,this.stamp());;){if(this.stopped)return;let progress=await stage.run({org,logger:this.deps.logger,caller:this.caller,rows});if(!progress.more)break;if(progress.wait===!0){this.backoff.delete(deletion.org);return}await deletions.heartbeat(deletion.org,stage.name,this.stamp())}}this.backoff.delete(deletion.org),this.owned.delete(deletion.org),this.deps.logger.info("organization purged",{org:deletion.org})}catch(error3){let faults=(this.backoff.get(deletion.org)?.faults??0)+1,delay2=Math.min(RETRY_MAX_MS,RETRY_BASE_MS*2**(faults-1));this.backoff.set(deletion.org,{faults,until:this.now().getTime()+delay2}),this.deps.logger.error("organization purge stage failed; retrying later",{org:deletion.org,stage:stageName,retryInMs:delay2,error:errorText2(error3)});try{await deletions.recordError(deletion.org,stageName,PURGE_FAULT_MESSAGE,this.stamp())}catch(recordError){this.deps.logger.warn("could not record an organization purge fault",{org:deletion.org,error:errorText2(recordError)})}}}async target(org){try{let row=await this.deps.store.getResource(ApiResourceKind.organization,org,OrganizationSchema);return{id:org,parentOrg:row.spec?.parentOrg??""}}catch(error3){if(error3 instanceof ResourceNotFoundError)return{id:org,parentOrg:""};throw error3}}stamp(){return this.now().toISOString()}};function errorText2(error3){return error3 instanceof Error?error3.message:String(error3)}function registerPlatformServices(router,deps){router.service(PlatformQueryController,{getServerInfo:()=>getServerInfo(deps),getLicenseStatus:()=>getLicenseStatus(deps),getModelReadiness:(input,ctx)=>getModelReadiness(deps,input,ctx),getRunnerBootstrapConfig:(_input,ctx)=>getRunnerBootstrapConfig(deps,ctx),getRunnerScopedToken:(input,ctx)=>getRunnerScopedToken(deps,input,ctx)})}function getServerInfo(deps){return create2(GetServerInfoOutputSchema,{edition:deps.edition,version:deps.version,authenticationRequired:deps.authenticationRequired,...deps.nativeSignIn!==void 0?{nativeSignIn:create2(NativeSignInSchema,deps.nativeSignIn)}:{},singleOrg:deps.singleOrganization?.current()!==void 0,environments:create2(EnvironmentAvailabilitySchema,{applies:deps.environmentPolicy.governs(ExecutionTarget.UNSPECIFIED),limitedNetworking:deps.environmentPolicy.support.limitedNetworking,packages:deps.environmentPolicy.support.packages})})}var READINESS_ENGINES=[Harness.STIGMER,Harness.CLAUDE];function wireAvailability(report){switch(report.state){case"served":return report.source==="organization"?ProviderAvailability.served_by_organization:report.source==="parent"?ProviderAvailability.served_by_parent_organization:ProviderAvailability.served_by_runners;case"missing":return report.scope==="organization"?ProviderAvailability.missing_from_organization:ProviderAvailability.missing_from_runners;case"unknown":return ProviderAvailability.availability_unknown}}async function getModelReadiness(deps,input,ctx){await authorizeDirect(PlatformQueryController.method.getModelReadiness,deps.authorizer,callerIdentityOf(ctx),input);let reports;try{reports=new Map(await Promise.all(MODEL_PROVIDERS.map(async provider=>[provider,await deps.providerAvailability.availability(input.org,provider)])))}catch(err3){throw deps.logger.warn("Model readiness could not read provider availability",{org:input.org,error:err3 instanceof Error?err3.message:String(err3)}),new ConnectError(PROVIDER_AVAILABILITY_UNAVAILABLE_COPY,Code.Unavailable)}let reportOf=provider=>reports.get(provider)??{state:"unknown"},judge2=(engine,model)=>{let placed=engine===Harness.UNSPECIFIED?Harness.STIGMER:engine,need=providerNeededBy(placed,model,deps.modelCatalog);return create2(ModelReadinessSchema,{harness:placed,model,provider:need?.provider??"",availability:need===void 0?ProviderAvailability.availability_unknown:wireAvailability(reportOf(need.provider))})};return create2(GetModelReadinessOutputSchema,{providers:MODEL_PROVIDERS.map(provider=>{let report=reportOf(provider);return create2(ProviderReadinessSchema,{provider,availability:wireAvailability(report),parentOrg:report.state==="served"&&report.source==="parent"?report.parentOrg:""})}),models:READINESS_ENGINES.flatMap(engine=>deps.modelCatalog.canonicalModels(harnessName(engine)).map(model=>judge2(engine,model))),judged:input.model===void 0?void 0:judge2(input.model.harness,input.model.model)})}async function getLicenseStatus(deps){let now=deps.now(),report=await deps.licenseStatus.status(now),output=create2(GetLicenseStatusOutputSchema,{state:report.state,checkedAt:timestampFromDate(now)});switch(report.state){case LicenseState.absent:return output;case LicenseState.invalid:return output.keyId=report.keyId,output;case LicenseState.valid:case LicenseState.expiring:case LicenseState.grace:case LicenseState.expired:return output.keyId=report.keyId,output.claims=report.claims,output;default:{let exhaustive=report;throw new Error(`unhandled license report: ${JSON.stringify(exhaustive)}`)}}}async function getRunnerBootstrapConfig(deps,ctx){let output=create2(GetRunnerBootstrapConfigOutputSchema,{temporalAddress:await isSandboxCaller(deps,ctx)?deps.sandboxTemporalAddress:deps.runnerBootstrapTemporalAddress,temporalNamespace:deps.temporalNamespace,mcpBridgeEndpoint:deps.runnerBootstrapMcpBridgeEndpoint}),bootstrapCredentials=deps.runnerAuthService.bootstrapCredentials?.bind(deps.runnerAuthService);if(bootstrapCredentials===void 0)return output;try{let credentials=await bootstrapCredentials(callerIdentityOf(ctx));credentials.accessToken!==void 0&&(output.runnerAccessToken=credentials.accessToken.token,output.tokenType="Bearer",output.runnerAccessTokenExpiresInSeconds=credentials.accessToken.expiresInSeconds),credentials.payloadKeys!==void 0&&(output.payloadEncryptionKey=credentials.payloadKeys.keyBase64,output.payloadEncryptionKeyId=credentials.payloadKeys.keyId,output.payloadEncryptionSecondaryKey=credentials.payloadKeys.secondaryKeyBase64??"",output.payloadEncryptionSecondaryKeyId=credentials.payloadKeys.secondaryKeyId??"")}catch(error3){deps.logger.warn("Bootstrap credentials unavailable \u2014 answering coordinates without them",{error:error3 instanceof Error?error3.message:String(error3)})}return output}async function getRunnerScopedToken(deps,input,ctx){let asking=ctx.values.get(callerIdentityKey);if(asking!==void 0&&isServiceAccountCaller(asking))throw new ConnectError(serviceAccountRefusedMessage("mint run credentials"),Code.PermissionDenied);let exchange=deps.runnerAuthService.exchangeScopedToken?.bind(deps.runnerAuthService);if(exchange!==void 0){let minted=await exchange(exchangeRequestOf(input),callerIdentityOf(ctx));return minted.minted?create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.expiresInSeconds}):create2(GetRunnerScopedTokenOutputSchema)}let executionId;switch(input.scope.case){case"runId":executionId=input.scope.value;break;case"renewal":return renewSandboxToken(deps,ctx);case void 0:return create2(GetRunnerScopedTokenOutputSchema);default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}if(executionId===""||!deps.runnerAuthService.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))return create2(GetRunnerScopedTokenOutputSchema);try{let minted=deps.runnerAuthService.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.ttlSeconds})}catch(error3){return deps.logger.warn("failed to mint runner scoped token \u2014 answering not-minted",{executionId,error:error3 instanceof Error?error3.message:String(error3)}),create2(GetRunnerScopedTokenOutputSchema)}}function exchangeRequestOf(input){switch(input.scope.case){case"runId":return{arm:"agent-execution",executionId:input.scope.value};case"renewal":return{arm:"renewal"};case void 0:return{arm:"unset"};default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}}async function isSandboxCaller(deps,ctx){let queueOf=deps.runnerAuthService.temporalTaskQueueOf?.bind(deps.runnerAuthService),bearer=bearerOf(ctx);if(queueOf===void 0||bearer===void 0)return!1;try{return await queueOf(bearer)!==void 0}catch(error3){return deps.logger.warn("Runner credential's Temporal queue could not be read; answering as for any runner",{error:error3 instanceof Error?error3.message:String(error3)}),!1}}function bearerOf(ctx){return/^Bearer\s+(\S+)$/i.exec(ctx.requestHeader.get("authorization")?.trim()??"")?.[1]}async function renewSandboxToken(deps,ctx){let renew=deps.runnerAuthService.renewSandboxToken?.bind(deps.runnerAuthService),bearer=bearerOf(ctx);if(renew===void 0||bearer===void 0)return create2(GetRunnerScopedTokenOutputSchema);let renewed=await renew(bearer);return renewed.minted?create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:renewed.token,tokenType:"Bearer",expiresInSeconds:renewed.expiresInSeconds}):create2(GetRunnerScopedTokenOutputSchema)}var SERVER_VERSION="0.1.0";var fileListIndex=declareListIndex({kind:ApiResourceKind.file,schema:FileSchema,revision:2,keys:{session:field("status.session_id"),run:field("status.run_id")}});var PAGE=200;function newCascadeDeleteSessionFilesStep(store,blobs,lifecycle,logger2){return{name:"CascadeDeleteSessionFiles",async execute(ctx){let sessionId=requireResourceId(ctx),removed=0;for(;;){let rows;try{rows=await store.queryResources(fileListIndex,{anyKey:[{name:"session",value:sessionId}],limit:PAGE})}catch(error3){throw internalError(error3,"failed to list the session's files")}for(let row of rows){let org=fromBinary2(FileSchema,row.data).metadata?.org??"";await blobs.removeFile(row.id),await cleanUpDeletedResource(lifecycle,logger2,{kind:ApiResourceKind.file,resourceId:row.id,orgId:org,caller:ctx.callerIdentity}),removed++}if(rows.length<PAGE)break}removed>0&&logger2.info("Cascade-deleted files of session",{sessionId,count:removed})}}}function newStampSessionRoutineStep(){return{name:"StampSessionRoutine",execute(ctx){let caller=ctx.callerIdentity,routineId=caller.routineId??"";routineId===""||!isServerComposedRequest(caller)||((ctx.newState.status??=create2(SessionStatusSchema)).routineId=routineId)}}}function newAdmitSessionEnvironmentStep(store,policy){return{name:"AdmitSessionEnvironment",async execute(ctx){let session=ctx.newState,environment=await loadSessionEnvironment(store,session);if(environment===void 0&&(session.spec?.environmentRef?.id??"")==="")return;let servers=await sessionRunServers(store,session);await admitEnvironment({policy,session,environment,servers})}}}function newRefuseLocalProgramsStep(store,policy){return{name:"RefuseLocalPrograms",async execute(ctx){let session=ctx.newState,target=session.spec?.executionTarget??ExecutionTarget.UNSPECIFIED;if(!policy.refusesLocalPrograms(target))return;let org=session.metadata?.org??"",agentId=session.status?.agentId??"",versionHash=session.status?.agentVersionHash??"",agentSpec=agentId===""?void 0:(await loadVersion(store,agentVersionBinding,agentId,versionHash)).resource.spec,subagents=await runSubagents(store,agentSpec,org),plugins=await loadRunPlugins(store,runPluginReferences(agentSpec,session,org,subagents),org);refuseLocalPrograms(policy,target,plugins)}}}function sessionRunTarget(session,stored){let agentId=session.status?.agentId??"";if(!(agentId===""||agentId===(stored?.status?.agentId??"")&&(session.status?.agentVersionHash??"")===(stored?.status?.agentVersionHash??"")))return{...RUN_GATE_CHECKS.agent,resourceId:agentId,deniedMessage:runAgentDeniedMessage2(agentId)}}var sessionSearchExtractor={kind:ApiResourceKind.session,schema:SessionSchema,getSearchSummary(resource){return resource.spec?.subject??""},toSearchResult(resource,score){let session=resource;return buildSearchResult({kind:ApiResourceKind.session,metadata:session.metadata,summary:session.spec?.subject??"",score,createdAt:session.status?.audit?.specAudit?.createdAt,updatedAt:session.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let session=resource,metadata=session.metadata;if(metadata!==void 0)return{name:metadata.name,description:session.spec?.subject??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(session.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var LIST_RESULT_KEY7="listResult";function newValidateHarnessImmutabilityStep(store){return{name:"ValidateHarnessImmutability",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0)return;let inputSpec=ctx.newState.spec;if(inputSpec===void 0||inputSpec.harness===Harness.UNSPECIFIED)return;let existingHarness=existingSpec.harness,inputHarness=inputSpec.harness;if(existingHarness===Harness.UNSPECIFIED&&(existingHarness=Harness.STIGMER),inputHarness!==existingHarness&&await sessionHasRun(store,ctx,existing))throw failedPreconditionError("session harness cannot be changed after the first execution \u2014 each harness owns its conversation state independently")}}}var EXECUTION_TARGET_PROTO_NAMES={[ExecutionTarget.UNSPECIFIED]:"EXECUTION_TARGET_UNSPECIFIED",[ExecutionTarget.LOCAL]:"EXECUTION_TARGET_LOCAL",[ExecutionTarget.CLOUD]:"EXECUTION_TARGET_CLOUD"};function newValidateExecutionTargetImmutabilityStep(temporalConfig,store){return{name:"ValidateExecutionTargetImmutability",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0)return;let inputSpec=ctx.newState.spec;if(inputSpec===void 0)return;let existingTarget=temporalConfig.resolveExecutionTarget(existingSpec.executionTarget),inputTarget=temporalConfig.resolveExecutionTarget(inputSpec.executionTarget);if(inputTarget!==existingTarget&&await sessionHasRun(store,ctx,existing))throw failedPreconditionError(`session execution_target cannot be changed after the first execution (${EXECUTION_TARGET_PROTO_NAMES[existingTarget]} \u2192 ${EXECUTION_TARGET_PROTO_NAMES[inputTarget]}; unset resolves to the deployment default, ${temporalConfig.defaultExecutionTarget}) \u2014 workspace state may not be portable between local and cloud environments`)}}}async function listExecutionsBySession(store,logger2,sessionId){let rows;try{rows=await store.queryResources(agentExecutionListIndex,{anyKey:[{name:"session",value:sessionId}]})}catch(error3){throw internalError(error3,"failed to list agent executions")}let executions=[];for(let row of rows)try{executions.push(fromBinary2(RunSchema,row.data))}catch(error3){logger2.warn("Failed to unmarshal execution, skipping",{error:error3 instanceof Error?error3.message:String(error3)})}return executions}function newRejectDeleteWithActiveExecutionsStep(store,logger2){return{name:"RejectDeleteWithActiveExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId),activeCount=0;for(let execution of executions)isActiveExecutionPhase(execution.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED)&&activeCount++;if(activeCount>0)throw failedPreconditionError(`session has ${activeCount} active execution(s); cancel them or wait for completion before deleting`)}}}function newCascadeDeleteAgentExecutionsStep(store,lifecycle,logger2,runScores){return{name:"CascadeDeleteAgentExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId);if(executions.length!==0){for(let execution of executions){let executionId=execution.metadata?.id??"";await runScores.deleteScoresOfRun(executionId);try{await store.deleteResource(ApiResourceKind.run,executionId)}catch(error3){throw internalError(error3,`failed to cascade-delete execution ${executionId} of session ${sessionId}`)}await cleanUpDeletedResource(lifecycle,logger2,{kind:ApiResourceKind.run,resourceId:executionId,orgId:execution.metadata?.org??"",caller:ctx.callerIdentity});try{await store.deleteSearchIndex(ApiResourceKind.run,executionId)}catch(error3){logger2.warn("CascadeDeleteAgentExecutions: failed to remove search index entry (best-effort)",{executionId,error:error3 instanceof Error?error3.message:String(error3)})}}logger2.info("Cascade-deleted executions of session",{sessionId,count:executions.length})}}}}function requireSessionId(ctx){let sessionId=ctx.get(RESOURCE_ID_KEY);if(typeof sessionId!="string"||sessionId==="")throw internalError(new Error("session id not found in context (ExtractResourceId must run first)"),"session id not found in context (ExtractResourceId must run first)");return sessionId}function newListAllSessionsStep(store,logger2,listReadScope){return{name:"ListAllSessions",async execute(ctx){let input=ctx.input,page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{org:input.org,withoutKeys:["eval_run"]},fingerprint:{lane:"session.list",org:input.org}});ctx.set(LIST_RESULT_KEY7,page)}}}function newFilterByAgentStep(store,logger2,listReadScope){return{name:"FilterByAgent",async execute(ctx){let agentId=ctx.input.agentId;if(agentId==="")throw invalidArgumentError("agent_id is required");let page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{anyKey:[{name:"agent",value:agentId}],withoutKeys:["eval_run"]},fingerprint:{lane:"session.listByAgent",agentId}});ctx.set(LIST_RESULT_KEY7,page)}}}function newAuthorizeChannelAccessStep(authorizer){return newAuthorizeResolvedTargetStep(authorizer,({input})=>input.channelId===""?[]:[{permission:IamPermission.can_view,resourceKind:ApiResourceKind.channel,resourceId:input.channelId,deniedMessage:"unauthorized to list channel conversations"}],"AuthorizeChannelAccess")}function newFilterByChannelStep(store,logger2,listReadScope){return{name:"FilterByChannel",async execute(ctx){let channelId=ctx.input.channelId;if(channelId==="")throw invalidArgumentError("channel_id is required");let page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{anyKey:[{name:"channel",value:channelId}]},fingerprint:{lane:"session.listByChannel",channelId}});ctx.set(LIST_RESULT_KEY7,page)}}}async function readSessionPage(store,logger2,listReadScope,caller,request3,lane){let page=await readListPage({store,declaration:sessionListIndex,query:lane.query,request:request3,fingerprint:listPageFingerprint({...lane.fingerprint,labels:sortedLabels(request3.labels)}),decode:data=>{try{return fromBinary2(SessionSchema,data)}catch(error3){logger2.warn("Failed to unmarshal session, skipping",{error:error3 instanceof Error?error3.message:String(error3)});return}},keep:session=>matchesAllLabels(session.metadata?.labels??{},request3.labels),scope:sessions=>restrictListByReadScope(listReadScope,caller,ApiResourceKind.session,sessions,""),failure:"failed to list sessions"});return create2(SessionListSchema,{entries:page.entries,nextPageToken:page.nextPageToken})}async function isRunnerForRun(deps,token,runId){let authorize=deps.runnerAuth.authorizeRunnerForRun?.bind(deps.runnerAuth);if(authorize!==void 0)try{return await authorize(token,runId)}catch(error3){return deps.logger.warn("Runner credential authorization failed; refusing",{error:error3 instanceof Error?error3.message:String(error3)}),!1}let bound2;try{bound2=deps.runnerAuth.verify(TOKEN_TYPE_EXECUTION_SCOPED,token)}catch{return!1}return bound2!==runId?(deps.logger.warn("A runner credential named another run; refusing",{tokenExecutionId:bound2,runId}),!1):!0}var SESSION_EVENT_MAX_BYTES=256*1024,NOT_THE_RUNS_RUNNER_MESSAGE="only the runner acting for this run may append its events";async function appendSessionEvents(deps,input,ctx){let runId=input.runId;if(runId==="")throw invalidArgumentError("run_id is required");let token=parseBearerToken(ctx.requestHeader.get("authorization")??"");if(token===""||!await isRunnerForRun(deps,token,runId))throw permissionDeniedError(NOT_THE_RUNS_RUNNER_MESSAGE);let run=await loadRun5(deps.store,runId);admitLive(run);let sessionId=sessionIdOfRun2(run);if(sessionId==="")throw failedPreconditionError(`run '${runId}' is in no session; it has no event log`);let drafts=input.events.map((event,index2)=>{if(event.event.case===void 0)throw invalidArgumentError(`events[${index2}] holds no event`);let type2=eventTypeOf(event);if(!RUNNER_EVENT_TYPES.has(type2))throw invalidArgumentError(`events[${index2}]: a runner may not append ${type2} events`);if(event.event.value.id==="")throw invalidArgumentError(`events[${index2}]: the event's id is required`);if(event.event.value.id.startsWith(`${SESSION_EVENT_ID_PREFIX}_`))throw invalidArgumentError(`events[${index2}]: ids starting with '${SESSION_EVENT_ID_PREFIX}_' are the server's`);let own=clone(SessionEventSchema,event);own.runId=runId;let draft=draftOf(own);if(draft.data.length>SESSION_EVENT_MAX_BYTES)throw invalidArgumentError(`events[${index2}] is ${draft.data.length} bytes; an event holds at most ${SESSION_EVENT_MAX_BYTES}`);return draft});input.previews.forEach((preview,index2)=>{let size=toBinary(SessionEventPreviewSchema,preview).length;if(size>SESSION_EVENT_MAX_BYTES)throw invalidArgumentError(`previews[${index2}] is ${size} bytes; a preview holds at most ${SESSION_EVENT_MAX_BYTES}`)});let stored={records:[],appended:[]};if(drafts.length>0)try{stored=await deps.store.sessionEvents.append(sessionId,run.metadata?.org??"",drafts,{kind:ApiResourceKind.run,id:runId,schema:RunSchema,admit:row=>admitLive(row)})}catch(error3){throw error3 instanceof ConnectError?error3:error3 instanceof SessionEventConflictError?new ConnectError(error3.message,Code.AlreadyExists):error3 instanceof ResourceNotFoundError?permissionDeniedError(NOT_THE_RUNS_RUNNER_MESSAGE):internalError(error3,"failed to append session events")}return deps.sessionEventBroker.publishPreviews(sessionId,input.previews.map(preview=>stampedPreview(preview,runId))),deps.sessionEventBroker.publish(sessionId,run.metadata?.org??"",stored.appended.map(eventOf)),create2(AppendSessionEventsResponseSchema,{events:stored.records.map(identityOf)})}function stampedPreview(preview,runId){if(preview.preview.case!=="stigmerRunLiveness"||preview.preview.value.runId===runId)return preview;let liveness=clone(RunLivenessSchema,preview.preview.value);return liveness.runId=runId,create2(SessionEventPreviewSchema,{preview:{case:"stigmerRunLiveness",value:liveness}})}async function loadRun5(store,runId){try{return await store.getResource(ApiResourceKind.run,runId,RunSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?permissionDeniedError(NOT_THE_RUNS_RUNNER_MESSAGE):internalError(error3,"failed to load the run")}}function admitLive(run){let phase=run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED;if(isTerminalExecutionPhase(phase))throw failedPreconditionError(`run '${run.metadata?.id??""}' is finished; it takes no more events`)}async function claimSessionInput(deps,input,ctx){let runId=input.runId;if(runId==="")throw invalidArgumentError("run_id is required");let token=parseBearerToken(ctx.requestHeader.get("authorization")??"");if(token===""||!await isRunnerForRun(deps,token,runId))throw permissionDeniedError(NOT_THE_RUNS_RUNNER_MESSAGE);let run=await loadRun6(deps,runId);admitWorking(run);let sessionId=sessionIdOfRun2(run),authority=authorityOfRun(run);if(sessionId===""||!(await deps.store.sessionEvents.queued(sessionId)).some(queued=>sameAuthority(authorityOfQueued(queued),authority)))return create2(ClaimSessionInputResponseSchema);let taken;try{taken=await updateRunAppendingEvents(deps,runId,(row,session)=>{admitWorking(row);let own=session.queued.filter(queued=>sameAuthority(authorityOfQueued(queued),authorityOfRun(row)));return{last:own.map(queued=>takenMessage(eventOf(queued.record),runId)),takeQueued:own.map(queued=>queued.record.eventId)}},{queued:!0})}catch(error3){throw error3 instanceof ConnectError?error3:error3 instanceof ResourceNotFoundError?permissionDeniedError(NOT_THE_RUNS_RUNNER_MESSAGE):internalError(error3,"failed to take the session's queued messages")}let events=taken.events.filter(event=>event.event.case==="userMessage"&&event.runId===runId);return events.length>0&&deps.logger.info("the run took its session's queued messages",{runId,messages:events.length}),create2(ClaimSessionInputResponseSchema,{events})}async function loadRun6(deps,runId){try{return await deps.store.getResource(ApiResourceKind.run,runId,RunSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?permissionDeniedError(NOT_THE_RUNS_RUNNER_MESSAGE):internalError(error3,"failed to load the run")}}function admitWorking(run){let phase=run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED;if(!isWorkingPhase(phase))throw failedPreconditionError(`run '${run.metadata?.id??""}' is not working; it takes no queued messages`)}function newDeleteSessionEventsStep(store){return{name:"DeleteSessionEvents",async execute(ctx){let sessionId=requireResourceId(ctx);try{await store.sessionEvents.deleteBySession(sessionId)}catch(error3){throw internalError(error3,"failed to delete the session's events")}}}}var SESSION_EVENT_PAGE_DEFAULT_SIZE=100,SESSION_EVENT_PAGE_MAX_BYTES=8*1024*1024;async function listSessionEvents(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listEvents.input,req,callerIdentityOf(ctx),ApiResourceKind.session),result=create2(SessionEventListSchema);return await newPipeline("session-list-events",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listEvents,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"ListSessionEvents",async execute(stepCtx){result=await readSessionEventPage(deps.store,stepCtx.input)}}).build().execute(reqCtx),result}async function readSessionEventPage(store,req){let order=req.order==="desc"?"desc":"asc",size=req.pageSize===0?SESSION_EVENT_PAGE_DEFAULT_SIZE:req.pageSize,fingerprint=listPageFingerprint({session:req.sessionId,order,size,types:req.types,run:req.runId,gt:req.createdAtGt,gte:req.createdAtGte,lt:req.createdAtLt,lte:req.createdAtLte}),query={order,limit:size+1,...req.pageToken===""?{}:{afterSeq:seqOfToken(req.pageToken,fingerprint)},...req.types.length===0?{}:{types:req.types},...req.runId===""?{}:{runId:req.runId},...bound("processedAtGt","created_at_gt",req.createdAtGt,"down"),...bound("processedAtGte","created_at_gte",req.createdAtGte,"up"),...bound("processedAtLt","created_at_lt",req.createdAtLt,"up"),...bound("processedAtLte","created_at_lte",req.createdAtLte,"down")},records;try{records=await store.sessionEvents.list(req.sessionId,query)}catch(error3){throw internalError(error3,"failed to list session events")}let page=[],bytes=0;for(let record4 of records.slice(0,size)){if(page.length>0&&bytes+record4.data.length>SESSION_EVENT_PAGE_MAX_BYTES)break;page.push(record4),bytes+=record4.data.length}let last=page[page.length-1];return create2(SessionEventListSchema,{events:page.map(eventOf),nextPageToken:records.length>page.length&&last!==void 0?encodeListPageToken({createdAt:"",id:String(last.seq)},fingerprint):""})}function seqOfToken(token,fingerprint){let seq2=Number(decodeListPageToken(token,fingerprint).cursor.id);if(!Number.isSafeInteger(seq2)||seq2<0)throw invalidArgumentError("invalid page_token");return seq2}var RFC33392=/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d{1,9}))?(Z|[+-]\d{2}:\d{2})$/i;function bound(key,field3,value,round){if(value==="")return{};let parts=RFC33392.exec(value),whole=parts===null?Number.NaN:Date.parse(`${parts[1]}${parts[3]}`);if(parts===null||Number.isNaN(whole))throw invalidArgumentError(`${field3} must be an RFC 3339 instant with its offset, got '${value}'`);let fraction=parts[2]??"",millis=Number(fraction.padEnd(3,"0").slice(0,3)),finer=/[1-9]/.test(fraction.slice(3))&&round==="up"?1:0;return{[key]:new Date(whole+millis+finer).toISOString()}}function sessionStateOf(events){let newest;for(let event of events)(event.event.case==="sessionStatusRunning"||event.event.case==="sessionStatusIdle")&&(newest===void 0||event.seq>newest.seq)&&(newest=event);return newest?.event.case==="sessionStatusRunning"?"running":"idle"}async function readSessionState(store,sessionId){let newest=await store.sessionEvents.list(sessionId,{order:"desc",types:SESSION_STATUS_TYPES,limit:1});return sessionStateOf(newest.map(eventOf))}async function stampSessionStates(store,sessions){await Promise.all(sessions.map(async session=>{let state2=await readSessionState(store,session.metadata?.id??"");(session.status??=create2(SessionStatusSchema)).state=state2}))}function newStampSessionStateStep(store,sessionsOf){return{name:"StampSessionState",async execute(ctx){await stampSessionStates(store,sessionsOf(ctx))}}}var SESSION_EVENT_PREVIEW_CAPACITY=4096,SESSION_EVENT_PREVIEW_MAX_BYTES=32*1024*1024,SESSION_EVENT_DROPPED_IDS_KEPT=4096,SESSION_EVENT_LIVENESS_TYPE="stigmer.run.liveness",SESSION_EVENT_LIVENESS_KEPT_MS=6e4,LIVENESS_STOPS_IN=new Set(["waiting","paused","completed","failed","cancelled","terminated"]);function sessionIdleBellOf(org){return`\0session.status_idle:${org}`}var SESSION_EVENT_BROKER_CLOSED_MESSAGE="the server is restarting; stream again with after_seq set to the last event received",SessionEventBroker=class{logger;now;subscribers=new Map;kept=new Map;sweptAt=-1/0;closedBecause;constructor(logger2,now=()=>performance.now()){this.logger=logger2,this.now=now}subscribe(sessionId,deltaTypes){let subscription={previews:[],sizes:[],ids:[],queuedBytes:0,deltaTypes:new Set(deltaTypes),droppedIds:new Set,dirty:!1,notify:void 0,closed:this.closedBecause!==void 0,closedBecause:this.closedBecause};if(subscription.closed)return subscription;let set2=this.subscribers.get(sessionId)??new Set;return set2.add(subscription),this.subscribers.set(sessionId,set2),subscription}unsubscribe(sessionId,subscription){let set2=this.subscribers.get(sessionId);if(set2===void 0||!set2.delete(subscription)){subscription.closed=!0;return}this.end(subscription,void 0),set2.size===0&&this.subscribers.delete(sessionId)}close(reason=SESSION_EVENT_BROKER_CLOSED_MESSAGE){if(this.closedBecause===void 0){this.closedBecause=reason;for(let set2 of this.subscribers.values())for(let subscription of set2)this.end(subscription,reason);this.subscribers.clear(),this.kept.clear()}}publish(sessionId,org,events){if(events.length===0)return;for(let event of events)event.event.case==="stigmerRunStatus"&&LIVENESS_STOPS_IN.has(event.event.value.phase)&&this.forget(sessionId,event.runId);let bells=org!==""&&events.some(event=>event.event.case==="sessionStatusIdle")?[sessionId,sessionIdleBellOf(org)]:[sessionId];for(let bell of bells)for(let subscription of this.subscribers.get(bell)??[])subscription.dirty=!0,this.wake(subscription)}publishPreviews(sessionId,previews){for(let preview of previews){let frame2,type2,id;switch(preview.preview.case){case"eventStart":frame2=create2(StreamSessionEventsResponseSchema,{frame:{case:"eventStart",value:preview.preview.value}}),type2=preview.preview.value.event?.type??"",id=preview.preview.value.event?.id??"";break;case"eventDelta":frame2=create2(StreamSessionEventsResponseSchema,{frame:{case:"eventDelta",value:preview.preview.value}}),type2="agent.message",id=preview.preview.value.eventId;break;case"stigmerToolOutputDelta":frame2=create2(StreamSessionEventsResponseSchema,{frame:{case:"stigmerToolOutputDelta",value:preview.preview.value}}),type2="stigmer.tool_output_delta",id=preview.preview.value.toolUseId;break;case"stigmerRunLiveness":frame2=create2(StreamSessionEventsResponseSchema,{frame:{case:"stigmerRunLiveness",value:preview.preview.value}}),type2=SESSION_EVENT_LIVENESS_TYPE,id=void 0,this.keep(sessionId,preview.preview.value);break;case void 0:continue;default:{let exhaustive=preview.preview;throw new Error(`unknown preview ${String(exhaustive)}`)}}this.deliverPreview(sessionId,frame2,type2,id)}}take(subscription){let frame2=subscription.previews.shift();return subscription.queuedBytes-=subscription.sizes.shift()??0,subscription.ids.shift(),frame2}currentLiveness(sessionId){let runs=this.kept.get(sessionId);if(runs===void 0)return[];let at2=this.now(),frames=[];for(let kept of runs.values()){let heldMs=at2-kept.at;heldMs>=SESSION_EVENT_LIVENESS_KEPT_MS||frames.push(create2(StreamSessionEventsResponseSchema,{frame:{case:"stigmerRunLiveness",value:aged(kept.liveness,heldMs)}}))}return frames}keptLivenessCount(){let count2=0;for(let runs of this.kept.values())count2+=runs.size;return count2}subscriberCount(sessionId){return this.subscribers.get(sessionId)?.size??0}deliverPreview(sessionId,frame2,type2,id){let set2=this.subscribers.get(sessionId);if(set2===void 0)return;let size;for(let subscription of set2)if(!(!subscription.deltaTypes.has(type2)||id!==void 0&&subscription.droppedIds.has(id))){if(size??=toBinary(StreamSessionEventsResponseSchema,frame2).length,subscription.previews.length+1>SESSION_EVENT_PREVIEW_CAPACITY||subscription.queuedBytes+size>SESSION_EVENT_PREVIEW_MAX_BYTES){this.logger.warn("A session event stream fell behind on previews; dropping them",{sessionId});for(let dropped of[...subscription.ids,id])dropped!==void 0&&remember(subscription,dropped);subscription.previews.length=0,subscription.sizes.length=0,subscription.ids.length=0,subscription.queuedBytes=0;continue}subscription.previews.push(frame2),subscription.sizes.push(size),subscription.ids.push(id),subscription.queuedBytes+=size,this.wake(subscription)}}keep(sessionId,liveness){if(this.closedBecause!==void 0||liveness.runId==="")return;let at2=this.now();this.sweep(at2);let runs=this.kept.get(sessionId)??new Map;runs.set(liveness.runId,{liveness,at:at2}),this.kept.set(sessionId,runs)}forget(sessionId,runId){let runs=this.kept.get(sessionId);runs?.delete(runId)===!0&&runs.size===0&&this.kept.delete(sessionId)}sweep(at2){if(!(at2-this.sweptAt<SESSION_EVENT_LIVENESS_KEPT_MS)){this.sweptAt=at2;for(let[sessionId,runs]of this.kept){for(let[runId,kept]of runs)at2-kept.at>=SESSION_EVENT_LIVENESS_KEPT_MS&&runs.delete(runId);runs.size===0&&this.kept.delete(sessionId)}}}wake(subscription){subscription.notify?.(),subscription.notify=void 0}end(subscription,reason){subscription.closed=!0,subscription.closedBecause=reason,this.wake(subscription)}};function remember(subscription,id){subscription.droppedIds.delete(id),subscription.droppedIds.add(id);for(let oldest of subscription.droppedIds){if(subscription.droppedIds.size<=SESSION_EVENT_DROPPED_IDS_KEPT)break;subscription.droppedIds.delete(oldest)}}function aged(liveness,ms){let copy=clone(RunLivenessSchema,liveness);for(let operation2 of copy.operations)operation2.elapsed!==void 0&&(operation2.elapsed=longer(operation2.elapsed,ms));return copy.awaitingModelFor!==void 0&&(copy.awaitingModelFor=longer(copy.awaitingModelFor,ms)),copy}function longer(duration,ms){let nanos=duration.seconds*1000000000n+BigInt(duration.nanos)+BigInt(Math.round(ms*1e6));return create2(DurationSchema,{seconds:nanos/1000000000n,nanos:Number(nanos%1000000000n)})}var SESSION_EVENT_STREAM_REAUTHORIZE_MS=300*1e3,SESSION_EVENT_REPLAY_BATCH=100,SESSION_EVENT_TAIL_MIN_MS=15e3,SESSION_EVENT_TAIL_MAX_MS=2*6e4;async function*streamSessionEvents(deps,req,context2){if(req.sessionId==="")throw invalidArgumentError("session_id is required");let now=deps.now??Date.now,tail=deps.tailMs??{min:SESSION_EVENT_TAIL_MIN_MS,max:SESSION_EVENT_TAIL_MAX_MS},authorize=()=>authorizeDirect(SessionQueryController.method.streamEvents,deps.authorizer,callerIdentityOf(context2),req);await authorize();let authorizedAt=now(),sessionId=req.sessionId,broker=deps.sessionEventBroker,subscription=broker.subscribe(sessionId,req.eventDeltas),abort=new Promise(resolve=>{context2.signal.addEventListener("abort",()=>resolve(),{once:!0})}),reauthorizeWhenDue=async()=>{now()-authorizedAt>=SESSION_EVENT_STREAM_REAUTHORIZE_MS&&(await authorize(),authorizedAt=now())},read3=async query=>{try{return await deps.store.sessionEvents.list(sessionId,query)}catch(error3){throw internalError(error3,"failed to read the session's events")}},endIfClosed=()=>{if(subscription.closed)throw new ConnectError(subscription.closedBecause??SESSION_EVENT_BROKER_CLOSED_MESSAGE,Code.Unavailable)};try{endIfClosed();let sent;req.afterSeq!==void 0?sent=Number(req.afterSeq):sent=(await read3({order:"desc",limit:1}))[0]?.seq??0;let tailMs=tail.min,readDue=!0,tailFired=!1,livenessDue=req.eventDeltas.includes(SESSION_EVENT_LIVENESS_TYPE);for(;!context2.signal.aborted;){endIfClosed();let frame2=broker.take(subscription);for(;frame2!==void 0;)await reauthorizeWhenDue(),yield frame2,frame2=broker.take(subscription);if(subscription.dirty||readDue){subscription.dirty=!1,readDue=!1;let delivered=!1;for(;;){let records=await read3({order:"asc",afterSeq:sent,limit:SESSION_EVENT_REPLAY_BATCH});for(let record4 of records)await reauthorizeWhenDue(),yield create2(StreamSessionEventsResponseSchema,{frame:{case:"event",value:eventOf(record4)}}),sent=record4.seq,delivered=!0;if(records.length<SESSION_EVENT_REPLAY_BATCH||context2.signal.aborted)break;for(frame2=broker.take(subscription);frame2!==void 0;)await reauthorizeWhenDue(),yield frame2,frame2=broker.take(subscription)}if(livenessDue&&!context2.signal.aborted){livenessDue=!1;for(let liveness of broker.currentLiveness(sessionId))await reauthorizeWhenDue(),yield liveness}delivered?tailMs=tail.min:tailFired&&(tailMs=Math.min(tailMs*2,tail.max)),tailFired=!1;continue}let timer;await Promise.race([abort,new Promise(resolve=>subscription.notify=resolve),new Promise(resolve=>{timer=setTimeout(()=>{readDue=!0,tailFired=!0,resolve()},tailMs)})]),clearTimeout(timer),subscription.notify=void 0}}finally{broker.unsubscribe(sessionId,subscription)}}var ATTENTION_OVERLAP_MS=3e4,ATTENTION_RESUME_LIMIT_MS=1440*6e4,CURSOR_TIME=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/,IDLE_TYPE="session.status_idle",STOPPED_BY_TYPES=["stigmer.run.status","user.interrupt"],REASONS={end_turn:"finished",retries_exhausted:"failed",budget_reached:"failed",requires_action:"needs_answer"};function attentionCursorOf(position){return`${position.processedAt}|${position.eventId}`}function positionOfCursor(cursor){let at2=cursor.indexOf("|"),processedAt=at2<0?"":cursor.slice(0,at2);if(!CURSOR_TIME.test(processedAt)||Number.isNaN(Date.parse(processedAt)))throw invalidArgumentError(`after_cursor '${cursor}' is not a cursor this stream sent`);return{processedAt,eventId:cursor.slice(at2+1)}}async function*streamAttention(deps,req,context2){if(req.org==="")throw invalidArgumentError("org is required");let request3=clone(StreamAttentionRequestSchema,req);await resolveOrganizationNames(StreamAttentionRequestSchema,request3,newOrganizationNameResolver(deps.store));let now=deps.now??Date.now,tail=deps.tailMs??{min:SESSION_EVENT_TAIL_MIN_MS,max:SESSION_EVENT_TAIL_MAX_MS},caller=callerIdentityOf(context2),authorize=()=>authorizeDirect(SessionQueryController.method.streamAttention,deps.authorizer,caller,request3);await authorize();let authorizedAt=now(),broker=deps.sessionEventBroker,bell=sessionIdleBellOf(request3.org),subscription=broker.subscribe(bell,[]),abort=new Promise(resolve=>{context2.signal.addEventListener("abort",()=>resolve(),{once:!0})}),conversations=new Map,handled=new Map,endIfClosed=()=>{if(subscription.closed)throw new ConnectError(subscription.closedBecause??SESSION_EVENT_BROKER_CLOSED_MESSAGE,Code.Unavailable)};try{endIfClosed();let cursor=req.afterCursor===""?{processedAt:new Date(now()).toISOString(),eventId:""}:positionOfCursor(req.afterCursor),oldest=new Date(now()-ATTENTION_RESUME_LIMIT_MS).toISOString();if(cursor.processedAt<oldest&&(cursor={processedAt:oldest,eventId:""}),req.afterCursor==="")for await(let page of windowPages(deps,request3.org,cursor))for(let record4 of page)handled.set(record4.eventId,record4.processedAt);let tailMs=tail.min,readDue=!0,tailFired=!1;for(;!context2.signal.aborted;){if(endIfClosed(),subscription.dirty||readDue){subscription.dirty=!1,readDue=!1;let delivered=!1;conversations.clear();for await(let page of windowPages(deps,request3.org,cursor)){for(let record4 of page){if(handled.has(record4.eventId))continue;handled.set(record4.eventId,record4.processedAt),record4.processedAt>cursor.processedAt&&(cursor={processedAt:record4.processedAt,eventId:record4.eventId});let attention=await attentionOf(deps,record4,caller.identityId,conversations);attention!==void 0&&(now()-authorizedAt>=SESSION_EVENT_STREAM_REAUTHORIZE_MS&&(await authorize(),authorizedAt=now()),yield attention,delivered=!0)}forgetBefore(handled,cursor)}delivered?tailMs=tail.min:tailFired&&(tailMs=Math.min(tailMs*2,tail.max)),tailFired=!1;continue}let timer;await Promise.race([abort,new Promise(resolve=>subscription.notify=resolve),new Promise(resolve=>{timer=setTimeout(()=>{readDue=!0,tailFired=!0,resolve()},tailMs)})]),clearTimeout(timer),subscription.notify=void 0}}finally{broker.unsubscribe(bell,subscription)}}function windowStart(cursor){return{processedAt:new Date(Date.parse(cursor.processedAt)-ATTENTION_OVERLAP_MS).toISOString(),eventId:""}}async function*windowPages(deps,org,cursor){let after=windowStart(cursor);for(;;){let page;try{page=await deps.store.sessionEvents.listByOrg(org,{types:[IDLE_TYPE],after,limit:SESSION_EVENT_REPLAY_BATCH})}catch(error3){throw internalError(error3,"failed to read the organization's events")}yield page;let last=page.at(-1);if(last===void 0||page.length<SESSION_EVENT_REPLAY_BATCH)return;after={processedAt:last.processedAt,eventId:last.eventId}}}function forgetBefore(handled,cursor){let start=windowStart(cursor).processedAt;for(let[eventId,processedAt]of handled)processedAt<start&&handled.delete(eventId)}async function attentionOf(deps,record4,caller,conversations){let event=eventOf(record4).event,reason=REASONS[event.case==="sessionStatusIdle"&&event.value.stopReason?.type||""];if(reason===void 0)return;conversations.has(record4.sessionId)||conversations.set(record4.sessionId,await conversationOf(deps.store,record4.sessionId));let conversation=conversations.get(record4.sessionId);if(!(conversation===void 0||conversation.creator===""||conversation.creator!==caller)&&!(reason==="finished"&&await stoppedByThePerson(deps.store,record4)))return create2(AttentionSchema,{id:record4.eventId,sessionId:record4.sessionId,title:conversation.title,runId:record4.runId,reason,at:record4.processedAt,cursor:attentionCursorOf({processedAt:record4.processedAt,eventId:record4.eventId})})}async function conversationOf(store,sessionId){try{let session=await store.getResource(ApiResourceKind.session,sessionId,SessionSchema);return{creator:session.status?.audit?.specAudit?.createdBy?.id??"",title:session.spec?.subject||session.metadata?.name||""}}catch(error3){if(error3 instanceof ResourceNotFoundError)return;throw internalError(error3,"failed to read the session")}}async function stoppedByThePerson(store,idle){let before;try{before=await store.sessionEvents.list(idle.sessionId,{order:"desc",afterSeq:idle.seq,types:STOPPED_BY_TYPES,limit:1})}catch(error3){throw internalError(error3,"failed to read the session's events")}let newest=before[0];if(newest===void 0)return!1;let event=eventOf(newest);return event.event.case==="userInterrupt"||event.event.case==="stigmerRunStatus"&&event.event.value.stopCause==="user"}var CONVERSATION_MOVED_ON_MESSAGE="the conversation has moved on; these edits were kept",CONFLICTING_DECISION_MESSAGE="this change was already decided, and a decision is final",TURN_EVENT_TYPE="user.message";function runIdOfChangeSet(changeSetId){let colon=changeSetId.indexOf(":");return colon<=0?"":changeSetId.slice(0,colon)}function changeSetNotFound(changeSetId,sessionId){return notFoundError("Change set",`'${changeSetId}' in session '${sessionId}'`)}var DecisionAlreadyRecorded=class extends Error{run;constructor(run){super("file decision already recorded"),this.run=run,this.name="DecisionAlreadyRecorded"}};async function decideFileChanges(deps,target,asked,identity2){let runId=target.runId,loaded=await loadRun7(deps,target,asked.changeSetId);validateFileDecisionTarget(loaded,asked);let decidedBy=identity2.identityId,committed;try{committed=(await updateRunAppendingEvents(deps,runId,(run,session)=>{validateFileDecisionTarget(run,asked);let recorded=decisionOnTarget(runReviewLogOf(session.runEvents.map(eventOf)),asked.changeSetId,asked.scope,asked.fileChangeId);if(recorded!==void 0&&isSameDecision(recorded,asked))throw new DecisionAlreadyRecorded(run);if(session.runOfNewestType!==runId)throw failedPreconditionError(CONVERSATION_MOVED_ON_MESSAGE);if(recorded!==void 0)throw failedPreconditionError(CONFLICTING_DECISION_MESSAGE);return{last:[decidedEvent(runId,{changeSetId:asked.changeSetId,scope:asked.scope,fileChangeId:asked.fileChangeId,action:asked.action,expectedDigest:asked.expectedDigest,origin:PERSON_ORIGIN,reason:asked.reason,decidedBy})]}},{runOfNewestType:TURN_EVENT_TYPE,runEventTypes:[FILE_REVIEW_DECIDED_TYPE]})).run}catch(error3){if(error3 instanceof DecisionAlreadyRecorded)return deps.logger.info("IDEMPOTENT: file decision already recorded",{executionId:runId,changeSetId:asked.changeSetId,fileChangeId:asked.fileChangeId}),{run:error3.run,recorded:!1,reconcileRunId:""};throw error3 instanceof ResourceNotFoundError?changeSetNotFound(asked.changeSetId,target.sessionId):error3 instanceof ConnectError?error3:internalError(error3,"failed to persist file decision")}deps.logger.info("AUDIT: File decision submitted",{executionId:runId,org:committed.metadata?.org??"",changeSetId:asked.changeSetId,fileChangeId:asked.fileChangeId,scope:asked.scope,action:asked.action,decidedBy});let reconcileRunId=asked.action==="undo"&&isTerminalExecutionPhase(committed.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED)?await startReconcileTurn(deps,committed,identity2):"";return{run:committed,recorded:!0,reconcileRunId}}async function loadRun7(deps,target,changeSetId){let sessionId=target.sessionId;if(target.runId==="")throw changeSetNotFound(changeSetId,sessionId);let run;try{run=await deps.store.getResource(ApiResourceKind.run,target.runId,RunSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?changeSetNotFound(changeSetId,sessionId):internalError(error3,"failed to load agent execution")}if(sessionIdOfRun2(run)!==sessionId)throw changeSetNotFound(changeSetId,sessionId);return run}function validateFileDecisionTarget(run,asked){let runId=run.metadata?.id??"",phase=run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED,changeSets=run.status?.fileChanges??[];if(changeSets.length===0)throw failedPreconditionError(`execution ${runId} has no actionable file change sets (phase ${enumToJson(RunPhaseSchema,phase)})`);let cs=findChangeSet(changeSets,asked.changeSetId);if(cs===void 0)throw failedPreconditionError(`change set ${asked.changeSetId} not found for execution ${runId}`);if(asked.scope==="file"){if(asked.fileChangeId==="")throw invalidArgumentError("file_change_id is required for FILE scope");if(findChange(cs,asked.fileChangeId)===void 0)throw failedPreconditionError(`file change ${asked.fileChangeId} not found in change set ${asked.changeSetId}`)}if(asked.action==="keep"){let reason=keepBlockedReason(cs,asked.scope,asked.fileChangeId,asked.acknowledgeUnreviewable);if(reason!=="")throw failedPreconditionError(reason)}if(asked.expectedDigest!==targetDigest(cs,asked.scope,asked.fileChangeId))throw invalidArgumentError(`expected_digest mismatch for change set ${asked.changeSetId}: the captured content changed since it was reviewed`)}function isSameDecision(recorded,asked){return recorded.origin===PERSON_ORIGIN&&recorded.action===asked.action}async function startReconcileTurn(deps,run,identity2){let sessionId=sessionIdOfRun2(run);if(sessionId==="")return"";let runId=run.metadata?.id??"";try{let reconcileRunId=(await deps.reconcileTurns().create(reconcileTurnRequest(run,sessionId),identity2)).metadata?.id??"";return deps.logger.info("Started a reconcile turn for an undo on an ended turn",{executionId:runId,sessionId,reconcileRunId}),reconcileRunId}catch(error3){let fields2={executionId:runId,sessionId,error:error3 instanceof Error?error3.message:String(error3)};return error3 instanceof ConnectError?deps.logger.warn("The reconcile turn was refused; the undo stands and the next turn restores it",fields2):deps.logger.error("The reconcile turn could not be started; the undo stands and the next turn restores it",fields2),""}}function reconcileTurnRequest(run,sessionId){return create2(RunSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Run",metadata:create2(ApiResourceMetadataSchema,{name:`reconcile-file-review-${Date.now()}`,org:run.metadata?.org??""}),spec:create2(RunSpecSchema,{target:{case:"sessionId",value:sessionId},reconcileFileReview:!0})})}var OUTCOME_KEY="fileDecisionOutcome";async function reviewFileChanges(deps,input,identity2){let reqCtx=new RequestContext(SessionCommandController.method.reviewFileChanges.input,input,identity2,ApiResourceKind.session);await newPipeline("session-review-file-changes",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.reviewFileChanges,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"DecideFileChanges",async execute(ctx){let scope=scopeOfWord(ctx.input.scope),action=actionOfWord(ctx.input.action);if(scope===void 0||action===void 0){throw invalidArgumentError("scope must be change_set or file, and action keep or undo")}let outcome3=await decideFileChanges(deps,{runId:runIdOfChangeSet(ctx.input.changeSetId),sessionId:ctx.input.sessionId},{changeSetId:ctx.input.changeSetId,scope,fileChangeId:ctx.input.fileChangeId,action,expectedDigest:ctx.input.expectedDigest,reason:ctx.input.reason,acknowledgeUnreviewable:ctx.input.acknowledgeUnreviewable},ctx.callerIdentity);ctx.set(OUTCOME_KEY,outcome3)}}).build().execute(reqCtx);let outcome2=reqCtx.get(OUTCOME_KEY);return create2(ReviewFileChangesResponseSchema,{reconcileRunId:outcome2.reconcileRunId})}var import_node_crypto39=require("node:crypto");var TOOL_NAME_TO_CATEGORY=new Map([["write","write"],["write_file","write"],["create_file","write"],["overwrite_file","write"],["Write","write"],["edit","write"],["edit_file","write"],["str_replace_editor","write"],["Edit","write"],["NotebookEdit","write"],["delete","delete"],["delete_file","delete"],["remove_file","delete"],["shell","shell"],["bash","shell"],["execute","shell"],["execute_command","shell"],["run_command","shell"],["terminal","shell"],["Bash","shell"]]);function toolApprovalCategory(name){return TOOL_NAME_TO_CATEGORY.get(name)}var HOOK_POLICY_SOURCE="hook";function deriveLeaseScope(ask){let slug=ask.mcpServer;if(ask.policySource===HOOK_POLICY_SOURCE)return{category:"",server:slug,hook:ask.policyHook,tool:ask.name};if(slug!=="")return{category:"",server:slug,tool:""};let category=toolApprovalCategory(ask.name);if(category!==void 0)return{category,server:"",tool:""}}function sameLeaseScope(a5,b7){return a5.category===b7.category&&a5.server===b7.server&&a5.hook===b7.hook&&a5.tool===b7.tool}function gateResolved(openGates){return openGates===0}var APPROVAL_ANSWER_KEY="approvalAnswer",OUTCOME_KEY2="approvalAnswerOutcome";function answerOutcomeOf(ctx){let outcome2=ctx.get(OUTCOME_KEY2);if(outcome2===void 0)throw new Error("the answer chain recorded no outcome");return outcome2}var CONFIRMATION_ID_PREFIX=`${SESSION_EVENT_ID_PREFIX}_tc_`,GRANT_ID_PREFIX2=`${SESSION_EVENT_ID_PREFIX}_pg_`;function digestOf(toolUseId){return(0,import_node_crypto39.createHash)("sha256").update(toolUseId).digest("hex").slice(0,40)}function toolConfirmationEventId(toolUseId){return`${CONFIRMATION_ID_PREFIX}${digestOf(toolUseId)}`}function permissionGrantEventId(toolUseId){return`${GRANT_ID_PREFIX2}${digestOf(toolUseId)}`}var TOOL_USE_TYPES=["agent.tool_use","agent.mcp_tool_use"],PERMISSION_ASKED_TYPE="stigmer.permission.asked",ASKED_PAGE_SIZE=1e3,GRANT_ASK_READS=3;async function askedEventsOf(store,sessionId,runId){let asked=new Map,afterSeq;for(;;){let page=await store.sessionEvents.list(sessionId,{order:"asc",runId,types:[PERMISSION_ASKED_TYPE],limit:ASKED_PAGE_SIZE,...afterSeq===void 0?{}:{afterSeq}});for(let record4 of page){let event=eventOf(record4);event.event.case==="stigmerPermissionAsked"&&!asked.has(event.event.value.toolUseId)&&asked.set(event.event.value.toolUseId,event.event.value)}if(page.length<ASKED_PAGE_SIZE)return asked;afterSeq=page[page.length-1].seq}}async function readAsks(store,sessionId,runId,toolUseIds){let asks=new Map,uses=await store.sessionEvents.list(sessionId,{order:"asc",eventIds:toolUseIds,types:TOOL_USE_TYPES,limit:Math.max(1,toolUseIds.length)}),asked=await askedEventsOf(store,sessionId,runId);for(let record4 of uses){let event=eventOf(record4);if(record4.runId!==runId)continue;let use=event.event.case==="agentToolUse"?{...event.event.value,mcpServer:""}:event.event.case==="agentMcpToolUse"?{...event.event.value,mcpServer:event.event.value.mcpServerName}:void 0;if(use===void 0||use.evaluatedPermission!==ASK_PERMISSION)continue;let why=asked.get(use.id);asks.set(use.id,{toolUseId:use.id,threadId:use.sessionThreadId,lease:why===void 0?void 0:deriveLeaseScope({name:use.name,mcpServer:use.mcpServer,policySource:why.policySource,policyHook:why.policyHook})})}return asks}function waitingInClass(asks,toolUseId,lease,open2){return[...open2].flatMap(otherUseId=>{let other=asks.get(otherUseId);return otherUseId!==toolUseId&&other!==void 0&&other.lease!==void 0&&sameLeaseScope(other.lease,lease)?[other]:[]})}function callIdOfToolUse(runId,toolUseId){let prefix=`${runId}.`;if(!toolUseId.startsWith(prefix))return"";let callId=toolUseId.slice(prefix.length);return HASHED_CALL_ID.test(callId)?"":callId}var HASHED_CALL_ID=/^h[0-9a-f]{32}$/;function confirmationEvent(runId,ask,result,denyMessage){return create2(SessionEventSchema,{runId,threadId:ask.threadId,event:{case:"userToolConfirmation",value:{id:toolConfirmationEventId(ask.toolUseId),result,toolUseId:ask.toolUseId,denyMessage:result==="deny"?denyMessage:"",sessionThreadId:ask.threadId}}})}function grantEvent(runId,ask,lease){return create2(SessionEventSchema,{runId,threadId:ask.threadId,event:{case:"stigmerPermissionGrant",value:{id:permissionGrantEventId(ask.toolUseId),toolUseId:ask.toolUseId,scope:"turn",lease:{category:lease.category,server:lease.server,...lease.hook===void 0?{}:{hook:lease.hook},tool:lease.tool}}}})}function phaseName2(phase){return enumToJson(RunPhaseSchema,phase)}function answeredOtherwise(toolUseId){return failedPreconditionError(`tool use ${toolUseId} was already answered otherwise; an answer is final`)}var AskClosedError=class extends Error{toolUseId;constructor(toolUseId){super(`tool use ${toolUseId} no longer waits`),this.toolUseId=toolUseId,this.name="AskClosedError"}},AsksMovedError=class extends Error{constructor(){super("an ask opened since the run's asks were read"),this.name="AsksMovedError"}};async function recordedAnswer(deps,run,request3,ask){let runId=run.metadata?.id??"",confirmationId=toolConfirmationEventId(request3.toolUseId),grantId=permissionGrantEventId(request3.toolUseId),events=(await deps.store.sessionEvents.list(request3.sessionId,{order:"asc",runId,types:["user.tool_confirmation","stigmer.permission.grant"],limit:1e3})).map(eventOf),confirmation=events.find(event=>event.event.case==="userToolConfirmation"&&event.event.value.id===confirmationId);if(confirmation===void 0||confirmation.event.case!=="userToolConfirmation")return;let grant=events.find(event=>event.event.case==="stigmerPermissionGrant"&&event.event.value.id===grantId),recorded=confirmation.event.value,sameResult=recorded.result===request3.result&&recorded.denyMessage===request3.denyMessage,sameGrant=request3.grant?grant!==void 0||ask.lease===void 0:grant===void 0;if(!sameResult||!sameGrant)throw answeredOtherwise(request3.toolUseId);let grantedAt=grant?.event.value?.processedAt;return{run,confirmations:[confirmation,...grantedAt===void 0?[]:events.filter(event=>event!==confirmation&&event.event.case==="userToolConfirmation"&&event.event.value.processedAt===grantedAt)],grant}}function answerSteps(deps,requestOf){let REQUEST_KEY="approvalAnswerRequest",RUN_KEY2="approvalAnswerRun",ASK_KEY="approvalAnswerAsk",requestIn=ctx=>ctx.get(REQUEST_KEY),runIn=ctx=>ctx.get(RUN_KEY2),askIn=ctx=>ctx.get(ASK_KEY),replayed=ctx=>ctx.get(OUTCOME_KEY2)!==void 0;return[{name:"LoadAskedRun",async execute(ctx){let request3=requestOf(ctx);ctx.set(REQUEST_KEY,request3);let runId=runIdOfToolUse(request3.toolUseId),missing=()=>notFoundError("tool use",request3.toolUseId);if(runId==="")throw missing();let run;try{run=await deps.store.getResource(ApiResourceKind.run,runId,RunSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?missing():internalError(error3,"failed to load the tool use's run")}if(sessionIdOfRun2(run)!==request3.sessionId)throw missing();let ask;try{ask=(await readAsks(deps.store,request3.sessionId,runId,[request3.toolUseId])).get(request3.toolUseId)}catch(error3){throw internalError(error3,"failed to read the tool use's ask")}if(ask===void 0)throw missing();ctx.set(RUN_KEY2,run),ctx.set(ASK_KEY,ask)}},{name:"AnswerReplay",async execute(ctx){let outcome2=await recordedAnswer(deps,runIn(ctx),requestIn(ctx),askIn(ctx));outcome2!==void 0&&ctx.set(OUTCOME_KEY2,outcome2)}},{name:"ValidateAnswer",async execute(ctx){if(replayed(ctx))return;let run=runIn(ctx),request3=requestIn(ctx),runId=run.metadata?.id??"",phase=run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED;if(phase!==RunPhase.RUN_WAITING_FOR_APPROVAL&&phase!==RunPhase.RUN_IN_PROGRESS)throw failedPreconditionError(`tool use ${request3.toolUseId} no longer waits: its turn is ${phaseName2(phase)}`);let open2;try{open2=(await deps.store.sessionEvents.openGates(request3.sessionId,runId)).some(gate=>gate.toolUseId===request3.toolUseId)}catch(error3){throw internalError(error3,"failed to read the tool use's ask")}if(!open2)throw failedPreconditionError(`tool use ${request3.toolUseId} no longer waits`);let answer={run,toolUseId:request3.toolUseId,toolCallId:callIdOfToolUse(runId,request3.toolUseId),result:request3.result,grant:request3.grant};ctx.set(APPROVAL_ANSWER_KEY,answer)}},...stepsForSlot(deps.gateSteps,"agent-execution-submit-approval:gate").map(step=>({name:step.name,async execute(ctx){replayed(ctx)||await step.execute(ctx)}})),{name:"RecordAnswer",async execute(ctx){if(replayed(ctx))return;let request3=requestIn(ctx);try{let recorded=await recordAnswer(deps,runIn(ctx),request3,askIn(ctx),ctx.callerIdentity.identityId);ctx.set(OUTCOME_KEY2,recorded.outcome),ctx.set(SIGNAL_KEY,recorded.openAsks)}catch(error3){if(error3 instanceof AskClosedError){let outcome2=await recordedAnswer(deps,runIn(ctx),request3,askIn(ctx));if(outcome2!==void 0){ctx.set(OUTCOME_KEY2,outcome2);return}throw failedPreconditionError(error3.message)}throw error3 instanceof ResourceNotFoundError?notFoundError("Run",runIn(ctx).metadata?.id??""):internalError(error3,"failed to record the answer")}}},{name:"SignalWorkflow",async execute(ctx){let openAsks=ctx.get(SIGNAL_KEY);openAsks!==void 0&&await signalWhenResolved(deps,answerOutcomeOf(ctx).run,openAsks)}}]}var SIGNAL_KEY="approvalAnswerOpenAsks";async function recordAnswer(deps,loaded,request3,ask,decidedBy){let runId=loaded.metadata?.id??"";for(let read3=1;;read3++){let others=request3.grant&&ask.lease!==void 0?await readAsks(deps.store,request3.sessionId,runId,(await deps.store.sessionEvents.openGates(request3.sessionId,runId)).map(gate=>gate.toolUseId)):new Map;try{return await writeAnswer(deps,runId,request3,ask,others,decidedBy,read3===GRANT_ASK_READS)}catch(error3){if(error3 instanceof AsksMovedError&&read3<GRANT_ASK_READS)continue;throw error3}}}async function writeAnswer(deps,runId,request3,ask,others,decidedBy,final){let confirmations=[],grant,openAsks=0,{run,events}=await updateRunAppendingEvents(deps,runId,(current,session)=>{let open2=openAsksOf(session,runId),phase=current.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED;if(!open2.has(request3.toolUseId)||phase!==RunPhase.RUN_WAITING_FOR_APPROVAL&&phase!==RunPhase.RUN_IN_PROGRESS)throw new AskClosedError(request3.toolUseId);confirmations=[confirmationEvent(runId,ask,request3.result,request3.denyMessage)],grant=void 0;let lease=request3.grant?ask.lease:void 0;if(lease!==void 0){if(!final&&[...open2].some(id=>id!==request3.toolUseId&&!others.has(id)))throw new AsksMovedError;grant=grantEvent(runId,ask,lease);for(let other of waitingInClass(others,request3.toolUseId,lease,open2))confirmations.push(confirmationEvent(runId,other,"allow",""))}let own=grant===void 0?confirmations:[confirmations[0],grant,...confirmations.slice(1)];return openAsks=openAsksOf(session,runId,own).size,own});deps.logger.info("AUDIT: tool use answered",{runId,org:run.metadata?.org??"",toolUseId:request3.toolUseId,result:request3.result,grant:grant!==void 0,answered:confirmations.length,decidedBy,openAsksRemaining:openAsks});let storedById=new Map(events.map(event=>[event.event.value?.id??"",event])),asStored=event=>storedById.get(event.event.value?.id??"")??event;return{outcome:{run,confirmations:confirmations.map(asStored),grant:grant===void 0?void 0:asStored(grant)},openAsks}}async function signalWhenResolved(deps,run,openAsks){let runId=run.metadata?.id??"";if(isTerminalExecutionPhase(run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED))return;if(!gateResolved(openAsks)){deps.logger.info("answer recorded; the turn still waits for others",{runId,openAsksRemaining:openAsks});return}let engine=deps.engineState();if(!engine.connected){deps.logger.warn("execution engine not connected; the turn is not signalled to resume",{runId});return}try{await engine.engine.signalApprovalGateResolved(runId)}catch(error3){throw error3 instanceof EngineWorkflowNotFoundError?(deps.logger.warn("workflow not found; reconciling the waiting run to FAILED",{runId}),await reconcileStaleExecution(deps,run),failedPreconditionError(`workflow not running for execution ${runId} - the backing workflow has terminated unexpectedly and the execution has been marked as failed`)):unavailableError(`failed to signal workflow: ${error3 instanceof Error?error3.message:String(error3)}`)}deps.logger.info("the turn's workflow was signalled to resume",{runId})}async function reconcileStaleExecution(deps,execution){let executionId=execution.metadata?.id??"",reconciled=create2(RunSchema,{apiVersion:execution.apiVersion,kind:execution.kind,metadata:execution.metadata,spec:execution.spec,status:{phase:RunPhase.RUN_FAILED,error:"Workflow backing this execution is no longer running. Execution has been marked as failed.",audit:execution.status?.audit,fileChanges:execution.status?.fileChanges??[]}});try{await overwriteRunAppendingEvents(deps,reconciled)}catch(error3){deps.logger.error("Failed to reconcile stale execution status - execution will remain in WAITING_FOR_APPROVAL until next attempt",{executionId,error:error3 instanceof Error?error3.message:String(error3)});return}deps.logger.info("RECONCILIATION: Updated stale execution status to FAILED",{executionId}),await notifyStatusObservers(deps,reconciled,execution.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED,RunPhase.RUN_FAILED)}async function confirmToolUse(deps,input,identity2){let reqCtx=new RequestContext(SessionCommandController.method.confirmToolUse.input,input,identity2,ApiResourceKind.session),builder2=newPipeline("session-confirm-tool-use",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.confirmToolUse,deps.authorizer)).addStep(newValidateProtoStep());for(let step of answerSteps(deps,ctx=>({sessionId:ctx.input.sessionId,toolUseId:ctx.input.toolUseId,result:ctx.input.result==="deny"?"deny":"allow",denyMessage:ctx.input.denyMessage,grant:!1})))builder2.addStep(step);return await builder2.build().execute(reqCtx),answerOutcomeOf(reqCtx).confirmations[0]}async function grantPermission(deps,input,identity2){let reqCtx=new RequestContext(SessionCommandController.method.grantPermission.input,input,identity2,ApiResourceKind.session),builder2=newPipeline("session-grant-permission",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.grantPermission,deps.authorizer)).addStep(newValidateProtoStep());for(let step of answerSteps(deps,ctx=>({sessionId:ctx.input.sessionId,toolUseId:ctx.input.toolUseId,result:"allow",denyMessage:"",grant:!0})))builder2.addStep(step);await builder2.build().execute(reqCtx);let outcome2=answerOutcomeOf(reqCtx);return create2(GrantPermissionResponseSchema,{...outcome2.grant===void 0?{}:{grant:outcome2.grant},confirmations:[...outcome2.confirmations]})}var EVENT_KEY="interruptEvent",STOPPED_KEY="interruptStoppedRunIds",ORG_KEY="interruptSessionOrg";async function interrupt(deps,input,identity2){let reqCtx=new RequestContext(SessionCommandController.method.interrupt.input,input,identity2,ApiResourceKind.session);return await newPipeline("session-interrupt",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.interrupt,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"RefuseThread",execute(ctx){if(ctx.input.sessionThreadId!=="")throw invalidArgumentError("interrupting one thread is not supported; interrupt the session")}}).addStep({name:"RequireEngine",execute(){if(!deps.engineState().connected)throw failedPreconditionError(TEMPORAL_UNAVAILABLE_MESSAGE)}}).addStep({name:"AppendInterrupt",async execute(ctx){let sessionId=ctx.input.sessionId,org;try{org=(await deps.store.getResource(ApiResourceKind.session,sessionId,SessionSchema)).metadata?.org??""}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Session",sessionId):internalError(error3,"failed to load session")}let event=create2(SessionEventSchema,{event:{case:"userInterrupt",value:{id:generateId(SESSION_EVENT_ID_PREFIX)}}}),stored;try{let appended=await deps.store.sessionEvents.append(sessionId,org,[draftOf(event)],{kind:ApiResourceKind.session,id:sessionId,schema:SessionSchema,admit:()=>{}});stored=eventOf(appended.records[0]),deps.sessionEventBroker.publish(sessionId,org,appended.appended.map(eventOf))}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Session",sessionId):internalError(error3,"failed to record the interrupt")}ctx.set(EVENT_KEY,stored),ctx.set(ORG_KEY,org)}}).addStep({name:"DropQueue",async execute(ctx){try{let dropped=await dropQueuedMessages(deps,ctx.input.sessionId,ctx.get(ORG_KEY));dropped.length>0&&deps.logger.info("the interrupt dropped the session's queued messages",{sessionId:ctx.input.sessionId,dropped:dropped.length})}catch(error3){throw internalError(error3,"failed to drop the session's queued messages")}}}).addStep({name:"StopRuns",async execute(ctx){ctx.set(STOPPED_KEY,await stopUnfinishedRuns(deps,ctx.input,ctx.callerIdentity))}}).build().execute(reqCtx),create2(InterruptSessionResponseSchema,{event:reqCtx.get(EVENT_KEY),stoppedRunIds:reqCtx.get(STOPPED_KEY)})}async function finishedSince(deps,runId){try{let run=await deps.store.getResource(ApiResourceKind.run,runId,RunSchema);return!CANCELLABLE_PHASES.includes(run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED)}catch(error3){if(error3 instanceof ResourceNotFoundError)return!0;throw error3}}async function stopUnfinishedRuns(deps,input,identity2){let sessionId=input.sessionId,rows;try{rows=await deps.store.queryResources(agentExecutionListIndex,{anyKey:[{name:"session",value:sessionId}]})}catch(error3){throw internalError(error3,"failed to list the session's runs")}let unfinished=[];for(let row of rows){let run=fromBinary2(RunSchema,row.data);CANCELLABLE_PHASES.includes(run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED)&&unfinished.push(run)}let stopped=[];for(let run of unfinished){let runId=run.metadata?.id??"",cancelCtx=new RequestContext(SessionCommandController.method.interrupt.input,input,identity2,ApiResourceKind.run),builder2=newPipeline("agentexecution-cancel",deps.logger);for(let step of cancelSteps(deps,()=>runId))builder2.addStep(step);try{await builder2.build().execute(cancelCtx)}catch(error3){if(error3 instanceof ConnectError&&await finishedSince(deps,runId)){deps.logger.info("a run finished before the interrupt reached it",{runId,sessionId});continue}throw error3}stopped.push(runId)}return deps.logger.info("AUDIT: session interrupted",{sessionId,stoppedRuns:stopped,interruptedBy:identity2.identityId}),stopped}var import_node_crypto40=require("node:crypto");var STATUS_TYPE="stigmer.background_command.status",STOP_REQUESTED_TYPE="stigmer.background_command.stop_requested",BACKGROUND_TYPES=[STATUS_TYPE,STOP_REQUESTED_TYPE],BACKGROUND_PAGE_SIZE=1e3,STOP_REQUEST_ID_PREFIX=`${SESSION_EVENT_ID_PREFIX}_bs_`;function backgroundStopRequestEventId(toolUseId){return`${STOP_REQUEST_ID_PREFIX}${(0,import_node_crypto40.createHash)("sha256").update(toolUseId).digest("hex").slice(0,40)}`}function commandIn(records,toolUseId){let running,ended=!1,stopRequest;for(let record4 of records){let event=eventOf(record4);event.event.case==="stigmerBackgroundCommandStatus"&&event.event.value.toolUseId===toolUseId?event.event.value.phase==="running"?running??=event.event.value.sessionThreadId:ended=!0:event.event.case==="stigmerBackgroundCommandStopRequested"&&event.event.value.toolUseId===toolUseId&&(stopRequest??=event)}return running===void 0?void 0:{threadId:running,ended,stopRequest}}async function backgroundEventsOf(store,sessionId,runId){let records=[],afterSeq;for(;;){let page=await store.sessionEvents.list(sessionId,{order:"asc",runId,types:[...BACKGROUND_TYPES],limit:BACKGROUND_PAGE_SIZE,...afterSeq===void 0?{}:{afterSeq}});if(records.push(...page),page.length<BACKGROUND_PAGE_SIZE)return records;afterSeq=page[page.length-1].seq}}function phaseName3(phase){return enumToJson(RunPhaseSchema,phase)}function alreadyEnded(toolUseId){return failedPreconditionError(`the background command of tool use ${toolUseId} already ended`)}function turnNotWorking(phase){return failedPreconditionError(`the turn is not working: it is ${phaseName3(phase)}`)}var StopSettledError=class extends Error{replay;refusal;constructor(replay,refusal2){super("the command's stop was settled under the lock"),this.replay=replay,this.refusal=refusal2,this.name="StopSettledError"}},RUN_KEY="stopBackgroundRun",COMMAND_KEY="stopBackgroundCommand",RESULT_KEY="stopBackgroundResult";async function stopBackgroundCommand(deps,input,identity2){let reqCtx=new RequestContext(SessionCommandController.method.stopBackgroundCommand.input,input,identity2,ApiResourceKind.session),runIn=ctx=>ctx.get(RUN_KEY),commandOf=ctx=>ctx.get(COMMAND_KEY),settled=ctx=>ctx.get(RESULT_KEY)!==void 0;return await newPipeline("session-stop-background-command",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.stopBackgroundCommand,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"LoadCommand",async execute(ctx){let{sessionId,toolUseId}=ctx.input,missing=()=>notFoundError("background command",toolUseId),runId=runIdOfToolUse(toolUseId);if(runId==="")throw missing();let run;try{run=await deps.store.getResource(ApiResourceKind.run,runId,RunSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?missing():internalError(error3,"failed to load the background command's run")}if(sessionIdOfRun2(run)!==sessionId)throw missing();let command5;try{command5=commandIn(await backgroundEventsOf(deps.store,sessionId,runId),toolUseId)}catch(error3){throw internalError(error3,"failed to read the background command")}if(command5===void 0)throw missing();ctx.set(RUN_KEY,run),ctx.set(COMMAND_KEY,command5)}}).addStep({name:"StopReplay",execute(ctx){let recorded=commandOf(ctx).stopRequest;recorded!==void 0&&ctx.set(RESULT_KEY,recorded)}}).addStep({name:"ValidateStop",execute(ctx){if(settled(ctx))return;let phase=runIn(ctx).status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED;if(!isWorkingPhase(phase))throw turnNotWorking(phase);if(commandOf(ctx).ended)throw alreadyEnded(ctx.input.toolUseId)}}).addStep({name:"RecordStop",async execute(ctx){settled(ctx)||ctx.set(RESULT_KEY,await recordStop(deps,runIn(ctx),ctx.input,commandOf(ctx),ctx.callerIdentity.identityId))}}).build().execute(reqCtx),reqCtx.get(RESULT_KEY)}async function recordStop(deps,loaded,input,command5,requestedBy){let runId=loaded.metadata?.id??"",request3=create2(SessionEventSchema,{runId,threadId:command5.threadId,event:{case:"stigmerBackgroundCommandStopRequested",value:{id:backgroundStopRequestEventId(input.toolUseId),toolUseId:input.toolUseId,sessionThreadId:command5.threadId}}}),written;try{written=await updateRunAppendingEvents(deps,runId,(current,session)=>{let now=commandIn(session.runEvents,input.toolUseId);if(now?.stopRequest!==void 0)throw new StopSettledError(now.stopRequest,void 0);let phase=current.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED;if(!isWorkingPhase(phase))throw new StopSettledError(void 0,turnNotWorking(phase));if(now===void 0||now.ended)throw new StopSettledError(void 0,alreadyEnded(input.toolUseId));return{last:[request3]}},{runEventTypes:BACKGROUND_TYPES})}catch(error3){if(error3 instanceof StopSettledError){if(error3.replay!==void 0)return error3.replay;throw error3.refusal??error3}throw error3 instanceof ResourceNotFoundError?notFoundError("background command",input.toolUseId):internalError(error3,"failed to record the stop")}deps.logger.info("AUDIT: background command stop requested",{runId,org:written.run.metadata?.org??"",toolUseId:input.toolUseId,requestedBy});let id=request3.event.value?.id??"";return written.events.find(event=>event.event.value?.id===id)??request3}var SESSION_VAULT_ATTACHMENTS={surface:"a conversation (include My vault in it instead: each person who sends a turn then uses their own)",attachers:{get:row=>row.status?.vaultAttachers,set:(row,attachers)=>{(row.status??=create2(SessionStatusSchema)).vaultAttachers=attachers}}};function registerSessionServices(router,deps){router.service(SessionCommandController,{apply:(session,ctx)=>apply9(deps,session,ctx),create:(session,ctx)=>createSession(deps,session,ctx),update:(input,ctx)=>update12(deps,input,ctx),updateSubject:(req,ctx)=>updateSubject(deps,req,callerIdentityOf(ctx)),delete:(id,ctx)=>deleteSession2(deps,id,ctx),appendEvents:(input,ctx)=>appendSessionEvents(deps,input,ctx),claimInput:(input,ctx)=>claimSessionInput(deps,input,ctx),reviewFileChanges:(input,ctx)=>reviewFileChanges(deps,input,callerIdentityOf(ctx)),confirmToolUse:(input,ctx)=>confirmToolUse(deps,input,callerIdentityOf(ctx)),grantPermission:(input,ctx)=>grantPermission(deps,input,callerIdentityOf(ctx)),interrupt:(input,ctx)=>interrupt(deps,input,callerIdentityOf(ctx)),stopBackgroundCommand:(input,ctx)=>stopBackgroundCommand(deps,input,callerIdentityOf(ctx))}),router.service(SessionQueryController,{get:(id,ctx)=>get15(deps,id,ctx),list:(req,ctx)=>list13(deps,req,ctx),listByAgent:(req,ctx)=>listByAgent4(deps,req,ctx),listByChannel:(req,ctx)=>listByChannel(deps,req,ctx),listEvents:(req,ctx)=>listSessionEvents(deps,req,ctx),streamEvents:(req,ctx)=>streamSessionEvents(deps,req,ctx),streamAttention:(req,ctx)=>streamAttention(deps,req,ctx)})}function sessionHarnesses2(session){return[{field:"spec.harness",harness:session.spec?.harness??Harness.UNSPECIFIED}]}function kindOf18(ctx){return ctx.values.get(apiResourceKindKey)}async function createSession(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf18(ctx)),instances=fileInstancesOf(deps),builder2=newPipeline("session-create",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newNormalizeReferencesStep(deps.store)).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newStampSessionRoutineStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newValidateReferencesStep(deps.store,deps.authorizer)).addStep(newVaultAttachmentsStep(deps.store,deps.authorizer,SESSION_VAULT_ATTACHMENTS)).addStep(newPreserveSessionValuesStep()).addStep(newResolveSessionAgentStep(deps.store,deps.logger,deps.authorizer)).addStep(newResolveSessionEnvironmentStep(deps.store,deps.environmentPolicy)).addStep(newRefuseUnofferedHarnessStep(sessionHarnesses2)).addStep(newAuthorizeRunTargetStep(deps.authorizer,sessionRunTarget)).addStep(newRefuseLocalProgramsStep(deps.store,newLocalProgramPolicy(deps.sandboxLane,deps.temporalConfig))).addStep(newAdmitSessionEnvironmentStep(deps.store,deps.environmentPolicy));for(let step of stepsForSlot(deps.gateSteps,"session-create:pre-side-effect-gate"))builder2.addStep(step);return await builder2.addStep(newResolveSessionResourcesStep(instances)).addStep(newSealSessionValuesStep(deps.secretService,deps.logger)).addStep(newClaimNameStep(deps.store,ApiResourceKind.session)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx).catch(async error3=>(await discardQuietly(instances,reqCtx.callerIdentity,deps.logger),releaseNameOnFailure(deps.store,deps.logger,reqCtx)(error3))),redacted(reqCtx.newState)}function fileInstancesOf(deps){return newFileInstances({store:deps.store,blobs:deps.fileBlobs,authorizer:deps.authorizer,lifecycle:deps.authorizationLifecycle,logger:deps.logger})}async function update12(deps,input,ctx){let instances=fileInstancesOf(deps),caller=callerIdentityOf(ctx);return runGuardedWrite(async()=>{let reqCtx=updateContext(SessionSchema,input,caller,kindOf18(ctx));return await newPipeline("session-update",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.update,deps.authorizer,input)).addStep(newResolveSlugStep({update:!0})).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newValidateProtoStep({of:"state"})).addStep(newRefuseUnofferedHarnessStep(sessionHarnesses2)).addStep(newValidateHarnessImmutabilityStep(deps.store)).addStep(newValidateExecutionTargetImmutabilityStep(deps.temporalConfig,deps.store)).addStep(newNormalizeReferencesStep(deps.store)).addStep(newValidateEnvironmentImmutabilityStep(deps.store)).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newValidateReferencesStep(deps.store,deps.authorizer,{judge:"introduced"})).addStep(newVaultAttachmentsStep(deps.store,deps.authorizer,SESSION_VAULT_ATTACHMENTS)).addStep(newPreserveSessionValuesStep()).addStep(newResolveSessionAgentStep(deps.store,deps.logger,deps.authorizer)).addStep(newResolveSessionEnvironmentStep(deps.store,deps.environmentPolicy)).addStep(newAuthorizeRunTargetStep(deps.authorizer,sessionRunTarget)).addStep(newResolveSessionResourcesStep(instances)).addStep(newSealSessionValuesStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newDestroyDroppedSessionValuesStep(deps.secretService,deps.logger)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx),redacted(reqCtx.newState)}).catch(async error3=>{throw await discardQuietly(instances,caller,deps.logger),error3})}async function apply9(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf18(ctx));await newPipeline("session-apply",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createSession(deps,session,ctx):update12(deps,everyPathUpdate(UpdateSessionInputSchema,withResolvedApplyId(SessionSchema,session,reqCtx)),ctx)}async function deleteSession2(deps,sessionId,ctx){let reqCtx=new RequestContext(SessionCommandController.method.delete.input,sessionId,callerIdentityOf(ctx),kindOf18(ctx));await newPipeline("session-delete",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,SessionSchema)).addStep(newRejectDeleteWithActiveExecutionsStep(deps.store,deps.logger)).addStep(newCascadeDeleteAgentExecutionsStep(deps.store,deps.authorizationLifecycle,deps.logger,deps.runScores)).addStep(newCascadeDeleteSessionFilesStep(deps.store,deps.fileBlobs,deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSessionEventsStep(deps.store)).addStep(newDeleteResourceStep(deps.store)).addStep(newCascadeDeleteSessionFilesStep(deps.store,deps.fileBlobs,deps.authorizationLifecycle,deps.logger)).addStep(newReleaseNamesStep(deps.store,deps.logger,ApiResourceKind.session)).addStep(newCleanupGrantsStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,sealedValuesOfSession)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted session not found in context"),"deleted session not found in context");return await deprovisionSessionSandboxBestEffort(deps.sandboxLane,deps.logger,deleted.metadata?.id??""),redacted(deleted)}async function updateSubject(deps,req,identity2){if(req.id==="")throw invalidArgumentError("id is required");let kind=ApiResourceKind.session,session;try{session=await deps.store.getResource(kind,req.id,SessionSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("session",req.id):internalError(error3,"failed to load session")}await authorizeDirect(SessionCommandController.method.updateSubject,deps.authorizer,identity2,req);try{session=await deps.store.updateResource(kind,req.id,SessionSchema,live=>{live.spec??=create2(SessionSpecSchema,{}),live.spec.subject=req.subject,setAuditFieldsForUpdate(SessionSchema,live,"spec_audit",identity2)})}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("session",req.id):internalError(error3,"failed to persist session")}return await indexSessionSearch(deps,kind,session),redacted(session)}async function indexSessionSearch(deps,kind,session){let entry=sessionSearchExtractor.getSearchIndexEntry(session);if(entry!==void 0)try{await deps.store.upsertSearchIndex(kind,session.metadata?.id??"",entry)}catch(error3){deps.logger.warn("UpdateSubject: failed to update search index (best-effort)",{id:session.metadata?.id??"",error:error3 instanceof Error?error3.message:String(error3)})}}async function get15(deps,id,ctx){let reqCtx=new RequestContext(SessionQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("session-get",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,SessionSchema)).addStep(newStampSessionStateStep(deps.store,ctx2=>[ctx2.get(TARGET_RESOURCE_KEY)])).build().execute(reqCtx),redacted(reqCtx.get(TARGET_RESOURCE_KEY))}async function list13(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("session-list",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListAllSessionsStep(deps.store,deps.logger,deps.listReadScope)).addStep(newStampSessionStateStep(deps.store,listedSessions)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY7))}async function listByAgent4(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByAgent.input,req,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("session-list-by-agent",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newFilterByAgentStep(deps.store,deps.logger,deps.listReadScope)).addStep(newStampSessionStateStep(deps.store,listedSessions)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY7))}async function listByChannel(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByChannel.input,req,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("session-list-by-channel",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByChannel,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeChannelAccessStep(deps.authorizer)).addStep(newFilterByChannelStep(deps.store,deps.logger,deps.listReadScope)).addStep(newStampSessionStateStep(deps.store,listedSessions)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY7))}function listedSessions(ctx){return ctx.get(LIST_RESULT_KEY7)?.entries??[]}function requireListResult2(result){if(result===void 0)throw internalError(new Error("session list not found in context"),"session list not found in context");let list18=result;for(let session of list18.entries)redactSessionValues(session);return list18}function redacted(session){return redactSessionValues(session),session}var import_node_path14=require("node:path");var file_ai_stigmer_agentic_plugin_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEyiQcKF1BsdWdpbkNvbW1hbmRDb250cm9sbGVyEqEBCgRwdXNoEi8uYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QdXNoUGx1Z2luUmVxdWVzdBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24S2AEKF2NyZWF0ZUFydGlmYWN0VXBsb2FkVXJsEkIuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5DcmVhdGVQbHVnaW5BcnRpZmFjdFVwbG9hZFVybFJlcXVlc3QaNS5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbkFydGlmYWN0VXBsb2FkVXJsIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24SsAEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiQuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW4iP8K4GDsIMBA6IgtyZXNvdXJjZV9pZCoodW5hdXRob3JpemVkIHRvIHVwZGF0ZSBwbHVnaW4gdmlzaWJpbGl0eRKGAQoGZGVsZXRlEiYuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5JZBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIi7CuBgqCAMQOiIFdmFsdWUqHXVuYXV0aG9yaXplZCB0byBkZWxldGUgcGx1Z2luEqwBCglsaXN0VG9vbHMSMi5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5Ub29sc0lucHV0GjMuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5MaXN0UGx1Z2luVG9vbHNPdXRwdXQiNsK4GDIIARA6IglwbHVnaW5faWQqIXVuYXV0aG9yaXplZCB0byBsaXN0IHBsdWdpbiB0b29scxoEoP8rOmIGcHJvdG8z",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginCommandController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_command,0);var file_ai_stigmer_agentic_plugin_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxMowGChVQbHVnaW5RdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luSWQaJC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbiIrwrgYJwgBEDoiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IHBsdWdpbhJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIgTQuBgBEmgKBGxpc3QSMC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5zUmVxdWVzdBooLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luTGlzdCIE0LgYARJ4CgtnZXRBcnRpZmFjdBIwLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuR2V0QXJ0aWZhY3RSZXF1ZXN0GjEuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5HZXRBcnRpZmFjdFJlc3BvbnNlIgTQuBgBEokBChZnZXRBcnRpZmFjdERvd25sb2FkVXJsEjAuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5HZXRBcnRpZmFjdFJlcXVlc3QaNy5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbkFydGlmYWN0RG93bmxvYWRVcmwiBNC4GAEShQEKDGxpc3RWZXJzaW9ucxI1LmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuTGlzdFBsdWdpblZlcnNpb25zSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5WZXJzaW9uc1Jlc3BvbnNlIgTQuBgBGgSg/ys6YgZwcm90bzM",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginQueryController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_query,0);var import_node_path13=__toESM(require("node:path"),1);var ArtifactNotFoundError=class extends Error{constructor(storageKey){super(`artifact not found: ${storageKey}`),this.name="ArtifactNotFoundError"}},ARCHIVE_CONTENT_TYPE="application/zip";function newContentAddressedArchiveStore(driver,keyPrefix){let virtualRoot=import_node_path13.default.resolve(import_node_path13.default.sep,"archive-store"),keyEscapesStore=storageKey=>{let resolved=import_node_path13.default.resolve(virtualRoot,storageKey);return resolved!==virtualRoot&&!resolved.startsWith(virtualRoot+import_node_path13.default.sep)};return{getStorageKey(hash){return`${keyPrefix}${hash}.zip`},async store(hash,data){let storageKey=this.getStorageKey(hash);return await driver.upload(storageKey,data,ARCHIVE_CONTENT_TYPE),storageKey},async get(storageKey){if(keyEscapesStore(storageKey))throw new ArtifactNotFoundError(storageKey);try{return await driver.download(storageKey)}catch(error3){throw error3 instanceof ArtifactStorageNotFoundError?new ArtifactNotFoundError(storageKey):new Error(`failed to read artifact: ${error3 instanceof Error?error3.message:String(error3)}`)}},async exists(hash){return driver.exists(this.getStorageKey(hash))},async size(storageKey){if(keyEscapesStore(storageKey))throw new ArtifactNotFoundError(storageKey);try{return await driver.size(storageKey)}catch(error3){throw error3 instanceof ArtifactStorageNotFoundError?new ArtifactNotFoundError(storageKey):new Error(`failed to stat artifact: ${error3 instanceof Error?error3.message:String(error3)}`)}}}}var pluginListIndex=declareListIndex({kind:ApiResourceKind.plugin,schema:PluginSchema,revision:1,keys:{}});async function recordConnectAttempt(store,logger2,start,now=Date.now()){let nowSeconds2=Math.floor(now/1e3),swept=await store.connectAttempts.deleteExpired(nowSeconds2);swept>0&&logger2.info("Swept expired connect attempts",{count:swept}),await store.connectAttempts.create({id:start.id,org:start.org,createdBy:start.createdBy,person:start.person??"",pluginId:start.pluginId,server:start.server,createdAt:nowSeconds2,expiresAt:nowSeconds2+Math.ceil(start.ttlMs/1e3)})}async function endConnectAttempt(store,logger2,id){try{await store.connectAttempts.delete(id)}catch(error3){logger2.warn("Failed to end a connect attempt (non-fatal; it expires)",{execution_id:id,error:error3 instanceof Error?error3.message:String(error3)})}}var CONNECT_SANDBOX_PROVISIONING_FAILED="failed to provision connect sandbox",SHARED_RUNNER_ROUTE=Object.freeze({taskQueue:Object.freeze({kind:"runner"}),release:async()=>{}});async function acquireConnectRoute(lane,logger2,request3){if(!lane.enabled)return SHARED_RUNNER_ROUTE;let{connectExecutionId,org,caller}=request3,taskQueue=connectTaskQueueFor(connectExecutionId),sandboxId;try{sandboxId=await lane.provisioner.createConnectSandbox(connectExecutionId,{taskQueue,stigmerToken:mintSandboxToken(lane,{scope:"connect",sessionId:"",executionId:connectExecutionId,org,callerIdentityId:caller.identityId},logger2),callerClass:caller.callerClass})}catch(error3){throw logger2.error("Connect sandbox provisioning failed - refusing the connect",{execution_id:connectExecutionId,error:error3 instanceof Error?error3.message:String(error3)}),unavailableError(CONNECT_SANDBOX_PROVISIONING_FAILED)}let released=!1;return{taskQueue:{kind:"sandbox",name:taskQueue},async release(){if(!released){released=!0;try{await lane.provisioner.deprovisionConnectSandbox(sandboxId)}catch(error3){logger2.warn("Failed to deprovision connect sandbox (non-fatal)",{execution_id:connectExecutionId,sandbox_id:sandboxId,error:error3 instanceof Error?error3.message:String(error3)})}}}}}var LIST_TOOLS_TIMEOUT={ms:42e4,label:"7m0s"},LIST_TOOLS_ORG_DENIED="unauthorized to list plugin tools in this organization",LIST_TOOLS_GET_BUFFER_MS=15e3;async function listTools(deps,input,identity2){if(input.pluginId===""||input.server==="")throw invalidArgumentError("plugin_id and server are required");if(input.org==="")throw invalidArgumentError("org is required to list a server's tools");let plugin2;try{plugin2=await deps.store.getResource(ApiResourceKind.plugin,input.pluginId,PluginSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("plugin",input.pluginId):internalError(error3,"failed to load plugin")}await authorizeDirect(PluginCommandController.method.listTools,deps.authorizer,identity2,input),await refuseBoundElsewhere(deps.credentialBinding,identity2,input.org),await authorizeResolvedResource(deps.authorizer,identity2,{permission:IamPermission.can_view,resourceKind:ApiResourceKind.organization,resourceId:input.org},LIST_TOOLS_ORG_DENIED);let entry=plugin2.status?.mcpServers.find(server2=>server2.name===input.server);if(entry===void 0)throw notFoundError(`MCP server of plugin '${plugin2.metadata?.slug??""}'`,input.server);let pluginName=plugin2.metadata?.name??"",server={home:{kind:"plugin",pluginId:input.pluginId,pluginName,pluginDigest:plugin2.status?.digest??""},entry,env:plugin2.status?.env??{}},engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError("listing a server's tools is not available: Temporal not configured");let person=runPersonOfCaller(identity2),needsValues=toolRequirements(server).length>0;needsValues&&await deps.vaultResolver.planConnect({orgId:input.org,person,server});let executionId=newConnectExecutionId(input.pluginId);try{await recordConnectAttempt(deps.store,deps.logger,{id:executionId,org:input.org,createdBy:identity2.identityId,person,pluginId:input.pluginId,server:input.server,ttlMs:LIST_TOOLS_TIMEOUT.ms+LIST_TOOLS_GET_BUFFER_MS})}catch(error3){throw internalError(error3,"failed to record the tools listing")}let route;try{route=await acquireConnectRoute(deps.sandboxLane,deps.logger,{connectExecutionId:executionId,org:input.org,caller:identity2});let workflowInput=withCredential(deps,executionId,needsValues,route.taskQueue,{plugin_id:input.pluginId,server:input.server}),run;try{run=await engineState.engine.startListing(executionId,workflowInput,LIST_TOOLS_TIMEOUT.ms,route.taskQueue)}catch(error3){throw deps.logger.error("Failed to start a plugin tools listing",{plugin_id:input.pluginId,server:input.server,error:error3 instanceof Error?error3.message:String(error3)}),internalError(error3,"failed to start the tools listing")}let outcome2=await run.result(LIST_TOOLS_TIMEOUT.ms+LIST_TOOLS_GET_BUFFER_MS);if(!outcome2.ok)throw mapListingFailure(deps.logger,server,run.workflowId,outcome2.failure);return create2(ListPluginToolsOutputSchema,{tools:(outcome2.output.tools??[]).map(tool=>create2(PluginToolSchema,{name:tool.name??"",description:tool.description??"",destructive:tool.destructiveHint===!0}))})}finally{await route?.release(),await endConnectAttempt(deps.store,deps.logger,executionId)}}function withCredential(deps,executionId,needsValues,taskQueue,input){if(!needsValues)return input;let withAttempt={...input,execution_context_id:executionId};if(taskQueue.kind==="sandbox"||!deps.runnerAuth.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))return withAttempt;try{let minted=deps.runnerAuth.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return{...withAttempt,execution_context_token:minted.token}}catch(error3){return deps.logger.warn("Failed to mint the listing's runner credential \u2014 the runner cannot fetch its values",{execution_id:executionId,error:error3 instanceof Error?error3.message:String(error3)}),withAttempt}}function mapListingFailure(logger2,server,workflowId,failure){let name=toolNameOf(server.home.pluginName,server.entry.name);switch(logger2.error("Plugin tools listing failed",{workflow_id:workflowId,plugin_id:server.home.pluginId,server:server.entry.name,failure_kind:failure.kind}),failure.kind){case"application":return failedPreconditionError(listingFailureMessage(name,server.entry,failure.message));case"timeout":return new ConnectError(`listing the tools of ${name} did not complete within the ${LIST_TOOLS_TIMEOUT.label} budget \u2014 if this repeats, check that your runner is running and healthy`,Code.DeadlineExceeded);case"service-not-found":return unavailableError(`listing the tools of ${name} is temporarily unavailable`);case"other":return new ConnectError(listingFailureMessage(name,server.entry,failure.message),Code.Internal);default:{let exhaustive=failure;throw new Error(`unhandled listing failure ${String(exhaustive)}`)}}}function listingFailureMessage(name,entry,cause){return cause.includes("requires OAuth")?cause:entry.transport.case==="stdio"?`listing the tools of ${name} failed: ${cause}. It is a local program the runner starts \u2014 check that the command is installed and its arguments and variables are right`:`listing the tools of ${name} failed: ${cause}. Check that the server's address is reachable and your sign-in or key is valid`}function registerPluginServices(router,deps){router.service(PluginCommandController,{push:(req,ctx)=>push(deps,req,ctx),createArtifactUploadUrl:(req,ctx)=>createArtifactUploadUrl(deps,req,ctx),updateVisibility:(input,ctx)=>updateVisibility4(deps,input,ctx),delete:(id,ctx)=>deletePlugin(deps,id,ctx),listTools:(input,ctx)=>listTools(deps.tools,input,callerIdentityOf(ctx))}),router.service(PluginQueryController,{get:(id,ctx)=>get16(deps,id,ctx),getByReference:(ref,ctx)=>getByReference8(deps,ref,ctx),list:(req,ctx)=>list14(deps,req,ctx),listVersions:(req,ctx)=>listVersions2(deps,req,ctx),getArtifact:(req,ctx)=>getArtifact(deps,req,ctx),getArtifactDownloadUrl:(req,ctx)=>getArtifactDownloadUrl2(deps,req,ctx)})}function kindOf19(ctx){return ctx.values.get(apiResourceKindKey)}async function push(deps,req,ctx){let previous;return runGuardedWrite(async()=>{let reqCtx=new RequestContext(PushPluginRequestSchema,req,callerIdentityOf(ctx),kindOf19(ctx)),consumed=previous?.get(ARTIFACT_BYTES_KEY);return consumed!==void 0&&reqCtx.set(ARTIFACT_BYTES_KEY,consumed),previous=reqCtx,await newPipeline("plugin-push-plan",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.push,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveArtifactSourceStep(deps.staging,{source:input=>({artifact:input.artifact,artifactUploadRef:input.artifactUploadRef}),laneNotConfigured:TRANSFER_LANE_NOT_CONFIGURED})).addStep(newGateAndHashArchiveStep("plugin")).addStep(newReadPluginPackageStep()).addStep(newBuildInitialPluginStep()).addStep(newFindExistingBySlugStep(deps.store,pluginPushBinding)).addStep(newRefuseRenamedSlugStep()).addStep(newGenerateIdIfNeededStep()).addStep(newPlanPluginStatusStep()).addStep(newGuardPushVisibilityStep(deps.store,pluginPushBinding,"GuardPluginVisibility")).addStep(newResolveConvergenceStep(pluginPushBinding)).build().execute(reqCtx),reqCtx.get(CONVERGED_KEY)===!0?reqCtx.get(EXISTING_PUSHED_RESOURCE_KEY):(await newPipeline("plugin-push-install",deps.logger).addStep(newProbeServerSignInsStep({outboundFetch:deps.outboundFetch,logger:deps.logger})).addStep(newCheckAndStoreArtifactStep(deps.artifactStorage)).addStep(newPopulatePluginFieldsStep()).addStep(newClaimPushedNameStep(deps.store,pluginPushBinding)).addStep(newStorePushedStep(deps.store,pluginPushBinding,"StorePlugin")).addStep(newArchiveCurrentPluginStep(deps.store,deps.logger)).addStep(newPushAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger,"PluginPushAuthorizationTuples")).addStep(newIndexPluginSearchStep(deps.store,deps.logger)).build().execute(reqCtx).catch(releaseNameOnFailure(deps.store,deps.logger,reqCtx)),reqCtx.get(PUSHED_RESOURCE_KEY))})}async function createArtifactUploadUrl(deps,req,ctx){let staging=deps.staging;if(staging===void 0)throw failedPreconditionError(TRANSFER_LANE_NOT_CONFIGURED);let reqCtx=new RequestContext(PluginCommandController.method.createArtifactUploadUrl.input,req,callerIdentityOf(ctx),kindOf19(ctx));if(await newPipeline("plugin-create-artifact-upload-url",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.createArtifactUploadUrl,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx),req.sizeBytes>BigInt(104857600))throw invalidArgumentError(`plugin archive size ${req.sizeBytes} bytes exceeds the ${104857600}-byte (100MB) archive limit`);let minted;try{minted=await staging.mint(Number(req.sizeBytes))}catch(error3){throw internalError(error3,"failed to mint upload reference")}return create2(PluginArtifactUploadUrlSchema,{url:minted.url,artifactUploadRef:minted.ref,ttlSeconds:Math.trunc(minted.ttlMs/1e3)})}var UPDATE_VISIBILITY_PLUGIN_KEY="updateVisibilityPlugin";async function updateVisibility4(deps,input,ctx){let reqCtx=new RequestContext(PluginCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("plugin-update-visibility",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadPluginByIdStep(deps.store,UPDATE_VISIBILITY_PLUGIN_KEY)).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_PLUGIN_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newRefuseChildOrgsVisibilityInChildUpdateStep(deps.store,UPDATE_VISIBILITY_PLUGIN_KEY)).addStep(newSetPluginVisibilityStep()).addStep(newPersistPluginStep(deps.store,UPDATE_VISIBILITY_PLUGIN_KEY,"PersistPluginForVisibilityUpdate")).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_PLUGIN_KEY)).addStep(newIndexPluginStep(deps.store,deps.logger,UPDATE_VISIBILITY_PLUGIN_KEY,"IndexPluginAfterVisibilityUpdate")).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_PLUGIN_KEY)}function newLoadPluginByIdStep(store,key){return{name:"LoadPluginForVisibilityUpdate",async execute(ctx){let plugin2;try{plugin2=await store.getResource(ctx.apiResourceKind,ctx.input.resourceId,PluginSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("plugin",ctx.input.resourceId):internalError(error3,"failed to load plugin")}ctx.set(key,plugin2)}}}function newSetPluginVisibilityStep(){return{name:"SetPluginVisibility",execute(ctx){let plugin2=ctx.get(UPDATE_VISIBILITY_PLUGIN_KEY);plugin2.metadata!==void 0&&(plugin2.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(PluginSchema,plugin2,"status_audit",ctx.callerIdentity)}}}async function deletePlugin(deps,id,ctx){let reqCtx=new RequestContext(PluginCommandController.method.delete.input,id,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("plugin-delete",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,PluginSchema)).addStep(newGuardUnlistedStep(deps.store,UNLISTED_PLUGIN)).addStep(newCascadeDeleteEvalRunsStep("plugin",deps.evalRuns)).addStep(newDeleteVersionArchivesStep(deps.store,deps.logger,{stepName:"DeletePluginArchives",noun:"plugin"})).addStep(newDeleteResourceStep(deps.store)).addStep(newReleaseNamesStep(deps.store,deps.logger,ApiResourceKind.plugin)).addStep(newSweepEvalRunsAfterDeleteStep("plugin",deps.evalRuns)).addStep(newCleanupGrantsStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted plugin not found in context"),"deleted plugin not found in context");return deleted}async function get16(deps,id,ctx){let reqCtx=new RequestContext(PluginQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("plugin-get",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,PluginSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference8(deps,ref,ctx){let reqCtx=new RequestContext(PluginQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("plugin-get-by-reference",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceWithVersionStep(deps.store,pluginVersionBinding,"LoadPluginByReference")).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(PluginQueryController.method.get),"AuthorizeResolvedPlugin")).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getArtifact(deps,req,ctx){let reqCtx=new RequestContext(PluginQueryController.method.getArtifact.input,req,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("plugin-get-artifact",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.getArtifact,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx);let artifact;try{artifact=await deps.artifactStorage.get(pluginStorageKey(req))}catch(error3){throw artifactReadError(error3,req,"failed to load plugin artifact")}return create2(GetArtifactResponseSchema,{artifact})}async function getArtifactDownloadUrl2(deps,req,ctx){let staging=deps.staging;if(staging===void 0)throw failedPreconditionError(TRANSFER_LANE_NOT_CONFIGURED);let reqCtx=new RequestContext(PluginQueryController.method.getArtifactDownloadUrl.input,req,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("plugin-get-artifact-download-url",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.getArtifactDownloadUrl,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx);let size;try{size=await deps.artifactStorage.size(pluginStorageKey(req))}catch(error3){throw artifactReadError(error3,req,"failed to stat plugin artifact")}let capability;try{capability=await staging.downloadUrl(req.artifactStorageKey,"runner")}catch(error3){throw internalError(error3,"failed to mint plugin artifact download URL")}return create2(PluginArtifactDownloadUrlSchema,{url:capability.url,ttlSeconds:Math.trunc(capability.ttlMs/1e3),sizeBytes:BigInt(size)})}function pluginStorageKey(req){let key=req.artifactStorageKey;if(!key.startsWith(PLUGIN_ARTIFACT_KEY_PREFIX)||import_node_path14.posix.normalize(key)!==key||key.split("/").includes(".."))throw new ArtifactNotFoundError(req.artifactStorageKey);return req.artifactStorageKey}function artifactReadError(error3,req,message6){return error3 instanceof ArtifactNotFoundError?new ConnectError(`plugin artifact not found: ${req.artifactStorageKey}`,Code.NotFound):internalError(error3,message6)}async function listVersions2(deps,req,ctx){let reqCtx=new RequestContext(PluginQueryController.method.listVersions.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("plugin-list-versions",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.listVersions,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveBySlugForVersionsStep(deps.store,pluginVersionBinding,"ResolvePluginBySlug")).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,versionHistoryTarget(ApiResourceKind.plugin,"unauthorized to view plugin version history"),"AuthorizeResolvedPlugin")).addStep(newLoadAndMapVersionsStep(deps.store,pluginVersionBinding,"LoadAndMapVersions")).build().execute(reqCtx),reqCtx.get(LIST_VERSIONS_RESPONSE_KEY)}function newPersistPluginStep(store,key,stepName){return{name:stepName,async execute(ctx){let plugin2=ctx.get(key),id=plugin2.metadata?.id??"",written;try{written=await store.updateResource(ctx.apiResourceKind,id,PluginSchema,row=>{row.metadata!==void 0&&(row.metadata.visibility=plugin2.metadata?.visibility??row.metadata.visibility);let audit=(row.status??=create2(PluginStatusSchema)).audit??=create2(ApiResourceAuditSchema);audit.statusAudit=plugin2.status?.audit?.statusAudit})}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("plugin",id):internalError(error3,"failed to save plugin")}ctx.set(key,written)}}}function newIndexPluginStep(store,logger2,key,stepName){return{name:stepName,async execute(ctx){let plugin2=ctx.get(key),entry=pluginSearchExtractor.getSearchIndexEntry(plugin2);if(entry!==void 0)try{await store.upsertSearchIndex(ctx.apiResourceKind,plugin2.metadata?.id??"",entry)}catch(error3){logger2.warn(`${stepName}: failed (best-effort)`,{id:plugin2.metadata?.id??"",error:error3 instanceof Error?error3.message:String(error3)})}}}}var PLUGIN_LIST_KEY="pluginList";async function list14(deps,req,ctx){let reqCtx=new RequestContext(PluginQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("plugin-list",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"ListByOrg",async execute(step){let page=await readOrgListPage({store:deps.store,logger:deps.logger,listReadScope:deps.listReadScope,caller:step.callerIdentity,kind:ApiResourceKind.plugin,schema:PluginSchema,declaration:pluginListIndex,request:step.input});step.set(PLUGIN_LIST_KEY,create2(PluginListSchema,{entries:page.entries,nextPageToken:page.nextPageToken}))}}).build().execute(reqCtx),reqCtx.get(PLUGIN_LIST_KEY)}var file_ai_stigmer_agentic_eval_v1_command=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvZXZhbC92MS9jb21tYW5kLnByb3RvEhphaS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MTK5BgoVRXZhbENvbW1hbmRDb250cm9sbGVyElsKBHB1c2gSKy5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5QdXNoRXZhbFJlcXVlc3QaIC5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5FdmFsIgTQuBgBEm8KDmFkZENhc2VGcm9tUnVuEjUuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuQWRkRXZhbENhc2VGcm9tUnVuUmVxdWVzdBogLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFsLnYxLkV2YWwiBNC4GAESkgEKF2NyZWF0ZUFydGlmYWN0VXBsb2FkVXJsEj4uYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuQ3JlYXRlRXZhbEFydGlmYWN0VXBsb2FkVXJsUmVxdWVzdBoxLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFsLnYxLkV2YWxBcnRpZmFjdFVwbG9hZFVybCIE0LgYARKqAQoQdXBkYXRlVmlzaWJpbGl0eRI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5VcGRhdGVWaXNpYmlsaXR5SW5wdXQaIC5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5FdmFsIj3CuBg5CDAQQiILcmVzb3VyY2VfaWQqJnVuYXV0aG9yaXplZCB0byB1cGRhdGUgZXZhbCB2aXNpYmlsaXR5EosBCgZyZW5hbWUSKy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuUmVuYW1lSW5wdXQaIC5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5FdmFsIjLCuBguCAMQQiILcmVzb3VyY2VfaWQqG3VuYXV0aG9yaXplZCB0byByZW5hbWUgZXZhbBJ8CgZkZWxldGUSIi5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5FdmFsSWQaIC5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5FdmFsIizCuBgoCAMQQiIFdmFsdWUqG3VuYXV0aG9yaXplZCB0byBkZWxldGUgZXZhbBoEoP8rQmIGcHJvdG8z",[file_ai_stigmer_agentic_eval_v1_api,file_ai_stigmer_agentic_eval_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EvalCommandController=serviceDesc(file_ai_stigmer_agentic_eval_v1_command,0);var file_ai_stigmer_agentic_eval_v1_query=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvZXZhbC92MS9xdWVyeS5wcm90bxIaYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEy2AYKE0V2YWxRdWVyeUNvbnRyb2xsZXISdgoDZ2V0EiIuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuRXZhbElkGiAuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuRXZhbCIpwrgYJQgBEEIiBXZhbHVlKhh1bmF1dGhvcml6ZWQgdG8gZ2V0IGV2YWwSbgoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaIC5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5FdmFsIgTQuBgBEmAKBGxpc3QSLC5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5MaXN0RXZhbHNSZXF1ZXN0GiQuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuRXZhbExpc3QiBNC4GAESfQoMbGlzdFZlcnNpb25zEjEuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuTGlzdEV2YWxWZXJzaW9uc0lucHV0GjQuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuTGlzdEV2YWxWZXJzaW9uc1Jlc3BvbnNlIgTQuBgBEm8KCGRvd25sb2FkEjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlGicuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuRXZhbEFyY2hpdmUiBNC4GAESgAEKDmdldERvd25sb2FkVXJsEjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlGjIuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuRXZhbEFyY2hpdmVEb3dubG9hZFVybCIE0LgYARJ+ChBidWlsZENhc2VGcm9tUnVuEjcuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuQnVpbGRFdmFsQ2FzZUZyb21SdW5SZXF1ZXN0GisuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuRXZhbENhc2VBcmNoaXZlIgTQuBgBGgSg/ytCYgZwcm90bzM",[file_ai_stigmer_agentic_eval_v1_api,file_ai_stigmer_agentic_eval_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EvalQueryController=serviceDesc(file_ai_stigmer_agentic_eval_v1_query,0);function writeArchive(files){let sorted=[...files].sort((a5,b7)=>compareWalkOrder(a5.path,b7.path)),bytes=new Map;for(let file of sorted){if(bytes.has(file.path))throw new Error(`archive path '${file.path}' listed twice`);bytes.set(file.path,file.bytes)}let listed={entries:sorted.map(file=>({path:file.path,size:file.bytes.length})),read:path17=>bytes.get(path17)??new Uint8Array};return archivePlugin(listed)}var import_node_crypto41=require("node:crypto");var RESUMING_HARNESSES=[...new Map(Object.values(EVAL_ENGINES).map(engine=>[engine.word,engine.label])).entries()].filter(([word])=>!EVAL_ENGINE_UNSUPPORTED_FEATURES[word].includes("resumed conversations")).map(([,label2])=>`the ${label2} harness`).join(" or "),MAX_CASE_NAME=48,DEFAULT_CASE_NAME="case-from-run",RESERVED_CASE_NAMES=new Set(["mocks","results"]),PLATFORM_SERVER_PREFIX="stigmer",MOCK_TOOL_NAME=/^[A-Za-z0-9-][A-Za-z0-9_-]*$/,encoder6=new TextEncoder;async function buildCaseFromRun(store,logger2,input){let{run}=input,runId=run.metadata?.id??"",sessionId=sessionIdOf(run.spec),events=sessionId===""?[]:await readSessionEvents(store,sessionId,{}),turns=turnsOf(events),own=turns.find(turn2=>turn2.runId===runId),earlier=await earlierTurnsOf2(store,run,turns,own),turn=turnOfTranscript({run,events:own?.events??[]}),request3=turn?.userMessage?.text||run.spec?.message||"",caseName=input.caseName!==""?input.caseName:suggestCaseName(request3),notes=[],files=[{path:"prompt.md",content:promptFile(request3)}];if(earlier.length>0){let harness=await harnessOf(store,sessionId),lines=[],unanswered=0;for(let previous of earlier){let transcript={run:previous.row,events:previous.turn.events},trace2=await evalTraceOf(transcript,{pluginName:"",harness,pluginsByDigest:new Map,wantedFiles:[],readArtifact:()=>Promise.reject(new Error("a history reads no file"))});lines.push(...trace2.traceLines),unanswered+=toolUsesOf(turnOfTranscript(transcript)).filter(use=>use.result===void 0).length}files.push({path:"history.jsonl",content:`${lines.join(`
+`)}gone(){return this.closed.aborted||this.response.writableEnded}};var MANAGED_AGENTS_VERSION="managed-agents-2026-04-01",SERVED_MANAGED_AGENTS_VERSIONS=new Set([MANAGED_AGENTS_VERSION]),MANAGED_AGENTS_BETA_PREFIX="managed-agents-";function selectManagedAgentsVersion(header){let named=(header??"").split(",").map(beta=>beta.trim()).filter(beta=>beta.startsWith(MANAGED_AGENTS_BETA_PREFIX));if(named.length===0)return{served:!0,version:MANAGED_AGENTS_VERSION};let unserved=named.find(beta=>!SERVED_MANAGED_AGENTS_VERSIONS.has(beta));return unserved!==void 0?{served:!1,message:`this server serves ${MANAGED_AGENTS_VERSION}, not ${unserved}`}:{served:!0,version:named[0]??MANAGED_AGENTS_VERSION}}var ROUTE_SHAPES={events:`${MANAGED_AGENTS_PATH_PREFIX}{id}/events`,stream:`${MANAGED_AGENTS_PATH_PREFIX}{id}/events/stream`},REQUEST_ID_PREFIX="req";function createManagedAgentsLane(options){let clients={sessionQuery:createClient(SessionQueryController,options.transport),sessionCommand:createClient(SessionCommandController,options.transport),runCommand:createClient(RunCommandController,options.transport),fileQuery:createClient(FileQueryController,options.transport)},now=options.now??Date.now,keepAliveMs=options.keepAliveMs??STREAM_KEEPALIVE_MS;return(request3,response)=>{let startedAt=performance.now(),requestId=generateId(REQUEST_ID_PREFIX),path17=(request3.url??"").split("?",1)[0]??"",route=routeOf(path17),fields2={method:request3.method??"",route:route===void 0?"unknown":ROUTE_SHAPES[route.kind],requestId};serve(request3,response,route,requestId,{clients,now,keepAliveMs,...options}).then(status=>{let logged={...fields2,status,durationMs:Math.round(performance.now()-startedAt)};status>=500?options.logger.error("managed agents lane request failed",logged):status===404?options.logger.debug("managed agents lane request found nothing",logged):status>=400?options.logger.warn("managed agents lane client error",logged):options.logger.info("managed agents lane request",logged)}).catch(error3=>{options.logger.error("managed agents lane handler failed",{...fields2,error:error3 instanceof Error?error3.message:String(error3)}),response.headersSent?response.writableEnded||response.end():writeError(response,requestId,laneError(500,"api_error",INTERNAL_ERROR_MESSAGE))})}}async function serve(request3,response,route,requestId,context2){let refuse=(error3,refuseOptions={})=>(writeError(response,requestId,error3,{...refuseOptions,noRetry:request3.method==="POST"}),error3.status);if(route===void 0)return refuse(notFound(`this API serves ${ROUTE_SHAPES.events} (GET, POST) and ${ROUTE_SHAPES.stream} (GET), nothing else under ${MANAGED_AGENTS_PATH_PREFIX}`));let method=request3.method??"",allow=route.kind==="events"?"GET, POST":"GET";if(!allow.split(", ").includes(method))return refuse(laneError(405,"invalid_request_error",`${method} is not served here; this path serves ${allow}`),{allow});let version=selectManagedAgentsVersion(headerOf(request3,"anthropic-beta"));if(!version.served)return refuse(laneError(400,"invalid_request_error",version.message));let headers2=forwardedHeaders(request3,context2.authenticationRequired);if(isLaneError(headers2))return refuse(headers2);let abort=new AbortController;response.on("close",()=>abort.abort());let call={sessionId:route.sessionId,clients:context2.clients,options:{headers:headers2,signal:abort.signal},requestId},params=new URLSearchParams((request3.url??"").split("?",2)[1]??"");try{if(route.kind==="stream"){let query=parseStreamQuery(params);return isLaneError(query)?refuse(query):await serveStream(call,query,response,context2.keepAliveMs)}if(method==="GET"){let query=parseListQuery(params);return isLaneError(query)?refuse(query):await serveList(call,query,response)}let body=await readJsonBody(request3);if(isLaneError(body))return refuse(body);let events=parseSendBody(body.value);if(isLaneError(events))return refuse(events);let unservable=await checkSendFiles(call,events);return unservable!==void 0?refuse(unservable):await serveSend(call,events,response,context2.now)}catch(error3){if(abort.signal.aborted)return 499;let answered=laneErrorOf(error3);return error3 instanceof ConnectError||context2.logger.error("managed agents lane call failed",{requestId,error:error3 instanceof Error?error3.message:String(error3)}),refuse(answered)}}function routeOf(path17){if(!path17.startsWith(MANAGED_AGENTS_PATH_PREFIX))return;let[encodedId,events,stream,...rest]=path17.slice(MANAGED_AGENTS_PATH_PREFIX.length).split("/");if(encodedId===void 0||encodedId===""||events!=="events"||rest.length>0)return;let sessionId;try{sessionId=decodeURIComponent(encodedId)}catch{return}return stream===void 0?{kind:"events",sessionId}:stream==="stream"?{kind:"stream",sessionId}:void 0}function forwardedHeaders(request3,authenticationRequired){let headers2=new Headers,origin=headerOf(request3,"origin");if(origin!==void 0&&headers2.set("origin",origin),!authenticationRequired)return headers2;let authorization=headerOf(request3,"authorization")??"",apiKey=(headerOf(request3,"x-api-key")??"").trim();return apiKey===""?(authorization!==""&&headers2.set("authorization",authorization),headers2):authorization!==""&&parseBearerToken(authorization)!==apiKey?laneError(401,"authentication_error","the X-Api-Key and Authorization headers carry different credentials; send one"):(headers2.set("authorization",`Bearer ${apiKey}`),headers2)}function headerOf(request3,name){let value=request3.headers[name];return Array.isArray(value)?value.join(", "):value}async function readJsonBody(request3){let tooLarge=()=>laneError(413,"invalid_request_error",`the request body exceeds ${10485760} bytes`);if(Number(headerOf(request3,"content-length")??0)>10485760)return tooLarge();let body=request3,read3=await new Promise((resolve,reject2)=>{let chunks=[],size=0,onData=chunk=>{if(size+=chunk.length,size>10485760){body.off("data",onData),resolve("too-large");return}chunks.push(chunk)};body.on("data",onData),body.once("end",()=>resolve(Buffer.concat(chunks))),body.once("error",reject2),body.once("close",()=>reject2(new Error("the client closed the request before its body ended")))});if(read3==="too-large")return tooLarge();try{return{value:JSON.parse(read3.toString("utf8"))}}catch{return laneError(400,"invalid_request_error","the request body must be JSON")}}function newMyVaultDeparture(deps){return async(identityAccountId,organizationId,caller)=>{await deleteMyVaultOf(deps,organizationId,identityAccountId,caller)&&deps.logger.info("my vault deleted with its person's departure",{identityAccountId,organizationId})}}var file_ai_stigmer_platform_github_v1_io=fileDesc("CiZhaS9zdGlnbWVyL3BsYXRmb3JtL2dpdGh1Yi92MS9pby5wcm90bxIdYWkuc3RpZ21lci5wbGF0Zm9ybS5naXRodWIudjEi0gEKEEdpdEh1YlJlcG9zaXRvcnkSCgoCaWQYASABKAMSEQoJZnVsbF9uYW1lGAIgASgJEgwKBG5hbWUYAyABKAkSDQoFb3duZXIYBCABKAkSHQoVb3duZXJfaXNfb3JnYW5pemF0aW9uGAUgASgIEhAKCGh0bWxfdXJsGAYgASgJEhEKCWNsb25lX3VybBgHIAEoCRIWCg5kZWZhdWx0X2JyYW5jaBgIIAEoCRISCgppc19wcml2YXRlGAkgASgIEhIKCnVwZGF0ZWRfYXQYCiABKAkiSgobTGlzdEdpdEh1YlJlcG9zaXRvcmllc0lucHV0EhQKA29yZxgBIAEoCUIHukgEcgIQARIVCgRwYWdlGAIgASgFQge6SAQaAigAImcKHVNlYXJjaEdpdEh1YlJlcG9zaXRvcmllc0lucHV0EhQKA29yZxgBIAEoCUIHukgEcgIQARIZCgVxdWVyeRgCIAEoCUIKukgHcgUQARiAAhIVCgRwYWdlGAMgASgFQge6SAQaAigAIm8KFEdpdEh1YlJlcG9zaXRvcnlMaXN0EkUKDHJlcG9zaXRvcmllcxgBIAMoCzIvLmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkdpdEh1YlJlcG9zaXRvcnkSEAoIaGFzX21vcmUYAiABKAgiiAEKF0xpc3RHaXRIdWJCcmFuY2hlc0lucHV0EhQKA29yZxgBIAEoCUIHukgEcgIQARIrCgVvd25lchgCIAEoCUIcukgZchcQARhkMhFeW0EtWmEtejAtOS5fLV0rJBIqCgRyZXBvGAMgASgJQhy6SBlyFxABGGQyEV5bQS1aYS16MC05Ll8tXSskIiEKEEdpdEh1YkJyYW5jaExpc3QSDQoFbmFtZXMYASADKAkinAEKEkdldEdpdEh1YlRyZWVJbnB1dBIUCgNvcmcYASABKAlCB7pIBHICEAESKwoFb3duZXIYAiABKAlCHLpIGXIXEAEYZDIRXltBLVphLXowLTkuXy1dKyQSKgoEcmVwbxgDIAEoCUIcukgZchcQARhkMhFeW0EtWmEtejAtOS5fLV0rJBIXCgNyZWYYBCABKAlCCrpIB3IFEAEY/wEiQwoPR2l0SHViVHJlZUVudHJ5EgwKBHBhdGgYASABKAkSFAoMaXNfZGlyZWN0b3J5GAIgASgIEgwKBHNpemUYAyABKAMiYAoKR2l0SHViVHJlZRI/CgdlbnRyaWVzGAEgAygLMi4uYWkuc3RpZ21lci5wbGF0Zm9ybS5naXRodWIudjEuR2l0SHViVHJlZUVudHJ5EhEKCXRydW5jYXRlZBgCIAEoCCK9AQoZR2V0R2l0SHViRmlsZUNvbnRlbnRJbnB1dBIUCgNvcmcYASABKAlCB7pIBHICEAESKwoFb3duZXIYAiABKAlCHLpIGXIXEAEYZDIRXltBLVphLXowLTkuXy1dKyQSKgoEcmVwbxgDIAEoCUIcukgZchcQARhkMhFeW0EtWmEtejAtOS5fLV0rJBIXCgNyZWYYBCABKAlCCrpIB3IFEAEY/wESGAoEcGF0aBgFIAEoCUIKukgHcgUQARiAICJFChFHaXRIdWJGaWxlQ29udGVudBIPCgdjb250ZW50GAEgASgMEgwKBHNpemUYAiABKAMSEQoJdG9vX2xhcmdlGAMgASgIYgZwcm90bzM",[file_buf_validate_validate]),GitHubRepositorySchema=messageDesc2(file_ai_stigmer_platform_github_v1_io,0);var GitHubRepositoryListSchema=messageDesc2(file_ai_stigmer_platform_github_v1_io,3);var GitHubBranchListSchema=messageDesc2(file_ai_stigmer_platform_github_v1_io,5);var GitHubTreeEntrySchema=messageDesc2(file_ai_stigmer_platform_github_v1_io,7),GitHubTreeSchema=messageDesc2(file_ai_stigmer_platform_github_v1_io,8);var GitHubFileContentSchema=messageDesc2(file_ai_stigmer_platform_github_v1_io,10);var file_ai_stigmer_platform_github_v1_query=fileDesc("CilhaS9zdGlnbWVyL3BsYXRmb3JtL2dpdGh1Yi92MS9xdWVyeS5wcm90bxIdYWkuc3RpZ21lci5wbGF0Zm9ybS5naXRodWIudjEyzwcKFUdpdEh1YlF1ZXJ5Q29udHJvbGxlchLEAQoQbGlzdFJlcG9zaXRvcmllcxI6LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkxpc3RHaXRIdWJSZXBvc2l0b3JpZXNJbnB1dBozLmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkdpdEh1YlJlcG9zaXRvcnlMaXN0Ij/CuBg7CDMQHiIDb3JnKjB1bmF1dGhvcml6ZWQgdG8gcmVhZCBHaXRIdWIgaW4gdGhpcyBvcmdhbml6YXRpb24SyAEKEnNlYXJjaFJlcG9zaXRvcmllcxI8LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLlNlYXJjaEdpdEh1YlJlcG9zaXRvcmllc0lucHV0GjMuYWkuc3RpZ21lci5wbGF0Zm9ybS5naXRodWIudjEuR2l0SHViUmVwb3NpdG9yeUxpc3QiP8K4GDsIMxAeIgNvcmcqMHVuYXV0aG9yaXplZCB0byByZWFkIEdpdEh1YiBpbiB0aGlzIG9yZ2FuaXphdGlvbhK4AQoMbGlzdEJyYW5jaGVzEjYuYWkuc3RpZ21lci5wbGF0Zm9ybS5naXRodWIudjEuTGlzdEdpdEh1YkJyYW5jaGVzSW5wdXQaLy5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HaXRIdWJCcmFuY2hMaXN0Ij/CuBg7CDMQHiIDb3JnKjB1bmF1dGhvcml6ZWQgdG8gcmVhZCBHaXRIdWIgaW4gdGhpcyBvcmdhbml6YXRpb24SqAEKB2dldFRyZWUSMS5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HZXRHaXRIdWJUcmVlSW5wdXQaKS5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HaXRIdWJUcmVlIj/CuBg7CDMQHiIDb3JnKjB1bmF1dGhvcml6ZWQgdG8gcmVhZCBHaXRIdWIgaW4gdGhpcyBvcmdhbml6YXRpb24SvQEKDmdldEZpbGVDb250ZW50EjguYWkuc3RpZ21lci5wbGF0Zm9ybS5naXRodWIudjEuR2V0R2l0SHViRmlsZUNvbnRlbnRJbnB1dBowLmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkdpdEh1YkZpbGVDb250ZW50Ij/CuBg7CDMQHiIDb3JnKjB1bmF1dGhvcml6ZWQgdG8gcmVhZCBHaXRIdWIgaW4gdGhpcyBvcmdhbml6YXRpb25iBnByb3RvMw",[file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_platform_github_v1_io]),GitHubQueryController=serviceDesc(file_ai_stigmer_platform_github_v1_query,0);var GITHUB_API="https://api.github.com",HTTP_TIMEOUT_MS=1e4,REPOSITORIES_PER_PAGE=100,FILE_CONTENT_CEILING_BYTES=10*1024*1024,GITHUB_RESPONSE_CEILING_BYTES=16*1024*1024,ERROR_BODY_CEILING_BYTES=64*1024,ResponseTooLargeError=class extends Error{ceilingBytes;constructor(ceilingBytes){super(`the answer is larger than ${ceilingBytes} bytes`),this.ceilingBytes=ceilingBytes,this.name="ResponseTooLargeError"}};async function readBoundedText(response,ceilingBytes){let declared=Number(response.headers.get("content-length")??Number.NaN);if(Number.isFinite(declared)&&declared>ceilingBytes)throw await releaseBody(response),new ResponseTooLargeError(ceilingBytes);if(response.body===null||response.body===void 0)return response.text();let reader=response.body.getReader(),chunks=[],read3=0;for(;;){let{done,value}=await reader.read();if(done)break;if(read3+=value.byteLength,read3>ceilingBytes)throw await reader.cancel().catch(()=>{}),new ResponseTooLargeError(ceilingBytes);chunks.push(value)}return Buffer.concat(chunks).toString("utf8")}var RECONNECT_GITHUB="GitHub refused the saved login: reconnect GitHub to refresh it";function newGitHubApi(token,fetchImpl){return{async getJson(path17,what){let response;try{response=await fetchImpl(`${GITHUB_API}${path17}`,{method:"GET",headers:{Accept:"application/vnd.github+json",Authorization:`Bearer ${token}`,"X-GitHub-Api-Version":"2022-11-28"},redirect:"manual",signal:AbortSignal.timeout(HTTP_TIMEOUT_MS)})}catch{throw unavailableError("failed to reach GitHub")}if(!response.ok)throw await refusalOf2(response,what);let body;try{body=JSON.parse(await readBoundedText(response,GITHUB_RESPONSE_CEILING_BYTES))}catch(error3){throw error3 instanceof ResponseTooLargeError?failedPreconditionError(`GitHub's answer for ${what} is larger than the ${error3.ceilingBytes/(1024*1024)} MiB the server reads`):unavailableError(`GitHub answered an unreadable body for ${what}`)}return{body,link:response.headers.get("link")??""}}}}async function refusalOf2(response,what){let status=response.status;if(status===403||status===429){let detail=await readBoundedText(response,ERROR_BODY_CEILING_BYTES).catch(()=>"");return new ConnectError(`GitHub refused the request for ${what} (HTTP ${status})${messageOf2(detail)}`,Code.ResourceExhausted)}return await releaseBody(response),status===401?failedPreconditionError(RECONNECT_GITHUB):status===404?notFoundError("GitHub",what):status>=300&&status<400?failedPreconditionError(`GitHub redirected the request for ${what} (HTTP ${status}); the server does not follow a redirect with your login. If the repository was renamed or moved, use its current name`):unavailableError(`GitHub answered HTTP ${status} for ${what}`)}async function releaseBody(response){await response.body?.cancel().catch(()=>{})}function messageOf2(body){try{let parsed=JSON.parse(body);return typeof parsed.message=="string"&&parsed.message!==""?`: ${parsed.message}`:""}catch{return""}}function hasNextPage(link){return/<[^>]*>;\s*rel="next"/.test(link)}function encodePath(path17){return path17.split("/").map(encodeURIComponent).join("/")}function decodeBase642(content){return new Uint8Array(Buffer.from(content.replace(/\s/g,""),"base64"))}function registerGitHubServices(router,deps){router.service(GitHubQueryController,{listRepositories:(req,ctx)=>listRepositories(deps,req,ctx),searchRepositories:(req,ctx)=>searchRepositories(deps,req,ctx),listBranches:(req,ctx)=>listBranches(deps,req,ctx),getTree:(req,ctx)=>getTree(deps,req,ctx),getFileContent:(req,ctx)=>getFileContent(deps,req,ctx)})}var CONNECT_GITHUB_FIRST="no GitHub login is saved in your My vault in this organization: connect GitHub first";async function githubFor(deps,method,req,ctx){let caller=callerIdentityOf(ctx);await authorizeDirect(method,deps.authorizer,caller,req),await refuseBoundElsewhere(deps.credentialBinding,caller,req.org);let vault=await deps.vaults.findMine(req.org,caller.identityId),token=vault===void 0?"":(await deps.vaults.entries(vault).connections.get(GITHUB_HOST)?.open())?.token??"";if(token==="")throw failedPreconditionError(CONNECT_GITHUB_FIRST);return newGitHubApi(token,deps.fetchImpl??fetch)}function isDotSegment(segment){return segment==="."||segment===".."}function refuseDotSegments(req){for(let[field3,value]of[["owner",req.owner],["repo",req.repo],["ref",req.ref??""]])if(isDotSegment(value))throw invalidArgumentError(`${field3} cannot be '${value}'`);if((req.path??"").split("/").some(isDotSegment))throw invalidArgumentError("path cannot hold a '.' or '..' segment")}function repositoryOf(json2){return create2(GitHubRepositorySchema,{id:BigInt(json2.id??0),fullName:json2.full_name??"",name:json2.name??"",owner:json2.owner?.login??"",ownerIsOrganization:json2.owner?.type==="Organization",htmlUrl:json2.html_url??"",cloneUrl:json2.clone_url??"",defaultBranch:json2.default_branch??"",isPrivate:json2.private===!0,updatedAt:json2.updated_at??""})}function pageOf(page){return page>0?page:1}async function listRepositories(deps,req,ctx){let api=await githubFor(deps,GitHubQueryController.method.listRepositories,req,ctx),page=pageOf(req.page),{body,link}=await api.getJson(`/user/repos?sort=pushed&direction=desc&per_page=${REPOSITORIES_PER_PAGE}&page=${page}`,"your repositories"),repositories=Array.isArray(body)?body.map(repositoryOf):[];return create2(GitHubRepositoryListSchema,{repositories,hasMore:link!==""?hasNextPage(link):repositories.length===REPOSITORIES_PER_PAGE})}async function searchRepositories(deps,req,ctx){let api=await githubFor(deps,GitHubQueryController.method.searchRepositories,req,ctx),page=pageOf(req.page),params=new URLSearchParams({q:req.query,sort:"stars",order:"desc",per_page:String(REPOSITORIES_PER_PAGE),page:String(page)}),{body}=await api.getJson(`/search/repositories?${params.toString()}`,"repository search"),repositories=(body.items??[]).map(repositoryOf);return create2(GitHubRepositoryListSchema,{repositories,hasMore:page*REPOSITORIES_PER_PAGE<(body.total_count??0)})}async function listBranches(deps,req,ctx){refuseDotSegments(req);let api=await githubFor(deps,GitHubQueryController.method.listBranches,req,ctx),repo=`${encodeURIComponent(req.owner)}/${encodeURIComponent(req.repo)}`,names2=[];for(let page=1;page<=MAX_BRANCH_PAGES;page+=1){let{body,link}=await api.getJson(`/repos/${repo}/branches?per_page=${REPOSITORIES_PER_PAGE}&page=${page}`,`${req.owner}/${req.repo}`),batch=Array.isArray(body)?body:[];if(names2.push(...batch.map(branch=>branch.name??"").filter(name=>name!=="")),!(link!==""?hasNextPage(link):batch.length===REPOSITORIES_PER_PAGE))break}return create2(GitHubBranchListSchema,{names:names2})}var MAX_BRANCH_PAGES=10;async function getTree(deps,req,ctx){refuseDotSegments(req);let api=await githubFor(deps,GitHubQueryController.method.getTree,req,ctx),repo=`${encodeURIComponent(req.owner)}/${encodeURIComponent(req.repo)}`,{body}=await api.getJson(`/repos/${repo}/git/trees/${encodeURIComponent(req.ref)}?recursive=1`,`${req.owner}/${req.repo} at ${req.ref}`),entries=(body.tree??[]).filter(node=>node.type==="blob"||node.type==="tree").map(node=>create2(GitHubTreeEntrySchema,{path:node.path??"",isDirectory:node.type==="tree",size:BigInt(node.size??0)}));return create2(GitHubTreeSchema,{entries,truncated:body.truncated===!0})}async function getFileContent(deps,req,ctx){refuseDotSegments(req);let api=await githubFor(deps,GitHubQueryController.method.getFileContent,req,ctx),repo=`${encodeURIComponent(req.owner)}/${encodeURIComponent(req.repo)}`,what=`${req.path} in ${req.owner}/${req.repo} at ${req.ref}`,{body:file}=await api.getJson(`/repos/${repo}/contents/${encodePath(req.path)}?ref=${encodeURIComponent(req.ref)}`,what);if(Array.isArray(file)||file.type!==void 0&&file.type!=="file")throw invalidArgumentError(`${req.path} is not a file`);let size=file.size??0;if(file.encoding==="base64")return create2(GitHubFileContentSchema,{content:decodeBase642(file.content??""),size:BigInt(size)});if(size>FILE_CONTENT_CEILING_BYTES)return create2(GitHubFileContentSchema,{size:BigInt(size),tooLarge:!0});let{body:blob}=await api.getJson(`/repos/${repo}/git/blobs/${encodeURIComponent(file.sha??"")}`,what);return create2(GitHubFileContentSchema,{content:decodeBase642(blob.content??""),size:BigInt(blob.size??size)})}var file_ai_stigmer_agentic_memory_v1_io=fileDesc("CiVhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2lvLnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxIiEKCE1lbW9yeUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEi4wEKE0xpc3RNZW1vcmllc1JlcXVlc3QSFAoDb3JnGAEgASgJQge6SARyAhABEhoKCXBhZ2Vfc2l6ZRgDIAEoBUIHukgEGgIoABIcCgpwYWdlX3Rva2VuGAQgASgJQgi6SAVyAxiACBJNCgZsYWJlbHMYBSADKAsyPS5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLkxpc3RNZW1vcmllc1JlcXVlc3QuTGFiZWxzRW50cnkaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASJcCgpNZW1vcnlMaXN0EjUKB2VudHJpZXMYAiADKAsyJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeRIXCg9uZXh0X3BhZ2VfdG9rZW4YAyABKAkizQIKEVVwZGF0ZU1lbW9yeUlucHV0Ej4KCHJlc291cmNlGAEgASgLMiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlCBrpIA9gBAxI3Cgt1cGRhdGVfbWFzaxgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCBrpIA8gBATq+AbpIugEatwEKF3VwZGF0ZV9uYW1lc19pdHNfdGFyZ2V0EkZyZXNvdXJjZS5tZXRhZGF0YS5pZCBpcyByZXF1aXJlZDogYW4gdXBkYXRlIG5hbWVzIHRoZSBtZW1vcnkgYnkgaXRzIGlkGlRoYXModGhpcy5yZXNvdXJjZSkgJiYgaGFzKHRoaXMucmVzb3VyY2UubWV0YWRhdGEpICYmIHRoaXMucmVzb3VyY2UubWV0YWRhdGEuaWQgIT0gJydiBnByb3RvMw",[file_ai_stigmer_agentic_memory_v1_api,file_buf_validate_validate,file_google_protobuf_field_mask2]),MemoryIdSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,0);var MemoryListSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,2);var file_ai_stigmer_agentic_memory_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEyuQUKF01lbW9yeUNvbW1hbmRDb250cm9sbGVyEloKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5GiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnkiBNC4GAESngEKBnVwZGF0ZRIvLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuVXBkYXRlTWVtb3J5SW5wdXQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSI9wrgYOQgCEDkiFHJlc291cmNlLm1ldGFkYXRhLmlkKh11bmF1dGhvcml6ZWQgdG8gdXBkYXRlIG1lbW9yeRKGAQoGZGVsZXRlEiYuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlJZBokLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5Ii7CuBgqCAMQOSIFdmFsdWUqHXVuYXV0aG9yaXplZCB0byBkZWxldGUgbWVtb3J5EogBCgdjb25maXJtEiYuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlJZBokLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5Ii/CuBgrCAIQOSIFdmFsdWUqHnVuYXV0aG9yaXplZCB0byBjb25maXJtIG1lbW9yeRKGAQoGcmVqZWN0EiYuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlJZBokLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5Ii7CuBgqCAIQOSIFdmFsdWUqHXVuYXV0aG9yaXplZCB0byByZWplY3QgbWVtb3J5GgSg/ys5YgZwcm90bzM",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryCommandController=serviceDesc(file_ai_stigmer_agentic_memory_v1_command,0);var file_ai_stigmer_agentic_memory_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxMosCChVNZW1vcnlRdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIrwrgYJwgBEDkiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IG1lbW9yeRJpCgRsaXN0EjEuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5MaXN0TWVtb3JpZXNSZXF1ZXN0GiguYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlMaXN0IgTQuBgBGgSg/ys5YgZwcm90bzM",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryQueryController=serviceDesc(file_ai_stigmer_agentic_memory_v1_query,0);var MEMORY_CAPTURE_CALLER_MESSAGE="memory can only be captured for a first-party human operator",MEMORY_CAPTURE_CREDENTIAL_KEY="memoryCaptureCredential";function newGuardMemoryCaptureStep(provider){return{name:"GuardMemoryCapture",async execute(ctx){let caller=ctx.callerIdentity;if(isServerComposedRequest(caller))return;let decide4=provider?.authorizeMemoryCapture;if(decide4!==void 0){let org=metadataOf(ctx.newState)?.org??"",decision=await decide4.call(provider,caller,org);switch(decision.verdict){case"admit":ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY,{subjectIdentityAccountId:decision.subjectIdentityAccountId,provedSessionId:decision.provedSessionId});return;case"refuse":throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied);case"no-opinion":break;default:{let exhaustive=decision;throw new Error(`unknown memory capture decision ${JSON.stringify(exhaustive)}`)}}}if(!isFirstPartyHumanOperator(caller))throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied)}}}function memoryCaptureCredentialOf(ctx){let payload=ctx.get(MEMORY_CAPTURE_CREDENTIAL_KEY);if(typeof payload=="object"&&payload!==null&&"subjectIdentityAccountId"in payload&&"provedSessionId"in payload)return payload}var MEMORY_FULL_MESSAGE="memory is full \u2014 review and delete existing memories";function memoryDisabledMessage(org){return`memory is not enabled for organization ${org} \u2014 an organization admin can enable it in organization preferences`}var MEMORY_ACCOUNT_DISABLED_MESSAGE="memory is not enabled for your account \u2014 enable it in account preferences",MEMORY_CONFIRM_REJECTED_MESSAGE="memory was rejected \u2014 delete it and let the agent propose it again",MEMORY_REJECT_CONFIRMED_MESSAGE="memory was confirmed \u2014 delete it to stop it from being recalled",MEMORY_SUBJECT_IMMUTABLE_MESSAGE="spec.subject_identity_account_id is immutable \u2014 it is derived from the capturing credential at create",MEMORY_PROVENANCE_IMMUTABLE_MESSAGE="spec.provenance is immutable \u2014 it records where the fact came from";var LIST_RESULT_KEY4="listResult";function newResolveMemoryDefaultsStep(personAccounts){return{name:"ResolveMemoryDefaults",async execute(ctx){let memory=ctx.newState,metadata=memory.metadata;if((metadata?.org??"")==="")throw invalidArgumentError("metadata.org is required for a memory");if(metadata===void 0)throw internalError(new Error("metadata is nil"),"metadata is nil");assignServerId(ctx,generateId("mem")),metadata.name===""&&metadata.slug===""&&(metadata.name=metadata.id);let spec=memory.spec;if(spec===void 0)throw internalError(new Error("memory spec is nil"),"memory spec is nil");let captureCredential=memoryCaptureCredentialOf(ctx);if(personAccounts===void 0)spec.subjectIdentityAccountId=captureCredential?.subjectIdentityAccountId??"";else{let account2=await resolveSubjectAccount(personAccounts,ctx,captureCredential?.subjectIdentityAccountId);spec.subjectIdentityAccountId=account2?.metadata?.id??"",account2!==void 0&&ctx.set(MEMORY_SUBJECT_ACCOUNT_KEY,account2)}spec.provenance!==void 0&&(spec.provenance.toolCallId=""),captureCredential!==void 0&&(spec.provenance===void 0&&(spec.provenance=create2(MemoryProvenanceSchema,{})),spec.provenance.sessionId=captureCredential.provedSessionId)}}}var MEMORY_SUBJECT_ACCOUNT_KEY="memorySubjectAccount";function memorySubjectAccountOf(ctx){let payload=ctx.get(MEMORY_SUBJECT_ACCOUNT_KEY);return isMessage2(payload,IdentityAccountSchema)?payload:void 0}async function resolveSubjectAccount(personAccounts,ctx,credentialSubject){let account2;try{account2=credentialSubject!==void 0?await accountForStamp(personAccounts,credentialSubject):await accountForCaller(personAccounts,ctx.callerIdentity)}catch(error3){throw internalError(error3,"failed to resolve the identity account a memory is about")}if(account2!==void 0&&(account2.metadata?.id??"")==="")throw internalError(new Error("identity account carries no id"),"failed to resolve the identity account a memory is about");return account2}var MEMORY_CREATE_DENIED_MESSAGE="unauthorized to capture memory in this organization";function resolveMemoryCreateTargets(ctx){return isServerComposedRequest(ctx.callerIdentity)?[]:[{permission:IamPermission.can_create_session,resourceKind:ApiResourceKind.organization,resourceId:ctx.newState.metadata?.org??"",deniedMessage:MEMORY_CREATE_DENIED_MESSAGE}]}function newCheckMemoryEnablementStep(store,personAccounts){return{name:"CheckMemoryEnablement",async execute(ctx){let orgID=ctx.newState.metadata?.org??"",org;try{org=await store.getResource(ApiResourceKind.organization,orgID,OrganizationSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Organization",orgID):internalError(error3,"failed to load organization for memory enablement check")}if(org.spec?.preferences?.memoryEnabled!==!0)throw failedPreconditionError(memoryDisabledMessage(orgID));if(personAccounts===void 0)return;if(memorySubjectAccountOf(ctx)?.spec?.preferences?.memoryEnabled!==!0)throw failedPreconditionError(MEMORY_ACCOUNT_DISABLED_MESSAGE)}}}function newCheckMemoryCapStep(store){return{name:"CheckMemoryCap",async execute(ctx){let newState=ctx.newState,org=newState.metadata?.org??"",subject=newState.spec?.subjectIdentityAccountId??"",count2;try{count2=(await listSubjectMemories(store,org,subject)).length}catch(error3){throw internalError(error3,"failed to count memories for cap check")}if(count2>=100)throw failedPreconditionError(MEMORY_FULL_MESSAGE)}}}function newInitializeMemoryLifecycleStep(){return{name:"InitializeMemoryLifecycle",execute(ctx){let memory=ctx.newState;memory.status===void 0&&(memory.status=create2(MemoryStatusSchema,{})),memory.status.lifecycleState=MemoryLifecycleState.lifecycle_state_proposed,memory.status.stateChangedAt=timestampNow()}}}function newValidateMemoryUpdateStep(){return{name:"ValidateMemoryUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing memory not found in context"),"existing memory not found in context");let newState=ctx.newState;if((newState.spec?.subjectIdentityAccountId??"")!==(existing.spec?.subjectIdentityAccountId??""))throw failedPreconditionError(MEMORY_SUBJECT_IMMUTABLE_MESSAGE);let newProvenance=newState.spec?.provenance,existingProvenance=existing.spec?.provenance;if(!(newProvenance===void 0||existingProvenance===void 0?newProvenance===existingProvenance:equals(MemoryProvenanceSchema,newProvenance,existingProvenance)))throw failedPreconditionError(MEMORY_PROVENANCE_IMMUTABLE_MESSAGE)}}}function newPersistMemoryUpdateStep(store){return{name:"PersistMemoryUpdate",async execute(ctx){await swapOntoLoadedRow(store,ctx,"failed to persist memory update")}}}function newTransitionMemoryLifecycleStep(store,target,blockedMessage){return{name:"TransitionMemoryLifecycle",async execute(ctx){let memoryId=ctx.get(EXISTING_RESOURCE_KEY).metadata?.id??"",transitionNoOp=new Error("memory already in target state"),blocked,live;try{live=await store.updateResource(ApiResourceKind.memory,memoryId,MemorySchema,row=>{live=row;let current=row.status?.lifecycleState??MemoryLifecycleState.lifecycle_state_unspecified;if(current===target)throw transitionNoOp;if(current!==MemoryLifecycleState.lifecycle_state_proposed&&current!==MemoryLifecycleState.lifecycle_state_unspecified)throw blocked=failedPreconditionError(blockedMessage),blocked;row.status===void 0&&(row.status=create2(MemoryStatusSchema,{})),row.status.lifecycleState=target,row.status.stateChangedAt=timestampNow(),setAuditFieldsForUpdate(MemorySchema,row,"status_audit",ctx.callerIdentity)})}catch(error3){if(error3!==transitionNoOp)throw blocked!==void 0&&error3===blocked?blocked:error3 instanceof ResourceNotFoundError?notFoundError("Memory",memoryId):internalError(error3,"failed to transition memory lifecycle")}if(live===void 0)throw internalError(new Error("transition closure did not observe the row"),"failed to transition memory lifecycle");ctx.set(EXISTING_RESOURCE_KEY,live)}}}function newListMemoriesByOrgStep(store,listReadScope){return{name:"ListMemoriesByOrg",async execute(ctx){let org=ctx.input.org,page=await readListPage({store,declaration:memoryListIndex,query:{org},request:ctx.input,fingerprint:listPageFingerprint({lane:"memory.list",org,labels:sortedLabels(ctx.input.labels)}),decode:decodeOrSkip(MemorySchema),keep:memory=>matchesAllLabels(memory.metadata?.labels??{},ctx.input.labels),scope:memories=>restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.memory,memories,""),failure:"failed to list memories"});ctx.set(LIST_RESULT_KEY4,create2(MemoryListSchema,{entries:page.entries,nextPageToken:page.nextPageToken}))}}}function registerMemoryServices(router,deps){router.service(MemoryCommandController,{create:(memory,ctx)=>createMemory(deps,memory,ctx),update:(input,ctx)=>update9(deps,input,ctx),delete:(id,ctx)=>deleteMemory(deps,id,ctx),confirm:(id,ctx)=>confirm(deps,id,ctx),reject:(id,ctx)=>reject(deps,id,ctx)}),router.service(MemoryQueryController,{get:(id,ctx)=>get12(deps,id,ctx),list:(req,ctx)=>list11(deps,req,ctx)})}function kindOf12(ctx){return ctx.values.get(apiResourceKindKey)}async function createMemory(deps,memory,ctx){let reqCtx=new RequestContext(MemorySchema,memory,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("memory-create",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider)).addStep(newValidateVisibilityStep()).addStep(newResolveMemoryDefaultsStep(deps.personAccounts)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveMemoryCreateTargets)).addStep(newCheckMemoryEnablementStep(deps.store,deps.personAccounts)).addStep(newCheckMemoryCapStep(deps.store)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newInitializeMemoryLifecycleStep()).addStep(newClaimNameStep(deps.store,ApiResourceKind.memory)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx).catch(releaseNameOnFailure(deps.store,deps.logger,reqCtx)),reqCtx.newState}async function update9(deps,input,ctx){return runGuardedWrite(async()=>{let reqCtx=updateContext(MemorySchema,input,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("memory-update",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.update,deps.authorizer,input)).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newValidateProtoStep({of:"state"})).addStep(newValidateMemoryUpdateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistMemoryUpdateStep(deps.store)).build().execute(reqCtx),reqCtx.newState})}async function confirm(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-confirm",MemoryCommandController.method.confirm,MemoryLifecycleState.lifecycle_state_confirmed,MEMORY_CONFIRM_REJECTED_MESSAGE)}async function reject(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-reject",MemoryCommandController.method.reject,MemoryLifecycleState.lifecycle_state_rejected,MEMORY_REJECT_CONFIRMED_MESSAGE)}async function runTransition(deps,memoryId,ctx,name,method,target,blockedMessage){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline(name,deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newTransitionMemoryLifecycleStep(deps.store,target,blockedMessage)).build().execute(reqCtx);let transitioned=reqCtx.get(EXISTING_RESOURCE_KEY);if(transitioned===void 0)throw internalError(new Error("transitioned memory not found in context"),"transitioned memory not found in context");return transitioned}async function deleteMemory(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("memory-delete",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newReleaseNamesStep(deps.store,deps.logger,ApiResourceKind.memory)).addStep(newCleanupGrantsStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted memory not found in context"),"deleted memory not found in context");return deleted}async function get12(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("memory-get",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,MemorySchema)).build().execute(reqCtx);let target=reqCtx.get(TARGET_RESOURCE_KEY);if(target===void 0)throw internalError(new Error("target memory not found in context"),"target memory not found in context");return target}async function list11(deps,req,ctx){let reqCtx=new RequestContext(MemoryQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("memory-list",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListMemoriesByOrgStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY4);if(result===void 0)throw internalError(new Error("memory list not found in context"),"memory list not found in context");return result}var file_ai_stigmer_agentic_scoringrule_v1_io=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvc2NvcmluZ3J1bGUvdjEvaW8ucHJvdG8SIWFpLnN0aWdtZXIuYWdlbnRpYy5zY29yaW5ncnVsZS52MSIrCg1TY29yaW5nUnVsZUlkEhoKBXZhbHVlGAEgASgJQgu6SAjIAQFyAxiAASI8ChxHZXRTY29yaW5nUnVsZUJ5QWdlbnRSZXF1ZXN0EhwKCGFnZW50X2lkGAEgASgJQgq6SAdyBRABGIABIuICChZVcGRhdGVTY29yaW5nUnVsZUlucHV0EkgKCHJlc291cmNlGAEgASgLMi4uYWkuc3RpZ21lci5hZ2VudGljLnNjb3JpbmdydWxlLnYxLlNjb3JpbmdSdWxlQga6SAPYAQMSNwoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQga6SAPIAQE6xAG6SMABGr0BChd1cGRhdGVfbmFtZXNfaXRzX3RhcmdldBJMcmVzb3VyY2UubWV0YWRhdGEuaWQgaXMgcmVxdWlyZWQ6IGFuIHVwZGF0ZSBuYW1lcyB0aGUgc2NvcmluZyBydWxlIGJ5IGl0cyBpZBpUaGFzKHRoaXMucmVzb3VyY2UpICYmIGhhcyh0aGlzLnJlc291cmNlLm1ldGFkYXRhKSAmJiB0aGlzLnJlc291cmNlLm1ldGFkYXRhLmlkICE9ICcnYgZwcm90bzM",[file_ai_stigmer_agentic_scoringrule_v1_api,file_buf_validate_validate,file_google_protobuf_field_mask2]),ScoringRuleIdSchema=messageDesc2(file_ai_stigmer_agentic_scoringrule_v1_io,0);var file_ai_stigmer_agentic_scoringrule_v1_command=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvc2NvcmluZ3J1bGUvdjEvY29tbWFuZC5wcm90bxIhYWkuc3RpZ21lci5hZ2VudGljLnNjb3JpbmdydWxlLnYxMvIDChxTY29yaW5nUnVsZUNvbW1hbmRDb250cm9sbGVyEm4KBmNyZWF0ZRIuLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yaW5ncnVsZS52MS5TY29yaW5nUnVsZRouLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yaW5ncnVsZS52MS5TY29yaW5nUnVsZSIE0LgYARK4AQoGdXBkYXRlEjkuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JpbmdydWxlLnYxLlVwZGF0ZVNjb3JpbmdSdWxlSW5wdXQaLi5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmluZ3J1bGUudjEuU2NvcmluZ1J1bGUiQ8K4GD8IAhA+IhRyZXNvdXJjZS5tZXRhZGF0YS5pZCojdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBzY29yaW5nIHJ1bGUSoAEKBmRlbGV0ZRIwLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yaW5ncnVsZS52MS5TY29yaW5nUnVsZUlkGi4uYWkuc3RpZ21lci5hZ2VudGljLnNjb3JpbmdydWxlLnYxLlNjb3JpbmdSdWxlIjTCuBgwCAMQPiIFdmFsdWUqI3VuYXV0aG9yaXplZCB0byBkZWxldGUgc2NvcmluZyBydWxlGgSg/ys+YgZwcm90bzM",[file_ai_stigmer_agentic_scoringrule_v1_api,file_ai_stigmer_agentic_scoringrule_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ScoringRuleCommandController=serviceDesc(file_ai_stigmer_agentic_scoringrule_v1_command,0);var file_ai_stigmer_agentic_scoringrule_v1_query=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvc2NvcmluZ3J1bGUvdjEvcXVlcnkucHJvdG8SIWFpLnN0aWdtZXIuYWdlbnRpYy5zY29yaW5ncnVsZS52MTKCAwoaU2NvcmluZ1J1bGVRdWVyeUNvbnRyb2xsZXISmgEKA2dldBIwLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yaW5ncnVsZS52MS5TY29yaW5nUnVsZUlkGi4uYWkuc3RpZ21lci5hZ2VudGljLnNjb3JpbmdydWxlLnYxLlNjb3JpbmdSdWxlIjHCuBgtCAEQPiIFdmFsdWUqIHVuYXV0aG9yaXplZCB0byBnZXQgc2NvcmluZyBydWxlEsABCgpnZXRCeUFnZW50Ej8uYWkuc3RpZ21lci5hZ2VudGljLnNjb3JpbmdydWxlLnYxLkdldFNjb3JpbmdSdWxlQnlBZ2VudFJlcXVlc3QaLi5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmluZ3J1bGUudjEuU2NvcmluZ1J1bGUiQcK4GD0IARAoIghhZ2VudF9pZCotdW5hdXRob3JpemVkIHRvIGdldCB0aGUgc2NvcmluZyBydWxlIG9mIGFnZW50GgSg/ys+YgZwcm90bzM",[file_ai_stigmer_agentic_scoringrule_v1_api,file_ai_stigmer_agentic_scoringrule_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ScoringRuleQueryController=serviceDesc(file_ai_stigmer_agentic_scoringrule_v1_query,0);var file_ai_stigmer_agentic_score_v1_io=fileDesc("CiRhaS9zdGlnbWVyL2FnZW50aWMvc2NvcmUvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MSIgCgdTY29yZUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEi6wEKFkxpc3RTY29yZXNCeVJ1blJlcXVlc3QSFwoGcnVuX2lkGAEgASgJQge6SARyAhABEhoKCXBhZ2Vfc2l6ZRgCIAEoBUIHukgEGgIoABIcCgpwYWdlX3Rva2VuGAMgASgJQgi6SAVyAxiACBJPCgZsYWJlbHMYBCADKAsyPy5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuTGlzdFNjb3Jlc0J5UnVuUmVxdWVzdC5MYWJlbHNFbnRyeRotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIvcBChpMaXN0U2NvcmVzQnlTZXNzaW9uUmVxdWVzdBIbCgpzZXNzaW9uX2lkGAEgASgJQge6SARyAhABEhoKCXBhZ2Vfc2l6ZRgCIAEoBUIHukgEGgIoABIcCgpwYWdlX3Rva2VuGAMgASgJQgi6SAVyAxiACBJTCgZsYWJlbHMYBCADKAsyQy5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuTGlzdFNjb3Jlc0J5U2Vzc2lvblJlcXVlc3QuTGFiZWxzRW50cnkaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASJZCglTY29yZUxpc3QSMwoHZW50cmllcxgCIAMoCzIiLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5TY29yZRIXCg9uZXh0X3BhZ2VfdG9rZW4YAyABKAkiaAocR2V0QWdlbnRRdWFsaXR5UmVwb3J0UmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESGQoIYWdlbnRfaWQYAiABKAlCB7pIBHICEAESFwoEZGF5cxgDIAEoBUIJukgGGgQYWigAIqoCChJBZ2VudFF1YWxpdHlSZXBvcnQSEQoJZnJvbV9kYXRlGAEgASgJEg8KB3RvX2RhdGUYAiABKAkSOgoFdG90YWwYAyABKAsyKy5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuUXVhbGl0eVN1bW1hcnkSNQoEZGF5cxgEIAMoCzInLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5RdWFsaXR5RGF5Ej0KCHZlcnNpb25zGAUgAygLMisuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLlF1YWxpdHlWZXJzaW9uEj4KCWFncmVlbWVudBgGIAMoCzIrLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5KdWRnZUFncmVlbWVudCKVAQoOSnVkZ2VBZ3JlZW1lbnQSGQoRZXZhbHVhdG9yX3ZlcnNpb24YASABKAkSDAoEcnVucxgCIAEoBRIfChd0aHVtYnNfZG93bl9ub25lX2ZhaWxlZBgDIAEoBRI5CgVydWxlcxgEIAMoCzIqLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5SdWxlQWdyZWVtZW50IokBCg1SdWxlQWdyZWVtZW50EgwKBG5hbWUYASABKAkSGgoSZmFpbGVkX3RodW1ic19kb3duGAIgASgFEhgKEGZhaWxlZF90aHVtYnNfdXAYAyABKAUSGgoScGFzc2VkX3RodW1ic19kb3duGAQgASgFEhgKEHBhc3NlZF90aHVtYnNfdXAYBSABKAUiWQoOUXVhbGl0eVN1bW1hcnkSDAoEcnVucxgBIAEoBRI5CgdtZXRyaWNzGAIgAygLMiguYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLk1ldHJpY1RhbGx5IrwBCgtNZXRyaWNUYWxseRIOCgZtZXRyaWMYASABKAkSGQoRZXZhbHVhdG9yX3ZlcnNpb24YAiABKAkSDgoGcGFzc2VkGAMgASgFEg4KBmZhaWxlZBgEIAEoBRISCgpub3RfZ3JhZGVkGAUgASgFEg8KB3BlbmRpbmcYBiABKAUSPQoIY3JpdGVyaWEYByADKAsyKy5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuQ3JpdGVyaW9uVGFsbHkiVgoOQ3JpdGVyaW9uVGFsbHkSDAoEbmFtZRgBIAEoCRIOCgZwYXNzZWQYAiABKAUSDgoGZmFpbGVkGAMgASgFEhYKDm5vdF9hcHBsaWNhYmxlGAQgASgFIlgKClF1YWxpdHlEYXkSDAoEZGF0ZRgBIAEoCRI8CgdzdW1tYXJ5GAIgASgLMisuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLlF1YWxpdHlTdW1tYXJ5IpEBCg5RdWFsaXR5VmVyc2lvbhIaChJhZ2VudF92ZXJzaW9uX2hhc2gYASABKAkSEgoKZmlyc3RfZGF0ZRgCIAEoCRIRCglsYXN0X2RhdGUYAyABKAkSPAoHc3VtbWFyeRgEIAEoCzIrLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5RdWFsaXR5U3VtbWFyeSKuAgofTGlzdEZsYWdnZWRTY29yZXNCeUFnZW50UmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESGQoIYWdlbnRfaWQYAiABKAlCB7pIBHICEAESFwoEZGF5cxgDIAEoBUIJukgGGgQYWigAEhoKCXBhZ2Vfc2l6ZRgEIAEoBUIHukgEGgIoABIcCgpwYWdlX3Rva2VuGAUgASgJQgi6SAVyAxiACBJYCgZsYWJlbHMYBiADKAsySC5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuTGlzdEZsYWdnZWRTY29yZXNCeUFnZW50UmVxdWVzdC5MYWJlbHNFbnRyeRotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIskCChBVcGRhdGVTY29yZUlucHV0EjwKCHJlc291cmNlGAEgASgLMiIuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLlNjb3JlQga6SAPYAQMSNwoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQga6SAPIAQE6vQG6SLkBGrYBChd1cGRhdGVfbmFtZXNfaXRzX3RhcmdldBJFcmVzb3VyY2UubWV0YWRhdGEuaWQgaXMgcmVxdWlyZWQ6IGFuIHVwZGF0ZSBuYW1lcyB0aGUgc2NvcmUgYnkgaXRzIGlkGlRoYXModGhpcy5yZXNvdXJjZSkgJiYgaGFzKHRoaXMucmVzb3VyY2UubWV0YWRhdGEpICYmIHRoaXMucmVzb3VyY2UubWV0YWRhdGEuaWQgIT0gJydiBnByb3RvMw",[file_ai_stigmer_agentic_score_v1_api,file_buf_validate_validate,file_google_protobuf_field_mask2]),ScoreIdSchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,0);var ScoreListSchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,3);var AgentQualityReportSchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,5),JudgeAgreementSchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,6),RuleAgreementSchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,7),QualitySummarySchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,8),MetricTallySchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,9),CriterionTallySchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,10),QualityDaySchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,11),QualityVersionSchema=messageDesc2(file_ai_stigmer_agentic_score_v1_io,12);var file_ai_stigmer_agentic_score_v1_command=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvc2NvcmUvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxMpYDChZTY29yZUNvbW1hbmRDb250cm9sbGVyElYKBmNyZWF0ZRIiLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5TY29yZRoiLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5TY29yZSIE0LgYARKZAQoGdXBkYXRlEi0uYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLlVwZGF0ZVNjb3JlSW5wdXQaIi5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuU2NvcmUiPMK4GDgIAhA9IhRyZXNvdXJjZS5tZXRhZGF0YS5pZCocdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBzY29yZRKBAQoGZGVsZXRlEiQuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLlNjb3JlSWQaIi5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuU2NvcmUiLcK4GCkIAxA9IgV2YWx1ZSocdW5hdXRob3JpemVkIHRvIGRlbGV0ZSBzY29yZRoEoP8rPWIGcHJvdG8z",[file_ai_stigmer_agentic_score_v1_api,file_ai_stigmer_agentic_score_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ScoreCommandController=serviceDesc(file_ai_stigmer_agentic_score_v1_command,0);var file_ai_stigmer_agentic_score_v1_query=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvc2NvcmUvdjEvcXVlcnkucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MTLlBgoUU2NvcmVRdWVyeUNvbnRyb2xsZXISewoDZ2V0EiQuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLlNjb3JlSWQaIi5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuU2NvcmUiKsK4GCYIARA9IgV2YWx1ZSoZdW5hdXRob3JpemVkIHRvIGdldCBzY29yZRKeAQoJbGlzdEJ5UnVuEjMuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLkxpc3RTY29yZXNCeVJ1blJlcXVlc3QaJi5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuU2NvcmVMaXN0IjTCuBgwCAEQKSIGcnVuX2lkKiJ1bmF1dGhvcml6ZWQgdG8gbGlzdCBzY29yZXMgb2YgcnVuEq4BCg1saXN0QnlTZXNzaW9uEjcuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLkxpc3RTY29yZXNCeVNlc3Npb25SZXF1ZXN0GiYuYWkuc3RpZ21lci5hZ2VudGljLnNjb3JlLnYxLlNjb3JlTGlzdCI8wrgYOAgBECoiCnNlc3Npb25faWQqJnVuYXV0aG9yaXplZCB0byBsaXN0IHNjb3JlcyBvZiBzZXNzaW9uEr0BChVnZXRBZ2VudFF1YWxpdHlSZXBvcnQSOS5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuR2V0QWdlbnRRdWFsaXR5UmVwb3J0UmVxdWVzdBovLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5BZ2VudFF1YWxpdHlSZXBvcnQiOMK4GDQIARAeIgNvcmcqKXVuYXV0aG9yaXplZCB0byB2aWV3IGFnZW50IHF1YWxpdHkgcmVwb3J0ErcBChJsaXN0RmxhZ2dlZEJ5QWdlbnQSPC5haS5zdGlnbWVyLmFnZW50aWMuc2NvcmUudjEuTGlzdEZsYWdnZWRTY29yZXNCeUFnZW50UmVxdWVzdBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zY29yZS52MS5TY29yZUxpc3QiO8K4GDcIARAeIgNvcmcqLHVuYXV0aG9yaXplZCB0byBsaXN0IGZsYWdnZWQgc2NvcmVzIG9mIGFnZW50GgSg/ys9YgZwcm90bzM",[file_ai_stigmer_agentic_score_v1_api,file_ai_stigmer_agentic_score_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ScoreQueryController=serviceDesc(file_ai_stigmer_agentic_score_v1_query,0);var QUALITY_DEFAULT_DAYS=30,QUALITY_REPORT_BATCH=1e4,QUALITY_REPORT_MAX_SCORES=5e4,DAY_MILLIS=864e5,QUALITY_AGENT_DENIED_MESSAGE="unauthorized to view agent quality report";function qualityReportTooLargeMessage(days){let shorter=Math.max(1,Math.floor(days/3));return`this agent has more than ${QUALITY_REPORT_MAX_SCORES.toLocaleString("en-US")} grades in the last ${days} days; ask for a shorter window, for example ${shorter} days`}function qualityWindowOf(days,now){let count2=days===0?QUALITY_DEFAULT_DAYS:days,today=Date.UTC(now.getUTCFullYear(),now.getUTCMonth(),now.getUTCDate()),first=today-(count2-1)*DAY_MILLIS;return{days:count2,fromDate:new Date(first).toISOString().slice(0,10),toDate:new Date(today).toISOString().slice(0,10),since:listIndexInstantOfMillis(first)}}function createdInstantOf(score){let created=score.status?.audit?.specAudit?.createdAt;if(created===void 0)return;let millis=Number(created.seconds)*1e3+Math.floor(created.nanos/1e6);return new Date(millis).toISOString()}var OUTCOME_OF_STATE={[ScoreState.unspecified]:()=>{},[ScoreState.graded]:passed2=>passed2?"passed":"failed",[ScoreState.not_graded]:()=>"notGraded",[ScoreState.pending]:()=>"pending"},FIELD_OF_CRITERION_RESULT={[CriterionResult.unspecified]:void 0,[CriterionResult.passed]:"passed",[CriterionResult.failed]:"failed",[CriterionResult.not_applicable]:"notApplicable"},SummaryCounts=class{runs=new Set;metrics=new Map;add(score,instant){let spec=score.spec;if(spec===void 0)return;this.runs.add(spec.runId);let key=`${spec.metric}\0${spec.evaluatorVersion}`,counts=this.metrics.get(key);counts===void 0&&(counts={metric:spec.metric,evaluatorVersion:spec.evaluatorVersion,passed:0,failed:0,notGraded:0,pending:0,lastSeen:instant,criteria:new Map},this.metrics.set(key,counts)),instant>counts.lastSeen&&(counts.lastSeen=instant);let outcome2=OUTCOME_OF_STATE[score.status?.state??ScoreState.unspecified](spec.value.case==="passed"&&spec.value.value);outcome2!==void 0&&(counts[outcome2]+=1);for(let criterion of spec.criteria){let tally=counts.criteria.get(criterion.name);tally===void 0&&(tally={passed:0,failed:0,notApplicable:0},counts.criteria.set(criterion.name,tally));let field3=FIELD_OF_CRITERION_RESULT[criterion.result];field3!==void 0&&(tally[field3]+=1)}}build(){let metrics2=[...this.metrics.values()].sort((a5,b7)=>a5.metric!==b7.metric?a5.metric<b7.metric?-1:1:a5.lastSeen!==b7.lastSeen?a5.lastSeen>b7.lastSeen?-1:1:a5.evaluatorVersion<b7.evaluatorVersion?-1:1);return create2(QualitySummarySchema,{runs:this.runs.size,metrics:metrics2.map(m3=>create2(MetricTallySchema,{metric:m3.metric,evaluatorVersion:m3.evaluatorVersion,passed:m3.passed,failed:m3.failed,notGraded:m3.notGraded,pending:m3.pending,criteria:[...m3.criteria.entries()].sort(([a5],[b7])=>a5<b7?-1:a5>b7?1:0).map(([name,c5])=>create2(CriterionTallySchema,{name,passed:c5.passed,failed:c5.failed,notApplicable:c5.notApplicable}))}))})}},AgreementCounts=class{judged=new Map;thumbs=new Map;add(score,instant){let spec=score.spec;if(!(spec===void 0||score.status?.state!==ScoreState.graded||spec.value.case!=="passed")){if(spec.metric===FEEDBACK_METRIC&&spec.source===ScoreSource.human){let runThumbs=this.thumbs.get(spec.runId)??[];runThumbs.push(spec.value.value),this.thumbs.set(spec.runId,runThumbs);return}if(spec.metric===JUDGE_METRIC&&spec.source===ScoreSource.judge){let grades=this.judged.get(spec.runId)??[];grades.push({version:spec.evaluatorVersion,instant,failed:spec.criteria.filter(c5=>c5.result===CriterionResult.failed).map(c5=>c5.name),passed:spec.criteria.filter(c5=>c5.result===CriterionResult.passed).map(c5=>c5.name)}),this.judged.set(spec.runId,grades)}}}build(){let versions2=new Map;for(let[runId,grades]of this.judged){let runThumbs=this.thumbs.get(runId);if(runThumbs!==void 0)for(let grade of grades){let version=versions2.get(grade.version);version===void 0&&(version={runs:0,thumbsDownNoneFailed:0,lastSeen:grade.instant,rules:new Map},versions2.set(grade.version,version)),grade.instant>version.lastSeen&&(version.lastSeen=grade.instant),version.runs+=1,grade.failed.length===0&&runThumbs.some(up=>!up)&&(version.thumbsDownNoneFailed+=1);for(let up of runThumbs){for(let name of grade.failed)ruleOf2(version,name)[up?"failedThumbsUp":"failedThumbsDown"]+=1;for(let name of grade.passed)ruleOf2(version,name)[up?"passedThumbsUp":"passedThumbsDown"]+=1}}}return[...versions2.entries()].sort(([a5,x3],[b7,y])=>x3.lastSeen!==y.lastSeen?x3.lastSeen>y.lastSeen?-1:1:a5<b7?-1:1).map(([evaluatorVersion,v])=>create2(JudgeAgreementSchema,{evaluatorVersion,runs:v.runs,thumbsDownNoneFailed:v.thumbsDownNoneFailed,rules:[...v.rules.entries()].sort(([a5],[b7])=>a5<b7?-1:a5>b7?1:0).map(([name,r5])=>create2(RuleAgreementSchema,{name,...r5}))}))}};function ruleOf2(version,name){let rule=version.rules.get(name);return rule===void 0&&(rule={failedThumbsDown:0,failedThumbsUp:0,passedThumbsDown:0,passedThumbsUp:0},version.rules.set(name,rule)),rule}var QualityTally=class{window;total=new SummaryCounts;agreement=new AgreementCounts;days=new Map;versions=new Map;constructor(window2){this.window=window2}add(score){if(score.spec?.source===ScoreSource.eval)return;let instant=createdInstantOf(score);if(instant===void 0)return;let date2=instant.slice(0,10);if(date2<this.window.fromDate)return;this.total.add(score,instant),this.agreement.add(score,instant);let day=this.days.get(date2);day===void 0&&(day=new SummaryCounts,this.days.set(date2,day)),day.add(score,instant);let hash=score.status?.agentVersionHash??"",version=this.versions.get(hash);version===void 0&&(version={summary:new SummaryCounts,firstSeen:instant,lastSeen:instant},this.versions.set(hash,version)),instant<version.firstSeen&&(version.firstSeen=instant),instant>version.lastSeen&&(version.lastSeen=instant),version.summary.add(score,instant)}build(){return create2(AgentQualityReportSchema,{fromDate:this.window.fromDate,toDate:this.window.toDate,total:this.total.build(),days:[...this.days.entries()].sort(([a5],[b7])=>a5<b7?-1:a5>b7?1:0).map(([date2,summary])=>create2(QualityDaySchema,{date:date2,summary:summary.build()})),versions:[...this.versions.entries()].sort(([,a5],[,b7])=>a5.lastSeen>b7.lastSeen?-1:a5.lastSeen<b7.lastSeen?1:0).map(([hash,v])=>create2(QualityVersionSchema,{agentVersionHash:hash,firstDate:v.firstSeen.slice(0,10),lastDate:v.lastSeen.slice(0,10),summary:v.summary.build()})),agreement:this.agreement.build()})}},QUALITY_REPORT_KEY="agentQualityReport",FLAGGED_SCORES_KEY="flaggedScores";function resolveQualityAgentTarget(ctx){return[{permission:IamPermission.can_view,resourceKind:ApiResourceKind.agent,resourceId:ctx.input.agentId,deniedMessage:QUALITY_AGENT_DENIED_MESSAGE}]}function agentScoresQuery(org,agentId,window2){return{org,anyKey:[{name:"agent",value:agentId}],withoutKeys:["eval_run"],createdAtOrAfter:window2.since}}function decodeScore(data,logger2){try{return fromBinary2(ScoreSchema,data)}catch(error3){logger2.warn("Failed to unmarshal score, skipping",{error:error3 instanceof Error?error3.message:String(error3)});return}}function newTallyAgentQualityStep(deps){return{name:"TallyAgentQuality",async execute(ctx){let window2=qualityWindowOf(ctx.input.days,deps.now()),query=agentScoresQuery(ctx.input.org,ctx.input.agentId,window2),tally=new QualityTally(window2),after,read3=0;for(;;){let rows;try{rows=await deps.store.queryResources(scoreListIndex,{...query,...after===void 0?{}:{after},limit:QUALITY_REPORT_BATCH})}catch(error3){throw internalError(error3,"failed to read the agent's scores")}if(read3+=rows.length,read3>QUALITY_REPORT_MAX_SCORES)throw failedPreconditionError(qualityReportTooLargeMessage(window2.days));for(let row of rows){let score=decodeScore(row.data,deps.logger);score!==void 0&&tally.add(score)}let last=rows[rows.length-1];if(rows.length<QUALITY_REPORT_BATCH||last===void 0)break;after=last.cursor}ctx.set(QUALITY_REPORT_KEY,tally.build())}}}function isFlagged(score){let spec=score.spec;return spec!==void 0&&spec.source!==ScoreSource.eval&&score.status?.state===ScoreState.graded&&spec.value.case==="passed"&&!spec.value.value&&createdInstantOf(score)!==void 0}function newListFlaggedScoresStep(deps){return{name:"ListFlaggedScores",async execute(ctx){let input=ctx.input,window2=qualityWindowOf(input.days,deps.now()),bySession=sessionReadScope(deps.store,deps.logger,deps.listReadScope,ctx.callerIdentity),page=await readListPage({store:deps.store,declaration:scoreListIndex,query:agentScoresQuery(input.org,input.agentId,window2),request:input,fingerprint:listPageFingerprint({lane:"score.listFlaggedByAgent",org:input.org,agentId:input.agentId,days:window2.days,labels:sortedLabels(input.labels)}),decode:data=>decodeScore(data,deps.logger),keep:score=>isFlagged(score)&&matchesAllLabels(score.metadata?.labels??{},input.labels),scope:bySession,failure:"failed to list the agent's flagged scores"});ctx.set(FLAGGED_SCORES_KEY,create2(ScoreListSchema,{entries:page.entries,nextPageToken:page.nextPageToken}))}}}function sessionReadScope(store,logger2,scope,caller){let decided=new Map;return async scores=>{if(scope===void 0||caller.callerClass==="internal")return scores;let unread=[...new Set(scores.map(score=>score.spec?.sessionId??"").filter(id=>!decided.has(id)))];if(unread.length>0){let sessions=[];await Promise.all(unread.map(async id=>{let session=await readSession(store,logger2,id);session===void 0?decided.set(id,!1):sessions.push(session)}));let kept=new Set((await restrictListByReadScope(scope,caller,ApiResourceKind.session,sessions,"")).map(session=>session.metadata?.id??""));for(let session of sessions){let id=session.metadata?.id??"";decided.set(id,kept.has(id))}}return scores.filter(score=>decided.get(score.spec?.sessionId??"")===!0)}}async function readSession(store,logger2,id){if(id!=="")try{return await store.getResource(ApiResourceKind.session,id,SessionSchema)}catch(error3){if(error3 instanceof ResourceNotFoundError){logger2.debug("Flagged score's session is gone, dropping",{sessionId:id});return}throw internalError(error3,"failed to read a flagged score's session")}}var LIST_RESULT_KEY5="listResult",SCORED_RUN_KEY="scoredRun",NOT_GRADED_REASON_KEY="notGradedReason",PENDING_REQUESTED_KEY="pendingRequested",SCORE_EXISTS_REASON="SCORE_EXISTS";function newGuardScoreSourceStep(){return{name:"GuardScoreSource",execute(ctx){let source=ctx.newState.spec?.source??ScoreSource.unspecified;if(source===ScoreSource.unspecified)throw invalidArgumentError("spec.source is required");let rule=SOURCE_RULES[source];if(!rule.admits(ctx.callerIdentity))throw permissionDeniedError(rule.refusal)}}}var SOURCE_RULES={[ScoreSource.human]:{admits:isFirstPartyHumanOperator,refusal:HUMAN_SOURCE_REFUSED_MESSAGE},[ScoreSource.check]:{admits:caller=>caller.callerClass==="internal",refusal:CHECK_SOURCE_REFUSED_MESSAGE},[ScoreSource.judge]:{admits:caller=>caller.callerClass==="internal",refusal:JUDGE_SOURCE_REFUSED_MESSAGE},[ScoreSource.eval]:{admits:caller=>caller.callerClass==="internal",refusal:EVAL_SOURCE_REFUSED_MESSAGE}},SOURCE_METRICS={[ScoreSource.human]:FEEDBACK_METRIC,[ScoreSource.check]:RUN_HEALTH_METRIC,[ScoreSource.judge]:JUDGE_METRIC,[ScoreSource.eval]:EVAL_METRIC};function resolveScoreCreateTargets(ctx){return isServerComposedRequest(ctx.callerIdentity)?[]:[{permission:IamPermission.can_view,resourceKind:ApiResourceKind.run,resourceId:ctx.newState.spec?.runId??"",deniedMessage:SCORE_CREATE_DENIED_MESSAGE}]}function newLoadScoredRunStep(store){return{name:"LoadScoredRun",async execute(ctx){let runId=ctx.newState.spec?.runId??"",run;try{run=await store.getResource(ApiResourceKind.run,runId,RunSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Run",runId):internalError(error3,"failed to load the run to score")}ctx.set(SCORED_RUN_KEY,run)}}}function scoredRunOf(ctx){let run=ctx.get(SCORED_RUN_KEY);if(run===void 0)throw internalError(new Error("scored run not found in context"),"scored run not found in context");return run}function newResolveScoreDefaultsStep(){return{name:"ResolveScoreDefaults",execute(ctx){let score=ctx.newState,metadata=score.metadata,spec=score.spec;if(metadata===void 0||metadata.org==="")throw invalidArgumentError("metadata.org is required for a score");if(spec===void 0)throw internalError(new Error("score spec is nil"),"score spec is nil");let run=scoredRunOf(ctx),runOrg=run.metadata?.org??"";if(metadata.org!==runOrg)throw failedPreconditionError(scoreOrgMismatchMessage(runOrg));let phase=run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED;if(!(spec.source===ScoreSource.eval?isTerminalExecutionPhase(phase):phase===RunPhase.RUN_COMPLETED))throw failedPreconditionError(runNotCompletedMessage(spec.runId));let human=spec.source===ScoreSource.human;if(spec.source===ScoreSource.unspecified||spec.metric!==SOURCE_METRICS[spec.source])throw invalidArgumentError(SCORE_METRIC_SOURCE_MISMATCH_MESSAGE);if(!human&&spec.comment!=="")throw invalidArgumentError(SCORE_COMMENT_HUMAN_ONLY_MESSAGE);if(spec.source!==ScoreSource.judge&&spec.judgeModel!=="")throw invalidArgumentError(SCORE_JUDGE_MODEL_JUDGE_ONLY_MESSAGE);if(human&&spec.value.case===void 0)throw invalidArgumentError(FEEDBACK_VALUE_REQUIRED_MESSAGE);if(human&&spec.criteria.length>0)throw invalidArgumentError(SCORE_CRITERIA_NOT_HUMAN_MESSAGE);if(human&&spec.evaluatorVersion!=="")throw invalidArgumentError(SCORE_EVALUATOR_VERSION_NOT_HUMAN_MESSAGE);spec.sessionId=sessionIdOf(run.spec),assignServerId(ctx,generateId("scr")),metadata.name===""&&metadata.slug===""&&(metadata.name=metadata.id),!human&&spec.value.case===void 0&&(ctx.set(NOT_GRADED_REASON_KEY,score.status?.notGradedReason??""),ctx.set(PENDING_REQUESTED_KEY,score.status?.state===ScoreState.pending))}}}function newCheckScoreUniqueStep(store,logger2){return{name:"CheckScoreUnique",async execute(ctx){let spec=ctx.newState.spec;if(spec===void 0)throw internalError(new Error("score spec is nil"),"score spec is nil");let existing;try{existing=await listRunScores(store,logger2,spec.runId)}catch(error3){throw internalError(error3,"failed to read the run's scores")}let caller=auditActorFor(ctx.callerIdentity).id;for(let score of existing){let other=score.spec;if(other===void 0||other.metric!==spec.metric)continue;let id=score.metadata?.id??"";if(spec.source===ScoreSource.human&&other.source===ScoreSource.human&&creatorOf2(score)===caller)throw alreadyExistsWithReasonError(feedbackExistsMessage(id),{reason:SCORE_EXISTS_REASON,metadata:{score_id:id}});if(spec.source===ScoreSource.check&&other.source===ScoreSource.check&&other.evaluatorVersion===spec.evaluatorVersion)throw alreadyExistsWithReasonError(runHealthExistsMessage(id),{reason:SCORE_EXISTS_REASON,metadata:{score_id:id}});if(spec.source===ScoreSource.judge&&other.source===ScoreSource.judge&&other.evaluatorVersion===spec.evaluatorVersion)throw alreadyExistsWithReasonError(judgeExistsMessage(id),{reason:SCORE_EXISTS_REASON,metadata:{score_id:id}});if(spec.source===ScoreSource.eval&&other.source===ScoreSource.eval&&other.evaluatorVersion===spec.evaluatorVersion)throw alreadyExistsWithReasonError(evalExistsMessage(id),{reason:SCORE_EXISTS_REASON,metadata:{score_id:id}})}}}}function creatorOf2(score){return score.status?.audit?.specAudit?.createdBy?.id??""}function newStampScoredRunStep(){return{name:"StampScoredRun",execute(ctx){let run=scoredRunOf(ctx),score=ctx.newState,status=score.status??create2(ScoreStatusSchema,{});status.agentId=run.status?.agentId??"",status.agentVersionHash=run.status?.agentVersionHash??"",score.status=status;let evalLabel=run.metadata?.labels[EVAL_RUN_LABEL];evalLabel!==void 0&&score.metadata!==void 0&&(score.metadata.labels[EVAL_RUN_LABEL]=evalLabel)}}}function newInitializeScoreStateStep(){return{name:"InitializeScoreState",execute(ctx){let score=ctx.newState;if(score.status===void 0&&(score.status=create2(ScoreStatusSchema,{})),score.spec?.value.case!==void 0){score.status.state=ScoreState.graded,score.status.notGradedReason="";return}if(ctx.get(PENDING_REQUESTED_KEY)===!0){score.status.state=ScoreState.pending,score.status.notGradedReason="";return}score.status.state=ScoreState.not_graded,score.status.notGradedReason=ctx.get(NOT_GRADED_REASON_KEY)??""}}}function newValidateScoreUpdateStep(){return{name:"ValidateScoreUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing score not found in context"),"existing score not found in context");let before=existing.spec,after=ctx.newState.spec;if(before===void 0||before.source!==ScoreSource.human)throw failedPreconditionError(SCORE_UPDATE_HUMAN_ONLY_MESSAGE);if(after===void 0||after.runId!==before.runId||after.sessionId!==before.sessionId||after.metric!==before.metric||after.source!==before.source||after.evaluatorVersion!==before.evaluatorVersion||after.criteria.length!==0||ctx.newState.metadata?.name!==existing.metadata?.name||!sameLabels2(ctx.newState.metadata?.labels,existing.metadata?.labels))throw failedPreconditionError(SCORE_UPDATE_FIELDS_MESSAGE);if(after.value.case===void 0)throw invalidArgumentError(FEEDBACK_VALUE_REQUIRED_MESSAGE)}}}function sameLabels2(a5,b7){let left=Object.entries(a5??{});return left.length===Object.keys(b7??{}).length&&left.every(([key,value])=>(b7??{})[key]===value)}function newListScoresByRunStep(store,logger2){return{name:"ListScoresByRun",async execute(ctx){let runId=ctx.input.runId;ctx.set(LIST_RESULT_KEY5,await readParentScorePage(store,logger2,ctx.input,{key:"run",value:runId,keep:score=>score.spec?.runId===runId,lane:"score.listByRun",failure:"failed to list the run's scores"}))}}}function newListScoresBySessionStep(store,logger2){return{name:"ListScoresBySession",async execute(ctx){let sessionId=ctx.input.sessionId;ctx.set(LIST_RESULT_KEY5,await readParentScorePage(store,logger2,ctx.input,{key:"session",value:sessionId,keep:score=>score.spec?.sessionId===sessionId,lane:"score.listBySession",failure:"failed to list the session's scores"}))}}}async function readParentScorePage(store,logger2,request3,parent){let page=await readListPage({store,declaration:scoreListIndex,query:{anyKey:[{name:parent.key,value:parent.value}]},request:request3,fingerprint:listPageFingerprint({lane:parent.lane,[parent.key]:parent.value,labels:sortedLabels(request3.labels)}),decode:decodeOrSkip(ScoreSchema,{logger:logger2,message:"Failed to unmarshal score, skipping",fields:{[parent.key]:parent.value}}),keep:score=>parent.keep(score)&&matchesAllLabels(score.metadata?.labels??{},request3.labels),scope:scores=>Promise.resolve(scores),failure:parent.failure});return create2(ScoreListSchema,{entries:page.entries,nextPageToken:page.nextPageToken})}function registerScoreServices(router,deps){router.service(ScoreCommandController,{create:(score,ctx)=>createScore(deps,score,ctx),update:(input,ctx)=>updateScore(deps,input,ctx),delete:(id,ctx)=>deleteScore2(deps,id,ctx)}),router.service(ScoreQueryController,{get:(id,ctx)=>getScore(deps,id,ctx),listByRun:(req,ctx)=>listByRun(deps,req,ctx),listBySession:(req,ctx)=>listBySession2(deps,req,ctx),getAgentQualityReport:(req,ctx)=>getAgentQualityReport(deps,req,ctx),listFlaggedByAgent:(req,ctx)=>listFlaggedByAgent(deps,req,ctx)})}function kindOf13(ctx){return ctx.values.get(apiResourceKindKey)}async function createScore(deps,score,ctx){let reqCtx=new RequestContext(ScoreSchema,score,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-create",deps.logger).addStep(newAuthorizeStep(ScoreCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newGuardScoreSourceStep()).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveScoreCreateTargets)).addStep(newLoadScoredRunStep(deps.store)).addStep(newResolveScoreDefaultsStep()).addStep(newCheckScoreUniqueStep(deps.store,deps.logger)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newStampScoredRunStep()).addStep(newInitializeScoreStateStep()).addStep(newClaimNameStep(deps.store,ApiResourceKind.score)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx).catch(releaseNameOnFailure(deps.store,deps.logger,reqCtx)),reqCtx.newState}async function updateScore(deps,input,ctx){return runGuardedWrite(async()=>{let reqCtx=updateContext(ScoreSchema,input,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-update",deps.logger).addStep(newAuthorizeStep(ScoreCommandController.method.update,deps.authorizer,input)).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newValidateProtoStep({of:"state"})).addStep(newValidateScoreUpdateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store,deps.credentialBinding)).build().execute(reqCtx),reqCtx.newState})}async function deleteScore2(deps,id,ctx){let reqCtx=new RequestContext(ScoreIdSchema,id,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-delete",deps.logger).addStep(newAuthorizeStep(ScoreCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,ScoreSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newReleaseNamesStep(deps.store,deps.logger,ApiResourceKind.score)).addStep(newCleanupGrantsStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(EXISTING_RESOURCE_KEY),"deleted score")}async function getScore(deps,id,ctx){let reqCtx=new RequestContext(ScoreIdSchema,id,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-get",deps.logger).addStep(newAuthorizeStep(ScoreQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,ScoreSchema)).build().execute(reqCtx),chainResult2(reqCtx.get(TARGET_RESOURCE_KEY),"target score")}async function listByRun(deps,req,ctx){let input=ScoreQueryController.method.listByRun.input,reqCtx=new RequestContext(input,req,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-list-by-run",deps.logger).addStep(newAuthorizeStep(ScoreQueryController.method.listByRun,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListScoresByRunStep(deps.store,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(LIST_RESULT_KEY5),"score list")}async function listBySession2(deps,req,ctx){let input=ScoreQueryController.method.listBySession.input,reqCtx=new RequestContext(input,req,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-list-by-session",deps.logger).addStep(newAuthorizeStep(ScoreQueryController.method.listBySession,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListScoresBySessionStep(deps.store,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(LIST_RESULT_KEY5),"score list")}async function getAgentQualityReport(deps,req,ctx){let input=ScoreQueryController.method.getAgentQualityReport.input,reqCtx=new RequestContext(input,req,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-agent-quality-report",deps.logger).addStep(newAuthorizeStep(ScoreQueryController.method.getAgentQualityReport,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveQualityAgentTarget)).addStep(newTallyAgentQualityStep(qualityDepsOf(deps))).build().execute(reqCtx),chainResult2(reqCtx.get(QUALITY_REPORT_KEY),"agent quality report")}async function listFlaggedByAgent(deps,req,ctx){let input=ScoreQueryController.method.listFlaggedByAgent.input,reqCtx=new RequestContext(input,req,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("score-list-flagged-by-agent",deps.logger).addStep(newAuthorizeStep(ScoreQueryController.method.listFlaggedByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveQualityAgentTarget)).addStep(newListFlaggedScoresStep(qualityDepsOf(deps))).build().execute(reqCtx),chainResult2(reqCtx.get(FLAGGED_SCORES_KEY),"flagged score list")}function qualityDepsOf(deps){return{store:deps.store,logger:deps.logger,listReadScope:deps.listReadScope,now:deps.now??(()=>new Date)}}function chainResult2(value,what){if(value===void 0)throw internalError(new Error(`${what} not found in context`),`${what} not found in context`);return value}var SCORING_RULE_EXISTS_REASON="SCORING_RULE_EXISTS",SCORING_RULE_CREATE_DENIED_MESSAGE="unauthorized to configure grading for agent";function scoringRuleExistsMessage(scoringRuleId){return`this agent already has a scoring rule (scoring rule ${scoringRuleId}); update that scoring rule instead`}function scoringRuleOrgMismatchMessage(agentOrg){return`metadata.org must be the agent's organization (${agentOrg})`}var SCORING_RULE_AGENT_IMMUTABLE_MESSAGE="spec.agent_id of a scoring rule cannot change; delete it and create one for the other agent";function noScoringRuleMessage(agentId){return`agent ${agentId} has no scoring rule: AI grading is off`}var EVALUATED_AGENT_KEY="evaluatedAgent",SCORING_RULE_RESULT_KEY="scoringRuleResult";function resolveScoringRuleCreateTargets(ctx){return isServerComposedRequest(ctx.callerIdentity)?[]:[{permission:IamPermission.can_edit,resourceKind:ApiResourceKind.agent,resourceId:ctx.newState.spec?.agentId??"",deniedMessage:SCORING_RULE_CREATE_DENIED_MESSAGE}]}function newLoadEvaluatedAgentStep(store){return{name:"LoadEvaluatedAgent",async execute(ctx){let agentId=ctx.newState.spec?.agentId??"",agent;try{agent=await store.getResource(ApiResourceKind.agent,agentId,AgentSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Agent",agentId):internalError(error3,"failed to load the agent to grade")}ctx.set(EVALUATED_AGENT_KEY,agent)}}}function newResolveScoringRuleDefaultsStep(){return{name:"ResolveScoringRuleDefaults",execute(ctx){let metadata=ctx.newState.metadata;if(metadata===void 0||metadata.org==="")throw invalidArgumentError("metadata.org is required for a scoring rule");let agent=ctx.get(EVALUATED_AGENT_KEY);if(agent===void 0)throw internalError(new Error("evaluated agent not found in context"),"evaluated agent not found in context");let agentOrg=agent.metadata?.org??"";if(metadata.org!==agentOrg)throw failedPreconditionError(scoringRuleOrgMismatchMessage(agentOrg));assignServerId(ctx,generateId("srl")),metadata.name===""&&metadata.slug===""&&(metadata.name=metadata.id)}}}function newCheckScoringRuleUniqueStep(store,logger2){return{name:"CheckScoringRuleUnique",async execute(ctx){let agentId=ctx.newState.spec?.agentId??"",existing;try{existing=await listAgentScoringRules(store,logger2,agentId)}catch(error3){throw internalError(error3,"failed to read the agent's scoring rule")}let first=existing[0];if(first!==void 0){let id=first.metadata?.id??"";throw alreadyExistsWithReasonError(scoringRuleExistsMessage(id),{reason:SCORING_RULE_EXISTS_REASON,metadata:{scoring_rule_id:id}})}}}}function newValidateScoringRuleUpdateStep(){return{name:"ValidateScoringRuleUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing scoring rule not found in context"),"existing scoring rule not found in context");if(ctx.newState.spec?.agentId!==existing.spec?.agentId)throw failedPreconditionError(SCORING_RULE_AGENT_IMMUTABLE_MESSAGE)}}}function newPersistScoringRuleSettingsStep(store,binding){return{name:"PersistScoringRuleSettings",async execute(ctx){await refuseBoundElsewhere(binding,ctx.callerIdentity,ctx.newState.metadata?.org??""),await swapOntoLoadedRow(store,ctx,"failed to save the scoring rule")}}}function newGetScoringRuleByAgentStep(store,logger2){return{name:"GetScoringRuleByAgent",async execute(ctx){let agentId=ctx.input.agentId,scoringRules;try{scoringRules=await listAgentScoringRules(store,logger2,agentId)}catch(error3){throw internalError(error3,"failed to read the agent's scoring rule")}let scoringRule=scoringRules[0];if(scoringRule===void 0)throw new ConnectError(noScoringRuleMessage(agentId),Code.NotFound);ctx.set(SCORING_RULE_RESULT_KEY,scoringRule)}}}function registerScoringRuleServices(router,deps){router.service(ScoringRuleCommandController,{create:(scoringRule,ctx)=>createScoringRule(deps,scoringRule,ctx),update:(input,ctx)=>updateScoringRule(deps,input,ctx),delete:(id,ctx)=>deleteScoringRule(deps,id,ctx)}),router.service(ScoringRuleQueryController,{get:(id,ctx)=>getScoringRule(deps,id,ctx),getByAgent:(req,ctx)=>getByAgent(deps,req,ctx)})}function kindOf14(ctx){return ctx.values.get(apiResourceKindKey)}async function createScoringRule(deps,scoringRule,ctx){let reqCtx=new RequestContext(ScoringRuleSchema,scoringRule,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("scoring-rule-create",deps.logger).addStep(newAuthorizeStep(ScoringRuleCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveScoringRuleCreateTargets)).addStep(newLoadEvaluatedAgentStep(deps.store)).addStep(newResolveScoringRuleDefaultsStep()).addStep(newCheckScoringRuleUniqueStep(deps.store,deps.logger)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newClaimNameStep(deps.store,ApiResourceKind.scoring_rule)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx).catch(releaseNameOnFailure(deps.store,deps.logger,reqCtx)),reqCtx.newState}async function updateScoringRule(deps,input,ctx){return runGuardedWrite(async()=>{let reqCtx=updateContext(ScoringRuleSchema,input,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("scoring-rule-update",deps.logger).addStep(newAuthorizeStep(ScoringRuleCommandController.method.update,deps.authorizer,input)).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newValidateProtoStep({of:"state"})).addStep(newValidateScoringRuleUpdateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistScoringRuleSettingsStep(deps.store,deps.credentialBinding)).build().execute(reqCtx),reqCtx.newState})}async function deleteScoringRule(deps,id,ctx){let reqCtx=new RequestContext(ScoringRuleIdSchema,id,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("scoring-rule-delete",deps.logger).addStep(newAuthorizeStep(ScoringRuleCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,ScoringRuleSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newReleaseNamesStep(deps.store,deps.logger,ApiResourceKind.scoring_rule)).addStep(newCleanupGrantsStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(EXISTING_RESOURCE_KEY),"deleted scoring rule")}async function getScoringRule(deps,id,ctx){let reqCtx=new RequestContext(ScoringRuleIdSchema,id,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("scoring-rule-get",deps.logger).addStep(newAuthorizeStep(ScoringRuleQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,ScoringRuleSchema)).build().execute(reqCtx),chainResult2(reqCtx.get(TARGET_RESOURCE_KEY),"target scoring rule")}async function getByAgent(deps,req,ctx){let input=ScoringRuleQueryController.method.getByAgent.input,reqCtx=new RequestContext(input,req,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("scoring-rule-get-by-agent",deps.logger).addStep(newAuthorizeStep(ScoringRuleQueryController.method.getByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newGetScoringRuleByAgentStep(deps.store,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(SCORING_RULE_RESULT_KEY),"scoring rule")}var file_ai_stigmer_agentic_evalrun_v1_command=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvZXZhbHJ1bi92MS9jb21tYW5kLnByb3RvEh1haS5zdGlnbWVyLmFnZW50aWMuZXZhbHJ1bi52MTKeAwoYRXZhbFJ1bkNvbW1hbmRDb250cm9sbGVyEl4KBmNyZWF0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFscnVuLnYxLkV2YWxSdW4aJi5haS5zdGlnbWVyLmFnZW50aWMuZXZhbHJ1bi52MS5FdmFsUnVuIgTQuBgBEowBCgZjYW5jZWwSKC5haS5zdGlnbWVyLmFnZW50aWMuZXZhbHJ1bi52MS5FdmFsUnVuSWQaJi5haS5zdGlnbWVyLmFnZW50aWMuZXZhbHJ1bi52MS5FdmFsUnVuIjDCuBgsCAIQQSIFdmFsdWUqH3VuYXV0aG9yaXplZCB0byBjYW5jZWwgZXZhbCBydW4SjAEKBmRlbGV0ZRIoLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFscnVuLnYxLkV2YWxSdW5JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFscnVuLnYxLkV2YWxSdW4iMMK4GCwIAxBBIgV2YWx1ZSofdW5hdXRob3JpemVkIHRvIGRlbGV0ZSBldmFsIHJ1bhoEoP8rQWIGcHJvdG8z",[file_ai_stigmer_agentic_evalrun_v1_api,file_ai_stigmer_agentic_evalrun_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EvalRunCommandController=serviceDesc(file_ai_stigmer_agentic_evalrun_v1_command,0);var file_ai_stigmer_agentic_evalrun_v1_query=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvZXZhbHJ1bi92MS9xdWVyeS5wcm90bxIdYWkuc3RpZ21lci5hZ2VudGljLmV2YWxydW4udjEykwQKFkV2YWxSdW5RdWVyeUNvbnRyb2xsZXIShgEKA2dldBIoLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFscnVuLnYxLkV2YWxSdW5JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFscnVuLnYxLkV2YWxSdW4iLcK4GCkIARBBIgV2YWx1ZSocdW5hdXRob3JpemVkIHRvIGdldCBldmFsIHJ1bhKxAQoLbGlzdEJ5QWdlbnQSOS5haS5zdGlnbWVyLmFnZW50aWMuZXZhbHJ1bi52MS5MaXN0RXZhbFJ1bnNCeUFnZW50UmVxdWVzdBoqLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFscnVuLnYxLkV2YWxSdW5MaXN0IjvCuBg3CAEQKCIIYWdlbnRfaWQqJ3VuYXV0aG9yaXplZCB0byBsaXN0IGV2YWwgcnVucyBvZiBhZ2VudBK1AQoMbGlzdEJ5UGx1Z2luEjouYWkuc3RpZ21lci5hZ2VudGljLmV2YWxydW4udjEuTGlzdEV2YWxSdW5zQnlQbHVnaW5SZXF1ZXN0GiouYWkuc3RpZ21lci5hZ2VudGljLmV2YWxydW4udjEuRXZhbFJ1bkxpc3QiPcK4GDkIARA6IglwbHVnaW5faWQqKHVuYXV0aG9yaXplZCB0byBsaXN0IGV2YWwgcnVucyBvZiBwbHVnaW4aBKD/K0FiBnByb3RvMw",[file_ai_stigmer_agentic_evalrun_v1_api,file_ai_stigmer_agentic_evalrun_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EvalRunQueryController=serviceDesc(file_ai_stigmer_agentic_evalrun_v1_query,0);var EVAL_RUN_VAULT_ATTACHMENTS={surface:"an eval run, whose tries every viewer of its agent or plugin can read",allowsOwnersMyVault:!1,attachers:{get:row=>row.status?.vaultAttachers,set:(row,attachers)=>{(row.status??=create2(EvalRunStatusSchema)).vaultAttachers=attachers}}};function registerEvalRunServices(router,deps){router.service(EvalRunCommandController,{create:(evalRun,ctx)=>createEvalRun(deps,evalRun,ctx),cancel:(id,ctx)=>cancelEvalRun(deps,id,ctx),delete:(id,ctx)=>deleteEvalRun2(deps,id,ctx)}),router.service(EvalRunQueryController,{get:(id,ctx)=>getEvalRun(deps,id,ctx),listByAgent:(req,ctx)=>listByAgent3(deps,req,ctx),listByPlugin:(req,ctx)=>listByPlugin(deps,req,ctx)})}function evalRunHarnesses(run){return(run.spec?.targets??[]).map((target,index2)=>({field:`spec.targets[${index2}].harness`,harness:target.harness}))}function kindOf15(ctx){return ctx.values.get(apiResourceKindKey)}async function createEvalRun(deps,evalRun,ctx){let reqCtx=new RequestContext(EvalRunSchema,evalRun,callerIdentityOf(ctx),kindOf15(ctx));return await newPipeline("eval-run-create",deps.logger).addStep(newAuthorizeStep(EvalRunCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newNormalizeReferencesStep(deps.store)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveEvalRunCreateTargets)).addStep(newLoadEvalRunSubjectStep(deps.store)).addStep(newResolveEvalRunDefaultsStep(deps.store,deps.authorizer)).addStep(newRefuseUnofferedHarnessStep(evalRunHarnesses)).addStep(newValidateEvalRunTargetsStep(deps.modelCatalog)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newValidateReferencesStep(deps.store,deps.authorizer)).addStep(newVaultAttachmentsStep(deps.store,deps.authorizer,EVAL_RUN_VAULT_ATTACHMENTS)).addStep(newPlanEvalRunStep(deps.suites,deps.modelCatalog)).addStep(newClaimNameStep(deps.store,ApiResourceKind.eval_run)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newEnsureEvalRunSubjectStillExistsStep(deps.store,deps.authorizationLifecycle,deps.logger)).addStep(newStartEvalRunWorkflowStep(deps.store,deps.workflows,deps.logger)).build().execute(reqCtx).catch(releaseNameOnFailure(deps.store,deps.logger,reqCtx)),reqCtx.newState}async function cancelEvalRun(deps,id,ctx){let reqCtx=new RequestContext(EvalRunIdSchema,id,callerIdentityOf(ctx),kindOf15(ctx));return await newPipeline("eval-run-cancel",deps.logger).addStep(newAuthorizeStep(EvalRunCommandController.method.cancel,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,EvalRunSchema)).addStep(newCancelEvalRunStep(deps.store,deps.workflows)).build().execute(reqCtx),chainResult2(reqCtx.get(EVAL_RUN_RESULT_KEY),"cancelled eval run")}async function deleteEvalRun2(deps,id,ctx){let reqCtx=new RequestContext(EvalRunIdSchema,id,callerIdentityOf(ctx),kindOf15(ctx));return await newPipeline("eval-run-delete",deps.logger).addStep(newAuthorizeStep(EvalRunCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,EvalRunSchema)).addStep(newRefuseActiveEvalRunDeleteStep()).addStep(newDeleteEvalRunTriesStep(deps.store,deps.sessions,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newReleaseNamesStep(deps.store,deps.logger,ApiResourceKind.eval_run)).addStep(newCleanupGrantsStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(EXISTING_RESOURCE_KEY),"deleted eval run")}async function getEvalRun(deps,id,ctx){let reqCtx=new RequestContext(EvalRunIdSchema,id,callerIdentityOf(ctx),kindOf15(ctx));return await newPipeline("eval-run-get",deps.logger).addStep(newAuthorizeStep(EvalRunQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,EvalRunSchema)).addStep(newSettleEndedEvalRunStep(deps.store)).build().execute(reqCtx),chainResult2(reqCtx.get(TARGET_RESOURCE_KEY),"target eval run")}async function listByAgent3(deps,req,ctx){let input=EvalRunQueryController.method.listByAgent.input,reqCtx=new RequestContext(input,req,callerIdentityOf(ctx),kindOf15(ctx));return await newPipeline("eval-run-list-by-agent",deps.logger).addStep(newAuthorizeStep(EvalRunQueryController.method.listByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListEvalRunsBySubjectStep("agent",deps.store,deps.authorizer,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(EVAL_RUN_RESULT_KEY),"eval runs of agent")}async function listByPlugin(deps,req,ctx){let input=EvalRunQueryController.method.listByPlugin.input,reqCtx=new RequestContext(input,req,callerIdentityOf(ctx),kindOf15(ctx));return await newPipeline("eval-run-list-by-plugin",deps.logger).addStep(newAuthorizeStep(EvalRunQueryController.method.listByPlugin,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListEvalRunsBySubjectStep("plugin",deps.store,deps.authorizer,deps.logger)).build().execute(reqCtx),chainResult2(reqCtx.get(EVAL_RUN_RESULT_KEY),"eval runs of plugin")}var import_client77=__toESM(require_lib3(),1);var GRADING_START_DEADLINE_MS=2e3,GRADE_RUN_EXECUTION_TIMEOUT="60 minutes";function newGradingObserver(deps){let deadlineMs=deps.startDeadlineMs??GRADING_START_DEADLINE_MS;return async({run,newPhase})=>{if(newPhase!==RunPhase.RUN_COMPLETED||isJudgeRun(run)||isEvalRun(run)||run.spec?.reconcileFileReview===!0)return;let runId=run.metadata?.id??"",client=deps.client();if(client===void 0){await recordNotStarted(deps,run,"no engine connection");return}try{await client.connection.withDeadline(Date.now()+deadlineMs,()=>client.workflow.start(GRADE_RUN_WORKFLOW_TYPE,{workflowId:gradeRunWorkflowId(runId),taskQueue:deps.config.stigmerQueue,workflowIdReusePolicy:"REJECT_DUPLICATE",workflowExecutionTimeout:GRADE_RUN_EXECUTION_TIMEOUT,args:[runId]}))}catch(error3){if(error3 instanceof import_client77.WorkflowExecutionAlreadyStartedError)return;await recordNotStarted(deps,run,error3 instanceof Error?error3.message:String(error3))}}}async function recordNotStarted(deps,run,cause){deps.logger.warn("grading could not start; recording the run as not graded",{runId:run.metadata?.id??"",cause}),await recordRunHealth(deps.recorder(),notGradedRunHealthScore(run,GRADING_NOT_STARTED_REASON))}var file_ai_stigmer_iam_oauthapp_v1_io=fileDesc("CiNhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9pby5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEiJgoKT0F1dGhBcHBJZBIYCgV2YWx1ZRgBIAEoCUIJukgGcgQQARhAIlsKCU9BdXRoQXBwcxI1CgdlbnRyaWVzGAEgAygLMiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHASFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJIt8BChJMaXN0T0F1dGhBcHBzSW5wdXQSFAoDb3JnGAEgASgJQge6SARyAhABEhoKCXBhZ2Vfc2l6ZRgCIAEoBUIHukgEGgIoABIcCgpwYWdlX3Rva2VuGAMgASgJQgi6SAVyAxiACBJKCgZsYWJlbHMYBCADKAsyOi5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5MaXN0T0F1dGhBcHBzSW5wdXQuTGFiZWxzRW50cnkaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASLSAgoTVXBkYXRlT0F1dGhBcHBJbnB1dBI+CghyZXNvdXJjZRgBIAEoCzIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwQga6SAPYAQMSNwoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQga6SAPIAQE6wQG6SL0BGroBChd1cGRhdGVfbmFtZXNfaXRzX3RhcmdldBJJcmVzb3VyY2UubWV0YWRhdGEuaWQgaXMgcmVxdWlyZWQ6IGFuIHVwZGF0ZSBuYW1lcyB0aGUgT0F1dGggYXBwIGJ5IGl0cyBpZBpUaGFzKHRoaXMucmVzb3VyY2UpICYmIGhhcyh0aGlzLnJlc291cmNlLm1ldGFkYXRhKSAmJiB0aGlzLnJlc291cmNlLm1ldGFkYXRhLmlkICE9ICcnYgZwcm90bzM",[file_ai_stigmer_iam_oauthapp_v1_api,file_buf_validate_validate,file_google_protobuf_field_mask2]);var OAuthAppsSchema=messageDesc2(file_ai_stigmer_iam_oauthapp_v1_io,1);var UpdateOAuthAppInputSchema=messageDesc2(file_ai_stigmer_iam_oauthapp_v1_io,3);var file_ai_stigmer_iam_oauthapp_v1_command=fileDesc("CihhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9jb21tYW5kLnByb3RvEhphaS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MTL5BQoZT0F1dGhBcHBDb21tYW5kQ29udHJvbGxlchJTCgVhcHBseRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHASowEKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiTcK4GEkIFxAeIgxtZXRhZGF0YS5vcmcqNXVuYXV0aG9yaXplZCB0byBjcmVhdGUgb2F1dGggYXBwIGluIHRoaXMgb3JnYW5pemF0aW9uEqEBCgZ1cGRhdGUSLy5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5VcGRhdGVPQXV0aEFwcElucHV0GiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiQMK4GDwIAhAWIhRyZXNvdXJjZS5tZXRhZGF0YS5pZCogdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBvYXV0aCBhcHASlAEKBnJlbmFtZRIrLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5SZW5hbWVJbnB1dBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAMQFiILcmVzb3VyY2VfaWQqIHVuYXV0aG9yaXplZCB0byByZW5hbWUgT0F1dGggYXBwEp8BCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAMQFiILcmVzb3VyY2VfaWQqIHVuYXV0aG9yaXplZCB0byBkZWxldGUgb2F1dGggYXBwGgSg/ysWYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api,file_ai_stigmer_iam_oauthapp_v1_io]),OAuthAppCommandController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_command,0);var file_ai_stigmer_iam_oauthapp_v1_query=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9xdWVyeS5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEyxgMKF09BdXRoQXBwUXVlcnlDb250cm9sbGVyEosBCgNnZXQSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIi/CuBgrCAEQFiIFdmFsdWUqHnVuYXV0aG9yaXplZCB0byB2aWV3IG9hdXRoIGFwcBJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIgTQuBgBEqIBCgRsaXN0Ei4uYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuTGlzdE9BdXRoQXBwc0lucHV0GiUuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHBzIkPCuBg/CAEQHiIDb3JnKjR1bmF1dGhvcml6ZWQgdG8gbGlzdCBvYXV0aCBhcHBzIGluIHRoaXMgb3JnYW5pemF0aW9uGgSg/ysWYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api,file_ai_stigmer_iam_oauthapp_v1_io]),OAuthAppQueryController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_query,0);var DROPPED_ADDRESSES_KEY="oauthapp.droppedAddresses";function newNormalizeAddressesStep(){return{name:"NormalizeAddresses",execute(ctx){let spec=ctx.newState.spec,normalized=[];for(let[index2,address]of(spec?.addresses??[]).entries()){let value;try{value=normalizeAddress(address)}catch(error3){throw error3 instanceof InvalidAddressError?invalidArgumentError(`spec.addresses[${index2}]: ${error3.message}`):error3}if(normalized.includes(value))throw invalidArgumentError(`spec.addresses[${index2}] is the same address as an earlier one once normalized: list each address once`);normalized.push(value)}spec!==void 0&&(spec.addresses=normalized)}}}function newClaimAddressesStep(store,mode){return{name:"ClaimAddresses",async execute(ctx){let app=ctx.newState,before=(mode==="update"?ctx.get(EXISTING_RESOURCE_KEY):void 0)?.spec?.addresses??[],after=app.spec?.addresses??[],added=after.filter(address=>!before.includes(address));ctx.set(DROPPED_ADDRESSES_KEY,before.filter(address=>!after.includes(address)));let org=app.metadata?.org??"",id=app.metadata?.id??"",claimed=[];for(let address of added){if(!await claimAddress(store,org,id,address)){for(let done of claimed)await store.resourceNames.releaseName(oauthAppAddressKey(org,done),id);throw new ConnectError(`the address ${address} already belongs to another login app in this organization: remove it there first`,Code.AlreadyExists)}claimed.push(address)}}}}function newReleaseDroppedAddressesStep(store,logger2){return{name:"ReleaseDroppedAddresses",async execute(ctx){let dropped=ctx.get(DROPPED_ADDRESSES_KEY)??[],org=ctx.newState.metadata?.org??"",id=ctx.newState.metadata?.id??"";for(let address of dropped)try{await store.resourceNames.releaseName(oauthAppAddressKey(org,address),id)}catch(error3){logger2.warn("an address a login app dropped could not be released",{oauthAppId:id,error:error3 instanceof Error?error3.message:String(error3)})}}}}function newReleaseAddressesStep(store,logger2){return{name:"ReleaseAddresses",async execute(ctx){let app=ctx.get(EXISTING_RESOURCE_KEY),id=app?.metadata?.id??"";try{await store.resourceNames.release(OAUTH_APP_ADDRESS_NAME_KIND,app?.metadata?.org??"",id)}catch(error3){logger2.warn("a deleted login app's addresses could not be released",{oauthAppId:id,error:error3 instanceof Error?error3.message:String(error3)})}}}}async function claimAddress(store,org,id,address){return(await claimName(store,oauthAppAddressKey(org,address),id,new Date,{holds:async()=>await findOrganizationApp(store,org,address)!==void 0})).claimed}var REDACTED_MARKER3="***REDACTED***",MARKER_ON_CREATE_MESSAGE="cannot use the redaction marker as client_secret on create",PRESERVE_NO_EXISTING_SECRET_MESSAGE="cannot preserve client_secret: no existing secret value found",CIPHERTEXT_SHAPED_SECRET_MESSAGE="client_secret must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients";function newCheckLoginEndpointsStep(){return{name:"CheckLoginEndpoints",execute(ctx){let spec=ctx.newState.spec;for(let[field3,value]of[["authorization_url",spec?.authorizationUrl??""],["token_url",spec?.tokenUrl??""],["userinfo_url",spec?.userinfoUrl??""]]){let problem=value===""?void 0:loginEndpointProblem(value);if(problem!==void 0)throw invalidArgumentError(`spec.${field3} ${problem}`)}}}}function redactOAuthApp(app){app.spec!==void 0&&app.spec.clientSecret!==""&&(app.spec.clientSecret=REDACTED_MARKER3)}function newEncryptClientSecretForCreateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!0)}function newEncryptClientSecretForUpdateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!1)}function newEncryptClientSecretStep(secretService,logger2,isCreate){return{name:"EncryptClientSecret",async execute(ctx){let app=ctx.newState;if(app.spec===void 0)return;let clientSecret=app.spec.clientSecret;if(clientSecret==="")return;if(clientSecret===REDACTED_MARKER3){preserveExistingSecret(ctx,app,isCreate,logger2);return}let existing=ctx.get(EXISTING_RESOURCE_KEY);if(!(!isCreate&&clientSecret===existing?.spec?.clientSecret)){if(isCiphertextShaped(clientSecret))throw invalidArgumentError(CIPHERTEXT_SHAPED_SECRET_MESSAGE);if(!secretService.isEnabled()){logger2.warn("encryption disabled: client_secret will be stored in plaintext");return}try{app.spec.clientSecret=await secretService.encrypt(clientSecret,EncryptionScope.forOrganization(app.metadata?.org??""))}catch(error3){throw internalError(error3,"failed to encrypt client_secret")}}}}}function preserveExistingSecret(ctx,app,isCreate,logger2){if(isCreate)throw invalidArgumentError(MARKER_ON_CREATE_MESSAGE);let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not loaded"),"cannot preserve client_secret: existing resource not loaded");let existingSecret=existing.spec?.clientSecret??"";if(existingSecret==="")throw invalidArgumentError(PRESERVE_NO_EXISTING_SECRET_MESSAGE);app.spec!==void 0&&(app.spec.clientSecret=existingSecret),logger2.debug("preserved existing encrypted client_secret",{oauthAppId:app.metadata?.id??""})}var oauthAppListIndex=declareListIndex({kind:ApiResourceKind.oauth_app,schema:OAuthAppSchema,revision:1,keys:{}});function registerOAuthAppServices(router,deps){router.service(OAuthAppCommandController,{apply:(app,ctx)=>apply7(deps,app,ctx),create:(app,ctx)=>createOAuthApp(deps,app,ctx),update:(input,ctx)=>update10(deps,input,ctx),rename:(input,ctx)=>rename7(deps,input,ctx),delete:(input,ctx)=>deleteOAuthApp(deps,input,ctx)}),router.service(OAuthAppQueryController,{get:(id,ctx)=>get13(deps,id,ctx),getByReference:(ref,ctx)=>getByReference7(deps,ref,ctx),list:(req,ctx)=>list12(deps,req,ctx)})}function kindOf16(ctx){return ctx.values.get(apiResourceKindKey)}async function createOAuthApp(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("oauthapp-create",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEncryptClientSecretForCreateStep(deps.secretService,deps.logger)).addStep(newBuildNewStateStep()).addStep(newCheckLoginEndpointsStep()).addStep(newNormalizeAddressesStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newClaimNameStep(deps.store,ApiResourceKind.oauth_app)).addStep(newClaimAddressesStep(deps.store,"create")).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx).catch(releaseNameOnFailure(deps.store,deps.logger,reqCtx));let result=reqCtx.newState;return redactOAuthApp(result),result}async function update10(deps,input,ctx){return runGuardedWrite(async()=>{let reqCtx=updateContext(OAuthAppSchema,input,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("oauthapp-update",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.update,deps.authorizer,input)).addStep(newResolveSlugStep({update:!0})).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newValidateProtoStep({of:"state"})).addStep(newCheckLoginEndpointsStep()).addStep(newNormalizeAddressesStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newEncryptClientSecretForUpdateStep(deps.secretService,deps.logger)).addStep(newClaimAddressesStep(deps.store,"update")).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newReleaseDroppedAddressesStep(deps.store,deps.logger)).build().execute(reqCtx);let result=reqCtx.newState;return redactOAuthApp(result),result})}async function rename7(deps,input,ctx){let renamed=await renameResource({method:OAuthAppCommandController.method.rename,names:deps.store,rows:storeRenameRows(deps.store,ApiResourceKind.oauth_app,OAuthAppSchema),authorizer:deps.authorizer,credentialBinding:deps.credentialBinding,logger:deps.logger},input,callerIdentityOf(ctx),kindOf16(ctx));return redactOAuthApp(renamed),renamed}async function apply7(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("oauthapp-apply",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOAuthApp(deps,app,ctx):update10(deps,everyPathUpdate(UpdateOAuthAppInputSchema,withResolvedApplyId(OAuthAppSchema,app,reqCtx)),ctx)}async function deleteOAuthApp(deps,input,ctx){let reqCtx=new RequestContext(OAuthAppCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf16(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("oauthapp-delete",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,OAuthAppSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newReleaseNamesStep(deps.store,deps.logger,ApiResourceKind.oauth_app)).addStep(newReleaseAddressesStep(deps.store,deps.logger)).addStep(newCleanupGrantsStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,app2=>app2.spec===void 0?[]:[app2.spec.clientSecret])).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted OAuthApp not found in context"),"deleted OAuthApp not found in context");let app=deleted;return redactOAuthApp(app),app}async function get13(deps,id,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("oauthapp-get",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OAuthAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}async function getByReference7(deps,ref,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("oauthapp-get-by-reference",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,OAuthAppSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(OAuthAppQueryController.method.get))).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}var LIST_RESULT_KEY6="listResult";async function list12(deps,req,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("oauthapp-list",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListStep3(deps.store,deps.listReadScope,deps.logger)).build().execute(reqCtx);let list18=reqCtx.get(LIST_RESULT_KEY6);if(list18===void 0)throw internalError(new Error("list result missing from pipeline context"),"OAuthApp list not found in context");return list18}function newListStep3(store,listReadScope,logger2){return{name:"ListByOrg",async execute(ctx){let org=ctx.input.org,page=await readListPage({store,declaration:oauthAppListIndex,query:{org},request:{pageSize:ctx.input.pageSize,pageToken:ctx.input.pageToken},fingerprint:listPageFingerprint({org,labels:sortedLabels(ctx.input.labels)}),decode:decodeOrSkip(OAuthAppSchema,{logger:logger2,message:"failed to unmarshal OAuthApp, skipping"}),keep:app=>(app.metadata?.org??"")===org&&matchesAllLabels(app.metadata?.labels??{},ctx.input.labels),scope:rows=>restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.oauth_app,rows,""),failure:"failed to list OAuthApps"});for(let app of page.entries)redactOAuthApp(app);ctx.set(LIST_RESULT_KEY6,create2(OAuthAppsSchema,{entries:page.entries,nextPageToken:page.nextPageToken}))}}}var file_ai_stigmer_iam_token_v1_token=fileDesc("CiNhaS9zdGlnbWVyL2lhbS90b2tlbi92MS90b2tlbi5wcm90bxIXYWkuc3RpZ21lci5pYW0udG9rZW4udjEihgEKFE1pbnRVc2VyVG9rZW5SZXF1ZXN0EhYKA29yZxgBIAEoCUIJukgGcgQQARhAEhsKB3VzZXJfaWQYAiABKAlCCrpIB3IFEAEYgAISHAoKdXNlcl9lbWFpbBgDIAEoCUIIukgFcgMYwAISGwoJdXNlcl9uYW1lGAQgASgJQgi6SAVyAxiAAiJVChVNaW50VXNlclRva2VuUmVzcG9uc2USFAoMYWNjZXNzX3Rva2VuGAEgASgJEhIKCnRva2VuX3R5cGUYAiABKAkSEgoKZXhwaXJlc19pbhgDIAEoBSK8AwoVTWludEd1ZXN0VG9rZW5SZXF1ZXN0Eh4KCmNoYW5uZWxfaWQYASABKAlCCrpIB3IFEAEYgAESFwoPZ3Vlc3RfY29va2llX2lkGAIgASgJEssCCgxlbWJlZF9vcmlnaW4YAyABKAlCtAK6SLACugGsAgoTZW1iZWRfb3JpZ2luLmZvcm1hdBJ3ZW1iZWRfb3JpZ2luIG11c3QgYmUgZW1wdHksICJudWxsIiwgb3IgYW4gZXhhY3Qgd2ViIG9yaWdpbiBsaWtlIGh0dHBzOi8vZXhhbXBsZS5jb20gKG5vIHBhdGgsIHF1ZXJ5LCBvciB0cmFpbGluZyBzbGFzaCkamwF0aGlzID09ICcnIHx8IHRoaXMgPT0gJ251bGwnIHx8IHRoaXMubWF0Y2hlcygnXmh0dHBzPzovL1tBLVphLXowLTldKFtBLVphLXowLTktXSpbQS1aYS16MC05XSk/KFxcLltBLVphLXowLTldKFtBLVphLXowLTktXSpbQS1aYS16MC05XSk/KSooOlswLTldezEsNX0pPyQnKRIcCgpsaW5rX3Rva2VuGAQgASgJQgi6SAVyAxiAASJvChZNaW50R3Vlc3RUb2tlblJlc3BvbnNlEhQKDGFjY2Vzc190b2tlbhgBIAEoCRISCgp0b2tlbl90eXBlGAIgASgJEhIKCmV4cGlyZXNfaW4YAyABKAUSFwoPZ3Vlc3RfY29va2llX2lkGAQgASgJMr8CCgxUb2tlblNlcnZpY2UStQEKDW1pbnRVc2VyVG9rZW4SLS5haS5zdGlnbWVyLmlhbS50b2tlbi52MS5NaW50VXNlclRva2VuUmVxdWVzdBouLmFpLnN0aWdtZXIuaWFtLnRva2VuLnYxLk1pbnRVc2VyVG9rZW5SZXNwb25zZSJFwrgYQQg5EB4iA29yZyo2dW5hdXRob3JpemVkIHRvIG1pbnQgdXNlciB0b2tlbnMgZm9yIHRoaXMgb3JnYW5pemF0aW9uEncKDm1pbnRHdWVzdFRva2VuEi4uYWkuc3RpZ21lci5pYW0udG9rZW4udjEuTWludEd1ZXN0VG9rZW5SZXF1ZXN0Gi8uYWkuc3RpZ21lci5pYW0udG9rZW4udjEuTWludEd1ZXN0VG9rZW5SZXNwb25zZSIEyLgYAWIGcHJvdG8z",[file_ai_stigmer_commons_rpc_method_options,file_buf_validate_validate]);var MintUserTokenResponseSchema=messageDesc2(file_ai_stigmer_iam_token_v1_token,1);var TokenService=serviceDesc(file_ai_stigmer_iam_token_v1_token,0);var import_node_crypto38=require("node:crypto");var PLATFORM_TOKEN_KEY_ENV_VAR="STIGMER_PLATFORM_TOKEN_KEY",PLATFORM_TOKEN_KEY_FILE_NAME="platform-token.key",DEFAULT_PLATFORM_TOKEN_TTL_SECONDS=900,MIN_RSA_MODULUS_BITS=2048;function canSign(ring){return ring.signer!==void 0}function resolvePlatformTokenKeys(input){if(input.requireAuthentication){if(input.supplied!==void 0)return input.supplied;if(input.edition!==ServerEdition.oss)throw new Error(`the ${ServerEdition[input.edition]} edition requires authentication but registers no platform-token key ring \u2014 register drivers.platformTokenKeys; only open source generates its own key`);return openSourcePlatformTokenKeyRing(input.options)}}function openSourcePlatformTokenKeyRing(options={}){let privateKey=getOrCreateKey(RSA_PRIVATE_KEY,PLATFORM_TOKEN_KEY_ENV_VAR,PLATFORM_TOKEN_KEY_FILE_NAME,options);return{signer:{key:privateKey,kid:kidOf(privateKey)},verificationKeys:[(0,import_node_crypto38.createPublicKey)(privateKey)],audience:"",ttlSeconds:DEFAULT_PLATFORM_TOKEN_TTL_SECONDS}}var RSA_PRIVATE_KEY={fromEnv(envVar,decoded){let key=parseKey2(()=>(0,import_node_crypto38.createPrivateKey)(decoded.toString("utf8")),envVar);return requireRsa(key,envVar)},fromFile(content){try{let key=(0,import_node_crypto38.createPrivateKey)(content.toString("utf8"));return isUsableRsa(key)?key:void 0}catch{return}},generate(){return(0,import_node_crypto38.generateKeyPairSync)("rsa",{modulusLength:MIN_RSA_MODULUS_BITS}).privateKey},toFile(key){return Buffer.from(key.export({format:"pem",type:"pkcs8"}))}};function kidOf(key){let publicKey=key.type==="private"?(0,import_node_crypto38.createPublicKey)(key):key;return(0,import_node_crypto38.createHash)("sha256").update(spkiOf(publicKey)).digest("base64url").slice(0,16)}function spkiOf(publicKey){return publicKey.export({format:"der",type:"spki"})}function parseKey2(parse5,what){try{return parse5()}catch(error3){throw new Error(`${what} is not a readable PEM key: ${error3 instanceof Error?error3.message:String(error3)}`)}}function requireRsa(key,what){if(!isUsableRsa(key))throw new Error(`${what} must be an RSA key of at least ${MIN_RSA_MODULUS_BITS} bits`);return key}function isUsableRsa(key){return key.asymmetricKeyType==="rsa"&&(key.asymmetricKeyDetails?.modulusLength??0)>=MIN_RSA_MODULUS_BITS}var EMBEDDING_ORGANIZATION_KEY="embeddingOrganization";function isGrantableSignInRole(role){return role===IamRole.iam_role_unspecified||grantableRolesFor(ApiResourceKind.organization).includes(role)}var EMBEDDING_VAULT_ATTACHMENTS={surface:"an organization's embedding settings",attachers:{get:row=>row.status?.embeddingVaultAttachers,set:(row,attachers)=>{(row.status??=create2(OrganizationStatusSchema)).embeddingVaultAttachers=attachers}}};function embeddingContext(input,caller){return new RequestContext(OrganizationSchema,create2(OrganizationSchema,{metadata:{id:input.orgId},spec:{embedding:clone(OrganizationEmbeddingSchema,input.embedding??create2(OrganizationEmbeddingSchema))}}),caller,ApiResourceKind.organization)}function newClearEmbeddingStep(){return{name:"ClearEmbedding",execute(ctx){ctx.newState.spec!==void 0&&(ctx.newState.spec.embedding=void 0)}}}function newPreserveEmbeddingStep(){return{name:"PreserveEmbedding",execute(ctx){let existing=storedOrganizationOf(ctx,"PreserveEmbedding"),spec=ctx.newState.spec??=create2(OrganizationSpecSchema),stored=existing.spec?.embedding;spec.embedding=stored===void 0?void 0:clone(OrganizationEmbeddingSchema,stored);let status=ctx.newState.status??=create2(OrganizationStatusSchema);status.embeddingVaultAttachers={...existing.status?.embeddingVaultAttachers??{}}}}}function newBuildEmbeddingStateStep(){return{name:"BuildEmbeddingState",execute(ctx){let existing=storedOrganizationOf(ctx,"BuildEmbeddingState"),requested=ctx.newState.spec?.embedding??create2(OrganizationEmbeddingSchema),next=clone(OrganizationSchema,existing);(next.spec??=create2(OrganizationSpecSchema)).embedding=clone(OrganizationEmbeddingSchema,requested),ctx.setNewState(next)}}}function newValidateSignInRoleStep(){return{name:"ValidateSignInRole",execute(ctx){let role=ctx.newState.spec?.embedding?.signInRole??IamRole.iam_role_unspecified;if(!isGrantableSignInRole(role))throw invalidArgumentError(signInRoleNotGrantableMessage(role))}}}function newPersistEmbeddingStep(store){return{name:"PersistEmbedding",async execute(ctx){let id=ctx.newState.metadata?.id??"",embedding=ctx.newState.spec?.embedding,attachers={...ctx.newState.status?.embeddingVaultAttachers??{}};try{let written=await store.updateResource(ApiResourceKind.organization,id,OrganizationSchema,live=>{(live.spec??=create2(OrganizationSpecSchema)).embedding=embedding===void 0?void 0:clone(OrganizationEmbeddingSchema,embedding),(live.status??=create2(OrganizationStatusSchema)).embeddingVaultAttachers=attachers,setAuditFieldsForUpdate(OrganizationSchema,live,"spec_audit",ctx.callerIdentity)});ctx.set(EMBEDDING_ORGANIZATION_KEY,written)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Organization",id):internalError(error3,"failed to save organization")}}}}function storedOrganizationOf(ctx,step){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error(`organization chain reached ${step} without its loaded row`),"failed to update organization");return existing}var SUBJECT_SEPARATOR="|";async function mintUserToken(deps,request3,caller){let keys=deps.keys;if(keys===void 0)throw new ConnectError(MINTING_REQUIRES_AUTHENTICATION_MESSAGE,Code.FailedPrecondition);if(!canSign(keys))throw new ConnectError(MINTING_DISABLED_MESSAGE,Code.FailedPrecondition);let minter=mintingAccountOf(caller);await authorizeDirect(TokenService.method.mintUserToken,deps.authorizer,caller,request3);let embedding=await embeddingOf(deps,minter.org),tokenOrg=request3.org,user={externalUserId:request3.userId,email:request3.userEmail,name:request3.userName},accountId=await resolveOrProvisionAccount(deps,minter.id,embedding,tokenOrg,user),signed=signPlatformToken(keys,{[USER_TOKEN_CLAIMS.subject]:accountId,[USER_TOKEN_CLAIMS.externalUserId]:user.externalUserId,[USER_TOKEN_CLAIMS.email]:user.email,[USER_TOKEN_CLAIMS.name]:user.name,[USER_TOKEN_CLAIMS.org]:tokenOrg,[USER_TOKEN_CLAIMS.mintedBy]:minter.id},{now:deps.now()});return create2(MintUserTokenResponseSchema,{accessToken:signed.token,tokenType:BEARER_TOKEN_TYPE,expiresIn:keys.ttlSeconds})}function mintingAccountOf(caller){let org=boundOrgOf(caller);if(!isServiceAccountCaller(caller)||org===void 0)throw new ConnectError(MINT_REQUIRES_SERVICE_ACCOUNT_MESSAGE,Code.PermissionDenied);return{id:caller.identityId,org}}async function embeddingOf(deps,org){try{return(await deps.store.getResource(ApiResourceKind.organization,org,OrganizationSchema)).spec?.embedding}catch(error3){throw error3 instanceof ResourceNotFoundError?new ConnectError(MINT_REQUIRES_SERVICE_ACCOUNT_MESSAGE,Code.PermissionDenied):internalError(error3,"failed to read the organization's embedding settings")}}async function resolveOrProvisionAccount(deps,minterId,embedding,org,user){let idpId=appUserSubject(org,user.externalUserId),existing=await findAccount(deps,idpId);if(existing!==void 0)return await appUserAccountId(deps,existing,user,org);if(embedding?.createAccountsOnSignIn!==!0)throw new ConnectError(noAccountMessage(user.externalUserId,await organizationForPeople(deps,org)),Code.FailedPrecondition);let input=accountInput(idpId,org,user),actor=serverActingFor(minterId);embedding.signInRole!==IamRole.iam_role_unspecified&&await grantSignInRole(deps,embedding.signInRole,org,accountIdFor(idpId),actor);try{return(await deps.createAccount(input,actor)).metadata?.id??""}catch(error3){let winner=await resolveCreateRace(error3,()=>deps.accounts.findByIdpId(idpId));return await appUserAccountId(deps,winner,user,org)}}async function findAccount(deps,idpId){try{return await deps.accounts.findByIdpId(idpId)}catch(error3){throw internalError(error3,"failed to resolve the app user")}}async function organizationForPeople(deps,org){try{return await organizationNameForPeople(deps.store,org)}catch(error3){throw internalError(error3,"failed to read the organization's name")}}async function appUserAccountId(deps,account2,user,org){if(account2.spec?.provisioningMode!==IdentityAccountProvisioningMode.app_user)throw new ConnectError(foreignAccountMessage(user.externalUserId,await organizationForPeople(deps,org)),Code.FailedPrecondition);return account2.metadata?.id??""}function accountInput(idpId,org,user){let input={name:fittedName(user.email!==""?user.email:user.externalUserId),spec:create2(IdentityAccountSpecSchema,{idpId,email:user.email,...splitName(user.name,user.email)}),provisioning:{mode:"app_user",org}},result=validator().validate(IdentityAccountSchema,create2(IdentityAccountSchema,{apiVersion:"iam.stigmer.ai/v1",kind:"IdentityAccount",metadata:{name:input.name,org},spec:input.spec}));if(result.kind==="invalid")throw new ConnectError(result.error.message,Code.InvalidArgument);if(result.kind==="error")throw new ConnectError(`validation could not run: ${result.error.message}`,Code.Internal);return input}async function grantSignInRole(deps,role,org,accountId,actor){if(role===IamRole.owner)throw new ConnectError(OWNER_SIGN_IN_ROLE_MESSAGE,Code.InvalidArgument);if(!isGrantableSignInRole(role))throw new ConnectError(signInRoleNotGrantableMessage(role),Code.InvalidArgument);try{await deps.grantPath.grant(organizationRole(accountId,role,org),actor,"grant")}catch(error3){throw deps.logger.error("app user sign-in role grant failed; nothing was provisioned",{accountId,mintedBy:actor.identityId,error:error3 instanceof Error?error3.message:String(error3)}),new ConnectError(PROVISIONING_FAILED_MESSAGE,Code.Internal)}}function appUserSubject(org,externalUserId){return requireSubjectPart("org",org),requireSubjectPart("externalUserId",externalUserId),`${APP_USER_SUBJECT_PREFIX}${org}${SUBJECT_SEPARATOR}${externalUserId}`}function requireSubjectPart(part,value){if(value.trim()==="")throw new ConnectError(blankSubjectPartMessage(part),Code.InvalidArgument);if(value.includes(SUBJECT_SEPARATOR))throw new ConnectError(subjectSeparatorMessage(part,value),Code.InvalidArgument)}function splitName(name,email){if(name!==""){let space=name.indexOf(" ");return space>0?{firstName:name.slice(0,space),lastName:name.slice(space+1)}:{firstName:name,lastName:""}}let at2=email.indexOf("@");return{firstName:at2>=0?email.slice(0,at2):email,lastName:""}}function registerTokenService(router,deps){router.service(TokenService,{mintUserToken:(request3,ctx)=>mintUserToken(deps.mint,request3,callerIdentityOf(ctx)),mintGuestToken:(request3,ctx)=>{if(deps.guestTokenMinting===void 0)throw new ConnectError(GUEST_MINT_UNIMPLEMENTED_MESSAGE,Code.Unimplemented);return deps.guestTokenMinting.mintGuestToken(request3,ctx.requestHeader)}})}var OPAQUE_ORIGIN="null";function newEmbeddingOriginGuard(deps){return{name:"embedding-origin",async guard(caller,method,headers2){let origin=headers2.get("origin")??"";if(origin.trim()==="")return;let mintedBy=mintingAccountOf2(caller);if(mintedBy===void 0)return;let allowed=await allowedOriginsOf(deps,mintedBy);if(!originAllowed(origin,allowed))throw deps.logger.warn("origin refusal: origin not in allowed_origins",{procedure:`/${method.parent.typeName}/${method.name}`,mintedBy,origin}),new ConnectError(originRefusalMessage(origin),Code.PermissionDenied)}}}function mintingAccountOf2(caller){let payload=decodeVerifiedPlatformTokenPayload(caller.rawToken);if(!(payload===void 0||stringClaim(payload,TOKEN_TYPE_CLAIM)!==void 0))return stringClaim(payload,USER_TOKEN_CLAIMS.mintedBy)}async function allowedOriginsOf(deps,mintedBy){let minter=await deps.accounts.findById(mintedBy),org=minter?.metadata?.org??"";if(minter===void 0||org==="")throw new ConnectError(DELETED_MINTER_MESSAGE,Code.Unauthenticated);try{return(await deps.store.getResource(ApiResourceKind.organization,org,OrganizationSchema)).spec?.embedding?.allowedOrigins??[]}catch(error3){throw error3 instanceof ResourceNotFoundError?new ConnectError(DELETED_MINTER_MESSAGE,Code.Unauthenticated):error3}}function originAllowed(origin,allowed){if(allowed.length===0)return!0;if(origin===OPAQUE_ORIGIN)return!1;let presented=origin.toLowerCase();return allowed.some(entry=>entry.toLowerCase()===presented)}function newUserTokenVerifier(deps){return{name:"user-token",async verify(token){let result=verifyPlatformToken(deps.keys,token,deps.now?.());switch(result.outcome){case"foreign":return null;case"refused":throw platformTokenRefusalError(result.refusal);case"verified":break;default:{let exhaustive=result;throw new Error(`unknown verification ${JSON.stringify(exhaustive)}`)}}let verified=result.token;if(verified.tokenType!==void 0)return null;let mintedBy=stringClaim(verified.payload,USER_TOKEN_CLAIMS.mintedBy);if(mintedBy===void 0||mintedBy==="")throw new ConnectError(TOKEN_NAMES_NO_MINTER_MESSAGE,Code.Unauthenticated);let minter=await deps.accounts.findById(mintedBy);if(minter===void 0||minter.spec?.provisioningMode!==IdentityAccountProvisioningMode.service_account)throw new ConnectError(DELETED_MINTER_MESSAGE,Code.Unauthenticated);let boundOrg=stringClaim(verified.payload,USER_TOKEN_CLAIMS.org),minterOrg=minter.metadata?.org??"";if(boundOrg===void 0||boundOrg===""||boundOrg!==minterOrg&&!await isChildOf(deps.store,boundOrg,minterOrg))throw new ConnectError(TOKEN_ORGANIZATION_MISMATCH_MESSAGE,Code.Unauthenticated);let email=stringClaim(verified.payload,USER_TOKEN_CLAIMS.email),displayName=stringClaim(verified.payload,USER_TOKEN_CLAIMS.name);return{identityId:verified.subject,callerClass:"user",issuer:PLATFORM_TOKEN_ISSUER,rawToken:token,...email!==void 0?{email}:{},...displayName!==void 0?{displayName}:{},mintedBy,boundOrg}}}}var file_ai_stigmer_tenancy_organization_v1_io=fileDesc("CithaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2lvLnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxImsKDU9yZ2FuaXphdGlvbnMSQQoHZW50cmllcxgBIAMoCzIwLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCSLdAQoYTGlzdE15T3JnYW5pemF0aW9uc0lucHV0EhoKCXBhZ2Vfc2l6ZRgBIAEoBUIHukgEGgIoABIcCgpwYWdlX3Rva2VuGAIgASgJQgi6SAVyAxiACBJYCgZsYWJlbHMYAyADKAsySC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLkxpc3RNeU9yZ2FuaXphdGlvbnNJbnB1dC5MYWJlbHNFbnRyeRotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIioKDk9yZ2FuaXphdGlvbklkEhgKBXZhbHVlGAEgASgJQgm6SAZyBBABGEAiXAoaT3JnYW5pemF0aW9uRXh0ZXJuYWxMb29rdXASHwoLZXh0ZXJuYWxfaWQYAiABKAlCCrpIB3IFEAEYgAISHQoKcGFyZW50X29yZxgDIAEoCUIJukgGcgQQARhAIukBChJMaXN0Q2hpbGRPcmdzSW5wdXQSFgoDb3JnGAEgASgJQgm6SAZyBBABGEASGgoJcGFnZV9zaXplGAIgASgFQge6SAQaAigAEhwKCnBhZ2VfdG9rZW4YAyABKAlCCLpIBXIDGIAIElIKBmxhYmVscxgEIAMoCzJCLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuTGlzdENoaWxkT3Jnc0lucHV0LkxhYmVsc0VudHJ5Gi0KC0xhYmVsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiagoMQ2hpbGRPcmdMaXN0EkEKB2VudHJpZXMYASADKAsyMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkikAEKH1VwZGF0ZU9yZ2FuaXphdGlvblBvbGljaWVzSW5wdXQSGQoGb3JnX2lkGAEgASgJQgm6SAZyBBABGEASUgoIcG9saWNpZXMYAiABKAsyOC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvblBvbGljaWVzQga6SAPIAQEikwEKIFVwZGF0ZU9yZ2FuaXphdGlvbkVtYmVkZGluZ0lucHV0EhkKBm9yZ19pZBgBIAEoCUIJukgGcgQQARhAElQKCWVtYmVkZGluZxgCIAEoCzI5LmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uRW1iZWRkaW5nQga6SAPIAQEi5QIKF1VwZGF0ZU9yZ2FuaXphdGlvbklucHV0EkoKCHJlc291cmNlGAEgASgLMjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb25CBrpIA9gBAxI3Cgt1cGRhdGVfbWFzaxgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCBrpIA8gBATrEAbpIwAEavQEKF3VwZGF0ZV9uYW1lc19pdHNfdGFyZ2V0EkxyZXNvdXJjZS5tZXRhZGF0YS5pZCBpcyByZXF1aXJlZDogYW4gdXBkYXRlIG5hbWVzIHRoZSBvcmdhbml6YXRpb24gYnkgaXRzIGlkGlRoYXModGhpcy5yZXNvdXJjZSkgJiYgaGFzKHRoaXMucmVzb3VyY2UubWV0YWRhdGEpICYmIHRoaXMucmVzb3VyY2UubWV0YWRhdGEuaWQgIT0gJydiBnByb3RvMw",[file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_spec,file_buf_validate_validate,file_google_protobuf_field_mask2]),OrganizationsSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,0);var ChildOrgListSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,5);var UpdateOrganizationInputSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,8);var file_ai_stigmer_tenancy_organization_v1_command=fileDesc("CjBhaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2NvbW1hbmQucHJvdG8SImFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEysgkKHU9yZ2FuaXphdGlvbkNvbW1hbmRDb250cm9sbGVyEmsKBWFwcGx5EjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24aMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhJyCgZjcmVhdGUSMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhowLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIgTQuBgBErwBCgZ1cGRhdGUSOy5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLlVwZGF0ZU9yZ2FuaXphdGlvbklucHV0GjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iQ8K4GD8IAhAeIhRyZXNvdXJjZS5tZXRhZGF0YS5pZCojdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBvcmdhbml6YXRpb24SxwEKDnVwZGF0ZVBvbGljaWVzEkMuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5VcGRhdGVPcmdhbml6YXRpb25Qb2xpY2llc0lucHV0GjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iPsK4GDoIAhAeIgZvcmdfaWQqLHVuYXV0aG9yaXplZCB0byB1cGRhdGUgb3JnYW5pemF0aW9uIHBvbGljaWVzEtMBCg91cGRhdGVFbWJlZGRpbmcSRC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLlVwZGF0ZU9yZ2FuaXphdGlvbkVtYmVkZGluZ0lucHV0GjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iSMK4GEQIAhAeIgZvcmdfaWQqNnVuYXV0aG9yaXplZCB0byB1cGRhdGUgb3JnYW5pemF0aW9uIGVtYmVkZGluZyBzZXR0aW5ncxKjAQoGcmVuYW1lEisuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlJlbmFtZUlucHV0GjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iOsK4GDYIAxAeIgtyZXNvdXJjZV9pZCojdW5hdXRob3JpemVkIHRvIHJlbmFtZSBvcmdhbml6YXRpb24SpAEKBmRlbGV0ZRIyLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uSWQaMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbiI0wrgYMAgDEB4iBXZhbHVlKiN1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG9yZ2FuaXphdGlvbhoEoP8rHmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io]),OrganizationCommandController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_command,0);var file_ai_stigmer_tenancy_organization_v1_query=fileDesc("Ci5haS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL3F1ZXJ5LnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxMvAFChtPcmdhbml6YXRpb25RdWVyeUNvbnRyb2xsZXISnwEKA2dldBIyLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uSWQaMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbiIywrgYLggyEB4iBXZhbHVlKiF1bmF1dGhvcml6ZWQgdG8gdmlldyBvcmdhbml6YXRpb24SgQEKCGxpc3RNaW5lEjwuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5MaXN0TXlPcmdhbml6YXRpb25zSW5wdXQaMS5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbnMiBNC4GAES2QEKD2dldEJ5RXh0ZXJuYWxJZBI+LmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uRXh0ZXJuYWxMb29rdXAaMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbiJUwrgYUAgxEB4iCnBhcmVudF9vcmcqPnVuYXV0aG9yaXplZCB0byBtYW5hZ2UgdGhpcyBvcmdhbml6YXRpb24ncyBjaGlsZCBvcmdhbml6YXRpb25zEsgBCg1saXN0Q2hpbGRPcmdzEjYuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5MaXN0Q2hpbGRPcmdzSW5wdXQaMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLkNoaWxkT3JnTGlzdCJNwrgYSQgxEB4iA29yZyo+dW5hdXRob3JpemVkIHRvIG1hbmFnZSB0aGlzIG9yZ2FuaXphdGlvbidzIGNoaWxkIG9yZ2FuaXphdGlvbnMaBKD/Kx5iBnByb3RvMw",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io]),OrganizationQueryController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_query,0);var POLICIES_ORGANIZATION_KEY="policiesOrganization";function defaultOrganizationPolicies(){return create2(OrganizationPoliciesSchema,{membersCanCreateAgents:!0})}function opensAgentCreation(before,after){return after.membersCanCreateAgents&&before?.membersCanCreateAgents!==!0}function closesAgentCreation(before,after){return!after.membersCanCreateAgents&&before?.membersCanCreateAgents!==!1}async function announce(lifecycle,organizationId,before,after){if(lifecycle?.onOrganizationPoliciesChanged!==void 0)try{await lifecycle.onOrganizationPoliciesChanged({organizationId,before,after})}catch(error3){throw internalError(error3,"failed to apply the organization's policies")}}function newDefaultOrganizationPoliciesStep(){return{name:"DefaultOrganizationPolicies",execute(ctx){let spec=ctx.newState.spec??=create2(OrganizationSpecSchema);spec.policies??=defaultOrganizationPolicies()}}}function newAnnounceCreatedOrganizationPoliciesStep(lifecycle){return{name:"AnnounceCreatedOrganizationPolicies",async execute(ctx){let after=ctx.newState.spec?.policies??defaultOrganizationPolicies();after.membersCanCreateAgents&&await announce(lifecycle,ctx.newState.metadata?.id??"",void 0,after)}}}function newPreservePoliciesStep(){return{name:"PreservePolicies",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("organization update reached PreservePolicies without its loaded row"),"failed to update organization");let stored=existing.spec?.policies;if(stored===void 0){ctx.newState.spec!==void 0&&(ctx.newState.spec.policies=void 0);return}let spec=ctx.newState.spec??=create2(OrganizationSpecSchema);spec.policies=clone(OrganizationPoliciesSchema,stored)}}}function newLoadOrganizationForPoliciesStep(store){return{name:"LoadOrganizationForPolicies",async execute(ctx){let organization;try{organization=await store.getResource(ApiResourceKind.organization,ctx.input.orgId,OrganizationSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Organization",ctx.input.orgId):internalError(error3,"failed to load organization")}ctx.set(POLICIES_ORGANIZATION_KEY,organization)}}}function newChangeOrganizationPoliciesStep(store,lifecycle){return{name:"ChangeOrganizationPolicies",async execute(ctx){let organization=ctx.get(POLICIES_ORGANIZATION_KEY),id=organization.metadata?.id??"",before=organization.spec?.policies,after=clone(OrganizationPoliciesSchema,ctx.input.policies??create2(OrganizationPoliciesSchema));if(before!==void 0&&before.membersCanCreateAgents===after.membersCanCreateAgents){await announce(lifecycle,id,before,after);return}closesAgentCreation(before,after)&&await announce(lifecycle,id,before,after);try{let written=await store.updateResource(ApiResourceKind.organization,id,OrganizationSchema,live=>{(live.spec??=create2(OrganizationSpecSchema)).policies=clone(OrganizationPoliciesSchema,after),setAuditFieldsForUpdate(OrganizationSchema,live,"spec_audit",ctx.callerIdentity)});ctx.set(POLICIES_ORGANIZATION_KEY,written)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Organization",id):internalError(error3,"failed to save organization")}opensAgentCreation(before,after)&&await announce(lifecycle,id,before,after)}}}var organizationSearchExtractor={kind:ApiResourceKind.organization,schema:OrganizationSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let org=resource;return buildSearchResult({kind:ApiResourceKind.organization,metadata:org.metadata,summary:org.spec?.description??"",score,createdAt:org.status?.audit?.specAudit?.createdAt,updatedAt:org.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let org=resource,metadata=org.metadata;if(metadata!==void 0)return{name:metadata.name,description:org.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(org.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var ORGANIZATION_PARENT_DELETING="ORGANIZATION_PARENT_DELETING",MARKED_KEY="organizationDeletionMarked",ACCEPTED_KEY="organizationDeletionAccepted",ORGANIZATION3="Organization";function loadedOrganizationId(ctx,step){let id=ctx.get(EXISTING_RESOURCE_KEY)?.metadata?.id??"";if(id==="")throw internalError(new Error(`organization delete reached ${step} without its loaded row`),"failed to delete organization");return id}function newMarkDeletingStep(store){return{name:"MarkDeleting",async execute(ctx){let id=loadedOrganizationId(ctx,"MarkDeleting"),marked;try{marked=await store.organizationDeletions.mark(id,new Date().toISOString())}catch(error3){throw internalError(error3,"failed to delete organization")}if(!marked)throw notFoundError(ORGANIZATION3,id);ctx.set(MARKED_KEY,!0)}}}function newAcceptPurgeStep(store,purge){return{name:"AcceptPurge",async execute(ctx){let id=loadedOrganizationId(ctx,"AcceptPurge"),accepted;try{accepted=await store.organizationDeletions.accept(id,new Date().toISOString())}catch(error3){throw internalError(error3,"failed to delete organization")}if(!accepted)throw internalError(new Error(`the deletion mark of ${id} was no longer pending`),"failed to delete organization");ctx.set(ACCEPTED_KEY,!0),purge.kick(id)}}}async function unmarkAfterFailure(store,logger2,ctx){if(ctx.get(MARKED_KEY)!==!0||ctx.get(ACCEPTED_KEY)===!0)return;let id=ctx.get(EXISTING_RESOURCE_KEY)?.metadata?.id??"";try{await store.organizationDeletions.unmark(id)}catch(error3){logger2.error("organization delete failed and its deletion mark could not be removed; the purge runner removes it once it is stale",{org:id,error:error3 instanceof Error?error3.message:String(error3)})}}function newRefuseParentDeletingStep(store,purge){return{name:"RefuseParentDeleting",async execute(ctx){let parentId=parentOrgOf(ctx.newState);if(parentId==="")return;let id=metadataOf(ctx.newState)?.id??"";try{if(!await store.organizationDeletions.isDeleting(parentId))return;let now=new Date().toISOString();await store.organizationDeletions.mark(id,now),await store.organizationDeletions.accept(id,now)}catch(error3){throw internalError(error3,"failed to create organization")}throw purge.kick(id),failedPreconditionError("the parent organization is being deleted",{reason:ORGANIZATION_PARENT_DELETING,metadata:{parent_org:parentId}})}}}var ORGANIZATION_SLUG_RESERVED="ORGANIZATION_SLUG_RESERVED",RENAMED_SLUG_HOLD_MS=RENAMED_NAME_HOLD_MS;var ORGANIZATION_NAME_KIND=ApiResourceKind[ApiResourceKind.organization],CLAIMED_NAME_KEY2="organizationNameClaim";function organizationNameKey(slug){return{kind:ORGANIZATION_NAME_KIND,org:"",name:slug}}function organizationSlugReservedMessage(slug){return`Organization slug '${slug}' was recently another organization's, and still leads to it`}function refusalForHeldName(entry){return entry.state==="previous"?alreadyExistsWithReasonError(organizationSlugReservedMessage(entry.name),{reason:ORGANIZATION_SLUG_RESERVED,metadata:{slug:entry.name}}):alreadyExistsError("Organization",`slug '${entry.name}'`)}async function nameHolderIsGone(store,entry,now){return holderIsGone(entry,now,organizationHolder(store))}function organizationHolder(store){return storedRowHolder(store,ApiResourceKind.organization,OrganizationSchema)}async function liveOrganizationName(store,slug,now){let entry=await store.resourceNames.resolve(organizationNameKey(slug),now.toISOString());if(!(entry===void 0||await nameHolderIsGone(store,entry,now)))return entry}function newClaimOrganizationSlugStep(store){return{name:"ClaimOrganizationSlug",async execute(ctx){let metadata=metadataOf(ctx.newState),slug=metadata?.slug??"",id=metadata?.id??"";if(slug===""||id==="")throw internalError(new Error("organization slug or id is empty"),"failed to claim the organization slug");let claim;try{claim=await claimFreeingGoneHolder(store,slug,id,new Date)}catch(error3){throw internalError(error3,"failed to claim the organization slug")}if(!claim.claimed)throw refusalForHeldName(claim.entry);ctx.set(CLAIMED_NAME_KEY2,claim.entry)}}}async function claimFreeingGoneHolder(store,slug,id,now){return claimName(store,organizationNameKey(slug),id,now,organizationHolder(store))}async function releaseSlugClaimAfterFailure(store,logger2,ctx){let entry=ctx.get(CLAIMED_NAME_KEY2);if(entry!==void 0){try{await store.getResource(ApiResourceKind.organization,entry.id,OrganizationSchema);return}catch(error3){if(!(error3 instanceof ResourceNotFoundError)){logger2.error("organization create failed and its slug claim could not be checked; the slug stays claimed",{slug:entry.name,error:error3 instanceof Error?error3.message:String(error3)});return}}try{await store.resourceNames.release(entry.kind,entry.org,entry.id)}catch(error3){logger2.error("organization create failed and its slug claim could not be released; the slug stays claimed",{slug:entry.name,error:error3 instanceof Error?error3.message:String(error3)})}}}function newRetireOrganizationSlugStep(store,logger2){return{name:"RetireOrganizationSlug",async execute(ctx){let id=ctx.get(EXISTING_RESOURCE_KEY)?.metadata?.id??"";if(id==="")throw internalError(new Error("organization delete reached RetireOrganizationSlug without its loaded row"),"failed to release the organization slug");try{await store.resourceNames.release(ORGANIZATION_NAME_KIND,"",id)}catch(error3){logger2.error("organization deleted but its names could not be released; a later claim frees them",{org:id,error:error3 instanceof Error?error3.message:String(error3)})}}}}function newOrganizationNameResolver(store){return{async resolve(name){return(await store.resourceNames.resolve(organizationNameKey(name),new Date().toISOString()))?.id}}}async function settleOrganizationSlug(store,organization,logger2){let metadata=organization.metadata;if(!(metadata===void 0||metadata.id===""))try{for(let attempt=0;attempt<SETTLE_ATTEMPTS;attempt++){let current=await store.resourceNames.current(ORGANIZATION_NAME_KIND,"",metadata.id);if(current===void 0||current.name===metadata.slug)return;metadata.slug=current.name,await store.updateResource(ApiResourceKind.organization,metadata.id,OrganizationSchema,row=>{row.metadata!==void 0&&(row.metadata.slug=current.name)})}}catch(error3){logger2.warn("organization row left behind its current name; the next rename settles it",{org:metadata.id,error:error3 instanceof Error?error3.message:String(error3)})}}var SETTLE_ATTEMPTS=3;var RENAMED_ORGANIZATION_KEY="renamedOrganization",NAME_MOVE_KEY2="organizationNameMove";function newLoadOrganizationForRenameStep(store){return{name:"LoadOrganizationForRename",async execute(ctx){let organization;try{organization=await store.getResource(ApiResourceKind.organization,ctx.input.resourceId,OrganizationSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Organization",ctx.input.resourceId):internalError(error3,"failed to load organization")}ctx.set(RENAMED_ORGANIZATION_KEY,organization)}}}function newRenameOrganizationSlugStep(store){return{name:"RenameOrganizationSlug",async execute(ctx){let metadata=ctx.get(RENAMED_ORGANIZATION_KEY).metadata;if(metadata===void 0||metadata.id===""||metadata.slug==="")throw internalError(new Error("organization row has no id or slug"),"failed to rename the organization");let current;try{current=await store.resourceNames.current(ORGANIZATION_NAME_KIND,"",metadata.id)}catch(error3){throw internalError(error3,"failed to rename the organization")}let from2=current?.name??metadata.slug;if(from2===ctx.input.slug){metadata.slug=from2;return}let now=new Date,move={kind:ORGANIZATION_NAME_KIND,org:"",id:metadata.id,from:from2,to:ctx.input.slug,fromExpiresAt:new Date(now.getTime()+RENAMED_SLUG_HOLD_MS).toISOString(),now:now.toISOString()},moved;try{moved=await moveName(store,move,organizationHolder(store))}catch(error3){throw internalError(error3,"failed to rename the organization")}if(!moved.claimed)throw refusalForHeldName(moved.entry);let recorded={move,undo:moved};ctx.set(NAME_MOVE_KEY2,recorded)}}}function newPersistRenamedOrganizationStep(store,logger2){return{name:"PersistRenamedOrganization",async execute(ctx){let recorded=ctx.get(NAME_MOVE_KEY2);if(recorded===void 0)return;let{move,undo}=recorded,identity2=ctx.callerIdentity,organization;try{organization=await store.updateResource(ApiResourceKind.organization,move.id,OrganizationSchema,row=>{row.metadata!==void 0&&(row.metadata.slug=move.to),setAuditFieldsForUpdate(OrganizationSchema,row,"spec_audit",identity2,"renamed")})}catch(error3){try{await store.resourceNames.revertRename(move,undo)}catch(revertError){logger2.error("organization rename failed and its names could not be moved back; both slugs lead to the organization until a retry",{org:move.id,from:move.from,to:move.to,error:revertError instanceof Error?revertError.message:String(revertError)})}throw error3 instanceof ResourceNotFoundError?notFoundError("Organization",move.id):internalError(error3,"failed to save organization")}ctx.set(RENAMED_ORGANIZATION_KEY,organization),await settleOrganizationSlug(store,organization,logger2)}}}function newIndexOrganizationAfterRenameStep(store,logger2){return{name:"IndexOrganizationAfterRename",async execute(ctx){if(ctx.get(NAME_MOVE_KEY2)===void 0)return;let organization=ctx.get(RENAMED_ORGANIZATION_KEY),id=organization.metadata?.id??"",entry=organizationSearchExtractor.getSearchIndexEntry(organization);if(entry!==void 0)try{await store.upsertSearchIndex(ApiResourceKind.organization,id,entry)}catch(error3){logger2.warn("IndexOrganizationAfterRename: failed (best-effort)",{id,error:error3 instanceof Error?error3.message:String(error3)})}}}}function newCheckOrgDuplicateStep(store){return{name:"CheckDuplicate",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("organization metadata is nil"),"duplicate check");if(metadata.slug==="")throw internalError(new Error("organization slug is empty"),"duplicate check");let entry;try{entry=await liveOrganizationName(store,metadata.slug,new Date)}catch(error3){throw internalError(error3,"failed to check for duplicate organization")}if(entry!==void 0)throw refusalForHeldName(entry)}}}var BOUND_CREDENTIAL_CREATES_NO_ORGANIZATION_MESSAGE="this credential is limited to one organization and cannot create another, except a child of that organization; sign in as yourself to create an organization";function newRefuseBoundCredentialStep(){return{name:"RefuseBoundCredential",execute(ctx){let bound2=boundOrgOf(ctx.callerIdentity);if(bound2!==void 0&&parentOrgRequested(ctx.input)!==bound2)throw new ConnectError(BOUND_CREDENTIAL_CREATES_NO_ORGANIZATION_MESSAGE,Code.PermissionDenied)}}}function parentOrgRequested(input){return isMessage2(input,OrganizationSchema)?input.spec?.parentOrg??"":""}function newRefuseOrganizationOrgStep(resolver){return{name:"RefuseOrganizationOrg",async execute(ctx){let metadata=metadataOf(ctx.newState),org=metadata?.org??"";if(metadata!==void 0&&org!==""&&(org===metadata.id||org===metadata.slug||metadata.slug!==""&&org===await resolver.resolve(metadata.slug))){metadata.org="";return}if(org!=="")throw invalidArgumentError("an organization belongs to no organization: metadata.org must be empty")}}}async function readOrganization(store,id){try{return await store.readResourceForWrite(ApiResourceKind.organization,id,OrganizationSchema)}catch(error3){if(error3 instanceof ResourceNotFoundError)return;throw error3}}async function organizationBySlug(store,slug){let entry=await liveOrganizationName(store,slug,new Date);if(entry?.state==="previous")throw slugRenamedError(ApiResourceKind.organization,slug);return entry===void 0?void 0:readOrganization(store,entry.id)}async function organizationForApply(store,id,slug){let byId=id===""?void 0:await readOrganization(store,id);return byId!==void 0||slug===""?byId:organizationBySlug(store,slug)}function newLoadOrganizationForApplyStep(store){return{name:"LoadForApply",async execute(ctx){let metadata=metadataOf(ctx.newState),existing=metadata===void 0?void 0:(await organizationForApply(store,metadata.id,metadata.slug))?.resource;if(existing===void 0){ctx.set(EXISTS_IN_DATABASE_KEY,!1),ctx.set(SHOULD_CREATE_KEY,!0);return}ctx.set(EXISTING_RESOURCE_KEY,existing),ctx.set(EXISTS_IN_DATABASE_KEY,!0),ctx.set(SHOULD_CREATE_KEY,!1),metadata!==void 0&&(metadata.id=existing.metadata?.id??"")}}}function newLoadExistingOrganizationStep(store){return{name:"LoadExisting",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"load existing");if(metadata.id===""&&metadata.slug==="")throw invalidArgumentError("resource id or slug is required for update");let read3=metadata.id!==""?await readOrganization(store,metadata.id):await organizationBySlug(store,metadata.slug);if(read3===void 0)throw notFoundError("Organization",metadata.id!==""?metadata.id:metadata.slug);metadata.id=read3.resource.metadata?.id??"",ctx.set(EXISTING_RESOURCE_KEY,read3.resource),ctx.set(EXISTING_RESOURCE_BYTES_KEY,read3.bytes)}}}function newRevokeOrganizationGrantsStep(grantPath){return{name:"RevokeOrganizationGrants",async execute(ctx){let id=ctx.get(EXISTING_RESOURCE_KEY)?.metadata?.id??"";if(id==="")throw internalError(new Error("organization delete reached RevokeOrganizationGrants without its loaded row"),"failed to remove the organization's grants");try{await grantPath.cleanupResource(create2(ApiResourceRefSchema,{kind:ApiResourceKind[ApiResourceKind.organization],id}),ctx.callerIdentity)}catch(error3){throw internalError(error3,"failed to remove the organization's grants")}}}}function registerOrganizationServices(router,deps){router.service(OrganizationCommandController,{apply:(org,ctx)=>apply8(deps,org,ctx),create:(org,ctx)=>createOrganization(deps,org,ctx),update:(input,ctx)=>update11(deps,input,ctx),updatePolicies:(input,ctx)=>updatePolicies(deps,input,ctx),updateEmbedding:(input,ctx)=>updateEmbedding(deps,input,ctx),rename:(input,ctx)=>rename8(deps,input,ctx),delete:(orgId,ctx)=>deleteOrganization(deps,orgId,ctx)}),router.service(OrganizationQueryController,{get:(orgId,ctx)=>get14(deps,orgId,ctx),listMine:(input,ctx)=>listMine(deps,input,ctx),getByExternalId:(lookup3,ctx)=>getByExternalId2(deps,lookup3,ctx),listChildOrgs:(input,ctx)=>listChildOrgs(deps,input,ctx)})}function kindOf17(ctx){return ctx.values.get(apiResourceKindKey)}async function createOrganization(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx)),builder2=newPipeline("organization-create",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.create,deps.authorizer)).addStep(newRefuseServiceAccountCallerStep("create organizations",deps.accounts)).addStep(newRefuseBoundCredentialStep()).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newRefuseOrganizationOrgStep(newOrganizationNameResolver(deps.store))).addStep(newValidateVisibilityStep()).addStep(newDefaultOrganizationPoliciesStep()).addStep(newClearEmbeddingStep()).addStep(newCheckOrgDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newValidateChildOrganizationStep(deps.store,deps.authorizer)).addStep(newNormalizeReferencesStep(deps.store)).addStep(newValidateReferencesStep(deps.store,deps.authorizer));deps.orgLimit!==void 0&&builder2.addStep(newOrganizationLimitStep(deps.store,deps.orgLimit));for(let step of stepsForSlot(deps.gateSteps,"org-create:pre-side-effect-gate"))builder2.addStep(step);builder2.addStep(newClaimOrganizationSlugStep(deps.store)).addStep(newClaimExternalIdStep(deps.store)).addStep(newLinkChildOrganizationStep(deps.authorizationLifecycle)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newRefuseParentDeletingStep(deps.store,deps.purge)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger,childOwnerAttribution)).addStep(newAnnounceCreatedOrganizationPoliciesStep(deps.authorizationLifecycle));for(let step of stepsForSlot(deps.gateSteps,"org-create:post-persist"))builder2.addStep(step);let pipeline2=builder2.addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build();try{await pipeline2.execute(reqCtx)}catch(error3){throw await releaseSlugClaimAfterFailure(deps.store,deps.logger,reqCtx),await releaseExternalIdClaimAfterFailure(deps.store,deps.logger,reqCtx),error3}return reqCtx.newState}var ORGANIZATION_REFUSED_UPDATE_PATHS=[{path:"spec.policies",writtenBy:"updatePolicies"},{path:"spec.embedding",writtenBy:"updateEmbedding"},{path:"spec.parent_org",writtenBy:"create"},{path:"spec.external_id",writtenBy:"create"}];async function update11(deps,input,ctx){return runGuardedWrite(async()=>{let reqCtx=updateContext(OrganizationSchema,input,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-update",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.update,deps.authorizer,input)).addStep(newResolveSlugStep({update:!0})).addStep(newLoadExistingOrganizationStep(deps.store)).addStep(newBuildUpdateStateStep({refused:ORGANIZATION_REFUSED_UPDATE_PATHS})).addStep(newValidateProtoStep({of:"state"})).addStep(newPreserveChildLinkStep()).addStep(newPreservePoliciesStep()).addStep(newPreserveEmbeddingStep()).addStep(newNormalizeReferencesStep(deps.store)).addStep(newValidateReferencesStep(deps.store,deps.authorizer,{judge:"introduced"})).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState})}async function updatePolicies(deps,input,ctx){let reqCtx=new RequestContext(OrganizationCommandController.method.updatePolicies.input,input,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-update-policies",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.updatePolicies,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadOrganizationForPoliciesStep(deps.store)).addStep(newChangeOrganizationPoliciesStep(deps.store,deps.authorizationLifecycle)).build().execute(reqCtx),reqCtx.get(POLICIES_ORGANIZATION_KEY)}var EMBEDDING_ACT="change the organization's embedding settings";async function updateEmbedding(deps,input,ctx){let reqCtx=embeddingContext(input,callerIdentityOf(ctx));return await newPipeline("organization-update-embedding",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.updateEmbedding,deps.authorizer,input)).addStep(newRefuseServiceAccountCallerStep(EMBEDDING_ACT,deps.accounts)).addStep(newLoadExistingOrganizationStep(deps.store)).addStep(newBuildEmbeddingStateStep()).addStep(newValidateProtoStep({of:"state"})).addStep(newValidateSignInRoleStep()).addStep(newNormalizeReferencesStep(deps.store)).addStep(newValidateReferencesStep(deps.store,deps.authorizer)).addStep(newVaultAttachmentsStep(deps.store,deps.authorizer,EMBEDDING_VAULT_ATTACHMENTS)).addStep(newPersistEmbeddingStep(deps.store)).build().execute(reqCtx),reqCtx.get(EMBEDDING_ORGANIZATION_KEY)}async function rename8(deps,input,ctx){let reqCtx=new RequestContext(OrganizationCommandController.method.rename.input,input,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-rename",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.rename,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadOrganizationForRenameStep(deps.store)).addStep(newRenameOrganizationSlugStep(deps.store)).addStep(newPersistRenamedOrganizationStep(deps.store,deps.logger)).addStep(newIndexOrganizationAfterRenameStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(RENAMED_ORGANIZATION_KEY)}async function apply8(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx));await newPipeline("organization-apply",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newRefuseOrganizationOrgStep(newOrganizationNameResolver(deps.store))).addStep(newLoadOrganizationForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOrganization(deps,org,ctx):update11(deps,everyPathUpdate(UpdateOrganizationInputSchema,withResolvedApplyId(OrganizationSchema,org,reqCtx)),ctx)}async function deleteOrganization(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationCommandController.method.delete.input,orgId,callerIdentityOf(ctx),kindOf17(ctx)),builder2=newPipeline("organization-delete",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.delete,deps.authorizer)).addStep(newRefuseServiceAccountCallerStep("delete organizations",deps.accounts)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,OrganizationSchema));deps.orgLimit===1&&builder2.addStep(newRefuseDeletingSingleOrganizationStep(deps.store)),builder2.addStep(newRefuseDeletingParentStep(deps.store)).addStep(newMarkDeletingStep(deps.store)).addStep(newRefuseDeletingParentStep(deps.store));for(let step of stepsForSlot(deps.gateSteps,"org-delete:pre-delete"))builder2.addStep(step);let pipeline2=builder2.addStep(newRevokeOrganizationGrantsStep(deps.grantPath)).addStep(newAcceptPurgeStep(deps.store,deps.purge)).build();try{await pipeline2.execute(reqCtx)}catch(error3){throw await unmarkAfterFailure(deps.store,deps.logger,reqCtx),error3}let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted organization not found in context"),"delete operation lost its loaded resource");return deleted}async function get14(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.get.input,orgId,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-get",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OrganizationSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function listMine(deps,input,ctx){let deleting;try{deleting=await deletingOrganizationIds(deps.store)}catch(error3){throw internalError(error3,"failed to list organizations")}let request3={pageSize:input.pageSize,pageToken:input.pageToken},keep=org=>!deleting.has(org.metadata?.id??"")&&matchesAllLabels(org.metadata?.labels??{},input.labels),fingerprint=listPageFingerprint({labels:sortedLabels(input.labels)}),directory=deps.organizationDirectory;if(directory!==void 0){let authorized=await directory.listMyOrganizationIds(callerIdentityOf(ctx));if(authorized!=="all"){let loaded=[];for(let id of authorized)if(!deleting.has(id))try{loaded.push(await deps.store.getResource(ApiResourceKind.organization,id,OrganizationSchema))}catch(error3){if(error3 instanceof ResourceNotFoundError)continue;throw internalError(error3,"failed to list organizations")}let page2=await readPage({source:inHandListPageSource(OrganizationSchema,loaded),request:request3,fingerprint,decode:decodeOrganization,keep,scope:rows=>Promise.resolve(rows),failure:"failed to list organizations"});return create2(OrganizationsSchema,{entries:page2.entries,nextPageToken:page2.nextPageToken})}}let page=await readListPage({store:deps.store,declaration:organizationListIndex,query:{},request:request3,fingerprint,decode:decodeOrganization,keep,scope:rows=>Promise.resolve(rows),failure:"failed to list organizations"});return create2(OrganizationsSchema,{entries:page.entries,nextPageToken:page.nextPageToken})}async function deletingOrganizationIds(store){return new Set((await store.organizationDeletions.list()).map(row=>row.org))}async function getByExternalId2(deps,input,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.getByExternalId.input,input,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-get-by-external-id",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.getByExternalId,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx),getChildByExternalId(deps.store,input.parentOrg,input.externalId)}async function listChildOrgs(deps,input,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.listChildOrgs.input,input,callerIdentityOf(ctx),kindOf17(ctx));await newPipeline("organization-list-child-orgs",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.listChildOrgs,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx);let deleting;try{deleting=await deletingOrganizationIds(deps.store)}catch(error3){throw internalError(error3,"failed to list child organizations")}let page=await readListPage({store:deps.store,declaration:organizationListIndex,query:{anyKey:[{name:"parent_org",value:input.org}]},request:{pageSize:input.pageSize,pageToken:input.pageToken},fingerprint:listPageFingerprint({org:input.org,labels:sortedLabels(input.labels)}),decode:decodeOrganization,keep:child=>parentOrgOf(child)===input.org&&!deleting.has(child.metadata?.id??"")&&matchesAllLabels(child.metadata?.labels??{},input.labels),scope:rows=>Promise.resolve(rows),failure:"failed to list child organizations"});return create2(ChildOrgListSchema,{entries:page.entries,nextPageToken:page.nextPageToken})}var QUIESCE_STAGE="quiesce",CONTENT_STAGE="content",SHRED_STAGE="shred",CHILDREN_STAGE="children",FINAL_STAGE="final",PURGE_TERMINATION_REASON="its organization was deleted",ENGINE_UNREACHABLE_FOR_PURGE="the execution engine is unreachable, and the organization has runs that may still be live",EXECUTION_PAGE=200,DONE={more:!1},MORE={more:!0};function newQuiesceStage(deps){return{name:QUIESCE_STAGE,async run(context2){return(await deps.routinePurge.purge(context2.org,context2.caller)).more?MORE:(await terminateAgentExecutions(deps,context2),await deprovisionSandboxes(deps,context2),await deps.store.pendingOAuthStates.deleteByOrg(context2.org.id),await deps.store.connectLinks.deleteByOrg(context2.org.id),await deps.store.connectAttempts.deleteByOrg(context2.org.id),DONE)}}}async function*organizationRows(store,declaration,org){let after;for(;;){let rows=await store.queryResources(declaration,{org,limit:EXECUTION_PAGE,...after===void 0?{}:{after}});for(let row of rows)yield row.data;if(rows.length<EXECUTION_PAGE)return;after=rows[rows.length-1].cursor}}async function terminateAgentExecutions(deps,context2){for await(let data of organizationRows(deps.store,agentExecutionListIndex,context2.org.id)){let execution=fromBinary2(RunSchema,data);if(isTerminalExecutionPhase(execution.status?.phase??0))continue;let state2=deps.agentEngine();if(!state2.connected)throw new Error(ENGINE_UNREACHABLE_FOR_PURGE);let id=execution.metadata?.id??"";try{await state2.engine.terminateWorkflow(id,PURGE_TERMINATION_REASON)}catch(error3){if(!(error3 instanceof EngineWorkflowNotFoundError))throw error3}}}async function deprovisionSandboxes(deps,context2){let lane=deps.sandboxLane;if(lane.enabled)for await(let data of organizationRows(deps.store,sessionListIndex,context2.org.id)){let id=fromBinary2(SessionSchema,data).metadata?.id??"";id!==""&&await lane.provisioner.deprovisionSessionSandbox(id)}}function newContentStage(purges){return{name:CONTENT_STAGE,async run(context2){for(let purge of purges)if((await purge.purge(context2.org,context2.caller)).more)return MORE;return DONE}}}function newShredStage(secrets){return{name:SHRED_STAGE,async run(context2){return await secrets.destroyOrganization(context2.org.id),DONE}}}function newChildrenStage(store){return{name:CHILDREN_STAGE,async run(context2){let children=await store.queryResources(organizationListIndex,{anyKey:[{name:"parent_org",value:context2.org.id}]});if(children.length===0)return DONE;let now=new Date().toISOString();for(let child of children)await store.organizationDeletions.isDeleting(child.id)||(await store.organizationDeletions.mark(child.id,now),await store.organizationDeletions.accept(child.id,now));return{more:!0,wait:!0}}}}function newFinalStage(deps){return{name:FINAL_STAGE,async run(context2){for(let sweep of deps.sweepFirst??[])for(;;){let progress=await sweep.run(context2);if(!progress.more)break;if(progress.wait===!0)return progress}let id=context2.org.id,organization=await loadOrganization2(deps.store,id)??create2(OrganizationSchema,{metadata:{id},spec:{parentOrg:context2.org.parentOrg}});deps.lifecycle!==void 0&&await deps.lifecycle.onResourceDeleted({kind:ApiResourceKind.organization,resourceId:id,orgId:"",caller:context2.caller});let ctx=new RequestContext(OrganizationCommandController.method.delete.input,create2(OrganizationCommandController.method.delete.input,{value:id}),context2.caller,ApiResourceKind.organization);return ctx.set(RESOURCE_ID_KEY,id),ctx.set(EXISTING_RESOURCE_KEY,organization),await deps.store.deleteSearchIndexByOrg(id),await deps.store.deleteRoutineFiresByOrg(id),await deps.store.sessionEvents.deleteByOrg(id),await newPipeline("organization-purge-final",deps.logger).addStep(newRevokeOrganizationGrantsStep(deps.grantPath)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newRetireOrganizationSlugStep(deps.store,deps.logger)).addStep(newReleaseExternalIdStep(deps.store,deps.logger)).build().execute(ctx),await deps.store.organizationDeletions.release(id),DONE}}}async function loadOrganization2(store,id){try{return await store.getResource(ApiResourceKind.organization,id,OrganizationSchema)}catch(error3){if(error3 instanceof ResourceNotFoundError)return;throw error3}}var SCAN_PAGE=500,REFUSED_KINDS=new Set([ApiResourceKind.api_key,ApiResourceKind.grant,ApiResourceKind.identity_account]);function tokenOf(kind,read3,id,createdAt=""){let token={kind:kindEnumName(kind),read:read3,id,createdAt};return JSON.stringify(token)}function positionOf(kind,read3,after){let parsed;try{parsed=JSON.parse(after)}catch{parsed=void 0}let token=parsed;if(token?.kind!==kindEnumName(kind)||token.read!==read3||typeof token.id!="string"||typeof token.createdAt!="string")throw new Error(`organization rows: \`after\` is not a page's \`next\` from the ${kindEnumName(kind)} reader`);return{kind:token.kind,read:read3,id:token.id,createdAt:token.createdAt}}function newOrganizationRows(store,listIndexes,org){let indexOf2=new Map(listIndexes.map(index2=>[index2.kind,index2])),orgOf2=(schema2,data)=>metadataOf(fromBinary2(schema2,data))?.org??"";async function indexed(index2,schema2,after,limit){let from2=after===""?void 0:positionOf(index2.kind,"index",after),rows=await store.queryResources(index2,{org,limit,...from2===void 0?{}:{after:{createdAt:from2.createdAt,id:from2.id}}}),last=rows[rows.length-1];return{ids:rows.filter(row=>orgOf2(schema2,row.data)===org).map(row=>row.id),next:rows.length<limit||last===void 0?void 0:tokenOf(index2.kind,"index",last.cursor.id,last.cursor.createdAt)}}async function scanned(kind,schema2,after,limit){let ids=[],from2=after===""?"":positionOf(kind,"scan",after).id;for(;;){let page=await store.findResourcesRawOrderedAfter(kind,from2,SCAN_PAGE);for(let raw of page)if(orgOf2(schema2,raw.data)===org&&(ids.push(raw.id),ids.length>=limit))return{ids,next:tokenOf(kind,"scan",raw.id)};if(page.length<SCAN_PAGE)return{ids,next:void 0};from2=page[page.length-1].id}}return{async ids(kind,schema2,{after,limit}){if(REFUSED_KINDS.has(kind))throw new Error(`organization rows: ${kindEnumName(kind)} rows do not name their organization in metadata.org`);if(!Number.isInteger(limit)||limit<=0)throw new Error(`organization rows: a page's limit is a positive integer, not ${limit}`);let index2=indexOf2.get(kind);return index2===void 0?scanned(kind,schema2,after,limit):indexed(index2,schema2,after,limit)}}}var PURGE_PASS_INTERVAL_MS=30*1e3,STALE_HEARTBEAT_MS=300*1e3,STALE_PENDING_MS=600*1e3,RETRY_BASE_MS=30*1e3,RETRY_MAX_MS=900*1e3,PURGE_FAULT_MESSAGE="the purge stage failed; it will be retried";var OrganizationPurgeRunner=class{deps;now;caller=serverActingFor(PURGE_ACTOR);running=new Set;owned=new Set;backoff=new Map;timer;pass;queued=!1;stopped=!1;constructor(deps){this.deps=deps,this.now=deps.now??(()=>new Date);let names2=new Set;for(let stage of deps.stages){if(names2.has(stage.name))throw new Error(`organization purge stage '${stage.name}' is composed twice \u2014 stage names are unique`);names2.add(stage.name)}}start(){this.timer!==void 0||this.stopped||(this.timer=setInterval(()=>this.schedulePass(),this.deps.intervalMs??PURGE_PASS_INTERVAL_MS),this.timer.unref(),this.schedulePass())}kick(_org){this.timer===void 0||this.stopped||this.schedulePass()}async stop(){this.stopped=!0,this.timer!==void 0&&(clearInterval(this.timer),this.timer=void 0),await this.pass}schedulePass(){if(this.pass!==void 0){this.queued=!0;return}this.pass=this.runPass().finally(()=>{this.pass=void 0,this.queued&&!this.stopped&&(this.queued=!1,this.schedulePass())})}async runPass(){let deletions;try{deletions=await this.deps.store.organizationDeletions.list()}catch(error3){this.deps.logger.warn("organization purge pass could not read the deletion table",{error:errorText2(error3)});return}let nowMs=this.now().getTime();for(let deletion of deletions){if(this.stopped)return;if(deletion.phase==="pending"){await this.recoverStalePending(deletion,nowMs);continue}if(!(this.running.has(deletion.org)||!this.isDue(deletion,nowMs))){this.running.add(deletion.org);try{await this.purge(deletion)}finally{this.running.delete(deletion.org)}}}}isDue(deletion,nowMs){let held=this.backoff.get(deletion.org);return held!==void 0&&nowMs<held.until?!1:deletion.heartbeatAt===""||this.owned.has(deletion.org)?!0:nowMs-Date.parse(deletion.heartbeatAt)>=STALE_HEARTBEAT_MS}async recoverStalePending(deletion,nowMs){if(!(nowMs-Date.parse(deletion.markedAt)<STALE_PENDING_MS))try{await this.deps.store.organizationDeletions.unmark(deletion.org)&&this.deps.logger.warn("an organization delete left its mark behind; the organization is live again",{org:deletion.org,markedAt:deletion.markedAt})}catch(error3){this.deps.logger.warn("could not remove a stale organization delete mark",{org:deletion.org,error:errorText2(error3)})}}async purge(deletion){let deletions=this.deps.store.organizationDeletions,stages=this.deps.stages,resumeAt=Math.max(0,stages.findIndex(stage=>stage.name===deletion.stage)),stageName=stages[resumeAt]?.name??"";this.owned.add(deletion.org);try{let org=await this.target(deletion.org),rows=newOrganizationRows(this.deps.store,this.deps.listIndexes??[],org.id);for(let index2=resumeAt;index2<stages.length;index2++){let stage=stages[index2];for(stageName=stage.name,await deletions.heartbeat(deletion.org,stage.name,this.stamp());;){if(this.stopped)return;let progress=await stage.run({org,logger:this.deps.logger,caller:this.caller,rows});if(!progress.more)break;if(progress.wait===!0){this.backoff.delete(deletion.org);return}await deletions.heartbeat(deletion.org,stage.name,this.stamp())}}this.backoff.delete(deletion.org),this.owned.delete(deletion.org),this.deps.logger.info("organization purged",{org:deletion.org})}catch(error3){let faults=(this.backoff.get(deletion.org)?.faults??0)+1,delay2=Math.min(RETRY_MAX_MS,RETRY_BASE_MS*2**(faults-1));this.backoff.set(deletion.org,{faults,until:this.now().getTime()+delay2}),this.deps.logger.error("organization purge stage failed; retrying later",{org:deletion.org,stage:stageName,retryInMs:delay2,error:errorText2(error3)});try{await deletions.recordError(deletion.org,stageName,PURGE_FAULT_MESSAGE,this.stamp())}catch(recordError){this.deps.logger.warn("could not record an organization purge fault",{org:deletion.org,error:errorText2(recordError)})}}}async target(org){try{let row=await this.deps.store.getResource(ApiResourceKind.organization,org,OrganizationSchema);return{id:org,parentOrg:row.spec?.parentOrg??""}}catch(error3){if(error3 instanceof ResourceNotFoundError)return{id:org,parentOrg:""};throw error3}}stamp(){return this.now().toISOString()}};function errorText2(error3){return error3 instanceof Error?error3.message:String(error3)}function registerPlatformServices(router,deps){router.service(PlatformQueryController,{getServerInfo:()=>getServerInfo(deps),getLicenseStatus:()=>getLicenseStatus(deps),getModelReadiness:(input,ctx)=>getModelReadiness(deps,input,ctx),getRunnerBootstrapConfig:(_input,ctx)=>getRunnerBootstrapConfig(deps,ctx),getRunnerScopedToken:(input,ctx)=>getRunnerScopedToken(deps,input,ctx)})}function getServerInfo(deps){return create2(GetServerInfoOutputSchema,{edition:deps.edition,version:deps.version,authenticationRequired:deps.authenticationRequired,...deps.nativeSignIn!==void 0?{nativeSignIn:create2(NativeSignInSchema,deps.nativeSignIn)}:{},singleOrg:deps.singleOrganization?.current()!==void 0,environments:create2(EnvironmentAvailabilitySchema,{applies:deps.environmentPolicy.governs(ExecutionTarget.UNSPECIFIED),limitedNetworking:deps.environmentPolicy.support.limitedNetworking,packages:deps.environmentPolicy.support.packages})})}var READINESS_ENGINES=[Harness.STIGMER,Harness.CLAUDE];function wireAvailability(report){switch(report.state){case"served":return report.source==="organization"?ProviderAvailability.served_by_organization:report.source==="parent"?ProviderAvailability.served_by_parent_organization:ProviderAvailability.served_by_runners;case"missing":return report.scope==="organization"?ProviderAvailability.missing_from_organization:ProviderAvailability.missing_from_runners;case"unknown":return ProviderAvailability.availability_unknown}}async function getModelReadiness(deps,input,ctx){await authorizeDirect(PlatformQueryController.method.getModelReadiness,deps.authorizer,callerIdentityOf(ctx),input);let reports;try{reports=new Map(await Promise.all(MODEL_PROVIDERS.map(async provider=>[provider,await deps.providerAvailability.availability(input.org,provider)])))}catch(err3){throw deps.logger.warn("Model readiness could not read provider availability",{org:input.org,error:err3 instanceof Error?err3.message:String(err3)}),new ConnectError(PROVIDER_AVAILABILITY_UNAVAILABLE_COPY,Code.Unavailable)}let reportOf=provider=>reports.get(provider)??{state:"unknown"},judge2=(engine,model)=>{let placed=engine===Harness.UNSPECIFIED?Harness.STIGMER:engine,need=providerNeededBy(placed,model,deps.modelCatalog);return create2(ModelReadinessSchema,{harness:placed,model,provider:need?.provider??"",availability:need===void 0?ProviderAvailability.availability_unknown:wireAvailability(reportOf(need.provider))})};return create2(GetModelReadinessOutputSchema,{providers:MODEL_PROVIDERS.map(provider=>{let report=reportOf(provider);return create2(ProviderReadinessSchema,{provider,availability:wireAvailability(report),parentOrg:report.state==="served"&&report.source==="parent"?report.parentOrg:""})}),models:READINESS_ENGINES.flatMap(engine=>deps.modelCatalog.canonicalModels(harnessName(engine)).map(model=>judge2(engine,model))),judged:input.model===void 0?void 0:judge2(input.model.harness,input.model.model)})}async function getLicenseStatus(deps){let now=deps.now(),report=await deps.licenseStatus.status(now),output=create2(GetLicenseStatusOutputSchema,{state:report.state,checkedAt:timestampFromDate(now)});switch(report.state){case LicenseState.absent:return output;case LicenseState.invalid:return output.keyId=report.keyId,output;case LicenseState.valid:case LicenseState.expiring:case LicenseState.grace:case LicenseState.expired:return output.keyId=report.keyId,output.claims=report.claims,output;default:{let exhaustive=report;throw new Error(`unhandled license report: ${JSON.stringify(exhaustive)}`)}}}async function getRunnerBootstrapConfig(deps,ctx){let output=create2(GetRunnerBootstrapConfigOutputSchema,{temporalAddress:await isSandboxCaller(deps,ctx)?deps.sandboxTemporalAddress:deps.runnerBootstrapTemporalAddress,temporalNamespace:deps.temporalNamespace,mcpBridgeEndpoint:deps.runnerBootstrapMcpBridgeEndpoint}),bootstrapCredentials=deps.runnerAuthService.bootstrapCredentials?.bind(deps.runnerAuthService);if(bootstrapCredentials===void 0)return output;try{let credentials=await bootstrapCredentials(callerIdentityOf(ctx));credentials.accessToken!==void 0&&(output.runnerAccessToken=credentials.accessToken.token,output.tokenType="Bearer",output.runnerAccessTokenExpiresInSeconds=credentials.accessToken.expiresInSeconds),credentials.payloadKeys!==void 0&&(output.payloadEncryptionKey=credentials.payloadKeys.keyBase64,output.payloadEncryptionKeyId=credentials.payloadKeys.keyId,output.payloadEncryptionSecondaryKey=credentials.payloadKeys.secondaryKeyBase64??"",output.payloadEncryptionSecondaryKeyId=credentials.payloadKeys.secondaryKeyId??"")}catch(error3){deps.logger.warn("Bootstrap credentials unavailable \u2014 answering coordinates without them",{error:error3 instanceof Error?error3.message:String(error3)})}return output}async function getRunnerScopedToken(deps,input,ctx){let asking=ctx.values.get(callerIdentityKey);if(asking!==void 0&&isServiceAccountCaller(asking))throw new ConnectError(serviceAccountRefusedMessage("mint run credentials"),Code.PermissionDenied);let exchange=deps.runnerAuthService.exchangeScopedToken?.bind(deps.runnerAuthService);if(exchange!==void 0){let minted=await exchange(exchangeRequestOf(input),callerIdentityOf(ctx));return minted.minted?create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.expiresInSeconds}):create2(GetRunnerScopedTokenOutputSchema)}let executionId;switch(input.scope.case){case"runId":executionId=input.scope.value;break;case"renewal":return renewSandboxToken(deps,ctx);case void 0:return create2(GetRunnerScopedTokenOutputSchema);default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}if(executionId===""||!deps.runnerAuthService.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))return create2(GetRunnerScopedTokenOutputSchema);try{let minted=deps.runnerAuthService.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.ttlSeconds})}catch(error3){return deps.logger.warn("failed to mint runner scoped token \u2014 answering not-minted",{executionId,error:error3 instanceof Error?error3.message:String(error3)}),create2(GetRunnerScopedTokenOutputSchema)}}function exchangeRequestOf(input){switch(input.scope.case){case"runId":return{arm:"agent-execution",executionId:input.scope.value};case"renewal":return{arm:"renewal"};case void 0:return{arm:"unset"};default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}}async function isSandboxCaller(deps,ctx){let queueOf=deps.runnerAuthService.temporalTaskQueueOf?.bind(deps.runnerAuthService),bearer=bearerOf(ctx);if(queueOf===void 0||bearer===void 0)return!1;try{return await queueOf(bearer)!==void 0}catch(error3){return deps.logger.warn("Runner credential's Temporal queue could not be read; answering as for any runner",{error:error3 instanceof Error?error3.message:String(error3)}),!1}}function bearerOf(ctx){return/^Bearer\s+(\S+)$/i.exec(ctx.requestHeader.get("authorization")?.trim()??"")?.[1]}async function renewSandboxToken(deps,ctx){let renew=deps.runnerAuthService.renewSandboxToken?.bind(deps.runnerAuthService),bearer=bearerOf(ctx);if(renew===void 0||bearer===void 0)return create2(GetRunnerScopedTokenOutputSchema);let renewed=await renew(bearer);return renewed.minted?create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:renewed.token,tokenType:"Bearer",expiresInSeconds:renewed.expiresInSeconds}):create2(GetRunnerScopedTokenOutputSchema)}var SERVER_VERSION="0.1.1";var fileListIndex=declareListIndex({kind:ApiResourceKind.file,schema:FileSchema,revision:2,keys:{session:field("status.session_id"),run:field("status.run_id")}});var PAGE=200;function newCascadeDeleteSessionFilesStep(store,blobs,lifecycle,logger2){return{name:"CascadeDeleteSessionFiles",async execute(ctx){let sessionId=requireResourceId(ctx),removed=0;for(;;){let rows;try{rows=await store.queryResources(fileListIndex,{anyKey:[{name:"session",value:sessionId}],limit:PAGE})}catch(error3){throw internalError(error3,"failed to list the session's files")}for(let row of rows){let org=fromBinary2(FileSchema,row.data).metadata?.org??"";await blobs.removeFile(row.id),await cleanUpDeletedResource(lifecycle,logger2,{kind:ApiResourceKind.file,resourceId:row.id,orgId:org,caller:ctx.callerIdentity}),removed++}if(rows.length<PAGE)break}removed>0&&logger2.info("Cascade-deleted files of session",{sessionId,count:removed})}}}function newStampSessionRoutineStep(){return{name:"StampSessionRoutine",execute(ctx){let caller=ctx.callerIdentity,routineId=caller.routineId??"";routineId===""||!isServerComposedRequest(caller)||((ctx.newState.status??=create2(SessionStatusSchema)).routineId=routineId)}}}function newAdmitSessionEnvironmentStep(store,policy){return{name:"AdmitSessionEnvironment",async execute(ctx){let session=ctx.newState,environment=await loadSessionEnvironment(store,session);if(environment===void 0&&(session.spec?.environmentRef?.id??"")==="")return;let servers=await sessionRunServers(store,session);await admitEnvironment({policy,session,environment,servers})}}}function newRefuseLocalProgramsStep(store,policy){return{name:"RefuseLocalPrograms",async execute(ctx){let session=ctx.newState,target=session.spec?.executionTarget??ExecutionTarget.UNSPECIFIED;if(!policy.refusesLocalPrograms(target))return;let org=session.metadata?.org??"",agentId=session.status?.agentId??"",versionHash=session.status?.agentVersionHash??"",agentSpec=agentId===""?void 0:(await loadVersion(store,agentVersionBinding,agentId,versionHash)).resource.spec,subagents=await runSubagents(store,agentSpec,org),plugins=await loadRunPlugins(store,runPluginReferences(agentSpec,session,org,subagents),org);refuseLocalPrograms(policy,target,plugins)}}}function sessionRunTarget(session,stored){let agentId=session.status?.agentId??"";if(!(agentId===""||agentId===(stored?.status?.agentId??"")&&(session.status?.agentVersionHash??"")===(stored?.status?.agentVersionHash??"")))return{...RUN_GATE_CHECKS.agent,resourceId:agentId,deniedMessage:runAgentDeniedMessage2(agentId)}}var sessionSearchExtractor={kind:ApiResourceKind.session,schema:SessionSchema,getSearchSummary(resource){return resource.spec?.subject??""},toSearchResult(resource,score){let session=resource;return buildSearchResult({kind:ApiResourceKind.session,metadata:session.metadata,summary:session.spec?.subject??"",score,createdAt:session.status?.audit?.specAudit?.createdAt,updatedAt:session.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let session=resource,metadata=session.metadata;if(metadata!==void 0)return{name:metadata.name,description:session.spec?.subject??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(session.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var LIST_RESULT_KEY7="listResult";function newValidateHarnessImmutabilityStep(store){return{name:"ValidateHarnessImmutability",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0)return;let inputSpec=ctx.newState.spec;if(inputSpec===void 0||inputSpec.harness===Harness.UNSPECIFIED)return;let existingHarness=existingSpec.harness,inputHarness=inputSpec.harness;if(existingHarness===Harness.UNSPECIFIED&&(existingHarness=Harness.STIGMER),inputHarness!==existingHarness&&await sessionHasRun(store,ctx,existing))throw failedPreconditionError("session harness cannot be changed after the first execution \u2014 each harness owns its conversation state independently")}}}var EXECUTION_TARGET_PROTO_NAMES={[ExecutionTarget.UNSPECIFIED]:"EXECUTION_TARGET_UNSPECIFIED",[ExecutionTarget.LOCAL]:"EXECUTION_TARGET_LOCAL",[ExecutionTarget.CLOUD]:"EXECUTION_TARGET_CLOUD"};function newValidateExecutionTargetImmutabilityStep(temporalConfig,store){return{name:"ValidateExecutionTargetImmutability",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0)return;let inputSpec=ctx.newState.spec;if(inputSpec===void 0)return;let existingTarget=temporalConfig.resolveExecutionTarget(existingSpec.executionTarget),inputTarget=temporalConfig.resolveExecutionTarget(inputSpec.executionTarget);if(inputTarget!==existingTarget&&await sessionHasRun(store,ctx,existing))throw failedPreconditionError(`session execution_target cannot be changed after the first execution (${EXECUTION_TARGET_PROTO_NAMES[existingTarget]} \u2192 ${EXECUTION_TARGET_PROTO_NAMES[inputTarget]}; unset resolves to the deployment default, ${temporalConfig.defaultExecutionTarget}) \u2014 workspace state may not be portable between local and cloud environments`)}}}async function listExecutionsBySession(store,logger2,sessionId){let rows;try{rows=await store.queryResources(agentExecutionListIndex,{anyKey:[{name:"session",value:sessionId}]})}catch(error3){throw internalError(error3,"failed to list agent executions")}let executions=[];for(let row of rows)try{executions.push(fromBinary2(RunSchema,row.data))}catch(error3){logger2.warn("Failed to unmarshal execution, skipping",{error:error3 instanceof Error?error3.message:String(error3)})}return executions}function newRejectDeleteWithActiveExecutionsStep(store,logger2){return{name:"RejectDeleteWithActiveExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId),activeCount=0;for(let execution of executions)isActiveExecutionPhase(execution.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED)&&activeCount++;if(activeCount>0)throw failedPreconditionError(`session has ${activeCount} active execution(s); cancel them or wait for completion before deleting`)}}}function newCascadeDeleteAgentExecutionsStep(store,lifecycle,logger2,runScores){return{name:"CascadeDeleteAgentExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId);if(executions.length!==0){for(let execution of executions){let executionId=execution.metadata?.id??"";await runScores.deleteScoresOfRun(executionId);try{await store.deleteResource(ApiResourceKind.run,executionId)}catch(error3){throw internalError(error3,`failed to cascade-delete execution ${executionId} of session ${sessionId}`)}await cleanUpDeletedResource(lifecycle,logger2,{kind:ApiResourceKind.run,resourceId:executionId,orgId:execution.metadata?.org??"",caller:ctx.callerIdentity});try{await store.deleteSearchIndex(ApiResourceKind.run,executionId)}catch(error3){logger2.warn("CascadeDeleteAgentExecutions: failed to remove search index entry (best-effort)",{executionId,error:error3 instanceof Error?error3.message:String(error3)})}}logger2.info("Cascade-deleted executions of session",{sessionId,count:executions.length})}}}}function requireSessionId(ctx){let sessionId=ctx.get(RESOURCE_ID_KEY);if(typeof sessionId!="string"||sessionId==="")throw internalError(new Error("session id not found in context (ExtractResourceId must run first)"),"session id not found in context (ExtractResourceId must run first)");return sessionId}function newListAllSessionsStep(store,logger2,listReadScope){return{name:"ListAllSessions",async execute(ctx){let input=ctx.input,page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{org:input.org,withoutKeys:["eval_run"]},fingerprint:{lane:"session.list",org:input.org}});ctx.set(LIST_RESULT_KEY7,page)}}}function newFilterByAgentStep(store,logger2,listReadScope){return{name:"FilterByAgent",async execute(ctx){let agentId=ctx.input.agentId;if(agentId==="")throw invalidArgumentError("agent_id is required");let page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{anyKey:[{name:"agent",value:agentId}],withoutKeys:["eval_run"]},fingerprint:{lane:"session.listByAgent",agentId}});ctx.set(LIST_RESULT_KEY7,page)}}}function newAuthorizeChannelAccessStep(authorizer){return newAuthorizeResolvedTargetStep(authorizer,({input})=>input.channelId===""?[]:[{permission:IamPermission.can_view,resourceKind:ApiResourceKind.channel,resourceId:input.channelId,deniedMessage:"unauthorized to list channel conversations"}],"AuthorizeChannelAccess")}function newFilterByChannelStep(store,logger2,listReadScope){return{name:"FilterByChannel",async execute(ctx){let channelId=ctx.input.channelId;if(channelId==="")throw invalidArgumentError("channel_id is required");let page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{anyKey:[{name:"channel",value:channelId}]},fingerprint:{lane:"session.listByChannel",channelId}});ctx.set(LIST_RESULT_KEY7,page)}}}async function readSessionPage(store,logger2,listReadScope,caller,request3,lane){let page=await readListPage({store,declaration:sessionListIndex,query:lane.query,request:request3,fingerprint:listPageFingerprint({...lane.fingerprint,labels:sortedLabels(request3.labels)}),decode:data=>{try{return fromBinary2(SessionSchema,data)}catch(error3){logger2.warn("Failed to unmarshal session, skipping",{error:error3 instanceof Error?error3.message:String(error3)});return}},keep:session=>matchesAllLabels(session.metadata?.labels??{},request3.labels),scope:sessions=>restrictListByReadScope(listReadScope,caller,ApiResourceKind.session,sessions,""),failure:"failed to list sessions"});return create2(SessionListSchema,{entries:page.entries,nextPageToken:page.nextPageToken})}async function isRunnerForRun(deps,token,runId){let authorize=deps.runnerAuth.authorizeRunnerForRun?.bind(deps.runnerAuth);if(authorize!==void 0)try{return await authorize(token,runId)}catch(error3){return deps.logger.warn("Runner credential authorization failed; refusing",{error:error3 instanceof Error?error3.message:String(error3)}),!1}let bound2;try{bound2=deps.runnerAuth.verify(TOKEN_TYPE_EXECUTION_SCOPED,token)}catch{return!1}return bound2!==runId?(deps.logger.warn("A runner credential named another run; refusing",{tokenExecutionId:bound2,runId}),!1):!0}var SESSION_EVENT_MAX_BYTES=256*1024,NOT_THE_RUNS_RUNNER_MESSAGE="only the runner acting for this run may append its events";async function appendSessionEvents(deps,input,ctx){let runId=input.runId;if(runId==="")throw invalidArgumentError("run_id is required");let token=parseBearerToken(ctx.requestHeader.get("authorization")??"");if(token===""||!await isRunnerForRun(deps,token,runId))throw permissionDeniedError(NOT_THE_RUNS_RUNNER_MESSAGE);let run=await loadRun5(deps.store,runId);admitLive(run);let sessionId=sessionIdOfRun2(run);if(sessionId==="")throw failedPreconditionError(`run '${runId}' is in no session; it has no event log`);let drafts=input.events.map((event,index2)=>{if(event.event.case===void 0)throw invalidArgumentError(`events[${index2}] holds no event`);let type2=eventTypeOf(event);if(!RUNNER_EVENT_TYPES.has(type2))throw invalidArgumentError(`events[${index2}]: a runner may not append ${type2} events`);if(event.event.value.id==="")throw invalidArgumentError(`events[${index2}]: the event's id is required`);if(event.event.value.id.startsWith(`${SESSION_EVENT_ID_PREFIX}_`))throw invalidArgumentError(`events[${index2}]: ids starting with '${SESSION_EVENT_ID_PREFIX}_' are the server's`);let own=clone(SessionEventSchema,event);own.runId=runId;let draft=draftOf(own);if(draft.data.length>SESSION_EVENT_MAX_BYTES)throw invalidArgumentError(`events[${index2}] is ${draft.data.length} bytes; an event holds at most ${SESSION_EVENT_MAX_BYTES}`);return draft});input.previews.forEach((preview,index2)=>{let size=toBinary(SessionEventPreviewSchema,preview).length;if(size>SESSION_EVENT_MAX_BYTES)throw invalidArgumentError(`previews[${index2}] is ${size} bytes; a preview holds at most ${SESSION_EVENT_MAX_BYTES}`)});let stored={records:[],appended:[]};if(drafts.length>0)try{stored=await deps.store.sessionEvents.append(sessionId,run.metadata?.org??"",drafts,{kind:ApiResourceKind.run,id:runId,schema:RunSchema,admit:row=>admitLive(row)})}catch(error3){throw error3 instanceof ConnectError?error3:error3 instanceof SessionEventConflictError?new ConnectError(error3.message,Code.AlreadyExists):error3 instanceof ResourceNotFoundError?permissionDeniedError(NOT_THE_RUNS_RUNNER_MESSAGE):internalError(error3,"failed to append session events")}return deps.sessionEventBroker.publishPreviews(sessionId,input.previews.map(preview=>stampedPreview(preview,runId))),deps.sessionEventBroker.publish(sessionId,run.metadata?.org??"",stored.appended.map(eventOf)),create2(AppendSessionEventsResponseSchema,{events:stored.records.map(identityOf)})}function stampedPreview(preview,runId){if(preview.preview.case!=="stigmerRunLiveness"||preview.preview.value.runId===runId)return preview;let liveness=clone(RunLivenessSchema,preview.preview.value);return liveness.runId=runId,create2(SessionEventPreviewSchema,{preview:{case:"stigmerRunLiveness",value:liveness}})}async function loadRun5(store,runId){try{return await store.getResource(ApiResourceKind.run,runId,RunSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?permissionDeniedError(NOT_THE_RUNS_RUNNER_MESSAGE):internalError(error3,"failed to load the run")}}function admitLive(run){let phase=run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED;if(isTerminalExecutionPhase(phase))throw failedPreconditionError(`run '${run.metadata?.id??""}' is finished; it takes no more events`)}async function claimSessionInput(deps,input,ctx){let runId=input.runId;if(runId==="")throw invalidArgumentError("run_id is required");let token=parseBearerToken(ctx.requestHeader.get("authorization")??"");if(token===""||!await isRunnerForRun(deps,token,runId))throw permissionDeniedError(NOT_THE_RUNS_RUNNER_MESSAGE);let run=await loadRun6(deps,runId);admitWorking(run);let sessionId=sessionIdOfRun2(run),authority=authorityOfRun(run);if(sessionId===""||!(await deps.store.sessionEvents.queued(sessionId)).some(queued=>sameAuthority(authorityOfQueued(queued),authority)))return create2(ClaimSessionInputResponseSchema);let taken;try{taken=await updateRunAppendingEvents(deps,runId,(row,session)=>{admitWorking(row);let own=session.queued.filter(queued=>sameAuthority(authorityOfQueued(queued),authorityOfRun(row)));return{last:own.map(queued=>takenMessage(eventOf(queued.record),runId)),takeQueued:own.map(queued=>queued.record.eventId)}},{queued:!0})}catch(error3){throw error3 instanceof ConnectError?error3:error3 instanceof ResourceNotFoundError?permissionDeniedError(NOT_THE_RUNS_RUNNER_MESSAGE):internalError(error3,"failed to take the session's queued messages")}let events=taken.events.filter(event=>event.event.case==="userMessage"&&event.runId===runId);return events.length>0&&deps.logger.info("the run took its session's queued messages",{runId,messages:events.length}),create2(ClaimSessionInputResponseSchema,{events})}async function loadRun6(deps,runId){try{return await deps.store.getResource(ApiResourceKind.run,runId,RunSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?permissionDeniedError(NOT_THE_RUNS_RUNNER_MESSAGE):internalError(error3,"failed to load the run")}}function admitWorking(run){let phase=run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED;if(!isWorkingPhase(phase))throw failedPreconditionError(`run '${run.metadata?.id??""}' is not working; it takes no queued messages`)}function newDeleteSessionEventsStep(store){return{name:"DeleteSessionEvents",async execute(ctx){let sessionId=requireResourceId(ctx);try{await store.sessionEvents.deleteBySession(sessionId)}catch(error3){throw internalError(error3,"failed to delete the session's events")}}}}var SESSION_EVENT_PAGE_DEFAULT_SIZE=100,SESSION_EVENT_PAGE_MAX_BYTES=8*1024*1024;async function listSessionEvents(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listEvents.input,req,callerIdentityOf(ctx),ApiResourceKind.session),result=create2(SessionEventListSchema);return await newPipeline("session-list-events",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listEvents,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"ListSessionEvents",async execute(stepCtx){result=await readSessionEventPage(deps.store,stepCtx.input)}}).build().execute(reqCtx),result}async function readSessionEventPage(store,req){let order=req.order==="desc"?"desc":"asc",size=req.pageSize===0?SESSION_EVENT_PAGE_DEFAULT_SIZE:req.pageSize,fingerprint=listPageFingerprint({session:req.sessionId,order,size,types:req.types,run:req.runId,gt:req.createdAtGt,gte:req.createdAtGte,lt:req.createdAtLt,lte:req.createdAtLte}),query={order,limit:size+1,...req.pageToken===""?{}:{afterSeq:seqOfToken(req.pageToken,fingerprint)},...req.types.length===0?{}:{types:req.types},...req.runId===""?{}:{runId:req.runId},...bound("processedAtGt","created_at_gt",req.createdAtGt,"down"),...bound("processedAtGte","created_at_gte",req.createdAtGte,"up"),...bound("processedAtLt","created_at_lt",req.createdAtLt,"up"),...bound("processedAtLte","created_at_lte",req.createdAtLte,"down")},records;try{records=await store.sessionEvents.list(req.sessionId,query)}catch(error3){throw internalError(error3,"failed to list session events")}let page=[],bytes=0;for(let record4 of records.slice(0,size)){if(page.length>0&&bytes+record4.data.length>SESSION_EVENT_PAGE_MAX_BYTES)break;page.push(record4),bytes+=record4.data.length}let last=page[page.length-1];return create2(SessionEventListSchema,{events:page.map(eventOf),nextPageToken:records.length>page.length&&last!==void 0?encodeListPageToken({createdAt:"",id:String(last.seq)},fingerprint):""})}function seqOfToken(token,fingerprint){let seq2=Number(decodeListPageToken(token,fingerprint).cursor.id);if(!Number.isSafeInteger(seq2)||seq2<0)throw invalidArgumentError("invalid page_token");return seq2}var RFC33392=/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d{1,9}))?(Z|[+-]\d{2}:\d{2})$/i;function bound(key,field3,value,round){if(value==="")return{};let parts=RFC33392.exec(value),whole=parts===null?Number.NaN:Date.parse(`${parts[1]}${parts[3]}`);if(parts===null||Number.isNaN(whole))throw invalidArgumentError(`${field3} must be an RFC 3339 instant with its offset, got '${value}'`);let fraction=parts[2]??"",millis=Number(fraction.padEnd(3,"0").slice(0,3)),finer=/[1-9]/.test(fraction.slice(3))&&round==="up"?1:0;return{[key]:new Date(whole+millis+finer).toISOString()}}function sessionStateOf(events){let newest;for(let event of events)(event.event.case==="sessionStatusRunning"||event.event.case==="sessionStatusIdle")&&(newest===void 0||event.seq>newest.seq)&&(newest=event);return newest?.event.case==="sessionStatusRunning"?"running":"idle"}async function readSessionState(store,sessionId){let newest=await store.sessionEvents.list(sessionId,{order:"desc",types:SESSION_STATUS_TYPES,limit:1});return sessionStateOf(newest.map(eventOf))}async function stampSessionStates(store,sessions){await Promise.all(sessions.map(async session=>{let state2=await readSessionState(store,session.metadata?.id??"");(session.status??=create2(SessionStatusSchema)).state=state2}))}function newStampSessionStateStep(store,sessionsOf){return{name:"StampSessionState",async execute(ctx){await stampSessionStates(store,sessionsOf(ctx))}}}var SESSION_EVENT_PREVIEW_CAPACITY=4096,SESSION_EVENT_PREVIEW_MAX_BYTES=32*1024*1024,SESSION_EVENT_DROPPED_IDS_KEPT=4096,SESSION_EVENT_LIVENESS_TYPE="stigmer.run.liveness",SESSION_EVENT_LIVENESS_KEPT_MS=6e4,LIVENESS_STOPS_IN=new Set(["waiting","paused","completed","failed","cancelled","terminated"]);function sessionIdleBellOf(org){return`\0session.status_idle:${org}`}var SESSION_EVENT_BROKER_CLOSED_MESSAGE="the server is restarting; stream again with after_seq set to the last event received",SessionEventBroker=class{logger;now;subscribers=new Map;kept=new Map;sweptAt=-1/0;closedBecause;constructor(logger2,now=()=>performance.now()){this.logger=logger2,this.now=now}subscribe(sessionId,deltaTypes){let subscription={previews:[],sizes:[],ids:[],queuedBytes:0,deltaTypes:new Set(deltaTypes),droppedIds:new Set,dirty:!1,notify:void 0,closed:this.closedBecause!==void 0,closedBecause:this.closedBecause};if(subscription.closed)return subscription;let set2=this.subscribers.get(sessionId)??new Set;return set2.add(subscription),this.subscribers.set(sessionId,set2),subscription}unsubscribe(sessionId,subscription){let set2=this.subscribers.get(sessionId);if(set2===void 0||!set2.delete(subscription)){subscription.closed=!0;return}this.end(subscription,void 0),set2.size===0&&this.subscribers.delete(sessionId)}close(reason=SESSION_EVENT_BROKER_CLOSED_MESSAGE){if(this.closedBecause===void 0){this.closedBecause=reason;for(let set2 of this.subscribers.values())for(let subscription of set2)this.end(subscription,reason);this.subscribers.clear(),this.kept.clear()}}publish(sessionId,org,events){if(events.length===0)return;for(let event of events)event.event.case==="stigmerRunStatus"&&LIVENESS_STOPS_IN.has(event.event.value.phase)&&this.forget(sessionId,event.runId);let bells=org!==""&&events.some(event=>event.event.case==="sessionStatusIdle")?[sessionId,sessionIdleBellOf(org)]:[sessionId];for(let bell of bells)for(let subscription of this.subscribers.get(bell)??[])subscription.dirty=!0,this.wake(subscription)}publishPreviews(sessionId,previews){for(let preview of previews){let frame2,type2,id;switch(preview.preview.case){case"eventStart":frame2=create2(StreamSessionEventsResponseSchema,{frame:{case:"eventStart",value:preview.preview.value}}),type2=preview.preview.value.event?.type??"",id=preview.preview.value.event?.id??"";break;case"eventDelta":frame2=create2(StreamSessionEventsResponseSchema,{frame:{case:"eventDelta",value:preview.preview.value}}),type2="agent.message",id=preview.preview.value.eventId;break;case"stigmerToolOutputDelta":frame2=create2(StreamSessionEventsResponseSchema,{frame:{case:"stigmerToolOutputDelta",value:preview.preview.value}}),type2="stigmer.tool_output_delta",id=preview.preview.value.toolUseId;break;case"stigmerRunLiveness":frame2=create2(StreamSessionEventsResponseSchema,{frame:{case:"stigmerRunLiveness",value:preview.preview.value}}),type2=SESSION_EVENT_LIVENESS_TYPE,id=void 0,this.keep(sessionId,preview.preview.value);break;case void 0:continue;default:{let exhaustive=preview.preview;throw new Error(`unknown preview ${String(exhaustive)}`)}}this.deliverPreview(sessionId,frame2,type2,id)}}take(subscription){let frame2=subscription.previews.shift();return subscription.queuedBytes-=subscription.sizes.shift()??0,subscription.ids.shift(),frame2}currentLiveness(sessionId){let runs=this.kept.get(sessionId);if(runs===void 0)return[];let at2=this.now(),frames=[];for(let kept of runs.values()){let heldMs=at2-kept.at;heldMs>=SESSION_EVENT_LIVENESS_KEPT_MS||frames.push(create2(StreamSessionEventsResponseSchema,{frame:{case:"stigmerRunLiveness",value:aged(kept.liveness,heldMs)}}))}return frames}keptLivenessCount(){let count2=0;for(let runs of this.kept.values())count2+=runs.size;return count2}subscriberCount(sessionId){return this.subscribers.get(sessionId)?.size??0}deliverPreview(sessionId,frame2,type2,id){let set2=this.subscribers.get(sessionId);if(set2===void 0)return;let size;for(let subscription of set2)if(!(!subscription.deltaTypes.has(type2)||id!==void 0&&subscription.droppedIds.has(id))){if(size??=toBinary(StreamSessionEventsResponseSchema,frame2).length,subscription.previews.length+1>SESSION_EVENT_PREVIEW_CAPACITY||subscription.queuedBytes+size>SESSION_EVENT_PREVIEW_MAX_BYTES){this.logger.warn("A session event stream fell behind on previews; dropping them",{sessionId});for(let dropped of[...subscription.ids,id])dropped!==void 0&&remember(subscription,dropped);subscription.previews.length=0,subscription.sizes.length=0,subscription.ids.length=0,subscription.queuedBytes=0;continue}subscription.previews.push(frame2),subscription.sizes.push(size),subscription.ids.push(id),subscription.queuedBytes+=size,this.wake(subscription)}}keep(sessionId,liveness){if(this.closedBecause!==void 0||liveness.runId==="")return;let at2=this.now();this.sweep(at2);let runs=this.kept.get(sessionId)??new Map;runs.set(liveness.runId,{liveness,at:at2}),this.kept.set(sessionId,runs)}forget(sessionId,runId){let runs=this.kept.get(sessionId);runs?.delete(runId)===!0&&runs.size===0&&this.kept.delete(sessionId)}sweep(at2){if(!(at2-this.sweptAt<SESSION_EVENT_LIVENESS_KEPT_MS)){this.sweptAt=at2;for(let[sessionId,runs]of this.kept){for(let[runId,kept]of runs)at2-kept.at>=SESSION_EVENT_LIVENESS_KEPT_MS&&runs.delete(runId);runs.size===0&&this.kept.delete(sessionId)}}}wake(subscription){subscription.notify?.(),subscription.notify=void 0}end(subscription,reason){subscription.closed=!0,subscription.closedBecause=reason,this.wake(subscription)}};function remember(subscription,id){subscription.droppedIds.delete(id),subscription.droppedIds.add(id);for(let oldest of subscription.droppedIds){if(subscription.droppedIds.size<=SESSION_EVENT_DROPPED_IDS_KEPT)break;subscription.droppedIds.delete(oldest)}}function aged(liveness,ms){let copy=clone(RunLivenessSchema,liveness);for(let operation2 of copy.operations)operation2.elapsed!==void 0&&(operation2.elapsed=longer(operation2.elapsed,ms));return copy.awaitingModelFor!==void 0&&(copy.awaitingModelFor=longer(copy.awaitingModelFor,ms)),copy}function longer(duration,ms){let nanos=duration.seconds*1000000000n+BigInt(duration.nanos)+BigInt(Math.round(ms*1e6));return create2(DurationSchema,{seconds:nanos/1000000000n,nanos:Number(nanos%1000000000n)})}var SESSION_EVENT_STREAM_REAUTHORIZE_MS=300*1e3,SESSION_EVENT_REPLAY_BATCH=100,SESSION_EVENT_TAIL_MIN_MS=15e3,SESSION_EVENT_TAIL_MAX_MS=2*6e4;async function*streamSessionEvents(deps,req,context2){if(req.sessionId==="")throw invalidArgumentError("session_id is required");let now=deps.now??Date.now,tail=deps.tailMs??{min:SESSION_EVENT_TAIL_MIN_MS,max:SESSION_EVENT_TAIL_MAX_MS},authorize=()=>authorizeDirect(SessionQueryController.method.streamEvents,deps.authorizer,callerIdentityOf(context2),req);await authorize();let authorizedAt=now(),sessionId=req.sessionId,broker=deps.sessionEventBroker,subscription=broker.subscribe(sessionId,req.eventDeltas),abort=new Promise(resolve=>{context2.signal.addEventListener("abort",()=>resolve(),{once:!0})}),reauthorizeWhenDue=async()=>{now()-authorizedAt>=SESSION_EVENT_STREAM_REAUTHORIZE_MS&&(await authorize(),authorizedAt=now())},read3=async query=>{try{return await deps.store.sessionEvents.list(sessionId,query)}catch(error3){throw internalError(error3,"failed to read the session's events")}},endIfClosed=()=>{if(subscription.closed)throw new ConnectError(subscription.closedBecause??SESSION_EVENT_BROKER_CLOSED_MESSAGE,Code.Unavailable)};try{endIfClosed();let sent;req.afterSeq!==void 0?sent=Number(req.afterSeq):sent=(await read3({order:"desc",limit:1}))[0]?.seq??0;let tailMs=tail.min,readDue=!0,tailFired=!1,livenessDue=req.eventDeltas.includes(SESSION_EVENT_LIVENESS_TYPE);for(;!context2.signal.aborted;){endIfClosed();let frame2=broker.take(subscription);for(;frame2!==void 0;)await reauthorizeWhenDue(),yield frame2,frame2=broker.take(subscription);if(subscription.dirty||readDue){subscription.dirty=!1,readDue=!1;let delivered=!1;for(;;){let records=await read3({order:"asc",afterSeq:sent,limit:SESSION_EVENT_REPLAY_BATCH});for(let record4 of records)await reauthorizeWhenDue(),yield create2(StreamSessionEventsResponseSchema,{frame:{case:"event",value:eventOf(record4)}}),sent=record4.seq,delivered=!0;if(records.length<SESSION_EVENT_REPLAY_BATCH||context2.signal.aborted)break;for(frame2=broker.take(subscription);frame2!==void 0;)await reauthorizeWhenDue(),yield frame2,frame2=broker.take(subscription)}if(livenessDue&&!context2.signal.aborted){livenessDue=!1;for(let liveness of broker.currentLiveness(sessionId))await reauthorizeWhenDue(),yield liveness}delivered?tailMs=tail.min:tailFired&&(tailMs=Math.min(tailMs*2,tail.max)),tailFired=!1;continue}let timer;await Promise.race([abort,new Promise(resolve=>subscription.notify=resolve),new Promise(resolve=>{timer=setTimeout(()=>{readDue=!0,tailFired=!0,resolve()},tailMs)})]),clearTimeout(timer),subscription.notify=void 0}}finally{broker.unsubscribe(sessionId,subscription)}}var ATTENTION_OVERLAP_MS=3e4,ATTENTION_RESUME_LIMIT_MS=1440*6e4,CURSOR_TIME=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/,IDLE_TYPE="session.status_idle",STOPPED_BY_TYPES=["stigmer.run.status","user.interrupt"],REASONS={end_turn:"finished",retries_exhausted:"failed",budget_reached:"failed",requires_action:"needs_answer"};function attentionCursorOf(position){return`${position.processedAt}|${position.eventId}`}function positionOfCursor(cursor){let at2=cursor.indexOf("|"),processedAt=at2<0?"":cursor.slice(0,at2);if(!CURSOR_TIME.test(processedAt)||Number.isNaN(Date.parse(processedAt)))throw invalidArgumentError(`after_cursor '${cursor}' is not a cursor this stream sent`);return{processedAt,eventId:cursor.slice(at2+1)}}async function*streamAttention(deps,req,context2){if(req.org==="")throw invalidArgumentError("org is required");let request3=clone(StreamAttentionRequestSchema,req);await resolveOrganizationNames(StreamAttentionRequestSchema,request3,newOrganizationNameResolver(deps.store));let now=deps.now??Date.now,tail=deps.tailMs??{min:SESSION_EVENT_TAIL_MIN_MS,max:SESSION_EVENT_TAIL_MAX_MS},caller=callerIdentityOf(context2),authorize=()=>authorizeDirect(SessionQueryController.method.streamAttention,deps.authorizer,caller,request3);await authorize();let authorizedAt=now(),broker=deps.sessionEventBroker,bell=sessionIdleBellOf(request3.org),subscription=broker.subscribe(bell,[]),abort=new Promise(resolve=>{context2.signal.addEventListener("abort",()=>resolve(),{once:!0})}),conversations=new Map,handled=new Map,endIfClosed=()=>{if(subscription.closed)throw new ConnectError(subscription.closedBecause??SESSION_EVENT_BROKER_CLOSED_MESSAGE,Code.Unavailable)};try{endIfClosed();let cursor=req.afterCursor===""?{processedAt:new Date(now()).toISOString(),eventId:""}:positionOfCursor(req.afterCursor),oldest=new Date(now()-ATTENTION_RESUME_LIMIT_MS).toISOString();if(cursor.processedAt<oldest&&(cursor={processedAt:oldest,eventId:""}),req.afterCursor==="")for await(let page of windowPages(deps,request3.org,cursor))for(let record4 of page)handled.set(record4.eventId,record4.processedAt);let tailMs=tail.min,readDue=!0,tailFired=!1;for(;!context2.signal.aborted;){if(endIfClosed(),subscription.dirty||readDue){subscription.dirty=!1,readDue=!1;let delivered=!1;conversations.clear();for await(let page of windowPages(deps,request3.org,cursor)){for(let record4 of page){if(handled.has(record4.eventId))continue;handled.set(record4.eventId,record4.processedAt),record4.processedAt>cursor.processedAt&&(cursor={processedAt:record4.processedAt,eventId:record4.eventId});let attention=await attentionOf(deps,record4,caller.identityId,conversations);attention!==void 0&&(now()-authorizedAt>=SESSION_EVENT_STREAM_REAUTHORIZE_MS&&(await authorize(),authorizedAt=now()),yield attention,delivered=!0)}forgetBefore(handled,cursor)}delivered?tailMs=tail.min:tailFired&&(tailMs=Math.min(tailMs*2,tail.max)),tailFired=!1;continue}let timer;await Promise.race([abort,new Promise(resolve=>subscription.notify=resolve),new Promise(resolve=>{timer=setTimeout(()=>{readDue=!0,tailFired=!0,resolve()},tailMs)})]),clearTimeout(timer),subscription.notify=void 0}}finally{broker.unsubscribe(bell,subscription)}}function windowStart(cursor){return{processedAt:new Date(Date.parse(cursor.processedAt)-ATTENTION_OVERLAP_MS).toISOString(),eventId:""}}async function*windowPages(deps,org,cursor){let after=windowStart(cursor);for(;;){let page;try{page=await deps.store.sessionEvents.listByOrg(org,{types:[IDLE_TYPE],after,limit:SESSION_EVENT_REPLAY_BATCH})}catch(error3){throw internalError(error3,"failed to read the organization's events")}yield page;let last=page.at(-1);if(last===void 0||page.length<SESSION_EVENT_REPLAY_BATCH)return;after={processedAt:last.processedAt,eventId:last.eventId}}}function forgetBefore(handled,cursor){let start=windowStart(cursor).processedAt;for(let[eventId,processedAt]of handled)processedAt<start&&handled.delete(eventId)}async function attentionOf(deps,record4,caller,conversations){let event=eventOf(record4).event,reason=REASONS[event.case==="sessionStatusIdle"&&event.value.stopReason?.type||""];if(reason===void 0)return;conversations.has(record4.sessionId)||conversations.set(record4.sessionId,await conversationOf(deps.store,record4.sessionId));let conversation=conversations.get(record4.sessionId);if(!(conversation===void 0||conversation.creator===""||conversation.creator!==caller)&&!(reason==="finished"&&await stoppedByThePerson(deps.store,record4)))return create2(AttentionSchema,{id:record4.eventId,sessionId:record4.sessionId,title:conversation.title,runId:record4.runId,reason,at:record4.processedAt,cursor:attentionCursorOf({processedAt:record4.processedAt,eventId:record4.eventId})})}async function conversationOf(store,sessionId){try{let session=await store.getResource(ApiResourceKind.session,sessionId,SessionSchema);return{creator:session.status?.audit?.specAudit?.createdBy?.id??"",title:session.spec?.subject||session.metadata?.name||""}}catch(error3){if(error3 instanceof ResourceNotFoundError)return;throw internalError(error3,"failed to read the session")}}async function stoppedByThePerson(store,idle){let before;try{before=await store.sessionEvents.list(idle.sessionId,{order:"desc",afterSeq:idle.seq,types:STOPPED_BY_TYPES,limit:1})}catch(error3){throw internalError(error3,"failed to read the session's events")}let newest=before[0];if(newest===void 0)return!1;let event=eventOf(newest);return event.event.case==="userInterrupt"||event.event.case==="stigmerRunStatus"&&event.event.value.stopCause==="user"}var CONVERSATION_MOVED_ON_MESSAGE="the conversation has moved on; these edits were kept",CONFLICTING_DECISION_MESSAGE="this change was already decided, and a decision is final",TURN_EVENT_TYPE="user.message";function runIdOfChangeSet(changeSetId){let colon=changeSetId.indexOf(":");return colon<=0?"":changeSetId.slice(0,colon)}function changeSetNotFound(changeSetId,sessionId){return notFoundError("Change set",`'${changeSetId}' in session '${sessionId}'`)}var DecisionAlreadyRecorded=class extends Error{run;constructor(run){super("file decision already recorded"),this.run=run,this.name="DecisionAlreadyRecorded"}};async function decideFileChanges(deps,target,asked,identity2){let runId=target.runId,loaded=await loadRun7(deps,target,asked.changeSetId);validateFileDecisionTarget(loaded,asked);let decidedBy=identity2.identityId,committed;try{committed=(await updateRunAppendingEvents(deps,runId,(run,session)=>{validateFileDecisionTarget(run,asked);let recorded=decisionOnTarget(runReviewLogOf(session.runEvents.map(eventOf)),asked.changeSetId,asked.scope,asked.fileChangeId);if(recorded!==void 0&&isSameDecision(recorded,asked))throw new DecisionAlreadyRecorded(run);if(session.runOfNewestType!==runId)throw failedPreconditionError(CONVERSATION_MOVED_ON_MESSAGE);if(recorded!==void 0)throw failedPreconditionError(CONFLICTING_DECISION_MESSAGE);return{last:[decidedEvent(runId,{changeSetId:asked.changeSetId,scope:asked.scope,fileChangeId:asked.fileChangeId,action:asked.action,expectedDigest:asked.expectedDigest,origin:PERSON_ORIGIN,reason:asked.reason,decidedBy})]}},{runOfNewestType:TURN_EVENT_TYPE,runEventTypes:[FILE_REVIEW_DECIDED_TYPE]})).run}catch(error3){if(error3 instanceof DecisionAlreadyRecorded)return deps.logger.info("IDEMPOTENT: file decision already recorded",{executionId:runId,changeSetId:asked.changeSetId,fileChangeId:asked.fileChangeId}),{run:error3.run,recorded:!1,reconcileRunId:""};throw error3 instanceof ResourceNotFoundError?changeSetNotFound(asked.changeSetId,target.sessionId):error3 instanceof ConnectError?error3:internalError(error3,"failed to persist file decision")}deps.logger.info("AUDIT: File decision submitted",{executionId:runId,org:committed.metadata?.org??"",changeSetId:asked.changeSetId,fileChangeId:asked.fileChangeId,scope:asked.scope,action:asked.action,decidedBy});let reconcileRunId=asked.action==="undo"&&isTerminalExecutionPhase(committed.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED)?await startReconcileTurn(deps,committed,identity2):"";return{run:committed,recorded:!0,reconcileRunId}}async function loadRun7(deps,target,changeSetId){let sessionId=target.sessionId;if(target.runId==="")throw changeSetNotFound(changeSetId,sessionId);let run;try{run=await deps.store.getResource(ApiResourceKind.run,target.runId,RunSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?changeSetNotFound(changeSetId,sessionId):internalError(error3,"failed to load agent execution")}if(sessionIdOfRun2(run)!==sessionId)throw changeSetNotFound(changeSetId,sessionId);return run}function validateFileDecisionTarget(run,asked){let runId=run.metadata?.id??"",phase=run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED,changeSets=run.status?.fileChanges??[];if(changeSets.length===0)throw failedPreconditionError(`execution ${runId} has no actionable file change sets (phase ${enumToJson(RunPhaseSchema,phase)})`);let cs=findChangeSet(changeSets,asked.changeSetId);if(cs===void 0)throw failedPreconditionError(`change set ${asked.changeSetId} not found for execution ${runId}`);if(asked.scope==="file"){if(asked.fileChangeId==="")throw invalidArgumentError("file_change_id is required for FILE scope");if(findChange(cs,asked.fileChangeId)===void 0)throw failedPreconditionError(`file change ${asked.fileChangeId} not found in change set ${asked.changeSetId}`)}if(asked.action==="keep"){let reason=keepBlockedReason(cs,asked.scope,asked.fileChangeId,asked.acknowledgeUnreviewable);if(reason!=="")throw failedPreconditionError(reason)}if(asked.expectedDigest!==targetDigest(cs,asked.scope,asked.fileChangeId))throw invalidArgumentError(`expected_digest mismatch for change set ${asked.changeSetId}: the captured content changed since it was reviewed`)}function isSameDecision(recorded,asked){return recorded.origin===PERSON_ORIGIN&&recorded.action===asked.action}async function startReconcileTurn(deps,run,identity2){let sessionId=sessionIdOfRun2(run);if(sessionId==="")return"";let runId=run.metadata?.id??"";try{let reconcileRunId=(await deps.reconcileTurns().create(reconcileTurnRequest(run,sessionId),identity2)).metadata?.id??"";return deps.logger.info("Started a reconcile turn for an undo on an ended turn",{executionId:runId,sessionId,reconcileRunId}),reconcileRunId}catch(error3){let fields2={executionId:runId,sessionId,error:error3 instanceof Error?error3.message:String(error3)};return error3 instanceof ConnectError?deps.logger.warn("The reconcile turn was refused; the undo stands and the next turn restores it",fields2):deps.logger.error("The reconcile turn could not be started; the undo stands and the next turn restores it",fields2),""}}function reconcileTurnRequest(run,sessionId){return create2(RunSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Run",metadata:create2(ApiResourceMetadataSchema,{name:`reconcile-file-review-${Date.now()}`,org:run.metadata?.org??""}),spec:create2(RunSpecSchema,{target:{case:"sessionId",value:sessionId},reconcileFileReview:!0})})}var OUTCOME_KEY="fileDecisionOutcome";async function reviewFileChanges(deps,input,identity2){let reqCtx=new RequestContext(SessionCommandController.method.reviewFileChanges.input,input,identity2,ApiResourceKind.session);await newPipeline("session-review-file-changes",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.reviewFileChanges,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"DecideFileChanges",async execute(ctx){let scope=scopeOfWord(ctx.input.scope),action=actionOfWord(ctx.input.action);if(scope===void 0||action===void 0){throw invalidArgumentError("scope must be change_set or file, and action keep or undo")}let outcome3=await decideFileChanges(deps,{runId:runIdOfChangeSet(ctx.input.changeSetId),sessionId:ctx.input.sessionId},{changeSetId:ctx.input.changeSetId,scope,fileChangeId:ctx.input.fileChangeId,action,expectedDigest:ctx.input.expectedDigest,reason:ctx.input.reason,acknowledgeUnreviewable:ctx.input.acknowledgeUnreviewable},ctx.callerIdentity);ctx.set(OUTCOME_KEY,outcome3)}}).build().execute(reqCtx);let outcome2=reqCtx.get(OUTCOME_KEY);return create2(ReviewFileChangesResponseSchema,{reconcileRunId:outcome2.reconcileRunId})}var import_node_crypto39=require("node:crypto");var TOOL_NAME_TO_CATEGORY=new Map([["write","write"],["write_file","write"],["create_file","write"],["overwrite_file","write"],["Write","write"],["edit","write"],["edit_file","write"],["str_replace_editor","write"],["Edit","write"],["NotebookEdit","write"],["delete","delete"],["delete_file","delete"],["remove_file","delete"],["shell","shell"],["bash","shell"],["execute","shell"],["execute_command","shell"],["run_command","shell"],["terminal","shell"],["Bash","shell"]]);function toolApprovalCategory(name){return TOOL_NAME_TO_CATEGORY.get(name)}var HOOK_POLICY_SOURCE="hook";function deriveLeaseScope(ask){let slug=ask.mcpServer;if(ask.policySource===HOOK_POLICY_SOURCE)return{category:"",server:slug,hook:ask.policyHook,tool:ask.name};if(slug!=="")return{category:"",server:slug,tool:""};let category=toolApprovalCategory(ask.name);if(category!==void 0)return{category,server:"",tool:""}}function sameLeaseScope(a5,b7){return a5.category===b7.category&&a5.server===b7.server&&a5.hook===b7.hook&&a5.tool===b7.tool}function gateResolved(openGates){return openGates===0}var APPROVAL_ANSWER_KEY="approvalAnswer",OUTCOME_KEY2="approvalAnswerOutcome";function answerOutcomeOf(ctx){let outcome2=ctx.get(OUTCOME_KEY2);if(outcome2===void 0)throw new Error("the answer chain recorded no outcome");return outcome2}var CONFIRMATION_ID_PREFIX=`${SESSION_EVENT_ID_PREFIX}_tc_`,GRANT_ID_PREFIX2=`${SESSION_EVENT_ID_PREFIX}_pg_`;function digestOf(toolUseId){return(0,import_node_crypto39.createHash)("sha256").update(toolUseId).digest("hex").slice(0,40)}function toolConfirmationEventId(toolUseId){return`${CONFIRMATION_ID_PREFIX}${digestOf(toolUseId)}`}function permissionGrantEventId(toolUseId){return`${GRANT_ID_PREFIX2}${digestOf(toolUseId)}`}var TOOL_USE_TYPES=["agent.tool_use","agent.mcp_tool_use"],PERMISSION_ASKED_TYPE="stigmer.permission.asked",ASKED_PAGE_SIZE=1e3,GRANT_ASK_READS=3;async function askedEventsOf(store,sessionId,runId){let asked=new Map,afterSeq;for(;;){let page=await store.sessionEvents.list(sessionId,{order:"asc",runId,types:[PERMISSION_ASKED_TYPE],limit:ASKED_PAGE_SIZE,...afterSeq===void 0?{}:{afterSeq}});for(let record4 of page){let event=eventOf(record4);event.event.case==="stigmerPermissionAsked"&&!asked.has(event.event.value.toolUseId)&&asked.set(event.event.value.toolUseId,event.event.value)}if(page.length<ASKED_PAGE_SIZE)return asked;afterSeq=page[page.length-1].seq}}async function readAsks(store,sessionId,runId,toolUseIds){let asks=new Map,uses=await store.sessionEvents.list(sessionId,{order:"asc",eventIds:toolUseIds,types:TOOL_USE_TYPES,limit:Math.max(1,toolUseIds.length)}),asked=await askedEventsOf(store,sessionId,runId);for(let record4 of uses){let event=eventOf(record4);if(record4.runId!==runId)continue;let use=event.event.case==="agentToolUse"?{...event.event.value,mcpServer:""}:event.event.case==="agentMcpToolUse"?{...event.event.value,mcpServer:event.event.value.mcpServerName}:void 0;if(use===void 0||use.evaluatedPermission!==ASK_PERMISSION)continue;let why=asked.get(use.id);asks.set(use.id,{toolUseId:use.id,threadId:use.sessionThreadId,lease:why===void 0?void 0:deriveLeaseScope({name:use.name,mcpServer:use.mcpServer,policySource:why.policySource,policyHook:why.policyHook})})}return asks}function waitingInClass(asks,toolUseId,lease,open2){return[...open2].flatMap(otherUseId=>{let other=asks.get(otherUseId);return otherUseId!==toolUseId&&other!==void 0&&other.lease!==void 0&&sameLeaseScope(other.lease,lease)?[other]:[]})}function callIdOfToolUse(runId,toolUseId){let prefix=`${runId}.`;if(!toolUseId.startsWith(prefix))return"";let callId=toolUseId.slice(prefix.length);return HASHED_CALL_ID.test(callId)?"":callId}var HASHED_CALL_ID=/^h[0-9a-f]{32}$/;function confirmationEvent(runId,ask,result,denyMessage){return create2(SessionEventSchema,{runId,threadId:ask.threadId,event:{case:"userToolConfirmation",value:{id:toolConfirmationEventId(ask.toolUseId),result,toolUseId:ask.toolUseId,denyMessage:result==="deny"?denyMessage:"",sessionThreadId:ask.threadId}}})}function grantEvent(runId,ask,lease){return create2(SessionEventSchema,{runId,threadId:ask.threadId,event:{case:"stigmerPermissionGrant",value:{id:permissionGrantEventId(ask.toolUseId),toolUseId:ask.toolUseId,scope:"turn",lease:{category:lease.category,server:lease.server,...lease.hook===void 0?{}:{hook:lease.hook},tool:lease.tool}}}})}function phaseName2(phase){return enumToJson(RunPhaseSchema,phase)}function answeredOtherwise(toolUseId){return failedPreconditionError(`tool use ${toolUseId} was already answered otherwise; an answer is final`)}var AskClosedError=class extends Error{toolUseId;constructor(toolUseId){super(`tool use ${toolUseId} no longer waits`),this.toolUseId=toolUseId,this.name="AskClosedError"}},AsksMovedError=class extends Error{constructor(){super("an ask opened since the run's asks were read"),this.name="AsksMovedError"}};async function recordedAnswer(deps,run,request3,ask){let runId=run.metadata?.id??"",confirmationId=toolConfirmationEventId(request3.toolUseId),grantId=permissionGrantEventId(request3.toolUseId),events=(await deps.store.sessionEvents.list(request3.sessionId,{order:"asc",runId,types:["user.tool_confirmation","stigmer.permission.grant"],limit:1e3})).map(eventOf),confirmation=events.find(event=>event.event.case==="userToolConfirmation"&&event.event.value.id===confirmationId);if(confirmation===void 0||confirmation.event.case!=="userToolConfirmation")return;let grant=events.find(event=>event.event.case==="stigmerPermissionGrant"&&event.event.value.id===grantId),recorded=confirmation.event.value,sameResult=recorded.result===request3.result&&recorded.denyMessage===request3.denyMessage,sameGrant=request3.grant?grant!==void 0||ask.lease===void 0:grant===void 0;if(!sameResult||!sameGrant)throw answeredOtherwise(request3.toolUseId);let grantedAt=grant?.event.value?.processedAt;return{run,confirmations:[confirmation,...grantedAt===void 0?[]:events.filter(event=>event!==confirmation&&event.event.case==="userToolConfirmation"&&event.event.value.processedAt===grantedAt)],grant}}function answerSteps(deps,requestOf){let REQUEST_KEY="approvalAnswerRequest",RUN_KEY2="approvalAnswerRun",ASK_KEY="approvalAnswerAsk",requestIn=ctx=>ctx.get(REQUEST_KEY),runIn=ctx=>ctx.get(RUN_KEY2),askIn=ctx=>ctx.get(ASK_KEY),replayed=ctx=>ctx.get(OUTCOME_KEY2)!==void 0;return[{name:"LoadAskedRun",async execute(ctx){let request3=requestOf(ctx);ctx.set(REQUEST_KEY,request3);let runId=runIdOfToolUse(request3.toolUseId),missing=()=>notFoundError("tool use",request3.toolUseId);if(runId==="")throw missing();let run;try{run=await deps.store.getResource(ApiResourceKind.run,runId,RunSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?missing():internalError(error3,"failed to load the tool use's run")}if(sessionIdOfRun2(run)!==request3.sessionId)throw missing();let ask;try{ask=(await readAsks(deps.store,request3.sessionId,runId,[request3.toolUseId])).get(request3.toolUseId)}catch(error3){throw internalError(error3,"failed to read the tool use's ask")}if(ask===void 0)throw missing();ctx.set(RUN_KEY2,run),ctx.set(ASK_KEY,ask)}},{name:"AnswerReplay",async execute(ctx){let outcome2=await recordedAnswer(deps,runIn(ctx),requestIn(ctx),askIn(ctx));outcome2!==void 0&&ctx.set(OUTCOME_KEY2,outcome2)}},{name:"ValidateAnswer",async execute(ctx){if(replayed(ctx))return;let run=runIn(ctx),request3=requestIn(ctx),runId=run.metadata?.id??"",phase=run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED;if(phase!==RunPhase.RUN_WAITING_FOR_APPROVAL&&phase!==RunPhase.RUN_IN_PROGRESS)throw failedPreconditionError(`tool use ${request3.toolUseId} no longer waits: its turn is ${phaseName2(phase)}`);let open2;try{open2=(await deps.store.sessionEvents.openGates(request3.sessionId,runId)).some(gate=>gate.toolUseId===request3.toolUseId)}catch(error3){throw internalError(error3,"failed to read the tool use's ask")}if(!open2)throw failedPreconditionError(`tool use ${request3.toolUseId} no longer waits`);let answer={run,toolUseId:request3.toolUseId,toolCallId:callIdOfToolUse(runId,request3.toolUseId),result:request3.result,grant:request3.grant};ctx.set(APPROVAL_ANSWER_KEY,answer)}},...stepsForSlot(deps.gateSteps,"agent-execution-submit-approval:gate").map(step=>({name:step.name,async execute(ctx){replayed(ctx)||await step.execute(ctx)}})),{name:"RecordAnswer",async execute(ctx){if(replayed(ctx))return;let request3=requestIn(ctx);try{let recorded=await recordAnswer(deps,runIn(ctx),request3,askIn(ctx),ctx.callerIdentity.identityId);ctx.set(OUTCOME_KEY2,recorded.outcome),ctx.set(SIGNAL_KEY,recorded.openAsks)}catch(error3){if(error3 instanceof AskClosedError){let outcome2=await recordedAnswer(deps,runIn(ctx),request3,askIn(ctx));if(outcome2!==void 0){ctx.set(OUTCOME_KEY2,outcome2);return}throw failedPreconditionError(error3.message)}throw error3 instanceof ResourceNotFoundError?notFoundError("Run",runIn(ctx).metadata?.id??""):internalError(error3,"failed to record the answer")}}},{name:"SignalWorkflow",async execute(ctx){let openAsks=ctx.get(SIGNAL_KEY);openAsks!==void 0&&await signalWhenResolved(deps,answerOutcomeOf(ctx).run,openAsks)}}]}var SIGNAL_KEY="approvalAnswerOpenAsks";async function recordAnswer(deps,loaded,request3,ask,decidedBy){let runId=loaded.metadata?.id??"";for(let read3=1;;read3++){let others=request3.grant&&ask.lease!==void 0?await readAsks(deps.store,request3.sessionId,runId,(await deps.store.sessionEvents.openGates(request3.sessionId,runId)).map(gate=>gate.toolUseId)):new Map;try{return await writeAnswer(deps,runId,request3,ask,others,decidedBy,read3===GRANT_ASK_READS)}catch(error3){if(error3 instanceof AsksMovedError&&read3<GRANT_ASK_READS)continue;throw error3}}}async function writeAnswer(deps,runId,request3,ask,others,decidedBy,final){let confirmations=[],grant,openAsks=0,{run,events}=await updateRunAppendingEvents(deps,runId,(current,session)=>{let open2=openAsksOf(session,runId),phase=current.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED;if(!open2.has(request3.toolUseId)||phase!==RunPhase.RUN_WAITING_FOR_APPROVAL&&phase!==RunPhase.RUN_IN_PROGRESS)throw new AskClosedError(request3.toolUseId);confirmations=[confirmationEvent(runId,ask,request3.result,request3.denyMessage)],grant=void 0;let lease=request3.grant?ask.lease:void 0;if(lease!==void 0){if(!final&&[...open2].some(id=>id!==request3.toolUseId&&!others.has(id)))throw new AsksMovedError;grant=grantEvent(runId,ask,lease);for(let other of waitingInClass(others,request3.toolUseId,lease,open2))confirmations.push(confirmationEvent(runId,other,"allow",""))}let own=grant===void 0?confirmations:[confirmations[0],grant,...confirmations.slice(1)];return openAsks=openAsksOf(session,runId,own).size,own});deps.logger.info("AUDIT: tool use answered",{runId,org:run.metadata?.org??"",toolUseId:request3.toolUseId,result:request3.result,grant:grant!==void 0,answered:confirmations.length,decidedBy,openAsksRemaining:openAsks});let storedById=new Map(events.map(event=>[event.event.value?.id??"",event])),asStored=event=>storedById.get(event.event.value?.id??"")??event;return{outcome:{run,confirmations:confirmations.map(asStored),grant:grant===void 0?void 0:asStored(grant)},openAsks}}async function signalWhenResolved(deps,run,openAsks){let runId=run.metadata?.id??"";if(isTerminalExecutionPhase(run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED))return;if(!gateResolved(openAsks)){deps.logger.info("answer recorded; the turn still waits for others",{runId,openAsksRemaining:openAsks});return}let engine=deps.engineState();if(!engine.connected){deps.logger.warn("execution engine not connected; the turn is not signalled to resume",{runId});return}try{await engine.engine.signalApprovalGateResolved(runId)}catch(error3){throw error3 instanceof EngineWorkflowNotFoundError?(deps.logger.warn("workflow not found; reconciling the waiting run to FAILED",{runId}),await reconcileStaleExecution(deps,run),failedPreconditionError(`workflow not running for execution ${runId} - the backing workflow has terminated unexpectedly and the execution has been marked as failed`)):unavailableError(`failed to signal workflow: ${error3 instanceof Error?error3.message:String(error3)}`)}deps.logger.info("the turn's workflow was signalled to resume",{runId})}async function reconcileStaleExecution(deps,execution){let executionId=execution.metadata?.id??"",reconciled=create2(RunSchema,{apiVersion:execution.apiVersion,kind:execution.kind,metadata:execution.metadata,spec:execution.spec,status:{phase:RunPhase.RUN_FAILED,error:"Workflow backing this execution is no longer running. Execution has been marked as failed.",audit:execution.status?.audit,fileChanges:execution.status?.fileChanges??[]}});try{await overwriteRunAppendingEvents(deps,reconciled)}catch(error3){deps.logger.error("Failed to reconcile stale execution status - execution will remain in WAITING_FOR_APPROVAL until next attempt",{executionId,error:error3 instanceof Error?error3.message:String(error3)});return}deps.logger.info("RECONCILIATION: Updated stale execution status to FAILED",{executionId}),await notifyStatusObservers(deps,reconciled,execution.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED,RunPhase.RUN_FAILED)}async function confirmToolUse(deps,input,identity2){let reqCtx=new RequestContext(SessionCommandController.method.confirmToolUse.input,input,identity2,ApiResourceKind.session),builder2=newPipeline("session-confirm-tool-use",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.confirmToolUse,deps.authorizer)).addStep(newValidateProtoStep());for(let step of answerSteps(deps,ctx=>({sessionId:ctx.input.sessionId,toolUseId:ctx.input.toolUseId,result:ctx.input.result==="deny"?"deny":"allow",denyMessage:ctx.input.denyMessage,grant:!1})))builder2.addStep(step);return await builder2.build().execute(reqCtx),answerOutcomeOf(reqCtx).confirmations[0]}async function grantPermission(deps,input,identity2){let reqCtx=new RequestContext(SessionCommandController.method.grantPermission.input,input,identity2,ApiResourceKind.session),builder2=newPipeline("session-grant-permission",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.grantPermission,deps.authorizer)).addStep(newValidateProtoStep());for(let step of answerSteps(deps,ctx=>({sessionId:ctx.input.sessionId,toolUseId:ctx.input.toolUseId,result:"allow",denyMessage:"",grant:!0})))builder2.addStep(step);await builder2.build().execute(reqCtx);let outcome2=answerOutcomeOf(reqCtx);return create2(GrantPermissionResponseSchema,{...outcome2.grant===void 0?{}:{grant:outcome2.grant},confirmations:[...outcome2.confirmations]})}var EVENT_KEY="interruptEvent",STOPPED_KEY="interruptStoppedRunIds",ORG_KEY="interruptSessionOrg";async function interrupt(deps,input,identity2){let reqCtx=new RequestContext(SessionCommandController.method.interrupt.input,input,identity2,ApiResourceKind.session);return await newPipeline("session-interrupt",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.interrupt,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"RefuseThread",execute(ctx){if(ctx.input.sessionThreadId!=="")throw invalidArgumentError("interrupting one thread is not supported; interrupt the session")}}).addStep({name:"RequireEngine",execute(){if(!deps.engineState().connected)throw failedPreconditionError(TEMPORAL_UNAVAILABLE_MESSAGE)}}).addStep({name:"AppendInterrupt",async execute(ctx){let sessionId=ctx.input.sessionId,org;try{org=(await deps.store.getResource(ApiResourceKind.session,sessionId,SessionSchema)).metadata?.org??""}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Session",sessionId):internalError(error3,"failed to load session")}let event=create2(SessionEventSchema,{event:{case:"userInterrupt",value:{id:generateId(SESSION_EVENT_ID_PREFIX)}}}),stored;try{let appended=await deps.store.sessionEvents.append(sessionId,org,[draftOf(event)],{kind:ApiResourceKind.session,id:sessionId,schema:SessionSchema,admit:()=>{}});stored=eventOf(appended.records[0]),deps.sessionEventBroker.publish(sessionId,org,appended.appended.map(eventOf))}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("Session",sessionId):internalError(error3,"failed to record the interrupt")}ctx.set(EVENT_KEY,stored),ctx.set(ORG_KEY,org)}}).addStep({name:"DropQueue",async execute(ctx){try{let dropped=await dropQueuedMessages(deps,ctx.input.sessionId,ctx.get(ORG_KEY));dropped.length>0&&deps.logger.info("the interrupt dropped the session's queued messages",{sessionId:ctx.input.sessionId,dropped:dropped.length})}catch(error3){throw internalError(error3,"failed to drop the session's queued messages")}}}).addStep({name:"StopRuns",async execute(ctx){ctx.set(STOPPED_KEY,await stopUnfinishedRuns(deps,ctx.input,ctx.callerIdentity))}}).build().execute(reqCtx),create2(InterruptSessionResponseSchema,{event:reqCtx.get(EVENT_KEY),stoppedRunIds:reqCtx.get(STOPPED_KEY)})}async function finishedSince(deps,runId){try{let run=await deps.store.getResource(ApiResourceKind.run,runId,RunSchema);return!CANCELLABLE_PHASES.includes(run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED)}catch(error3){if(error3 instanceof ResourceNotFoundError)return!0;throw error3}}async function stopUnfinishedRuns(deps,input,identity2){let sessionId=input.sessionId,rows;try{rows=await deps.store.queryResources(agentExecutionListIndex,{anyKey:[{name:"session",value:sessionId}]})}catch(error3){throw internalError(error3,"failed to list the session's runs")}let unfinished=[];for(let row of rows){let run=fromBinary2(RunSchema,row.data);CANCELLABLE_PHASES.includes(run.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED)&&unfinished.push(run)}let stopped=[];for(let run of unfinished){let runId=run.metadata?.id??"",cancelCtx=new RequestContext(SessionCommandController.method.interrupt.input,input,identity2,ApiResourceKind.run),builder2=newPipeline("agentexecution-cancel",deps.logger);for(let step of cancelSteps(deps,()=>runId))builder2.addStep(step);try{await builder2.build().execute(cancelCtx)}catch(error3){if(error3 instanceof ConnectError&&await finishedSince(deps,runId)){deps.logger.info("a run finished before the interrupt reached it",{runId,sessionId});continue}throw error3}stopped.push(runId)}return deps.logger.info("AUDIT: session interrupted",{sessionId,stoppedRuns:stopped,interruptedBy:identity2.identityId}),stopped}var import_node_crypto40=require("node:crypto");var STATUS_TYPE="stigmer.background_command.status",STOP_REQUESTED_TYPE="stigmer.background_command.stop_requested",BACKGROUND_TYPES=[STATUS_TYPE,STOP_REQUESTED_TYPE],BACKGROUND_PAGE_SIZE=1e3,STOP_REQUEST_ID_PREFIX=`${SESSION_EVENT_ID_PREFIX}_bs_`;function backgroundStopRequestEventId(toolUseId){return`${STOP_REQUEST_ID_PREFIX}${(0,import_node_crypto40.createHash)("sha256").update(toolUseId).digest("hex").slice(0,40)}`}function commandIn(records,toolUseId){let running,ended=!1,stopRequest;for(let record4 of records){let event=eventOf(record4);event.event.case==="stigmerBackgroundCommandStatus"&&event.event.value.toolUseId===toolUseId?event.event.value.phase==="running"?running??=event.event.value.sessionThreadId:ended=!0:event.event.case==="stigmerBackgroundCommandStopRequested"&&event.event.value.toolUseId===toolUseId&&(stopRequest??=event)}return running===void 0?void 0:{threadId:running,ended,stopRequest}}async function backgroundEventsOf(store,sessionId,runId){let records=[],afterSeq;for(;;){let page=await store.sessionEvents.list(sessionId,{order:"asc",runId,types:[...BACKGROUND_TYPES],limit:BACKGROUND_PAGE_SIZE,...afterSeq===void 0?{}:{afterSeq}});if(records.push(...page),page.length<BACKGROUND_PAGE_SIZE)return records;afterSeq=page[page.length-1].seq}}function phaseName3(phase){return enumToJson(RunPhaseSchema,phase)}function alreadyEnded(toolUseId){return failedPreconditionError(`the background command of tool use ${toolUseId} already ended`)}function turnNotWorking(phase){return failedPreconditionError(`the turn is not working: it is ${phaseName3(phase)}`)}var StopSettledError=class extends Error{replay;refusal;constructor(replay,refusal2){super("the command's stop was settled under the lock"),this.replay=replay,this.refusal=refusal2,this.name="StopSettledError"}},RUN_KEY="stopBackgroundRun",COMMAND_KEY="stopBackgroundCommand",RESULT_KEY="stopBackgroundResult";async function stopBackgroundCommand(deps,input,identity2){let reqCtx=new RequestContext(SessionCommandController.method.stopBackgroundCommand.input,input,identity2,ApiResourceKind.session),runIn=ctx=>ctx.get(RUN_KEY),commandOf=ctx=>ctx.get(COMMAND_KEY),settled=ctx=>ctx.get(RESULT_KEY)!==void 0;return await newPipeline("session-stop-background-command",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.stopBackgroundCommand,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"LoadCommand",async execute(ctx){let{sessionId,toolUseId}=ctx.input,missing=()=>notFoundError("background command",toolUseId),runId=runIdOfToolUse(toolUseId);if(runId==="")throw missing();let run;try{run=await deps.store.getResource(ApiResourceKind.run,runId,RunSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?missing():internalError(error3,"failed to load the background command's run")}if(sessionIdOfRun2(run)!==sessionId)throw missing();let command5;try{command5=commandIn(await backgroundEventsOf(deps.store,sessionId,runId),toolUseId)}catch(error3){throw internalError(error3,"failed to read the background command")}if(command5===void 0)throw missing();ctx.set(RUN_KEY,run),ctx.set(COMMAND_KEY,command5)}}).addStep({name:"StopReplay",execute(ctx){let recorded=commandOf(ctx).stopRequest;recorded!==void 0&&ctx.set(RESULT_KEY,recorded)}}).addStep({name:"ValidateStop",execute(ctx){if(settled(ctx))return;let phase=runIn(ctx).status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED;if(!isWorkingPhase(phase))throw turnNotWorking(phase);if(commandOf(ctx).ended)throw alreadyEnded(ctx.input.toolUseId)}}).addStep({name:"RecordStop",async execute(ctx){settled(ctx)||ctx.set(RESULT_KEY,await recordStop(deps,runIn(ctx),ctx.input,commandOf(ctx),ctx.callerIdentity.identityId))}}).build().execute(reqCtx),reqCtx.get(RESULT_KEY)}async function recordStop(deps,loaded,input,command5,requestedBy){let runId=loaded.metadata?.id??"",request3=create2(SessionEventSchema,{runId,threadId:command5.threadId,event:{case:"stigmerBackgroundCommandStopRequested",value:{id:backgroundStopRequestEventId(input.toolUseId),toolUseId:input.toolUseId,sessionThreadId:command5.threadId}}}),written;try{written=await updateRunAppendingEvents(deps,runId,(current,session)=>{let now=commandIn(session.runEvents,input.toolUseId);if(now?.stopRequest!==void 0)throw new StopSettledError(now.stopRequest,void 0);let phase=current.status?.phase??RunPhase.RUN_PHASE_UNSPECIFIED;if(!isWorkingPhase(phase))throw new StopSettledError(void 0,turnNotWorking(phase));if(now===void 0||now.ended)throw new StopSettledError(void 0,alreadyEnded(input.toolUseId));return{last:[request3]}},{runEventTypes:BACKGROUND_TYPES})}catch(error3){if(error3 instanceof StopSettledError){if(error3.replay!==void 0)return error3.replay;throw error3.refusal??error3}throw error3 instanceof ResourceNotFoundError?notFoundError("background command",input.toolUseId):internalError(error3,"failed to record the stop")}deps.logger.info("AUDIT: background command stop requested",{runId,org:written.run.metadata?.org??"",toolUseId:input.toolUseId,requestedBy});let id=request3.event.value?.id??"";return written.events.find(event=>event.event.value?.id===id)??request3}var SESSION_VAULT_ATTACHMENTS={surface:"a conversation (include My vault in it instead: each person who sends a turn then uses their own)",attachers:{get:row=>row.status?.vaultAttachers,set:(row,attachers)=>{(row.status??=create2(SessionStatusSchema)).vaultAttachers=attachers}}};function registerSessionServices(router,deps){router.service(SessionCommandController,{apply:(session,ctx)=>apply9(deps,session,ctx),create:(session,ctx)=>createSession(deps,session,ctx),update:(input,ctx)=>update12(deps,input,ctx),updateSubject:(req,ctx)=>updateSubject(deps,req,callerIdentityOf(ctx)),delete:(id,ctx)=>deleteSession2(deps,id,ctx),appendEvents:(input,ctx)=>appendSessionEvents(deps,input,ctx),claimInput:(input,ctx)=>claimSessionInput(deps,input,ctx),reviewFileChanges:(input,ctx)=>reviewFileChanges(deps,input,callerIdentityOf(ctx)),confirmToolUse:(input,ctx)=>confirmToolUse(deps,input,callerIdentityOf(ctx)),grantPermission:(input,ctx)=>grantPermission(deps,input,callerIdentityOf(ctx)),interrupt:(input,ctx)=>interrupt(deps,input,callerIdentityOf(ctx)),stopBackgroundCommand:(input,ctx)=>stopBackgroundCommand(deps,input,callerIdentityOf(ctx))}),router.service(SessionQueryController,{get:(id,ctx)=>get15(deps,id,ctx),list:(req,ctx)=>list13(deps,req,ctx),listByAgent:(req,ctx)=>listByAgent4(deps,req,ctx),listByChannel:(req,ctx)=>listByChannel(deps,req,ctx),listEvents:(req,ctx)=>listSessionEvents(deps,req,ctx),streamEvents:(req,ctx)=>streamSessionEvents(deps,req,ctx),streamAttention:(req,ctx)=>streamAttention(deps,req,ctx)})}function sessionHarnesses2(session){return[{field:"spec.harness",harness:session.spec?.harness??Harness.UNSPECIFIED}]}function kindOf18(ctx){return ctx.values.get(apiResourceKindKey)}async function createSession(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf18(ctx)),instances=fileInstancesOf(deps),builder2=newPipeline("session-create",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newNormalizeReferencesStep(deps.store)).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newStampSessionRoutineStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newValidateReferencesStep(deps.store,deps.authorizer)).addStep(newVaultAttachmentsStep(deps.store,deps.authorizer,SESSION_VAULT_ATTACHMENTS)).addStep(newPreserveSessionValuesStep()).addStep(newResolveSessionAgentStep(deps.store,deps.logger,deps.authorizer)).addStep(newResolveSessionEnvironmentStep(deps.store,deps.environmentPolicy)).addStep(newRefuseUnofferedHarnessStep(sessionHarnesses2)).addStep(newAuthorizeRunTargetStep(deps.authorizer,sessionRunTarget)).addStep(newRefuseLocalProgramsStep(deps.store,newLocalProgramPolicy(deps.sandboxLane,deps.temporalConfig))).addStep(newAdmitSessionEnvironmentStep(deps.store,deps.environmentPolicy));for(let step of stepsForSlot(deps.gateSteps,"session-create:pre-side-effect-gate"))builder2.addStep(step);return await builder2.addStep(newResolveSessionResourcesStep(instances)).addStep(newSealSessionValuesStep(deps.secretService,deps.logger)).addStep(newClaimNameStep(deps.store,ApiResourceKind.session)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx).catch(async error3=>(await discardQuietly(instances,reqCtx.callerIdentity,deps.logger),releaseNameOnFailure(deps.store,deps.logger,reqCtx)(error3))),redacted(reqCtx.newState)}function fileInstancesOf(deps){return newFileInstances({store:deps.store,blobs:deps.fileBlobs,authorizer:deps.authorizer,lifecycle:deps.authorizationLifecycle,logger:deps.logger})}async function update12(deps,input,ctx){let instances=fileInstancesOf(deps),caller=callerIdentityOf(ctx);return runGuardedWrite(async()=>{let reqCtx=updateContext(SessionSchema,input,caller,kindOf18(ctx));return await newPipeline("session-update",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.update,deps.authorizer,input)).addStep(newResolveSlugStep({update:!0})).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newValidateProtoStep({of:"state"})).addStep(newRefuseUnofferedHarnessStep(sessionHarnesses2)).addStep(newValidateHarnessImmutabilityStep(deps.store)).addStep(newValidateExecutionTargetImmutabilityStep(deps.temporalConfig,deps.store)).addStep(newNormalizeReferencesStep(deps.store)).addStep(newValidateEnvironmentImmutabilityStep(deps.store)).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newValidateReferencesStep(deps.store,deps.authorizer,{judge:"introduced"})).addStep(newVaultAttachmentsStep(deps.store,deps.authorizer,SESSION_VAULT_ATTACHMENTS)).addStep(newPreserveSessionValuesStep()).addStep(newResolveSessionAgentStep(deps.store,deps.logger,deps.authorizer)).addStep(newResolveSessionEnvironmentStep(deps.store,deps.environmentPolicy)).addStep(newAuthorizeRunTargetStep(deps.authorizer,sessionRunTarget)).addStep(newResolveSessionResourcesStep(instances)).addStep(newSealSessionValuesStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store,deps.credentialBinding)).addStep(newDestroyDroppedSessionValuesStep(deps.secretService,deps.logger)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx),redacted(reqCtx.newState)}).catch(async error3=>{throw await discardQuietly(instances,caller,deps.logger),error3})}async function apply9(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf18(ctx));await newPipeline("session-apply",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createSession(deps,session,ctx):update12(deps,everyPathUpdate(UpdateSessionInputSchema,withResolvedApplyId(SessionSchema,session,reqCtx)),ctx)}async function deleteSession2(deps,sessionId,ctx){let reqCtx=new RequestContext(SessionCommandController.method.delete.input,sessionId,callerIdentityOf(ctx),kindOf18(ctx));await newPipeline("session-delete",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,SessionSchema)).addStep(newRejectDeleteWithActiveExecutionsStep(deps.store,deps.logger)).addStep(newCascadeDeleteAgentExecutionsStep(deps.store,deps.authorizationLifecycle,deps.logger,deps.runScores)).addStep(newCascadeDeleteSessionFilesStep(deps.store,deps.fileBlobs,deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSessionEventsStep(deps.store)).addStep(newDeleteResourceStep(deps.store)).addStep(newCascadeDeleteSessionFilesStep(deps.store,deps.fileBlobs,deps.authorizationLifecycle,deps.logger)).addStep(newReleaseNamesStep(deps.store,deps.logger,ApiResourceKind.session)).addStep(newCleanupGrantsStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,sealedValuesOfSession)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted session not found in context"),"deleted session not found in context");return await deprovisionSessionSandboxBestEffort(deps.sandboxLane,deps.logger,deleted.metadata?.id??""),redacted(deleted)}async function updateSubject(deps,req,identity2){if(req.id==="")throw invalidArgumentError("id is required");let kind=ApiResourceKind.session,session;try{session=await deps.store.getResource(kind,req.id,SessionSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("session",req.id):internalError(error3,"failed to load session")}await authorizeDirect(SessionCommandController.method.updateSubject,deps.authorizer,identity2,req);try{session=await deps.store.updateResource(kind,req.id,SessionSchema,live=>{live.spec??=create2(SessionSpecSchema,{}),live.spec.subject=req.subject,setAuditFieldsForUpdate(SessionSchema,live,"spec_audit",identity2)})}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("session",req.id):internalError(error3,"failed to persist session")}return await indexSessionSearch(deps,kind,session),redacted(session)}async function indexSessionSearch(deps,kind,session){let entry=sessionSearchExtractor.getSearchIndexEntry(session);if(entry!==void 0)try{await deps.store.upsertSearchIndex(kind,session.metadata?.id??"",entry)}catch(error3){deps.logger.warn("UpdateSubject: failed to update search index (best-effort)",{id:session.metadata?.id??"",error:error3 instanceof Error?error3.message:String(error3)})}}async function get15(deps,id,ctx){let reqCtx=new RequestContext(SessionQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("session-get",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,SessionSchema)).addStep(newStampSessionStateStep(deps.store,ctx2=>[ctx2.get(TARGET_RESOURCE_KEY)])).build().execute(reqCtx),redacted(reqCtx.get(TARGET_RESOURCE_KEY))}async function list13(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("session-list",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListAllSessionsStep(deps.store,deps.logger,deps.listReadScope)).addStep(newStampSessionStateStep(deps.store,listedSessions)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY7))}async function listByAgent4(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByAgent.input,req,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("session-list-by-agent",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newFilterByAgentStep(deps.store,deps.logger,deps.listReadScope)).addStep(newStampSessionStateStep(deps.store,listedSessions)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY7))}async function listByChannel(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByChannel.input,req,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("session-list-by-channel",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByChannel,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeChannelAccessStep(deps.authorizer)).addStep(newFilterByChannelStep(deps.store,deps.logger,deps.listReadScope)).addStep(newStampSessionStateStep(deps.store,listedSessions)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY7))}function listedSessions(ctx){return ctx.get(LIST_RESULT_KEY7)?.entries??[]}function requireListResult2(result){if(result===void 0)throw internalError(new Error("session list not found in context"),"session list not found in context");let list18=result;for(let session of list18.entries)redactSessionValues(session);return list18}function redacted(session){return redactSessionValues(session),session}var import_node_path14=require("node:path");var file_ai_stigmer_agentic_plugin_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEyiQcKF1BsdWdpbkNvbW1hbmRDb250cm9sbGVyEqEBCgRwdXNoEi8uYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QdXNoUGx1Z2luUmVxdWVzdBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24S2AEKF2NyZWF0ZUFydGlmYWN0VXBsb2FkVXJsEkIuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5DcmVhdGVQbHVnaW5BcnRpZmFjdFVwbG9hZFVybFJlcXVlc3QaNS5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbkFydGlmYWN0VXBsb2FkVXJsIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24SsAEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiQuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW4iP8K4GDsIMBA6IgtyZXNvdXJjZV9pZCoodW5hdXRob3JpemVkIHRvIHVwZGF0ZSBwbHVnaW4gdmlzaWJpbGl0eRKGAQoGZGVsZXRlEiYuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5JZBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIi7CuBgqCAMQOiIFdmFsdWUqHXVuYXV0aG9yaXplZCB0byBkZWxldGUgcGx1Z2luEqwBCglsaXN0VG9vbHMSMi5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5Ub29sc0lucHV0GjMuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5MaXN0UGx1Z2luVG9vbHNPdXRwdXQiNsK4GDIIARA6IglwbHVnaW5faWQqIXVuYXV0aG9yaXplZCB0byBsaXN0IHBsdWdpbiB0b29scxoEoP8rOmIGcHJvdG8z",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginCommandController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_command,0);var file_ai_stigmer_agentic_plugin_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxMowGChVQbHVnaW5RdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luSWQaJC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbiIrwrgYJwgBEDoiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IHBsdWdpbhJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIgTQuBgBEmgKBGxpc3QSMC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5zUmVxdWVzdBooLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luTGlzdCIE0LgYARJ4CgtnZXRBcnRpZmFjdBIwLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuR2V0QXJ0aWZhY3RSZXF1ZXN0GjEuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5HZXRBcnRpZmFjdFJlc3BvbnNlIgTQuBgBEokBChZnZXRBcnRpZmFjdERvd25sb2FkVXJsEjAuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5HZXRBcnRpZmFjdFJlcXVlc3QaNy5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbkFydGlmYWN0RG93bmxvYWRVcmwiBNC4GAEShQEKDGxpc3RWZXJzaW9ucxI1LmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuTGlzdFBsdWdpblZlcnNpb25zSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5WZXJzaW9uc1Jlc3BvbnNlIgTQuBgBGgSg/ys6YgZwcm90bzM",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginQueryController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_query,0);var import_node_path13=__toESM(require("node:path"),1);var ArtifactNotFoundError=class extends Error{constructor(storageKey){super(`artifact not found: ${storageKey}`),this.name="ArtifactNotFoundError"}},ARCHIVE_CONTENT_TYPE="application/zip";function newContentAddressedArchiveStore(driver,keyPrefix){let virtualRoot=import_node_path13.default.resolve(import_node_path13.default.sep,"archive-store"),keyEscapesStore=storageKey=>{let resolved=import_node_path13.default.resolve(virtualRoot,storageKey);return resolved!==virtualRoot&&!resolved.startsWith(virtualRoot+import_node_path13.default.sep)};return{getStorageKey(hash){return`${keyPrefix}${hash}.zip`},async store(hash,data){let storageKey=this.getStorageKey(hash);return await driver.upload(storageKey,data,ARCHIVE_CONTENT_TYPE),storageKey},async get(storageKey){if(keyEscapesStore(storageKey))throw new ArtifactNotFoundError(storageKey);try{return await driver.download(storageKey)}catch(error3){throw error3 instanceof ArtifactStorageNotFoundError?new ArtifactNotFoundError(storageKey):new Error(`failed to read artifact: ${error3 instanceof Error?error3.message:String(error3)}`)}},async exists(hash){return driver.exists(this.getStorageKey(hash))},async size(storageKey){if(keyEscapesStore(storageKey))throw new ArtifactNotFoundError(storageKey);try{return await driver.size(storageKey)}catch(error3){throw error3 instanceof ArtifactStorageNotFoundError?new ArtifactNotFoundError(storageKey):new Error(`failed to stat artifact: ${error3 instanceof Error?error3.message:String(error3)}`)}}}}var pluginListIndex=declareListIndex({kind:ApiResourceKind.plugin,schema:PluginSchema,revision:1,keys:{}});async function recordConnectAttempt(store,logger2,start,now=Date.now()){let nowSeconds2=Math.floor(now/1e3),swept=await store.connectAttempts.deleteExpired(nowSeconds2);swept>0&&logger2.info("Swept expired connect attempts",{count:swept}),await store.connectAttempts.create({id:start.id,org:start.org,createdBy:start.createdBy,person:start.person??"",pluginId:start.pluginId,server:start.server,createdAt:nowSeconds2,expiresAt:nowSeconds2+Math.ceil(start.ttlMs/1e3)})}async function endConnectAttempt(store,logger2,id){try{await store.connectAttempts.delete(id)}catch(error3){logger2.warn("Failed to end a connect attempt (non-fatal; it expires)",{execution_id:id,error:error3 instanceof Error?error3.message:String(error3)})}}var CONNECT_SANDBOX_PROVISIONING_FAILED="failed to provision connect sandbox",SHARED_RUNNER_ROUTE=Object.freeze({taskQueue:Object.freeze({kind:"runner"}),release:async()=>{}});async function acquireConnectRoute(lane,logger2,request3){if(!lane.enabled)return SHARED_RUNNER_ROUTE;let{connectExecutionId,org,caller}=request3,taskQueue=connectTaskQueueFor(connectExecutionId),sandboxId;try{sandboxId=await lane.provisioner.createConnectSandbox(connectExecutionId,{taskQueue,stigmerToken:mintSandboxToken(lane,{scope:"connect",sessionId:"",executionId:connectExecutionId,org,callerIdentityId:caller.identityId},logger2),callerClass:caller.callerClass})}catch(error3){throw logger2.error("Connect sandbox provisioning failed - refusing the connect",{execution_id:connectExecutionId,error:error3 instanceof Error?error3.message:String(error3)}),unavailableError(CONNECT_SANDBOX_PROVISIONING_FAILED)}let released=!1;return{taskQueue:{kind:"sandbox",name:taskQueue},async release(){if(!released){released=!0;try{await lane.provisioner.deprovisionConnectSandbox(sandboxId)}catch(error3){logger2.warn("Failed to deprovision connect sandbox (non-fatal)",{execution_id:connectExecutionId,sandbox_id:sandboxId,error:error3 instanceof Error?error3.message:String(error3)})}}}}}var LIST_TOOLS_TIMEOUT={ms:42e4,label:"7m0s"},LIST_TOOLS_ORG_DENIED="unauthorized to list plugin tools in this organization",LIST_TOOLS_GET_BUFFER_MS=15e3;async function listTools(deps,input,identity2){if(input.pluginId===""||input.server==="")throw invalidArgumentError("plugin_id and server are required");if(input.org==="")throw invalidArgumentError("org is required to list a server's tools");let plugin2;try{plugin2=await deps.store.getResource(ApiResourceKind.plugin,input.pluginId,PluginSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("plugin",input.pluginId):internalError(error3,"failed to load plugin")}await authorizeDirect(PluginCommandController.method.listTools,deps.authorizer,identity2,input),await refuseBoundElsewhere(deps.credentialBinding,identity2,input.org),await authorizeResolvedResource(deps.authorizer,identity2,{permission:IamPermission.can_view,resourceKind:ApiResourceKind.organization,resourceId:input.org},LIST_TOOLS_ORG_DENIED);let entry=plugin2.status?.mcpServers.find(server2=>server2.name===input.server);if(entry===void 0)throw notFoundError(`MCP server of plugin '${plugin2.metadata?.slug??""}'`,input.server);let pluginName=plugin2.metadata?.name??"",server={home:{kind:"plugin",pluginId:input.pluginId,pluginName,pluginDigest:plugin2.status?.digest??""},entry,env:plugin2.status?.env??{}},engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError("listing a server's tools is not available: Temporal not configured");let person=runPersonOfCaller(identity2),needsValues=toolRequirements(server).length>0;needsValues&&await deps.vaultResolver.planConnect({orgId:input.org,person,server});let executionId=newConnectExecutionId(input.pluginId);try{await recordConnectAttempt(deps.store,deps.logger,{id:executionId,org:input.org,createdBy:identity2.identityId,person,pluginId:input.pluginId,server:input.server,ttlMs:LIST_TOOLS_TIMEOUT.ms+LIST_TOOLS_GET_BUFFER_MS})}catch(error3){throw internalError(error3,"failed to record the tools listing")}let route;try{route=await acquireConnectRoute(deps.sandboxLane,deps.logger,{connectExecutionId:executionId,org:input.org,caller:identity2});let workflowInput=withCredential(deps,executionId,needsValues,route.taskQueue,{plugin_id:input.pluginId,server:input.server}),run;try{run=await engineState.engine.startListing(executionId,workflowInput,LIST_TOOLS_TIMEOUT.ms,route.taskQueue)}catch(error3){throw deps.logger.error("Failed to start a plugin tools listing",{plugin_id:input.pluginId,server:input.server,error:error3 instanceof Error?error3.message:String(error3)}),internalError(error3,"failed to start the tools listing")}let outcome2=await run.result(LIST_TOOLS_TIMEOUT.ms+LIST_TOOLS_GET_BUFFER_MS);if(!outcome2.ok)throw mapListingFailure(deps.logger,server,run.workflowId,outcome2.failure);return create2(ListPluginToolsOutputSchema,{tools:(outcome2.output.tools??[]).map(tool=>create2(PluginToolSchema,{name:tool.name??"",description:tool.description??"",destructive:tool.destructiveHint===!0}))})}finally{await route?.release(),await endConnectAttempt(deps.store,deps.logger,executionId)}}function withCredential(deps,executionId,needsValues,taskQueue,input){if(!needsValues)return input;let withAttempt={...input,execution_context_id:executionId};if(taskQueue.kind==="sandbox"||!deps.runnerAuth.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))return withAttempt;try{let minted=deps.runnerAuth.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return{...withAttempt,execution_context_token:minted.token}}catch(error3){return deps.logger.warn("Failed to mint the listing's runner credential \u2014 the runner cannot fetch its values",{execution_id:executionId,error:error3 instanceof Error?error3.message:String(error3)}),withAttempt}}function mapListingFailure(logger2,server,workflowId,failure){let name=toolNameOf(server.home.pluginName,server.entry.name);switch(logger2.error("Plugin tools listing failed",{workflow_id:workflowId,plugin_id:server.home.pluginId,server:server.entry.name,failure_kind:failure.kind}),failure.kind){case"application":return failedPreconditionError(listingFailureMessage(name,server.entry,failure.message));case"timeout":return new ConnectError(`listing the tools of ${name} did not complete within the ${LIST_TOOLS_TIMEOUT.label} budget \u2014 if this repeats, check that your runner is running and healthy`,Code.DeadlineExceeded);case"service-not-found":return unavailableError(`listing the tools of ${name} is temporarily unavailable`);case"other":return new ConnectError(listingFailureMessage(name,server.entry,failure.message),Code.Internal);default:{let exhaustive=failure;throw new Error(`unhandled listing failure ${String(exhaustive)}`)}}}function listingFailureMessage(name,entry,cause){return cause.includes("requires OAuth")?cause:entry.transport.case==="stdio"?`listing the tools of ${name} failed: ${cause}. It is a local program the runner starts \u2014 check that the command is installed and its arguments and variables are right`:`listing the tools of ${name} failed: ${cause}. Check that the server's address is reachable and your sign-in or key is valid`}function registerPluginServices(router,deps){router.service(PluginCommandController,{push:(req,ctx)=>push(deps,req,ctx),createArtifactUploadUrl:(req,ctx)=>createArtifactUploadUrl(deps,req,ctx),updateVisibility:(input,ctx)=>updateVisibility4(deps,input,ctx),delete:(id,ctx)=>deletePlugin(deps,id,ctx),listTools:(input,ctx)=>listTools(deps.tools,input,callerIdentityOf(ctx))}),router.service(PluginQueryController,{get:(id,ctx)=>get16(deps,id,ctx),getByReference:(ref,ctx)=>getByReference8(deps,ref,ctx),list:(req,ctx)=>list14(deps,req,ctx),listVersions:(req,ctx)=>listVersions2(deps,req,ctx),getArtifact:(req,ctx)=>getArtifact(deps,req,ctx),getArtifactDownloadUrl:(req,ctx)=>getArtifactDownloadUrl2(deps,req,ctx)})}function kindOf19(ctx){return ctx.values.get(apiResourceKindKey)}async function push(deps,req,ctx){let previous;return runGuardedWrite(async()=>{let reqCtx=new RequestContext(PushPluginRequestSchema,req,callerIdentityOf(ctx),kindOf19(ctx)),consumed=previous?.get(ARTIFACT_BYTES_KEY);return consumed!==void 0&&reqCtx.set(ARTIFACT_BYTES_KEY,consumed),previous=reqCtx,await newPipeline("plugin-push-plan",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.push,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveArtifactSourceStep(deps.staging,{source:input=>({artifact:input.artifact,artifactUploadRef:input.artifactUploadRef}),laneNotConfigured:TRANSFER_LANE_NOT_CONFIGURED})).addStep(newGateAndHashArchiveStep("plugin")).addStep(newReadPluginPackageStep()).addStep(newBuildInitialPluginStep()).addStep(newFindExistingBySlugStep(deps.store,pluginPushBinding)).addStep(newRefuseRenamedSlugStep()).addStep(newGenerateIdIfNeededStep()).addStep(newPlanPluginStatusStep()).addStep(newGuardPushVisibilityStep(deps.store,pluginPushBinding,"GuardPluginVisibility")).addStep(newResolveConvergenceStep(pluginPushBinding)).build().execute(reqCtx),reqCtx.get(CONVERGED_KEY)===!0?reqCtx.get(EXISTING_PUSHED_RESOURCE_KEY):(await newPipeline("plugin-push-install",deps.logger).addStep(newProbeServerSignInsStep({outboundFetch:deps.outboundFetch,logger:deps.logger})).addStep(newCheckAndStoreArtifactStep(deps.artifactStorage)).addStep(newPopulatePluginFieldsStep()).addStep(newClaimPushedNameStep(deps.store,pluginPushBinding)).addStep(newStorePushedStep(deps.store,pluginPushBinding,"StorePlugin")).addStep(newArchiveCurrentPluginStep(deps.store,deps.logger)).addStep(newPushAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger,"PluginPushAuthorizationTuples")).addStep(newIndexPluginSearchStep(deps.store,deps.logger)).build().execute(reqCtx).catch(releaseNameOnFailure(deps.store,deps.logger,reqCtx)),reqCtx.get(PUSHED_RESOURCE_KEY))})}async function createArtifactUploadUrl(deps,req,ctx){let staging=deps.staging;if(staging===void 0)throw failedPreconditionError(TRANSFER_LANE_NOT_CONFIGURED);let reqCtx=new RequestContext(PluginCommandController.method.createArtifactUploadUrl.input,req,callerIdentityOf(ctx),kindOf19(ctx));if(await newPipeline("plugin-create-artifact-upload-url",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.createArtifactUploadUrl,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx),req.sizeBytes>BigInt(104857600))throw invalidArgumentError(`plugin archive size ${req.sizeBytes} bytes exceeds the ${104857600}-byte (100MB) archive limit`);let minted;try{minted=await staging.mint(Number(req.sizeBytes))}catch(error3){throw internalError(error3,"failed to mint upload reference")}return create2(PluginArtifactUploadUrlSchema,{url:minted.url,artifactUploadRef:minted.ref,ttlSeconds:Math.trunc(minted.ttlMs/1e3)})}var UPDATE_VISIBILITY_PLUGIN_KEY="updateVisibilityPlugin";async function updateVisibility4(deps,input,ctx){let reqCtx=new RequestContext(PluginCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("plugin-update-visibility",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadPluginByIdStep(deps.store,UPDATE_VISIBILITY_PLUGIN_KEY)).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_PLUGIN_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newRefuseChildOrgsVisibilityInChildUpdateStep(deps.store,UPDATE_VISIBILITY_PLUGIN_KEY)).addStep(newSetPluginVisibilityStep()).addStep(newPersistPluginStep(deps.store,UPDATE_VISIBILITY_PLUGIN_KEY,"PersistPluginForVisibilityUpdate")).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_PLUGIN_KEY)).addStep(newIndexPluginStep(deps.store,deps.logger,UPDATE_VISIBILITY_PLUGIN_KEY,"IndexPluginAfterVisibilityUpdate")).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_PLUGIN_KEY)}function newLoadPluginByIdStep(store,key){return{name:"LoadPluginForVisibilityUpdate",async execute(ctx){let plugin2;try{plugin2=await store.getResource(ctx.apiResourceKind,ctx.input.resourceId,PluginSchema)}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("plugin",ctx.input.resourceId):internalError(error3,"failed to load plugin")}ctx.set(key,plugin2)}}}function newSetPluginVisibilityStep(){return{name:"SetPluginVisibility",execute(ctx){let plugin2=ctx.get(UPDATE_VISIBILITY_PLUGIN_KEY);plugin2.metadata!==void 0&&(plugin2.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(PluginSchema,plugin2,"status_audit",ctx.callerIdentity)}}}async function deletePlugin(deps,id,ctx){let reqCtx=new RequestContext(PluginCommandController.method.delete.input,id,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("plugin-delete",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,PluginSchema)).addStep(newGuardUnlistedStep(deps.store,UNLISTED_PLUGIN)).addStep(newCascadeDeleteEvalRunsStep("plugin",deps.evalRuns)).addStep(newDeleteVersionArchivesStep(deps.store,deps.logger,{stepName:"DeletePluginArchives",noun:"plugin"})).addStep(newDeleteResourceStep(deps.store)).addStep(newReleaseNamesStep(deps.store,deps.logger,ApiResourceKind.plugin)).addStep(newSweepEvalRunsAfterDeleteStep("plugin",deps.evalRuns)).addStep(newCleanupGrantsStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted plugin not found in context"),"deleted plugin not found in context");return deleted}async function get16(deps,id,ctx){let reqCtx=new RequestContext(PluginQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("plugin-get",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,PluginSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference8(deps,ref,ctx){let reqCtx=new RequestContext(PluginQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("plugin-get-by-reference",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceWithVersionStep(deps.store,pluginVersionBinding,"LoadPluginByReference")).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(PluginQueryController.method.get),"AuthorizeResolvedPlugin")).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getArtifact(deps,req,ctx){let reqCtx=new RequestContext(PluginQueryController.method.getArtifact.input,req,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("plugin-get-artifact",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.getArtifact,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx);let artifact;try{artifact=await deps.artifactStorage.get(pluginStorageKey(req))}catch(error3){throw artifactReadError(error3,req,"failed to load plugin artifact")}return create2(GetArtifactResponseSchema,{artifact})}async function getArtifactDownloadUrl2(deps,req,ctx){let staging=deps.staging;if(staging===void 0)throw failedPreconditionError(TRANSFER_LANE_NOT_CONFIGURED);let reqCtx=new RequestContext(PluginQueryController.method.getArtifactDownloadUrl.input,req,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("plugin-get-artifact-download-url",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.getArtifactDownloadUrl,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx);let size;try{size=await deps.artifactStorage.size(pluginStorageKey(req))}catch(error3){throw artifactReadError(error3,req,"failed to stat plugin artifact")}let capability;try{capability=await staging.downloadUrl(req.artifactStorageKey,"runner")}catch(error3){throw internalError(error3,"failed to mint plugin artifact download URL")}return create2(PluginArtifactDownloadUrlSchema,{url:capability.url,ttlSeconds:Math.trunc(capability.ttlMs/1e3),sizeBytes:BigInt(size)})}function pluginStorageKey(req){let key=req.artifactStorageKey;if(!key.startsWith(PLUGIN_ARTIFACT_KEY_PREFIX)||import_node_path14.posix.normalize(key)!==key||key.split("/").includes(".."))throw new ArtifactNotFoundError(req.artifactStorageKey);return req.artifactStorageKey}function artifactReadError(error3,req,message6){return error3 instanceof ArtifactNotFoundError?new ConnectError(`plugin artifact not found: ${req.artifactStorageKey}`,Code.NotFound):internalError(error3,message6)}async function listVersions2(deps,req,ctx){let reqCtx=new RequestContext(PluginQueryController.method.listVersions.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("plugin-list-versions",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.listVersions,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveBySlugForVersionsStep(deps.store,pluginVersionBinding,"ResolvePluginBySlug")).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,versionHistoryTarget(ApiResourceKind.plugin,"unauthorized to view plugin version history"),"AuthorizeResolvedPlugin")).addStep(newLoadAndMapVersionsStep(deps.store,pluginVersionBinding,"LoadAndMapVersions")).build().execute(reqCtx),reqCtx.get(LIST_VERSIONS_RESPONSE_KEY)}function newPersistPluginStep(store,key,stepName){return{name:stepName,async execute(ctx){let plugin2=ctx.get(key),id=plugin2.metadata?.id??"",written;try{written=await store.updateResource(ctx.apiResourceKind,id,PluginSchema,row=>{row.metadata!==void 0&&(row.metadata.visibility=plugin2.metadata?.visibility??row.metadata.visibility);let audit=(row.status??=create2(PluginStatusSchema)).audit??=create2(ApiResourceAuditSchema);audit.statusAudit=plugin2.status?.audit?.statusAudit})}catch(error3){throw error3 instanceof ResourceNotFoundError?notFoundError("plugin",id):internalError(error3,"failed to save plugin")}ctx.set(key,written)}}}function newIndexPluginStep(store,logger2,key,stepName){return{name:stepName,async execute(ctx){let plugin2=ctx.get(key),entry=pluginSearchExtractor.getSearchIndexEntry(plugin2);if(entry!==void 0)try{await store.upsertSearchIndex(ctx.apiResourceKind,plugin2.metadata?.id??"",entry)}catch(error3){logger2.warn(`${stepName}: failed (best-effort)`,{id:plugin2.metadata?.id??"",error:error3 instanceof Error?error3.message:String(error3)})}}}}var PLUGIN_LIST_KEY="pluginList";async function list14(deps,req,ctx){let reqCtx=new RequestContext(PluginQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("plugin-list",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"ListByOrg",async execute(step){let page=await readOrgListPage({store:deps.store,logger:deps.logger,listReadScope:deps.listReadScope,caller:step.callerIdentity,kind:ApiResourceKind.plugin,schema:PluginSchema,declaration:pluginListIndex,request:step.input});step.set(PLUGIN_LIST_KEY,create2(PluginListSchema,{entries:page.entries,nextPageToken:page.nextPageToken}))}}).build().execute(reqCtx),reqCtx.get(PLUGIN_LIST_KEY)}var file_ai_stigmer_agentic_eval_v1_command=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvZXZhbC92MS9jb21tYW5kLnByb3RvEhphaS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MTK5BgoVRXZhbENvbW1hbmRDb250cm9sbGVyElsKBHB1c2gSKy5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5QdXNoRXZhbFJlcXVlc3QaIC5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5FdmFsIgTQuBgBEm8KDmFkZENhc2VGcm9tUnVuEjUuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuQWRkRXZhbENhc2VGcm9tUnVuUmVxdWVzdBogLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFsLnYxLkV2YWwiBNC4GAESkgEKF2NyZWF0ZUFydGlmYWN0VXBsb2FkVXJsEj4uYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuQ3JlYXRlRXZhbEFydGlmYWN0VXBsb2FkVXJsUmVxdWVzdBoxLmFpLnN0aWdtZXIuYWdlbnRpYy5ldmFsLnYxLkV2YWxBcnRpZmFjdFVwbG9hZFVybCIE0LgYARKqAQoQdXBkYXRlVmlzaWJpbGl0eRI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5VcGRhdGVWaXNpYmlsaXR5SW5wdXQaIC5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5FdmFsIj3CuBg5CDAQQiILcmVzb3VyY2VfaWQqJnVuYXV0aG9yaXplZCB0byB1cGRhdGUgZXZhbCB2aXNpYmlsaXR5EosBCgZyZW5hbWUSKy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuUmVuYW1lSW5wdXQaIC5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5FdmFsIjLCuBguCAMQQiILcmVzb3VyY2VfaWQqG3VuYXV0aG9yaXplZCB0byByZW5hbWUgZXZhbBJ8CgZkZWxldGUSIi5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5FdmFsSWQaIC5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5FdmFsIizCuBgoCAMQQiIFdmFsdWUqG3VuYXV0aG9yaXplZCB0byBkZWxldGUgZXZhbBoEoP8rQmIGcHJvdG8z",[file_ai_stigmer_agentic_eval_v1_api,file_ai_stigmer_agentic_eval_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EvalCommandController=serviceDesc(file_ai_stigmer_agentic_eval_v1_command,0);var file_ai_stigmer_agentic_eval_v1_query=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvZXZhbC92MS9xdWVyeS5wcm90bxIaYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEy2AYKE0V2YWxRdWVyeUNvbnRyb2xsZXISdgoDZ2V0EiIuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuRXZhbElkGiAuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuRXZhbCIpwrgYJQgBEEIiBXZhbHVlKhh1bmF1dGhvcml6ZWQgdG8gZ2V0IGV2YWwSbgoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaIC5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5FdmFsIgTQuBgBEmAKBGxpc3QSLC5haS5zdGlnbWVyLmFnZW50aWMuZXZhbC52MS5MaXN0RXZhbHNSZXF1ZXN0GiQuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuRXZhbExpc3QiBNC4GAESfQoMbGlzdFZlcnNpb25zEjEuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuTGlzdEV2YWxWZXJzaW9uc0lucHV0GjQuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuTGlzdEV2YWxWZXJzaW9uc1Jlc3BvbnNlIgTQuBgBEm8KCGRvd25sb2FkEjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlGicuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuRXZhbEFyY2hpdmUiBNC4GAESgAEKDmdldERvd25sb2FkVXJsEjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlGjIuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuRXZhbEFyY2hpdmVEb3dubG9hZFVybCIE0LgYARJ+ChBidWlsZENhc2VGcm9tUnVuEjcuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuQnVpbGRFdmFsQ2FzZUZyb21SdW5SZXF1ZXN0GisuYWkuc3RpZ21lci5hZ2VudGljLmV2YWwudjEuRXZhbENhc2VBcmNoaXZlIgTQuBgBGgSg/ytCYgZwcm90bzM",[file_ai_stigmer_agentic_eval_v1_api,file_ai_stigmer_agentic_eval_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EvalQueryController=serviceDesc(file_ai_stigmer_agentic_eval_v1_query,0);function writeArchive(files){let sorted=[...files].sort((a5,b7)=>compareWalkOrder(a5.path,b7.path)),bytes=new Map;for(let file of sorted){if(bytes.has(file.path))throw new Error(`archive path '${file.path}' listed twice`);bytes.set(file.path,file.bytes)}let listed={entries:sorted.map(file=>({path:file.path,size:file.bytes.length})),read:path17=>bytes.get(path17)??new Uint8Array};return archivePlugin(listed)}var import_node_crypto41=require("node:crypto");var RESUMING_HARNESSES=[...new Map(Object.values(EVAL_ENGINES).map(engine=>[engine.word,engine.label])).entries()].filter(([word])=>!EVAL_ENGINE_UNSUPPORTED_FEATURES[word].includes("resumed conversations")).map(([,label2])=>`the ${label2} harness`).join(" or "),MAX_CASE_NAME=48,DEFAULT_CASE_NAME="case-from-run",RESERVED_CASE_NAMES=new Set(["mocks","results"]),PLATFORM_SERVER_PREFIX="stigmer",MOCK_TOOL_NAME=/^[A-Za-z0-9-][A-Za-z0-9_-]*$/,encoder6=new TextEncoder;async function buildCaseFromRun(store,logger2,input){let{run}=input,runId=run.metadata?.id??"",sessionId=sessionIdOf(run.spec),events=sessionId===""?[]:await readSessionEvents(store,sessionId,{}),turns=turnsOf(events),own=turns.find(turn2=>turn2.runId===runId),earlier=await earlierTurnsOf2(store,run,turns,own),turn=turnOfTranscript({run,events:own?.events??[]}),request3=turn?.userMessage?.text||run.spec?.message||"",caseName=input.caseName!==""?input.caseName:suggestCaseName(request3),notes=[],files=[{path:"prompt.md",content:promptFile(request3)}];if(earlier.length>0){let harness=await harnessOf(store,sessionId),lines=[],unanswered=0;for(let previous of earlier){let transcript={run:previous.row,events:previous.turn.events},trace2=await evalTraceOf(transcript,{pluginName:"",harness,pluginsByDigest:new Map,wantedFiles:[],readArtifact:()=>Promise.reject(new Error("a history reads no file"))});lines.push(...trace2.traceLines),unanswered+=toolUsesOf(turnOfTranscript(transcript)).filter(use=>use.result===void 0).length}files.push({path:"history.jsonl",content:`${lines.join(`
 `)}
 `}),files.push({path:"case.yaml",content:`schema_version: "1.1"
 name: ${caseName}