@stigmer/server-slim 3.17.0 → 3.18.0

package/main.js

@@ -473,7 +473,7 @@ ${captureLines}`:capture.stack}module2.exports.fetch=function(init,options=void
 `);for(let line of lines){if(line==="")continue;let i6=line.indexOf(":");if(i6>0){let name=line.substring(0,i6).trim(),value=line.substring(i6+1).trim();headers2.append(name,value)}}return headers2}function trailerSerialize(trailer){let lines=[];return trailer.forEach((value,key)=>{lines.push(`${key}: ${value}\r
 `)}),new TextEncoder().encode(lines.join(""))}function createTrailerSerialization(){return{serialize:trailerSerialize,parse:trailerParse}}var headerContentType="Content-Type",headerEncoding="Grpc-Encoding",headerAcceptEncoding="Grpc-Accept-Encoding",headerTimeout="Grpc-Timeout",headerGrpcStatus="Grpc-Status",headerGrpcMessage="Grpc-Message",headerStatusDetailsBin="Grpc-Status-Details-Bin";var contentTypeRegExp=/^application\/grpc-web(-text)?(?:\+(?:(json)(?:; ?charset=utf-?8)?|proto))?$/i,contentTypeProto="application/grpc-web+proto",contentTypeJson="application/grpc-web+json";function parseContentType(contentType){let match=contentType?.match(contentTypeRegExp);if(!match)return;let text=!!match[1],binary2=!match[2];return{text,binary:binary2}}function parseTimeout(value,maxTimeoutMs){if(value===null)return{};let results=/^(\d{1,8})([HMSmun])$/.exec(value);if(results===null)return{error:new ConnectError(`protocol error: invalid grpc timeout value: ${value}`,Code.InvalidArgument)};let timeoutMs={H:3600*1e3,M:60*1e3,S:1e3,m:1,u:.001,n:1e-6}[results[2]]*parseInt(results[1]);return timeoutMs>maxTimeoutMs?{timeoutMs,error:new ConnectError(`timeout ${timeoutMs}ms must be <= ${maxTimeoutMs}`,Code.InvalidArgument)}:{timeoutMs}}var file_status=fileDesc2("CgxzdGF0dXMucHJvdG8SCmdvb2dsZS5ycGMiTgoGU3RhdHVzEgwKBGNvZGUYASABKAUSDwoHbWVzc2FnZRgCIAEoCRIlCgdkZXRhaWxzGAMgAygLMhQuZ29vZ2xlLnByb3RvYnVmLkFueUJeCg5jb20uZ29vZ2xlLnJwY0ILU3RhdHVzUHJvdG9QAVo3Z29vZ2xlLmdvbGFuZy5vcmcvZ2VucHJvdG8vZ29vZ2xlYXBpcy9ycGMvc3RhdHVzO3N0YXR1c6ICA1JQQ2IGcHJvdG8z",[file_google_protobuf_any]),StatusSchema=messageDesc3(file_status,0);var grpcStatusOk="0";function setTrailerStatus(target,error2){if(error2){if(error2.metadata.forEach((value,key)=>{target.append(key,value)}),target.set(headerGrpcStatus,error2.code.toString(10)),target.set(headerGrpcMessage,encodeURIComponent(error2.rawMessage)),error2.details.length>0){let status=create2(StatusSchema,{code:error2.code,message:error2.rawMessage,details:error2.details.map(detail=>"desc"in detail?anyPack(detail.desc,create2(detail.desc,detail.value)):{typeUrl:`type.googleapis.com/${detail.type}`,value:detail.value})});target.set(headerStatusDetailsBin,encodeBinaryHeader(status,StatusSchema))}}else target.set(headerGrpcStatus,grpcStatusOk.toString());return target}function contentTypeMatcher(...supported){let cache7=new Map,source=supported.reduce((previousValue,currentValue)=>previousValue.concat("supported"in currentValue?currentValue.supported:currentValue),[]);function match(contentType){if(contentType===null||contentType.length==0)return!1;let cached2=cache7.get(contentType);if(cached2!==void 0)return cached2;let ok=source.some(re2=>re2.test(contentType));return cache7.size<1024&&cache7.set(contentType,ok),ok}return match.supported=source,match}function createMethodUrl(baseUrl,method){return baseUrl.toString().replace(/\/?$/,`/${method.parent.typeName}/${method.name}`)}function normalize(desc,message6){return create2(desc,message6)}function normalizeIterable(desc,input){function transform(result){return result.done===!0?result:{done:result.done,value:normalize(desc,result.value)}}return{[Symbol.asyncIterator](){let it=input[Symbol.asyncIterator](),res={next:()=>it.next().then(transform)};return it.throw!==void 0&&(res.throw=e6=>it.throw(e6).then(transform)),it.return!==void 0&&(res.return=v=>it.return(v).then(transform)),res}}}function applyInterceptors(next,interceptors){if(!interceptors)return next;for(let i6 of interceptors.concat().reverse())next=i6(next);return next}var __await3=function(v){return this instanceof __await3?(this.v=v,this):new __await3(v)},__asyncGenerator3=function(thisArg,_arguments,generator){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var g5=generator.apply(thisArg,_arguments||[]),i6,q4=[];return i6=Object.create((typeof AsyncIterator=="function"?AsyncIterator:Object).prototype),verb("next"),verb("throw"),verb("return",awaitReturn),i6[Symbol.asyncIterator]=function(){return this},i6;function awaitReturn(f5){return function(v){return Promise.resolve(v).then(f5,reject2)}}function verb(n3,f5){g5[n3]&&(i6[n3]=function(v){return new Promise(function(a5,b7){q4.push([n3,v,a5,b7])>1||resume2(n3,v)})},f5&&(i6[n3]=f5(i6[n3])))}function resume2(n3,v){try{step(g5[n3](v))}catch(e6){settle(q4[0][3],e6)}}function step(r5){r5.value instanceof __await3?Promise.resolve(r5.value.v).then(fulfill,reject2):settle(q4[0][2],r5)}function fulfill(value){resume2("next",value)}function reject2(value){resume2("throw",value)}function settle(f5,v){f5(v),q4.shift(),q4.length&&resume2(q4[0][0],q4[0][1])}},__asyncValues3=function(o3){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var m3=o3[Symbol.asyncIterator],i6;return m3?m3.call(o3):(o3=typeof __values=="function"?__values(o3):o3[Symbol.iterator](),i6={},verb("next"),verb("throw"),verb("return"),i6[Symbol.asyncIterator]=function(){return this},i6);function verb(n3){i6[n3]=o3[n3]&&function(v){return new Promise(function(resolve,reject2){v=o3[n3](v),settle(resolve,reject2,v.done,v.value)})}}function settle(resolve,reject2,d5,v){Promise.resolve(v).then(function(v2){resolve({value:v2,done:d5})},reject2)}},__asyncDelegator3=function(o3){var i6,p3;return i6={},verb("next"),verb("throw",function(e6){throw e6}),verb("return"),i6[Symbol.iterator]=function(){return this},i6;function verb(n3,f5){i6[n3]=o3[n3]?function(v){return(p3=!p3)?{value:__await3(o3[n3](v)),done:!1}:f5?f5(v):v}:f5}};async function invokeUnaryImplementation(spec,context2,input,interceptors){let next=applyInterceptors(async req=>Object.assign({message:normalize(spec.method.output,await spec.impl(req.message,mergeRequest(context2,req))),stream:!1,method:spec.method},responseCommon(context2,spec)),interceptors),{message:message6,header,trailer}=await next(Object.assign({stream:!1,message:input,method:spec.method},requestCommon(context2,spec)));return copyHeaders(header,context2.responseHeader),copyHeaders(trailer,context2.responseTrailer),message6}function transformInvokeImplementation(spec,context2,interceptors){switch(spec.kind){case"unary":return function(input){return __asyncGenerator3(this,arguments,function*(){yield yield __await3(yield __await3(invokeUnaryImplementation(spec,context2,yield __await3(ensureSingle(input,"unary")),interceptors)))})};case"server_streaming":return function(input){return invokeStreamImplementation(spec,context2,input,interceptors,async req=>{let output=normalizeIterable(spec.method.output,spec.impl(await ensureSingle(req.message,"server-streaming"),mergeRequest(context2,req)));return Object.assign({stream:!0,message:output,method:spec.method},responseCommon(context2,spec))})};case"client_streaming":return function(input){return invokeStreamImplementation(spec,context2,input,interceptors,async req=>Object.assign({message:createAsyncIterable([normalize(spec.method.output,await spec.impl(req.message,mergeRequest(context2,req)))]),stream:!0,method:spec.method},responseCommon(context2,spec)))};case"bidi_streaming":return function(input){return invokeStreamImplementation(spec,context2,input,interceptors,req=>Promise.resolve(Object.assign({message:normalizeIterable(spec.method.output,spec.impl(req.message,mergeRequest(context2,req))),stream:!0,method:spec.method},responseCommon(context2,spec))))}}}function invokeStreamImplementation(spec,context2,input,interceptors,anyFn){return __asyncGenerator3(this,arguments,function*(){let next=applyInterceptors(anyFn,interceptors),{message:message6,header,trailer}=yield __await3(next(Object.assign({stream:!0,message:input,method:spec.method},requestCommon(context2,spec))));copyHeaders(header,context2.responseHeader),yield __await3(yield*__asyncDelegator3(__asyncValues3(message6))),copyHeaders(trailer,context2.responseTrailer)})}async function ensureSingle(iterable,method){let it=iterable[Symbol.asyncIterator](),first=await it.next();if(first.done===!0)throw new ConnectError(`protocol error: missing input message for ${method} method`,Code.Unimplemented);if((await it.next()).done!==!0)throw new ConnectError(`protocol error: received extra input message for ${method} method`,Code.Unimplemented);return first.value}function requestCommon(context2,spec){return{requestMethod:context2.requestMethod,url:context2.url,signal:context2.signal,header:context2.requestHeader,service:spec.method.parent,contextValues:context2.values}}function responseCommon(context2,spec){return{service:spec.method.parent,header:context2.responseHeader,trailer:context2.responseTrailer}}function mergeRequest(context2,req){return Object.assign(Object.assign({},context2),{service:req.service,requestHeader:req.header,signal:req.signal,values:req.contextValues})}function copyHeaders(from3,to){from3!==to&&(to.forEach((_,key)=>{to.delete(key)}),from3.forEach((value,key)=>{to.set(key,value)}))}function getJsonOptions(options){var _a3;let o3=Object.assign({},options);return(_a3=o3.ignoreUnknownFields)!==null&&_a3!==void 0||(o3.ignoreUnknownFields=!0),o3}function createMethodSerializationLookup(method,binaryOptions,jsonOptions,limitOptions){let inputBinary=limitSerialization(createBinarySerialization(method.input,binaryOptions),limitOptions),inputJson=limitSerialization(createJsonSerialization(method.input,jsonOptions),limitOptions),outputBinary=limitSerialization(createBinarySerialization(method.output,binaryOptions),limitOptions),outputJson=limitSerialization(createJsonSerialization(method.output,jsonOptions),limitOptions);return{getI(useBinaryFormat){return useBinaryFormat?inputBinary:inputJson},getO(useBinaryFormat){return useBinaryFormat?outputBinary:outputJson}}}function limitSerialization(serialization,limitOptions){return{serialize(data){let bytes=serialization.serialize(data);return assertWriteMaxBytes(limitOptions.writeMaxBytes,bytes.byteLength),bytes},parse(data){return assertReadMaxBytes(limitOptions.readMaxBytes,data.byteLength,!0),serialization.parse(data)}}}function createBinarySerialization(desc,options){return{parse(data){try{return fromBinary2(desc,data,options)}catch(e6){let m3=e6 instanceof Error?e6.message:String(e6);throw new ConnectError(`parse binary: ${m3}`,Code.Internal)}},serialize(data){try{return toBinary(desc,data,options)}catch(e6){let m3=e6 instanceof Error?e6.message:String(e6);throw new ConnectError(`serialize binary: ${m3}`,Code.Internal)}}}}function createJsonSerialization(desc,options){var _a3,_b2;let textEncoder=(_a3=options?.textEncoder)!==null&&_a3!==void 0?_a3:new TextEncoder,textDecoder=(_b2=options?.textDecoder)!==null&&_b2!==void 0?_b2:new TextDecoder,o3=getJsonOptions(options);return{parse(data){try{let json2=textDecoder.decode(data);return fromJsonString(desc,json2,o3)}catch(e6){throw ConnectError.from(e6,Code.InvalidArgument)}},serialize(data){try{let json2=toJsonString(desc,data,o3);return textEncoder.encode(json2)}catch(e6){throw ConnectError.from(e6,Code.Internal)}}}}function assertByteStreamRequest(req){if(!(typeof req.body=="object"&&req.body!==null&&Symbol.asyncIterator in req.body))throw new Error("byte stream required, but received JSON")}var uResponseOk={status:200},uResponseNotFound={status:404},uResponseUnsupportedMediaType={status:415},uResponseMethodNotAllowed={status:405},uResponseVersionNotSupported={status:505};function validateUniversalHandlerOptions(opt){var _a3,_b2,_c5;opt??(opt={});let acceptCompression=opt.acceptCompression?[...opt.acceptCompression]:[],requireConnectProtocolHeader=(_a3=opt.requireConnectProtocolHeader)!==null&&_a3!==void 0?_a3:!1,maxTimeoutMs=(_b2=opt.maxTimeoutMs)!==null&&_b2!==void 0?_b2:Number.MAX_SAFE_INTEGER;return Object.assign(Object.assign({acceptCompression},validateReadWriteMaxBytes(opt.readMaxBytes,opt.writeMaxBytes,opt.compressMinBytes)),{jsonOptions:opt.jsonOptions,binaryOptions:opt.binaryOptions,maxTimeoutMs,shutdownSignal:opt.shutdownSignal,requireConnectProtocolHeader,interceptors:(_c5=opt.interceptors)!==null&&_c5!==void 0?_c5:[]})}function createUniversalServiceHandlers(spec,protocols2){return Object.entries(spec.methods).map(([,implSpec])=>createUniversalMethodHandler(implSpec,protocols2))}function createUniversalMethodHandler(spec,protocols2){return negotiateProtocol(protocols2.map(f5=>f5(spec)))}function negotiateProtocol(protocolHandlers){if(protocolHandlers.length==0)throw new ConnectError("at least one protocol is required",Code.Internal);let service=protocolHandlers[0].service,method=protocolHandlers[0].method,requestPath=protocolHandlers[0].requestPath;if(protocolHandlers.some(h5=>h5.service!==service||h5.method!==method))throw new ConnectError("cannot negotiate protocol for different RPCs",Code.Internal);if(protocolHandlers.some(h5=>h5.requestPath!==requestPath))throw new ConnectError("cannot negotiate protocol for different requestPaths",Code.Internal);async function protocolNegotiatingHandler(request){var _a3;if(method.methodKind=="bidi_streaming"&&request.httpVersion.startsWith("1."))return Object.assign(Object.assign({},uResponseVersionNotSupported),{header:new Headers({Connection:"close"})});let contentType=(_a3=request.header.get("Content-Type"))!==null&&_a3!==void 0?_a3:"",matchingMethod=protocolHandlers.filter(h5=>h5.allowedMethods.includes(request.method));if(matchingMethod.length==0)return uResponseMethodNotAllowed;if(matchingMethod.length==1&&contentType===""){let onlyMatch=matchingMethod[0];return onlyMatch(request)}let matchingContentTypes=matchingMethod.filter(h5=>h5.supportedContentType(contentType));if(matchingContentTypes.length==0)return uResponseUnsupportedMediaType;let firstMatch=matchingContentTypes[0];return firstMatch(request)}return Object.assign(protocolNegotiatingHandler,{service,method,requestPath,supportedContentType:contentTypeMatcher(...protocolHandlers.map(h5=>h5.supportedContentType)),protocolNames:protocolHandlers.flatMap(h5=>h5.protocolNames).filter((value,index2,array)=>array.indexOf(value)===index2),allowedMethods:protocolHandlers.flatMap(h5=>h5.allowedMethods).filter((value,index2,array)=>array.indexOf(value)===index2)})}var protocolName="grpc-web",methodPost="POST";function createHandlerFactory(options){let opt=validateUniversalHandlerOptions(options),trailerSerialization=createTrailerSerialization();function fact(spec){let h5=createHandler(opt,trailerSerialization,spec);return Object.assign(h5,{protocolNames:[protocolName],allowedMethods:[methodPost],supportedContentType:contentTypeMatcher(contentTypeRegExp),requestPath:createMethodUrl("/",spec.method),service:spec.method.parent,method:spec.method})}return fact.protocolName=protocolName,fact}function createHandler(opt,trailerSerialization,spec){let serialization=createMethodSerializationLookup(spec.method,opt.binaryOptions,opt.jsonOptions,opt);return async function(req){assertByteStreamRequest(req);let type2=parseContentType(req.header.get(headerContentType));if(type2==null||type2.text)return uResponseUnsupportedMediaType;if(req.method!==methodPost)return uResponseMethodNotAllowed;let timeout=parseTimeout(req.header.get(headerTimeout),opt.maxTimeoutMs),context2=createHandlerContext(Object.assign(Object.assign({},spec),{service:spec.method.parent,requestMethod:req.method,protocolName,timeoutMs:timeout.timeoutMs,shutdownSignal:opt.shutdownSignal,requestSignal:req.signal,requestHeader:req.header,url:req.url,responseHeader:{[headerContentType]:type2.binary?contentTypeProto:contentTypeJson},responseTrailer:{[headerGrpcStatus]:grpcStatusOk},contextValues:req.contextValues})),compression=compressionNegotiate(opt.acceptCompression,req.header.get(headerEncoding),req.header.get(headerAcceptEncoding),headerAcceptEncoding);compression.response&&context2.responseHeader.set(headerEncoding,compression.response.name);let inputIt=pipe(req.body,transformPrepend(()=>{if(compression.error)throw compression.error;if(timeout.error)throw timeout.error}),transformSplitEnvelope(opt.readMaxBytes),transformDecompressEnvelope(compression.request,opt.readMaxBytes),transformParseEnvelope(serialization.getI(type2.binary),128)),it=transformInvokeImplementation(spec,context2,opt.interceptors)(inputIt)[Symbol.asyncIterator](),outputIt=pipe({[Symbol.asyncIterator](){return{next:()=>it.next(),throw:e6=>{var _a3,_b2;return context2.abort(e6),(_b2=(_a3=it.throw)===null||_a3===void 0?void 0:_a3.call(it,e6))!==null&&_b2!==void 0?_b2:Promise.reject({done:!0})},return:v=>{var _a3,_b2;return context2.abort(),(_b2=(_a3=it.return)===null||_a3===void 0?void 0:_a3.call(it,v))!==null&&_b2!==void 0?_b2:Promise.resolve({done:!0,value:v})}}}},transformSerializeEnvelope(serialization.getO(type2.binary)),transformCatchFinally(e6=>(context2.abort(e6),e6 instanceof ConnectError?setTrailerStatus(context2.responseTrailer,e6):e6!==void 0&&setTrailerStatus(context2.responseTrailer,new ConnectError("internal error",Code.Internal,void 0,void 0,e6)),{flags:128,data:trailerSerialization.serialize(context2.responseTrailer)})),transformCompressEnvelope(compression.response,opt.compressMinBytes),transformJoinEnvelopes(),{propagateDownStreamError:!0});return Object.assign(Object.assign({},uResponseOk),{body:await untilFirst(outputIt),header:context2.responseHeader})}}var contentTypeRegExp2=/^application\/grpc(?:\+(?:(json)(?:; ?charset=utf-?8)?|proto))?$/i,contentTypeProto2="application/grpc+proto",contentTypeJson2="application/grpc+json";function parseContentType2(contentType){let match=contentType?.match(contentTypeRegExp2);return match?{binary:!match[1]}:void 0}var protocolName2="grpc",methodPost2="POST";function createHandlerFactory2(options){let opt=validateUniversalHandlerOptions(options);function fact(spec){let h5=createHandler2(opt,spec);return Object.assign(h5,{protocolNames:[protocolName2],allowedMethods:[methodPost2],supportedContentType:contentTypeMatcher(contentTypeRegExp2),requestPath:createMethodUrl("/",spec.method),service:spec.method.parent,method:spec.method})}return fact.protocolName=protocolName2,fact}function createHandler2(opt,spec){let serialization=createMethodSerializationLookup(spec.method,opt.binaryOptions,opt.jsonOptions,opt);return async function(req){assertByteStreamRequest(req);let type2=parseContentType2(req.header.get(headerContentType));if(type2==null)return uResponseUnsupportedMediaType;if(req.method!==methodPost2)return uResponseMethodNotAllowed;let timeout=parseTimeout(req.header.get(headerTimeout),opt.maxTimeoutMs),context2=createHandlerContext(Object.assign(Object.assign({},spec),{service:spec.method.parent,requestMethod:req.method,protocolName:protocolName2,timeoutMs:timeout.timeoutMs,shutdownSignal:opt.shutdownSignal,requestSignal:req.signal,requestHeader:req.header,url:req.url,responseHeader:{[headerContentType]:type2.binary?contentTypeProto2:contentTypeJson2},responseTrailer:{[headerGrpcStatus]:grpcStatusOk},contextValues:req.contextValues})),compression=compressionNegotiate(opt.acceptCompression,req.header.get(headerEncoding),req.header.get(headerAcceptEncoding),headerAcceptEncoding);compression.response&&context2.responseHeader.set(headerEncoding,compression.response.name);let inputIt=pipe(req.body,transformPrepend(()=>{if(compression.error)throw compression.error;if(timeout.error)throw timeout.error}),transformSplitEnvelope(opt.readMaxBytes),transformDecompressEnvelope(compression.request,opt.readMaxBytes),transformParseEnvelope(serialization.getI(type2.binary))),it=transformInvokeImplementation(spec,context2,opt.interceptors)(inputIt)[Symbol.asyncIterator](),outputIt=pipe({[Symbol.asyncIterator](){return{next:()=>it.next(),throw:e6=>{var _a3,_b2;return context2.abort(e6),(_b2=(_a3=it.throw)===null||_a3===void 0?void 0:_a3.call(it,e6))!==null&&_b2!==void 0?_b2:Promise.reject({done:!0})},return:v=>{var _a3,_b2;return context2.abort(),(_b2=(_a3=it.return)===null||_a3===void 0?void 0:_a3.call(it,v))!==null&&_b2!==void 0?_b2:Promise.resolve({done:!0,value:v})}}}},transformSerializeEnvelope(serialization.getO(type2.binary)),transformCompressEnvelope(compression.response,opt.compressMinBytes),transformJoinEnvelopes(),transformCatchFinally(e6=>{context2.abort(e6),e6 instanceof ConnectError?setTrailerStatus(context2.responseTrailer,e6):e6!==void 0&&setTrailerStatus(context2.responseTrailer,new ConnectError("internal error",Code.Internal,void 0,void 0,e6))}),{propagateDownStreamError:!0});return Object.assign(Object.assign({},uResponseOk),{body:await untilFirst(outputIt),header:context2.responseHeader,trailer:context2.responseTrailer})}}var contentTypeRegExp3=/^application\/(connect\+)?(?:(json)(?:; ?charset=utf-?8)?|(proto))$/i,contentTypeUnaryRegExp=/^application\/(?:json(?:; ?charset=utf-?8)?|proto)$/i,contentTypeStreamRegExp=/^application\/connect\+?(?:json(?:; ?charset=utf-?8)?|proto)$/i,contentTypeUnaryProto="application/proto",contentTypeUnaryJson="application/json",contentTypeStreamProto="application/connect+proto",contentTypeStreamJson="application/connect+json",encodingProto="proto",encodingJson="json";function parseContentType3(contentType){let match=contentType?.match(contentTypeRegExp3);if(!match)return;let stream=!!match[1],binary2=!!match[3];return{stream,binary:binary2}}function parseEncodingQuery(encoding){switch(encoding){case encodingProto:return{stream:!1,binary:!0};case encodingJson:return{stream:!1,binary:!1};default:return}}var __rest=function(s2,e6){var t={};for(var p3 in s2)Object.prototype.hasOwnProperty.call(s2,p3)&&e6.indexOf(p3)<0&&(t[p3]=s2[p3]);if(s2!=null&&typeof Object.getOwnPropertySymbols=="function")for(var i6=0,p3=Object.getOwnPropertySymbols(s2);i6<p3.length;i6++)e6.indexOf(p3[i6])<0&&Object.prototype.propertyIsEnumerable.call(s2,p3[i6])&&(t[p3[i6]]=s2[p3[i6]]);return t};function errorFromJson(jsonValue,metadata,fallback3){var _a3;if(metadata&&new Headers(metadata).forEach((value,key)=>fallback3.metadata.append(key,value)),typeof jsonValue!="object"||jsonValue==null||Array.isArray(jsonValue))throw fallback3;let code=fallback3.code;"code"in jsonValue&&typeof jsonValue.code=="string"&&(code=(_a3=codeFromString(jsonValue.code))!==null&&_a3!==void 0?_a3:code);let message6=jsonValue.message;if(message6!=null&&typeof message6!="string")throw fallback3;let error2=new ConnectError(message6??"",code,metadata);if("details"in jsonValue&&Array.isArray(jsonValue.details))for(let detail of jsonValue.details){if(detail===null||typeof detail!="object"||Array.isArray(detail)||typeof detail.type!="string"||typeof detail.value!="string")throw fallback3;try{error2.details.push({type:detail.type,value:base64Decode2(detail.value),debug:detail.debug})}catch{throw fallback3}}return error2}function errorFromJsonBytes(bytes,metadata,fallback3){let jsonValue;try{jsonValue=JSON.parse(new TextDecoder().decode(bytes))}catch{throw fallback3}return errorFromJson(jsonValue,metadata,fallback3)}function errorToJson(error2,jsonWriteOptions){let o3={code:codeToString(error2.code)};return error2.rawMessage.length>0&&(o3.message=error2.rawMessage),error2.details.length>0&&(o3.details=error2.details.map(detail=>{if("desc"in detail){let msg=create2(detail.desc,detail.value),i6={type:detail.desc.typeName,value:toBinary(detail.desc,msg)};try{i6.debug=toJson(detail.desc,msg,jsonWriteOptions)}catch{}return i6}return detail}).map(_a3=>{var{value}=_a3,rest=__rest(_a3,["value"]);return Object.assign(Object.assign({},rest),{value:base64Encode(value,"std_raw")})})),o3}function errorToJsonBytes(error2,jsonWriteOptions){let textEncoder=new TextEncoder;try{let jsonObject=errorToJson(error2,jsonWriteOptions),jsonString=JSON.stringify(jsonObject);return textEncoder.encode(jsonString)}catch(e6){let m3=e6 instanceof Error?e6.message:String(e6);throw new ConnectError(`failed to serialize Connect Error: ${m3}`,Code.Internal)}}var endStreamFlag=2;function endStreamFromJson(data){let parseErr=new ConnectError("invalid end stream",Code.Unknown),jsonValue;try{jsonValue=JSON.parse(typeof data=="string"?data:new TextDecoder().decode(data))}catch{throw parseErr}if(typeof jsonValue!="object"||jsonValue==null||Array.isArray(jsonValue))throw parseErr;let metadata=new Headers;if("metadata"in jsonValue){if(typeof jsonValue.metadata!="object"||jsonValue.metadata==null||Array.isArray(jsonValue.metadata))throw parseErr;for(let[key,values]of Object.entries(jsonValue.metadata)){if(!Array.isArray(values)||values.some(value=>typeof value!="string"))throw parseErr;for(let value of values)metadata.append(key,value)}}let error2="error"in jsonValue&&jsonValue.error!=null?errorFromJson(jsonValue.error,metadata,parseErr):void 0;return{metadata,error:error2}}function endStreamToJson(metadata,error2,jsonWriteOptions){let es={};error2!==void 0&&(es.error=errorToJson(error2,jsonWriteOptions),metadata=appendHeaders(metadata,error2.metadata));let hasMetadata=!1,md={};return metadata.forEach((value,key)=>{hasMetadata=!0,md[key]=[value]}),hasMetadata&&(es.metadata=md),es}function createEndStreamSerialization(options){let textEncoder=new TextEncoder;return{serialize(data){try{let jsonObject=endStreamToJson(data.metadata,data.error,options),jsonString=JSON.stringify(jsonObject);return textEncoder.encode(jsonString)}catch(e6){let m3=e6 instanceof Error?e6.message:String(e6);throw new ConnectError(`failed to serialize EndStreamResponse: ${m3}`,Code.Internal)}},parse(data){try{return endStreamFromJson(data)}catch(e6){let m3=e6 instanceof Error?e6.message:String(e6);throw new ConnectError(`failed to parse EndStreamResponse: ${m3}`,Code.InvalidArgument)}}}}var headerContentType2="Content-Type",headerUnaryContentLength="Content-Length",headerUnaryEncoding="Content-Encoding",headerStreamEncoding="Connect-Content-Encoding",headerUnaryAcceptEncoding="Accept-Encoding",headerStreamAcceptEncoding="Connect-Accept-Encoding",headerTimeout2="Connect-Timeout-Ms",headerProtocolVersion="Connect-Protocol-Version",headerUserAgent2="User-Agent";function codeFromHttpStatus(httpStatus){switch(httpStatus){case 400:return Code.Internal;case 401:return Code.Unauthenticated;case 403:return Code.PermissionDenied;case 404:return Code.Unimplemented;case 429:return Code.Unavailable;case 502:return Code.Unavailable;case 503:return Code.Unavailable;case 504:return Code.Unavailable;default:return Code.Unknown}}function codeToHttpStatus(code){switch(code){case Code.Canceled:return 499;case Code.Unknown:return 500;case Code.InvalidArgument:return 400;case Code.DeadlineExceeded:return 504;case Code.NotFound:return 404;case Code.AlreadyExists:return 409;case Code.PermissionDenied:return 403;case Code.ResourceExhausted:return 429;case Code.FailedPrecondition:return 400;case Code.Aborted:return 409;case Code.OutOfRange:return 400;case Code.Unimplemented:return 501;case Code.Internal:return 500;case Code.Unavailable:return 503;case Code.DataLoss:return 500;case Code.Unauthenticated:return 401;default:return 500}}function parseTimeout2(value,maxTimeoutMs){if(value===null)return{};let results=/^\d{1,10}$/.exec(value);if(results===null)return{error:new ConnectError(`protocol error: invalid connect timeout value: ${value}`,Code.InvalidArgument)};let timeoutMs=parseInt(results[0]);return timeoutMs>maxTimeoutMs?{timeoutMs,error:new ConnectError(`timeout ${timeoutMs}ms must be <= ${maxTimeoutMs}`,Code.InvalidArgument)}:{timeoutMs:parseInt(results[0])}}var paramConnectVersion="connect",paramEncoding="encoding",paramCompression="compression",paramBase64="base64",paramMessage="message";function trailerDemux(header){let h5=new Headers,t=new Headers;return header.forEach((value,key)=>{key.toLowerCase().startsWith("trailer-")?t.append(key.substring(8),value):h5.append(key,value)}),[h5,t]}function trailerMux(header,trailer){let h5=new Headers(header);return trailer.forEach((value,key)=>{h5.append(`trailer-${key}`,value)}),h5}var protocolVersion="1";function requireProtocolVersionHeader(requestHeader2){let v=requestHeader2.get(headerProtocolVersion);if(v===null)throw new ConnectError(`missing required header: set ${headerProtocolVersion} to "${protocolVersion}"`,Code.InvalidArgument);if(v!==protocolVersion)throw new ConnectError(`${headerProtocolVersion} must be "${protocolVersion}": got "${v}"`,Code.InvalidArgument)}function requireProtocolVersionParam(queryParams){let v=queryParams.get(paramConnectVersion);if(v===null)throw new ConnectError(`missing required parameter: set ${paramConnectVersion} to "v${protocolVersion}"`,Code.InvalidArgument);if(v!==`v${protocolVersion}`)throw new ConnectError(`${paramConnectVersion} must be "v${protocolVersion}": got "${v}"`,Code.InvalidArgument)}var protocolName3="connect",methodPost3="POST",methodGet="GET";function createHandlerFactory3(options){let opt=validateUniversalHandlerOptions(options),endStreamSerialization=createEndStreamSerialization(opt.jsonOptions);function fact(spec){let h5,contentTypeRegExp4,serialization=createMethodSerializationLookup(spec.method,opt.binaryOptions,opt.jsonOptions,opt);spec.kind==="unary"?(contentTypeRegExp4=contentTypeUnaryRegExp,h5=createUnaryHandler(opt,spec,serialization)):(contentTypeRegExp4=contentTypeStreamRegExp,h5=createStreamHandler(opt,spec,serialization,endStreamSerialization));let allowedMethods=[methodPost3];return spec.method.idempotency===MethodOptions_IdempotencyLevel2.NO_SIDE_EFFECTS&&allowedMethods.push(methodGet),Object.assign(h5,{protocolNames:[protocolName3],supportedContentType:contentTypeMatcher(contentTypeRegExp4),allowedMethods,requestPath:createMethodUrl("/",spec.method),service:spec.method.parent,method:spec.method})}return fact.protocolName=protocolName3,fact}function createUnaryHandler(opt,spec,serialization){return async function(req){let isGet=req.method==methodGet;if(isGet&&spec.method.idempotency!=MethodOptions_IdempotencyLevel2.NO_SIDE_EFFECTS)return uResponseMethodNotAllowed;let queryParams=new URL(req.url).searchParams,compressionRequested=isGet?queryParams.get(paramCompression):req.header.get(headerUnaryEncoding),type2=isGet?parseEncodingQuery(queryParams.get(paramEncoding)):parseContentType3(req.header.get(headerContentType2));if(type2==null||type2.stream)return uResponseUnsupportedMediaType;let timeout=parseTimeout2(req.header.get(headerTimeout2),opt.maxTimeoutMs),context2=createHandlerContext(Object.assign(Object.assign({},spec),{service:spec.method.parent,requestMethod:req.method,protocolName:protocolName3,timeoutMs:timeout.timeoutMs,shutdownSignal:opt.shutdownSignal,requestSignal:req.signal,requestHeader:req.header,url:req.url,responseHeader:{[headerContentType2]:type2.binary?contentTypeUnaryProto:contentTypeUnaryJson},contextValues:req.contextValues})),compression=compressionNegotiate(opt.acceptCompression,compressionRequested,req.header.get(headerUnaryAcceptEncoding),headerUnaryAcceptEncoding),status=uResponseOk.status,body;try{if(opt.requireConnectProtocolHeader&&(isGet?requireProtocolVersionParam(queryParams):requireProtocolVersionHeader(req.header)),compression.error)throw compression.error;if(timeout.error)throw timeout.error;let reqBody;isGet?reqBody=await readUnaryMessageFromQuery(opt.readMaxBytes,compression.request,queryParams):reqBody=await readUnaryMessageFromBody(opt.readMaxBytes,compression.request,req);let input=parseUnaryMessage(spec.method,type2.binary,serialization,reqBody),output=await invokeUnaryImplementation(spec,context2,input,opt.interceptors);body=serialization.getO(type2.binary).serialize(output)}catch(e6){context2.abort(e6);let error2;e6 instanceof ConnectError?error2=e6:error2=new ConnectError("internal error",Code.Internal,void 0,void 0,e6),status=codeToHttpStatus(error2.code),context2.responseHeader.set(headerContentType2,contentTypeUnaryJson),error2.metadata.forEach((value,key)=>{context2.responseHeader.set(key,value)}),body=errorToJsonBytes(error2,opt.jsonOptions)}finally{context2.abort()}compression.response&&body.byteLength>=opt.compressMinBytes&&(body=await compression.response.compress(body),context2.responseHeader.set(headerUnaryEncoding,compression.response.name));let header=trailerMux(context2.responseHeader,context2.responseTrailer);return header.set(headerUnaryContentLength,body.byteLength.toString(10)),{status,body:createAsyncIterable([body]),header}}}async function readUnaryMessageFromBody(readMaxBytes,compression,request){if(typeof request.body=="object"&&request.body!==null&&Symbol.asyncIterator in request.body){let reqBytes=await readAllBytes(request.body,readMaxBytes,request.header.get(headerUnaryContentLength));return compression&&(reqBytes=await compression.decompress(reqBytes,readMaxBytes)),reqBytes}return request.body}async function readUnaryMessageFromQuery(readMaxBytes,compression,queryParams){var _a3;let base64=queryParams.get(paramBase64),message6=(_a3=queryParams.get(paramMessage))!==null&&_a3!==void 0?_a3:"",decoded;return base64==="1"?decoded=base64Decode2(message6):decoded=new TextEncoder().encode(message6),compression&&(decoded=await compression.decompress(decoded,readMaxBytes)),decoded}function parseUnaryMessage(method,useBinaryFormat,serialization,input){if(input instanceof Uint8Array)return serialization.getI(useBinaryFormat).parse(input);if(useBinaryFormat)throw new ConnectError("received parsed JSON request body, but content-type indicates binary format",Code.Internal);try{return fromJson(method.input,input)}catch(e6){throw ConnectError.from(e6,Code.InvalidArgument)}}function createStreamHandler(opt,spec,serialization,endStreamSerialization){return async function(req){assertByteStreamRequest(req);let type2=parseContentType3(req.header.get(headerContentType2));if(type2==null||!type2.stream)return uResponseUnsupportedMediaType;if(req.method!==methodPost3)return uResponseMethodNotAllowed;let timeout=parseTimeout2(req.header.get(headerTimeout2),opt.maxTimeoutMs),context2=createHandlerContext(Object.assign(Object.assign({},spec),{service:spec.method.parent,requestMethod:req.method,protocolName:protocolName3,timeoutMs:timeout.timeoutMs,shutdownSignal:opt.shutdownSignal,requestSignal:req.signal,requestHeader:req.header,url:req.url,responseHeader:{[headerContentType2]:type2.binary?contentTypeStreamProto:contentTypeStreamJson},contextValues:req.contextValues})),compression=compressionNegotiate(opt.acceptCompression,req.header.get(headerStreamEncoding),req.header.get(headerStreamAcceptEncoding),headerStreamAcceptEncoding);compression.response&&context2.responseHeader.set(headerStreamEncoding,compression.response.name);let inputIt=pipe(req.body,transformPrepend(()=>{if(opt.requireConnectProtocolHeader&&requireProtocolVersionHeader(req.header),compression.error)throw compression.error;if(timeout.error)throw timeout.error}),transformSplitEnvelope(opt.readMaxBytes),transformDecompressEnvelope(compression.request,opt.readMaxBytes),transformParseEnvelope(serialization.getI(type2.binary),endStreamFlag)),it=transformInvokeImplementation(spec,context2,opt.interceptors)(inputIt)[Symbol.asyncIterator](),outputIt=pipe({[Symbol.asyncIterator](){return{next:()=>it.next(),throw:e6=>{var _a3,_b2;return context2.abort(e6),(_b2=(_a3=it.throw)===null||_a3===void 0?void 0:_a3.call(it,e6))!==null&&_b2!==void 0?_b2:Promise.reject({done:!0})},return:v=>{var _a3,_b2;return context2.abort(),(_b2=(_a3=it.return)===null||_a3===void 0?void 0:_a3.call(it,v))!==null&&_b2!==void 0?_b2:Promise.resolve({done:!0,value:v})}}}},transformSerializeEnvelope(serialization.getO(type2.binary)),transformCatchFinally(e6=>{context2.abort(e6);let end={metadata:context2.responseTrailer};return e6 instanceof ConnectError?end.error=e6:e6!==void 0&&(end.error=new ConnectError("internal error",Code.Internal,void 0,void 0,e6)),{flags:endStreamFlag,data:endStreamSerialization.serialize(end)}}),transformCompressEnvelope(compression.response,opt.compressMinBytes),transformJoinEnvelopes(),{propagateDownStreamError:!0});return Object.assign(Object.assign({},uResponseOk),{body:await untilFirst(outputIt),header:context2.responseHeader})}}function createConnectRouter(routerOptions){let base=whichProtocols(routerOptions),handlers=[],router={handlers,service:(service,implementation,options)=>{let{protocols:protocols2}=whichProtocols(options,base);return handlers.push(...createUniversalServiceHandlers(createServiceImplSpec(service,implementation),protocols2)),router},rpc:(method,impl,opt)=>{let{protocols:protocols2}=whichProtocols(opt,base);return handlers.push(createUniversalMethodHandler(createMethodImplSpec(method,impl),protocols2)),router}};return router}function whichProtocols(options,base){if(base&&!options)return base;let opt=base?Object.assign(Object.assign({},validateUniversalHandlerOptions(base.options)),options):Object.assign(Object.assign({},options),validateUniversalHandlerOptions(options??{})),protocols2=[];if(options?.grpc!==!1&&protocols2.push(createHandlerFactory2(opt)),options?.grpcWeb!==!1&&protocols2.push(createHandlerFactory(opt)),options?.connect!==!1&&protocols2.push(createHandlerFactory3(opt)),protocols2.length===0)throw new ConnectError("cannot create handler, all protocols are disabled",Code.InvalidArgument);return{options:opt,protocols:protocols2}}function requestHeader(methodKind,useBinaryFormat,timeoutMs,userProvidedHeaders,setUserAgent){let result=new Headers(userProvidedHeaders??{});return timeoutMs!==void 0&&result.set(headerTimeout2,`${timeoutMs}`),result.set(headerContentType2,methodKind=="unary"?useBinaryFormat?contentTypeUnaryProto:contentTypeUnaryJson:useBinaryFormat?contentTypeStreamProto:contentTypeStreamJson),result.set(headerProtocolVersion,protocolVersion),!result.has(headerUserAgent2)&&setUserAgent&&result.set(headerUserAgent2,"connect-es/2.1.2"),result}function requestHeaderWithCompression(methodKind,useBinaryFormat,timeoutMs,userProvidedHeaders,acceptCompression,sendCompression,setUserAgent){let result=requestHeader(methodKind,useBinaryFormat,timeoutMs,userProvidedHeaders,setUserAgent);if(sendCompression!=null){let name=methodKind=="unary"?headerUnaryEncoding:headerStreamEncoding;result.set(name,sendCompression.name)}if(acceptCompression.length>0){let name=methodKind=="unary"?headerUnaryAcceptEncoding:headerStreamAcceptEncoding;result.set(name,acceptCompression.map(c5=>c5.name).join(","))}return result}function validateResponse(methodKind,useBinaryFormat,status,headers2){let mimeType=headers2.get(headerContentType2),parsedType=parseContentType3(mimeType);if(status!==200){let errorFromStatus=new ConnectError(`HTTP ${status}`,codeFromHttpStatus(status),headers2);if(methodKind=="unary"&&parsedType&&!parsedType.binary)return{isUnaryError:!0,unaryError:errorFromStatus};throw errorFromStatus}let allowedContentType={binary:useBinaryFormat,stream:methodKind!=="unary"};if(parsedType?.binary!==allowedContentType.binary||parsedType.stream!==allowedContentType.stream)throw new ConnectError(`unsupported content type ${mimeType}`,parsedType===void 0?Code.Unknown:Code.Internal,headers2);return{isUnaryError:!1}}function validateResponseWithCompression(methodKind,acceptCompression,useBinaryFormat,status,headers2){let compression,encoding=headers2.get(methodKind=="unary"?headerUnaryEncoding:headerStreamEncoding);if(encoding!=null&&encoding.toLowerCase()!=="identity"&&(compression=acceptCompression.find(c5=>c5.name===encoding),!compression))throw new ConnectError(`unsupported response encoding "${encoding}"`,Code.Internal,headers2);return Object.assign({compression},validateResponse(methodKind,useBinaryFormat,status,headers2))}var contentTypePrefix="application/";function encodeMessageForUrl(message6,useBase64){return useBase64?base64Encode(message6,"url"):encodeURIComponent(new TextDecoder().decode(message6))}function transformConnectPostToGetRequest(request,message6,useBase64){let query=`?connect=v${protocolVersion}`,compressionQuery="",compression=request.header.get(headerUnaryEncoding);compression!==null&&compression!=="identity"&&(compressionQuery="&compression="+encodeURIComponent(compression),useBase64=!0),useBase64&&(query+="&base64=1"),query+=compressionQuery;let contentType=request.header.get(headerContentType2);contentType?.indexOf(contentTypePrefix)===0&&(query+="&encoding="+encodeURIComponent(contentType.slice(contentTypePrefix.length))),query+="&message="+encodeMessageForUrl(message6,useBase64);let url=request.url+query,header=new Headers(request.header);for(let h5 of[headerProtocolVersion,headerContentType2,headerUnaryContentLength,headerUnaryEncoding,headerUnaryAcceptEncoding])header.delete(h5);return Object.assign(Object.assign({},request),{requestMethod:"GET",url,header})}function runUnaryCall(opt){let next=applyInterceptors(opt.next,opt.interceptors),[signal3,abort,done]=setupSignal(opt),req=Object.assign(Object.assign({},opt.req),{message:normalize(opt.req.method.input,opt.req.message),signal:signal3});return next(req).then(res=>(done(),res),abort)}function runStreamingCall(opt){let next=applyInterceptors(opt.next,opt.interceptors),[signal3,abort,done]=setupSignal(opt),req=Object.assign(Object.assign({},opt.req),{message:normalizeIterable(opt.req.method.input,opt.req.message),signal:signal3}),doneCalled=!1;return signal3.addEventListener("abort",function(){var _a3,_b2;let it=opt.req.message[Symbol.asyncIterator]();doneCalled||(_a3=it.throw)===null||_a3===void 0||_a3.call(it,this.reason).catch(()=>{}),(_b2=it.return)===null||_b2===void 0||_b2.call(it).catch(()=>{})}),next(req).then(res=>Object.assign(Object.assign({},res),{message:{[Symbol.asyncIterator](){let it=res.message[Symbol.asyncIterator]();return{next(){return it.next().then(r5=>(r5.done==!0&&(doneCalled=!0,done()),r5),abort)}}}}}),abort)}function setupSignal(opt){let{signal:signal3,cleanup}=createDeadlineSignal(opt.timeoutMs),controller=createLinkedAbortController(opt.signal,signal3);return[controller.signal,function(reason){let e6=controller.signal.aborted?ConnectError.from(getAbortSignalReason(controller.signal),Code.Canceled):ConnectError.from(reason);return controller.abort(e6),cleanup(),Promise.reject(e6)},function(){cleanup(),controller.abort()}]}var __asyncValues4=function(o3){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var m3=o3[Symbol.asyncIterator],i6;return m3?m3.call(o3):(o3=typeof __values=="function"?__values(o3):o3[Symbol.iterator](),i6={},verb("next"),verb("throw"),verb("return"),i6[Symbol.asyncIterator]=function(){return this},i6);function verb(n3){i6[n3]=o3[n3]&&function(v){return new Promise(function(resolve,reject2){v=o3[n3](v),settle(resolve,reject2,v.done,v.value)})}}function settle(resolve,reject2,d5,v){Promise.resolve(v).then(function(v2){resolve({value:v2,done:d5})},reject2)}},__await4=function(v){return this instanceof __await4?(this.v=v,this):new __await4(v)},__asyncGenerator4=function(thisArg,_arguments,generator){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var g5=generator.apply(thisArg,_arguments||[]),i6,q4=[];return i6=Object.create((typeof AsyncIterator=="function"?AsyncIterator:Object).prototype),verb("next"),verb("throw"),verb("return",awaitReturn),i6[Symbol.asyncIterator]=function(){return this},i6;function awaitReturn(f5){return function(v){return Promise.resolve(v).then(f5,reject2)}}function verb(n3,f5){g5[n3]&&(i6[n3]=function(v){return new Promise(function(a5,b7){q4.push([n3,v,a5,b7])>1||resume2(n3,v)})},f5&&(i6[n3]=f5(i6[n3])))}function resume2(n3,v){try{step(g5[n3](v))}catch(e6){settle(q4[0][3],e6)}}function step(r5){r5.value instanceof __await4?Promise.resolve(r5.value.v).then(fulfill,reject2):settle(q4[0][2],r5)}function fulfill(value){resume2("next",value)}function reject2(value){resume2("throw",value)}function settle(f5,v){f5(v),q4.shift(),q4.length&&resume2(q4[0][0],q4[0][1])}};function createTransport(opt){return{async unary(method,signal3,timeoutMs,header,message6,contextValues){let serialization=createMethodSerializationLookup(method,opt.binaryOptions,opt.jsonOptions,opt);return timeoutMs=timeoutMs===void 0?opt.defaultTimeoutMs:timeoutMs<=0?void 0:timeoutMs,await runUnaryCall({interceptors:opt.interceptors,signal:signal3,timeoutMs,req:{stream:!1,service:method.parent,method,requestMethod:"POST",url:createMethodUrl(opt.baseUrl,method),header:requestHeaderWithCompression(method.methodKind,opt.useBinaryFormat,timeoutMs,header,opt.acceptCompression,opt.sendCompression,!0),contextValues:contextValues??createContextValues(),message:message6},next:async req=>{let requestBody=serialization.getI(opt.useBinaryFormat).serialize(req.message);opt.sendCompression&&requestBody.byteLength>opt.compressMinBytes?(requestBody=await opt.sendCompression.compress(requestBody),req.header.set(headerUnaryEncoding,opt.sendCompression.name)):req.header.delete(headerUnaryEncoding);let useGet=opt.useHttpGet===!0&&method.idempotency===MethodOptions_IdempotencyLevel2.NO_SIDE_EFFECTS,body;useGet?req=transformConnectPostToGetRequest(req,requestBody,opt.useBinaryFormat):body=createAsyncIterable([requestBody]);let universalResponse=await opt.httpClient({url:req.url,method:req.requestMethod,header:req.header,signal:req.signal,body}),{compression,isUnaryError,unaryError}=validateResponseWithCompression(method.methodKind,opt.acceptCompression,opt.useBinaryFormat,universalResponse.status,universalResponse.header),[header2,trailer]=trailerDemux(universalResponse.header),responseBody=await pipeTo(universalResponse.body,sinkAllBytes(opt.readMaxBytes,universalResponse.header.get(headerUnaryContentLength)),{propagateDownStreamError:!1});if(compression&&(responseBody=await compression.decompress(responseBody,opt.readMaxBytes)),isUnaryError)throw errorFromJsonBytes(responseBody,appendHeaders(header2,trailer),unaryError);return{stream:!1,service:method.parent,method,header:header2,message:serialization.getO(opt.useBinaryFormat).parse(responseBody),trailer}}})},async stream(method,signal3,timeoutMs,header,input,contextValues){let serialization=createMethodSerializationLookup(method,opt.binaryOptions,opt.jsonOptions,opt),endStreamSerialization=createEndStreamSerialization(opt.jsonOptions);return timeoutMs=timeoutMs===void 0?opt.defaultTimeoutMs:timeoutMs<=0?void 0:timeoutMs,runStreamingCall({interceptors:opt.interceptors,signal:signal3,timeoutMs,req:{stream:!0,service:method.parent,method,requestMethod:"POST",url:createMethodUrl(opt.baseUrl,method),header:requestHeaderWithCompression(method.methodKind,opt.useBinaryFormat,timeoutMs,header,opt.acceptCompression,opt.sendCompression,!0),contextValues:contextValues??createContextValues(),message:input},next:async req=>{let uRes=await opt.httpClient({url:req.url,method:"POST",header:req.header,signal:req.signal,body:pipe(req.message,transformSerializeEnvelope(serialization.getI(opt.useBinaryFormat)),transformCompressEnvelope(opt.sendCompression,opt.compressMinBytes),transformJoinEnvelopes(),{propagateDownStreamError:!0})}),{compression}=validateResponseWithCompression(method.methodKind,opt.acceptCompression,opt.useBinaryFormat,uRes.status,uRes.header),res=Object.assign(Object.assign({},req),{header:uRes.header,trailer:new Headers,message:pipe(uRes.body,transformSplitEnvelope(opt.readMaxBytes),transformDecompressEnvelope(compression??null,opt.readMaxBytes),transformParseEnvelope(serialization.getO(opt.useBinaryFormat),endStreamFlag,endStreamSerialization),function(iterable){return __asyncGenerator4(this,arguments,function*(){var _a3,e_1,_b2,_c5;let endStreamReceived=!1;try{for(var _d=!0,iterable_1=__asyncValues4(iterable),iterable_1_1;iterable_1_1=yield __await4(iterable_1.next()),_a3=iterable_1_1.done,!_a3;_d=!0){_c5=iterable_1_1.value,_d=!1;let chunk=_c5;if(chunk.end){if(endStreamReceived)throw new ConnectError("protocol error: received extra EndStreamResponse",Code.InvalidArgument);if(endStreamReceived=!0,chunk.value.error){let error2=chunk.value.error;throw uRes.header.forEach((value,key)=>{error2.metadata.append(key,value)}),error2}chunk.value.metadata.forEach((value,key)=>res.trailer.set(key,value));continue}if(endStreamReceived)throw new ConnectError("protocol error: received extra message after EndStreamResponse",Code.InvalidArgument);yield yield __await4(chunk.value)}}catch(e_1_1){e_1={error:e_1_1}}finally{try{!_d&&!_a3&&(_b2=iterable_1.return)&&(yield __await4(_b2.call(iterable_1)))}finally{if(e_1)throw e_1.error}}if(!endStreamReceived)throw new ConnectError("protocol error: missing EndStreamResponse",Code.InvalidArgument)})},{propagateDownStreamError:!0})});return res}})}}}function createUniversalHandlerClient(uHandlers){let handlerMap=new Map;for(let handler of uHandlers)handlerMap.set(handler.requestPath,handler);return async uClientReq=>{var _a3,_b2,_c5;let pathname=new URL(uClientReq.url).pathname,handler=handlerMap.get(pathname);if(!handler)throw new ConnectError(`RouterHttpClient: no handler registered for ${pathname}`,Code.Unimplemented);let reqSignal=(_a3=uClientReq.signal)!==null&&_a3!==void 0?_a3:new AbortController().signal,uServerRes=await raceSignal(reqSignal,handler({body:(_b2=uClientReq.body)!==null&&_b2!==void 0?_b2:createAsyncIterable([]),httpVersion:"2.0",method:uClientReq.method,url:uClientReq.url,header:uClientReq.header,signal:reqSignal})),body=(_c5=uServerRes.body)!==null&&_c5!==void 0?_c5:createAsyncIterable([]);return{body:pipe(body,iterable=>({[Symbol.asyncIterator](){let it=iterable[Symbol.asyncIterator](),w={next(){return raceSignal(reqSignal,it.next())}};return it.throw!==void 0&&(w.throw=e6=>it.throw(e6)),it.return!==void 0&&(w.return=value=>it.return(value)),w}})),header:new Headers(uServerRes.header),status:uServerRes.status,trailer:new Headers(uServerRes.trailer)}}}function raceSignal(signal3,promise){let cleanup,signalPromise=new Promise((_,reject2)=>{let onAbort=()=>reject2(getAbortSignalReason(signal3));if(signal3.aborted)return onAbort();signal3.addEventListener("abort",onAbort),cleanup=()=>signal3.removeEventListener("abort",onAbort)});return Promise.race([signalPromise,promise]).finally(cleanup)}function createRouterTransport(routes,options){var _a3,_b2;let router=createConnectRouter(Object.assign(Object.assign({},(_a3=options?.router)!==null&&_a3!==void 0?_a3:{}),{connect:!0}));return routes(router),createTransport(Object.assign({httpClient:createUniversalHandlerClient(router.handlers),baseUrl:"https://in-memory",useBinaryFormat:!0,interceptors:[],acceptCompression:[],sendCompression:null,compressMinBytes:Number.MAX_SAFE_INTEGER,readMaxBytes:Number.MAX_SAFE_INTEGER,writeMaxBytes:Number.MAX_SAFE_INTEGER},(_b2=options?.transport)!==null&&_b2!==void 0?_b2:{}))}function notFoundError(resource,id){return new ConnectError(`${resource} not found: ${id}`,Code.NotFound)}function invalidArgumentError(message6){return new ConnectError(message6,Code.InvalidArgument)}function alreadyExistsError(resource,id){return new ConnectError(`${resource} already exists: ${id}`,Code.AlreadyExists)}function failedPreconditionError(message6){return new ConnectError(message6,Code.FailedPrecondition)}function abortedError(message6){return new ConnectError(message6,Code.Aborted)}function unavailableError(message6){return new ConnectError(message6,Code.Unavailable)}function internalError(cause,message6){return new ConnectError(message6,Code.Internal,void 0,void 0,cause)}var GRPC_CODE_NAMES={[Code.Canceled]:"Canceled",[Code.Unknown]:"Unknown",[Code.InvalidArgument]:"InvalidArgument",[Code.DeadlineExceeded]:"DeadlineExceeded",[Code.NotFound]:"NotFound",[Code.AlreadyExists]:"AlreadyExists",[Code.PermissionDenied]:"PermissionDenied",[Code.ResourceExhausted]:"ResourceExhausted",[Code.FailedPrecondition]:"FailedPrecondition",[Code.Aborted]:"Aborted",[Code.OutOfRange]:"OutOfRange",[Code.Unimplemented]:"Unimplemented",[Code.Internal]:"Internal",[Code.Unavailable]:"Unavailable",[Code.DataLoss]:"DataLoss",[Code.Unauthenticated]:"Unauthenticated"};function grpcCodeName(code){return GRPC_CODE_NAMES[code]}function goWrappedStatusError(prefix,error2){return new ConnectError(`${prefix}: ${goGrpcErrorText(error2)}`,error2.code)}function goGrpcErrorText(error2){return`rpc error: code = ${GRPC_CODE_NAMES[error2.code]} desc = ${error2.rawMessage}`}function rethrownStatusError(error2){return new ConnectError(error2.rawMessage,error2.code)}var import_node_crypto2=require("node:crypto");function buildPath(schema2){return new PathBuilderImpl(schema2,schema2,[])}function pathToString(path14){let str2=[];for(let ele of path14)switch(ele.kind){case"field":case"oneof":str2.length>0&&str2.push("."),str2.push(ele.name);break;case"extension":str2.push("[",ele.typeName,"]");break;case"list_sub":str2.push("[",ele.index,"]");break;case"map_sub":typeof ele.key=="string"?str2.push('["',ele.key.split("\\").join("\\\\").split('"').join('\\"').split("\r").join("\\r").split(`
 `).join("\\n"),'"]'):str2.push("[",ele.key,"]");break}return str2.join("")}var InvalidPathError=class extends Error{constructor(schema2,message6,path14){super(message6),this.name="InvalidPathError",this.schema=schema2,this.path=path14,Object.setPrototypeOf(this,new.target.prototype)}},PathBuilderImpl=class _PathBuilderImpl{constructor(schema2,left,path14){this.schema=schema2,this.left=left,this.path=path14}getLeft(){return this.left}field(field2){return this.push(field2)}oneof(oneof2){return this.push(oneof2)}extension(extension){return this.push(extension)}list(index2){return this.push({kind:"list_sub",index:index2})}map(key){return this.push({kind:"map_sub",key})}add(pathOrBuilder){let path14=Array.isArray(pathOrBuilder)?pathOrBuilder:pathOrBuilder.toPath(),l3=this.path.length;try{for(let ele of path14)this.push(ele)}catch(e6){throw this.path.splice(l3),e6}return this}toPath(){return this.path.concat()}clone(){return new _PathBuilderImpl(this.schema,this.left,this.path.concat())}push(ele){switch(ele.kind){case"field":if(!this.left||this.left.kind!="message"||this.left.typeName!=ele.parent.typeName)throw this.err("field access");return this.path.push(ele),this.left=ele.fieldKind=="message"?ele.message:ele.fieldKind=="list"||ele.fieldKind=="map"?ele:void 0,this;case"oneof":if(!this.left||this.left.kind!="message"||this.left.typeName!=ele.parent.typeName)throw this.err("oneof access");return this.path.push(ele),this.left=void 0,this;case"extension":if(!this.left||this.left.kind!="message"||this.left.typeName!=ele.extendee.typeName)throw this.err("extension access");return this.path.push(ele),this.left=ele.fieldKind=="message"?ele.message:void 0,this;case"list_sub":if(!this.left||this.left.kind!="field"||this.left.fieldKind!="list")throw this.err("list access");if(ele.index<0||!Number.isInteger(ele.index))throw this.err("list index");return this.path.push(ele),this.left=this.left.listKind=="message"?this.left.message:void 0,this;case"map_sub":if(!this.left||this.left.kind!="field"||this.left.fieldKind!="map")throw this.err("map access");if(!checkKeyType(ele.key,this.left.mapKey))throw this.err("map key");return this.path.push(ele),this.left=this.left.mapKind=="message"?this.left.message:void 0,this}}err(what){return new InvalidPathError(this.schema,"Invalid "+what,this.path)}};function checkKeyType(key,type2){switch(type2){case ScalarType2.STRING:return typeof key=="string";case ScalarType2.INT32:case ScalarType2.UINT32:case ScalarType2.SINT32:case ScalarType2.SFIXED32:case ScalarType2.FIXED32:return typeof key=="number";case ScalarType2.UINT64:case ScalarType2.INT64:case ScalarType2.FIXED64:case ScalarType2.SFIXED64:case ScalarType2.SINT64:return typeof key=="bigint";case ScalarType2.BOOL:return typeof key=="boolean"}}var import_node_crypto=__toESM(require("node:crypto"),1);function assertError(err2){if(!isError(err2))throw new Error("Parameter was not an error")}function isError(err2){return!!err2&&typeof err2=="object"&&objectToString(err2)==="[object Error]"||err2 instanceof Error}function objectToString(obj){return Object.prototype.toString.call(obj)}var NAME="Layerr",__name=NAME;function getGlobalName(){return __name}function parseArguments(args){let options,shortMessage="";if(args.length===0)options={};else if(isError(args[0]))options={cause:args[0]},shortMessage=args.slice(1).join(" ")||"";else if(args[0]&&typeof args[0]=="object")options=Object.assign({},args[0]),shortMessage=args.slice(1).join(" ")||"";else if(typeof args[0]=="string")options={},shortMessage=shortMessage=args.join(" ")||"";else throw new Error("Invalid arguments passed to Layerr");return{options,shortMessage}}var Layerr=class _Layerr extends Error{constructor(errorOptionsOrMessage,messageText){let args=[...arguments],{options,shortMessage}=parseArguments(args),message6=shortMessage;if(options.cause&&(message6=`${message6}: ${options.cause.message}`),super(message6),this.message=message6,options.name&&typeof options.name=="string"?this.name=options.name:this.name=getGlobalName(),options.cause&&Object.defineProperty(this,"_cause",{value:options.cause}),Object.defineProperty(this,"_info",{value:{}}),options.info&&typeof options.info=="object"&&Object.assign(this._info,options.info),Error.captureStackTrace){let ctor=options.constructorOpt||this.constructor;Error.captureStackTrace(this,ctor)}}static cause(err2){return assertError(err2),err2._cause&&isError(err2._cause)?err2._cause:null}static fullStack(err2){assertError(err2);let cause=_Layerr.cause(err2);return cause?`${err2.stack}
-caused by: ${_Layerr.fullStack(cause)}`:err2.stack??""}static info(err2){assertError(err2);let output={},cause=_Layerr.cause(err2);return cause&&Object.assign(output,_Layerr.info(cause)),err2._info&&Object.assign(output,err2._info),output}toString(){let output=this.name||this.constructor.name||this.constructor.prototype.name;return this.message&&(output=`${output}: ${this.message}`),output}};var ENCODING="0123456789ABCDEFGHJKMNPQRSTVWXYZ",ENCODING_LEN=32,TIME_MAX=0xffffffffffff,TIME_LEN=10,RANDOM_LEN=16,ERROR_INFO=Object.freeze({source:"ulid"});function detectPRNG(root5){let rootLookup=root5||detectRoot(),globalCrypto=rootLookup&&(rootLookup.crypto||rootLookup.msCrypto)||(typeof import_node_crypto.default<"u"?import_node_crypto.default:null);if(typeof globalCrypto?.getRandomValues=="function")return()=>{let buffer=new Uint8Array(1);return globalCrypto.getRandomValues(buffer),buffer[0]/255};if(typeof globalCrypto?.randomBytes=="function")return()=>globalCrypto.randomBytes(1).readUInt8()/255;if(import_node_crypto.default?.randomBytes)return()=>import_node_crypto.default.randomBytes(1).readUInt8()/255;throw new Layerr({info:{code:"PRNG_DETECT",...ERROR_INFO}},"Failed to find a reliable PRNG")}function detectRoot(){return inWebWorker()?self:typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:null}function encodeRandom(len,prng){let str2="";for(;len>0;len--)str2=randomChar(prng)+str2;return str2}function encodeTime(now,len){if(isNaN(now))throw new Layerr({info:{code:"ENC_TIME_NAN",...ERROR_INFO}},`Time must be a number: ${now}`);if(now>TIME_MAX)throw new Layerr({info:{code:"ENC_TIME_SIZE_EXCEED",...ERROR_INFO}},`Cannot encode a time larger than ${TIME_MAX}: ${now}`);if(now<0)throw new Layerr({info:{code:"ENC_TIME_NEG",...ERROR_INFO}},`Time must be positive: ${now}`);if(Number.isInteger(now)===!1)throw new Layerr({info:{code:"ENC_TIME_TYPE",...ERROR_INFO}},`Time must be an integer: ${now}`);let mod2,str2="";for(let currentLen=len;currentLen>0;currentLen--)mod2=now%ENCODING_LEN,str2=ENCODING.charAt(mod2)+str2,now=(now-mod2)/ENCODING_LEN;return str2}function inWebWorker(){return typeof WorkerGlobalScope<"u"&&self instanceof WorkerGlobalScope}function randomChar(prng){let rand=Math.floor(prng()*ENCODING_LEN);return rand===ENCODING_LEN&&(rand=ENCODING_LEN-1),ENCODING.charAt(rand)}function ulid(seedTime,prng){let currentPRNG=prng||detectPRNG(),seed=isNaN(seedTime)?Date.now():seedTime;return encodeTime(seed,TIME_LEN)+encodeRandom(RANDOM_LEN,currentPRNG)}function metadataOf(msg){return msg.metadata}function idValueOf(msg){let value=msg.value;return typeof value=="string"?value:""}function camelCaseFieldName(specField){return specField.replace(/_([a-z0-9])/g,(_,ch)=>ch.toUpperCase())}function parentIdOf(resource,specField){let spec=resource.spec;if(spec===void 0)return"";let value=spec[camelCaseFieldName(specField)];return typeof value=="string"?value:""}function messageFieldByName(msg,name){let field2=msg.fields.find(f5=>f5.name===name);return field2!==void 0&&field2.fieldKind==="message"?field2:void 0}function getStatusField(schema2,msg){let root5=reflect2(schema2,msg),field2=messageFieldByName(root5,"status");if(!(field2===void 0||!root5.isSet(field2)))return root5.get(field2)}function getOrCreateStatusField(schema2,msg){let root5=reflect2(schema2,msg),field2=messageFieldByName(root5,"status");if(field2!==void 0)return root5.isSet(field2)||root5.set(field2,reflect2(field2.message)),root5.get(field2)}function hasStatusField(schema2){return schema2.fields.some(f5=>f5.name==="status"&&f5.fieldKind==="message")}function newBuildNewStateStep(){return{name:"BuildNewState",execute(ctx){let resource=ctx.newState,metadata=metadataOf(resource);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"build new state");hasStatusField(ctx.schema)&&clearStatusField(ctx.schema,resource),metadata.id===""&&(metadata.id=generateId(getIdPrefix(ctx.apiResourceKind))),hasStatusField(ctx.schema)&&setAuditFieldsForCreate(ctx.schema,resource,ctx.callerIdentity),metadata.visibility===ApiResourceVisibility.api_resource_visibility_unspecified&&(metadata.visibility=defaultVisibilityFor(ctx.apiResourceKind))}}}function clearStatusField(schema2,msg){let root5=reflect2(schema2,msg),field2=root5.fields.find(f5=>f5.name==="status"&&f5.fieldKind==="message");field2!==void 0&&root5.isSet(field2)&&root5.clear(field2)}function setAuditFieldsForCreate(schema2,resource,identity2){let now=timestampNow(),actor=auditActorFor(identity2),info=create2(ApiResourceAuditInfoSchema,{createdBy:actor,createdAt:now,updatedBy:actor,updatedAt:now,event:"created"});setAuditReflect(schema2,resource,create2(ApiResourceAuditSchema,{specAudit:info,statusAudit:info}))}function setAuditFieldsForUpdate(schema2,resource,slot,identity2){let now=timestampNow(),actor=auditActorFor(identity2),{createdBy,createdAt}=creationAuditOf(schema2,resource,slot);setAuditSlotReflect(schema2,resource,slot,updatedAuditInfo(createdBy,createdAt,actor,now))}var operatorEmail="",operatorName="",operatorIdentityInstalled=!1;function setOperatorIdentity(email,displayName){if(operatorIdentityInstalled)throw new Error("operator identity already installed (boot wiring bug)");operatorIdentityInstalled=!0,operatorEmail=email,operatorName=displayName}function operatorIdentitySnapshot(){return{email:operatorEmail,displayName:operatorName}}function auditActorFor(identity2){return create2(ApiResourceAuditActorSchema,{id:identity2.identityId,email:identity2.email??"",displayName:identity2.displayName??""})}function updatedAuditInfo(createdBy,createdAt,actor,now){return create2(ApiResourceAuditInfoSchema,{createdBy:createdBy??actor,createdAt:createdAt??now,updatedBy:actor,updatedAt:now,event:"updated"})}function creationAuditOf(schema2,resource,slot){let audit=auditOf(schema2,resource),info=slot==="spec_audit"?audit?.specAudit:audit?.statusAudit;return{createdBy:info?.createdBy!==void 0?clone(ApiResourceAuditActorSchema,info.createdBy):void 0,createdAt:info?.createdAt!==void 0?{...info.createdAt}:void 0}}function auditOf(schema2,resource){let status=getStatusField(schema2,resource);if(status===void 0)return;let auditField=messageFieldByName(status,"audit");if(!(auditField===void 0||!status.isSet(auditField)))return status.get(auditField).message}function setAuditReflect(schema2,resource,audit){let status=getOrCreateStatusField(schema2,resource);if(status===void 0)return;let auditField=messageFieldByName(status,"audit");auditField!==void 0&&status.set(auditField,reflect2(ApiResourceAuditSchema,audit))}function setAuditSlotReflect(schema2,resource,slot,info){let status=getOrCreateStatusField(schema2,resource);if(status===void 0)return;let auditField=messageFieldByName(status,"audit");if(auditField===void 0)return;status.isSet(auditField)||status.set(auditField,reflect2(auditField.message));let auditMsg=status.get(auditField),slotField=messageFieldByName(auditMsg,slot);slotField!==void 0&&auditMsg.set(slotField,reflect2(ApiResourceAuditInfoSchema,info))}function generateId(prefix){return`${prefix}_${ulid().toLowerCase()}`}var CROCKFORD_ALPHABET="0123456789abcdefghjkmnpqrstvwxyz",DERIVED_ID_CHARS=26,DERIVED_ID_BITS=BigInt(DERIVED_ID_CHARS*5),SHA256_BITS=256n;function derivedId(prefix,canonicalText){let digest3=(0,import_node_crypto2.createHash)("sha256").update(canonicalText,"utf8").digest(),bits2=0n;for(let byte of digest3)bits2=bits2<<8n|BigInt(byte);let top=bits2>>SHA256_BITS-DERIVED_ID_BITS,encoded="";for(let i6=0;i6<DERIVED_ID_CHARS;i6++)encoded=CROCKFORD_ALPHABET[Number(top&31n)]+encoded,top>>=5n;return`${prefix}_${encoded}`}var AUTHENTICATION_TOKEN_MISSING_MESSAGE="authentication token missing",AUTHENTICATION_EXEMPT_SERVICES=new Set(["grpc.health.v1.Health"]);function isAuthenticationExempt(method){return getOption(method,is_public)||AUTHENTICATION_EXEMPT_SERVICES.has(method.parent.typeName)}var callerIdentityKey=createContextKey(void 0,{description:"caller identity produced at chain position 1"});function callerIdentityOf(ctx){let identity2=ctx.values.get(callerIdentityKey);if(identity2===void 0)throw internalError(new Error("no caller identity in context (chain wiring bug)"),"internal server error");return identity2}function trustedLocalIdentity(){return trustedLocalIdentityFor(operatorIdentitySnapshot())}var SYSTEM_OPERATOR_IDENTITY_ID="system";function trustedLocalIdentityFor(operator){return operator.email===""?{identityId:SYSTEM_OPERATOR_IDENTITY_ID,callerClass:"user",issuer:"",rawToken:""}:{identityId:operator.email,callerClass:"user",issuer:"",rawToken:"",email:operator.email,displayName:operator.displayName}}function createVerifierChainInterceptor(verifiers,guards,logger2,requireAuthentication=!1){return next=>async request=>{request.header.delete(IN_PROCESS_CALLER_HEADER);let token=parseBearerToken(request.header.get("authorization")??""),identity2;if(token!==""){if(identity2=await authenticateBearerToken(verifiers,token,logger2),identity2===void 0&&verifiers.length>0)throw logger2.warn("presented token not claimed by any identity verifier",{verifiers:verifiers.map(v=>v.name).join(", ")}),new ConnectError("the presented token was not accepted by any configured identity verifier",Code.Unauthenticated)}else if(requireAuthentication&&!isAuthenticationExempt(request.method))throw new ConnectError(AUTHENTICATION_TOKEN_MISSING_MESSAGE,Code.Unauthenticated);let stamped=identity2??trustedLocalIdentity();return request.contextValues.set(callerIdentityKey,stamped),await runCallerGuards(guards,stamped,request,logger2),next(request)}}async function runCallerGuards(guards,caller,request,logger2){for(let guard of guards)try{await guard.guard(caller,request.method,request.header)}catch(error2){let procedure=`/${request.service.typeName}/${request.method.name}`;throw error2 instanceof ConnectError?(logger2.warn("caller guard refused the request",{guard:guard.name,procedure,code:Code[error2.code]}),error2):(logger2.error("caller guard failed",{guard:guard.name,procedure,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"internal server error"))}}var IN_PROCESS_CALLER_HEADER="x-stigmer-inprocess-caller";function encodeInProcessCaller(caller){return Buffer.from(JSON.stringify(caller)).toString("base64url")}function createInProcessCallerInterceptor(){return next=>request=>{let encoded=request.header.get(IN_PROCESS_CALLER_HEADER),identity2;if(encoded!==null){request.header.delete(IN_PROCESS_CALLER_HEADER);try{identity2={...JSON.parse(Buffer.from(encoded,"base64url").toString("utf8")),origin:"in-process"}}catch(error2){throw internalError(error2 instanceof Error?error2:new Error(String(error2)),"internal server error")}}else identity2={...trustedLocalIdentity(),callerClass:"internal",origin:"in-process"};return request.contextValues.set(callerIdentityKey,identity2),next(request)}}async function authenticateBearerToken(verifiers,token,logger2){for(let verifier of verifiers){let claimed;try{claimed=await verifier.verify(token)}catch(error2){throw error2 instanceof ConnectError?error2:(logger2.error("identity verifier failed",{verifier:verifier.name,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"internal server error"))}if(claimed!==null)return claimed}}function parseBearerToken(joinedHeaderValue){let header=joinedHeaderValue.split(",")[0]??"",prefix="bearer ";return header.length<=prefix.length||header.slice(0,prefix.length).toLowerCase()!==prefix?"":header.slice(prefix.length).trim()}function rfc3339Seconds(date2){return date2.toISOString().replace(/\.\d{3}Z$/,"Z")}function accountAsCaller(account2){return{...principalOf(account2),callerClass:"user",issuer:"",rawToken:""}}function accountAsRunnerCaller(account2,rawToken){if(rawToken==="")throw new Error("a runner caller carries the credential it presented \u2014 refusing to build one with none");return{...principalOf(account2),callerClass:"runner",issuer:"",rawToken}}function principalOf(account2){let accountId=account2.metadata?.id??"";if(accountId==="")throw new Error("identity account carries no id \u2014 refusing to build a caller for an empty principal");let email=account2.spec?.email??"",displayName=account2.metadata?.name??"";return{identityId:accountId,...email!==""?{email}:{},...displayName!==""?{displayName}:{}}}var POLICY_ID_PREFIX="iamp",IAM_POLICY_API_VERSION="iam.stigmer.ai/v1",IAM_POLICY_KIND="IamPolicy",TRIPLE_DELIMITERS=[":","#","@"];function completeTriple(spec){if(spec.principal===void 0||spec.resource===void 0)throw new Error("policy spec must carry principal and resource");return{principal:spec.principal,resource:spec.resource,relation:spec.relation}}function canonicalTripleText(spec){let{principal,resource,relation}=completeTriple(spec);return`${principal.kind}:${principal.id}#${principal.relation}@${resource.kind}:${resource.id}#${relation}`}function malformedTripleField(spec){let fields2=[["principal.kind",spec.principal?.kind??""],["principal.id",spec.principal?.id??""],["principal.relation",spec.principal?.relation??""],["resource.kind",spec.resource?.kind??""],["resource.id",spec.resource?.id??""],["relation",spec.relation]];for(let[path14,value]of fields2)if(TRIPLE_DELIMITERS.some(delimiter=>value.includes(delimiter)))return path14}function policyIdFor(spec){let text=canonicalTripleText(spec),malformed=malformedTripleField(spec);if(malformed!==void 0)throw new Error(malformedTripleMessage(malformed));return derivedId(POLICY_ID_PREFIX,text)}var BLUEPRINT_KINDS=[ApiResourceKind.agent,ApiResourceKind.workflow,ApiResourceKind.skill,ApiResourceKind.mcp_server,ApiResourceKind.environment,ApiResourceKind.schedule],ROLES_RECONCILED_KEY="membership_rules_reconciled",USER_GRANT_PRINCIPAL_KINDS=[ApiResourceKind.identity_account];function policyNotFoundMessage(id){return`IAM policy not found: ${id}`}function noGrantableRolesMessage(kind){return`No roles can be granted on resource kind '${kind}'. Role assignments for this resource kind are system-managed.`}function roleNotGrantableMessage(role,kind,grantable){return`Role '${role}' cannot be granted on resource kind '${kind}'. Grantable roles: [${grantable.join(", ")}]`}var AUTHENTICATION_REQUIRED_MESSAGE="Authentication required to check permissions";function unknownResourceKindMessage(kind){return`Unknown resource kind: '${kind}'`}var PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE="per-resource access grants are served by the Enterprise and Cloud editions",AUTHORIZATION_QUERIES_UNIMPLEMENTED_MESSAGE="authorization queries are served by the Enterprise and Cloud editions";function unknownPermissionMessage(relation){return`unknown permission '${relation}'`}function unknownPrincipalKindMessage(kind){return`Unknown principal kind: '${kind}'`}function principalNotGrantableMessage(kind){let grantable=USER_GRANT_PRINCIPAL_KINDS.map(k5=>kindEnumName(k5));return`Principal kind '${kind}' cannot be granted a role. Grantable principal kinds: [${grantable.join(", ")}]`}function malformedTripleMessage(field2){return`policy ${field2} must not contain ':', '#' or '@'`}var file_ai_stigmer_iam_iampolicy_v1_spec=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvc3BlYy5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxIr4BCg1JYW1Qb2xpY3lTcGVjEkYKCXByaW5jaXBhbBgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEkUKCHJlc291cmNlGAIgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmQga6SAPIAQESHgoIcmVsYXRpb24YAyABKAlCDLpICcgBAXIEEAEYQCJkCg5BcGlSZXNvdXJjZVJlZhIbCgRraW5kGAEgASgJQg26SArIAQFyBRABGIACEhkKAmlkGAIgASgJQg26SArIAQFyBRABGIACEhoKCHJlbGF0aW9uGAMgASgJQgi6SAVyAxiAAmIGcHJvdG8z",[file_buf_validate_validate]),IamPolicySpecSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_spec,0),ApiResourceRefSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_spec,1);function relationOf(role){if(role===IamRole.iam_role_unspecified)throw new Error("iam_role_unspecified is not a relation");return IamRole[role]}function organizationRole(accountId,role,organizationId){return create2(IamPolicySpecSchema,{principal:{kind:kindEnumName(ApiResourceKind.identity_account),id:accountId},relation:relationOf(role),resource:{kind:kindEnumName(ApiResourceKind.organization),id:organizationId}})}var CREATOR_SCAN_SCHEMAS=new Map([[ApiResourceKind.organization,OrganizationSchema],[ApiResourceKind.agent,AgentSchema],[ApiResourceKind.workflow,WorkflowSchema],[ApiResourceKind.skill,SkillSchema],[ApiResourceKind.mcp_server,McpServerSchema],[ApiResourceKind.environment,EnvironmentSchema],[ApiResourceKind.schedule,ScheduleSchema]]),ORGANIZATION=kindEnumName(ApiResourceKind.organization),IDENTITY_ACCOUNT=kindEnumName(ApiResourceKind.identity_account);function isPersonStamp(stamp){return stamp!==""&&stamp!==SYSTEM_OPERATOR_IDENTITY_ID}function isPersonAccount(account2){let spec=account2.spec;return spec!==void 0&&!spec.isMachineAccount&&spec.provisioningMode!==IdentityAccountProvisioningMode.machine}function roleFor(question){let{accountId,subject,email,operatorEmail:operatorEmail2,organization,blueprintsInOrganization,organizationHasRows}=question,isMine=stamp=>stamp!==""&&(stamp===subject||stamp===accountId);return isMine(organization.createdBy)?IamRole.owner:blueprintsInOrganization.some(b7=>isMine(b7.createdBy))?IamRole.admin:operatorEmail2!==""&&email===operatorEmail2?IamRole.admin:![organization.createdBy,...blueprintsInOrganization.map(b7=>b7.createdBy)].some(stamp=>isPersonStamp(stamp)&&!isMine(stamp))&&!organizationHasRows?IamRole.admin:IamRole.member}function createdAtMillisOf(account2){let stamp=account2.status?.audit?.specAudit?.createdAt;return stamp===void 0?Number.NEGATIVE_INFINITY:Number(stamp.seconds)*1e3+Math.floor(stamp.nanos/1e6)}function newMembershipRules(deps){let{grantPath,policies,store,operatorEmail:operatorEmail2}=deps;async function scan2(kind){let schema2=CREATOR_SCAN_SCHEMAS.get(kind);if(schema2===void 0)throw new Error(`no schema to decode ${kindEnumName(kind)} rows for the creator scan`);return(await store.listResources(kind)).map(bytes=>{let resource=fromBinary2(schema2,bytes),metadata=metadataOf(resource);return{id:metadata?.id??"",org:metadata?.org??"",createdBy:auditOf(schema2,resource)?.specAudit?.createdBy?.id??""}})}async function scanBlueprints(){let scanned=[];for(let kind of BLUEPRINT_KINDS)scanned.push(...await scan2(kind));return scanned}async function organizationsHeldBy(accountId){let rows=await policies.findByPrincipal(IDENTITY_ACCOUNT,accountId);return new Set(rows.filter(row=>row.spec?.resource?.kind===ORGANIZATION).map(row=>row.spec?.resource?.id??""))}async function scanWorld(){return{organizations:await scan2(ApiResourceKind.organization),blueprints:await scanBlueprints()}}async function applyRulesTo(account2,caller,world){let accountId=account2.metadata?.id??"";if(accountId==="")throw new Error("membership rules: the account carries no id");let subject=account2.spec?.idpId??"",email=account2.spec?.email??"",held=await organizationsHeldBy(accountId);for(let organization of world.organizations){if(held.has(organization.id))continue;let blueprintsInOrganization=world.blueprints.filter(blueprint=>blueprint.org===organization.id),role=roleFor({accountId,subject,email,operatorEmail:operatorEmail2,organization,blueprintsInOrganization,organizationHasRows:(await policies.findByResource(ORGANIZATION,organization.id)).length>0});await grantPath.grant(organizationRole(accountId,role,organization.id),caller)}}async function scanPersonAccounts(){return(await store.listResources(ApiResourceKind.identity_account)).map(bytes=>fromBinary2(IdentityAccountSchema,bytes)).filter(isPersonAccount).sort((a5,b7)=>{let byCreation=createdAtMillisOf(a5)-createdAtMillisOf(b7);return byCreation!==0?byCreation:(a5.metadata?.id??"").localeCompare(b7.metadata?.id??"")})}return{async onAccountCreated(account2,caller){if(caller.callerClass!=="user")return;if((account2.metadata?.id??"")==="")throw new Error("membership rules: the provisioned account carries no id");let organizations=await scan2(ApiResourceKind.organization);organizations.length!==0&&await applyRulesTo(account2,caller,{organizations,blueprints:await scanBlueprints()})},async ensureRolesForExistingAccounts(){if(await store.bootstrapState.get(ROLES_RECONCILED_KEY)!=="")return;let accounts=await scanPersonAccounts();if(accounts.length>0){let world=await scanWorld();for(let account2 of accounts)await applyRulesTo(account2,accountAsCaller(account2),world)}await store.bootstrapState.set(ROLES_RECONCILED_KEY,rfc3339Seconds(new Date))},async ensureOperatorOwnership(operator){let accountId=operator.metadata?.id??"";if(accountId==="")throw new Error("membership rules: the operator account carries no id");let actor=accountAsCaller(operator);for(let organization of await scan2(ApiResourceKind.organization))(await policies.findByResourceWithRelations(ORGANIZATION,organization.id,[relationOf(IamRole.owner)])).length>0||await grantPath.grant(organizationRole(accountId,IamRole.owner,organization.id),actor)}}}var ResourceNotFoundError=class extends Error{constructor(detail){super(`resource not found: ${detail}`),this.name="ResourceNotFoundError"}},AuditNotFoundError=class extends Error{constructor(detail){super(`audit record not found: ${detail}`),this.name="AuditNotFoundError"}},IN_FLIGHT_CLAIM_TTL_MS=300*1e3,DELIVERED_SIGNAL_DEDUPE_TTL_MS=1440*60*1e3,PENDING_OAUTH_STATE_TTL_MS=600*1e3;async function findResourceBySlug(store,kind,schema2,slug,org){let rows=await store.listResources(kind);for(let data of rows){let resource;try{resource=fromBinary2(schema2,data)}catch{continue}let metadata=metadataOf(resource);if(!(metadata===void 0||metadata.slug!==slug)&&!(org!==""&&metadata.org!==org))return resource}}async function findResourceByLabelAndOrg(store,kind,schema2,labelKey,labelValue,org){let rows=await store.listResources(kind);for(let data of rows){let resource;try{resource=fromBinary2(schema2,data)}catch{continue}let metadata=metadataOf(resource);if(metadata!==void 0&&metadata.labels[labelKey]===labelValue&&metadata.org===org)return resource}}function requireOrgForReference(kind,org){if(org!=="")return;let scopeType,kindName2;try{let meta=getKindMeta(kind);scopeType=meta.authorization?.scopeType,kindName2=meta.name}catch(error2){throw internalError(error2,"failed to resolve kind metadata for reference org check")}if(scopeType===AuthorizationScopeType.ORGANIZATION)throw invalidArgumentError(`org is required for ${kindName2} lookup`)}function compareCreatedAtDesc(a5,b7){return a5===void 0||b7===void 0?a5===void 0&&b7===void 0?0:a5!==void 0?-1:1:a5.seconds!==b7.seconds?a5.seconds>b7.seconds?-1:1:a5.nanos!==b7.nanos?a5.nanos>b7.nanos?-1:1:0}function matchesAllLabels(resourceLabels,filterLabels){return Object.entries(filterLabels).every(([key,value])=>resourceLabels[key]===value)}var EXISTING_RESOURCE_KEY="existingResource";function newLoadExistingStep(store){return{name:"LoadExisting",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"load existing");let existing;if(metadata.id!=="")try{existing=await store.getResource(ctx.apiResourceKind,metadata.id,ctx.schema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError(getKindName(ctx.apiResourceKind),metadata.id):error2}else if(metadata.slug!==""){let found=await findResourceBySlug(store,ctx.apiResourceKind,ctx.schema,metadata.slug,metadata.org);if(found===void 0)throw notFoundError(getKindName(ctx.apiResourceKind),metadata.slug);existing=found,metadata.id=metadataOf(existing)?.id??""}else throw invalidArgumentError("resource id or slug is required for update");ctx.set(EXISTING_RESOURCE_KEY,existing)}}}async function notifyDefaultInstanceLinked(lifecycle,event){lifecycle?.onDefaultInstanceLinked!==void 0&&await lifecycle.onDefaultInstanceLinked(event)}function visibilityShapesFor(kind,level){let config2=getKindMeta(kind).authorization?.visibility,shapes=new Set,orgFloor=config2?.defaultsToOrgVisibility===!0&&config2.supportsOrg===!0;switch(level){case ApiResourceVisibility.visibility_org:config2?.supportsOrg===!0&&shapes.add("org-viewer");break;case ApiResourceVisibility.visibility_public:config2?.supportsPublic===!0&&(shapes.add("public-viewer"),orgFloor&&shapes.add("org-viewer"));break;case ApiResourceVisibility.visibility_platform:config2?.supportsPlatform===!0&&(shapes.add("platform-viewer"),orgFloor&&shapes.add("org-viewer"));break;default:break}return shapes}function diffVisibilityShapes(kind,oldLevel,newLevel){if(oldLevel===newLevel)return{shapesToCreate:[],shapesToDelete:[]};let oldShapes=visibilityShapesFor(kind,oldLevel),newShapes=visibilityShapesFor(kind,newLevel);return{shapesToCreate:[...newShapes].filter(shape=>!oldShapes.has(shape)),shapesToDelete:[...oldShapes].filter(shape=>!newShapes.has(shape))}}function resolveParentLink(kind,resource,parentConfig){let parentId=parentIdOf(resource,parentConfig.specField);if(parentId==="")throw internalError(new Error(`parent id for relation '${parentConfig.relation}' (spec field '${parentConfig.specField}') is missing on ${getKindName(kind)}`),"failed to create authorization tuples");return{relation:parentConfig.relation,parentKind:getKindEnum(parentConfig.kind),parentId}}function resolveParentLinks(kind,config2,resource,orgId,logger2){let links=[];switch(config2.scopeType){case AuthorizationScopeType.ORGANIZATION:{if(orgId==="")throw internalError(new Error(`organization id is required to create authorization tuples for ${getKindName(kind)}`),"failed to create authorization tuples");links.push({relation:"organization",parentKind:getKindEnum("organization"),parentId:orgId});break}case AuthorizationScopeType.PARENT:{if(config2.parent===void 0)throw internalError(new Error(`${getKindName(kind)} declares PARENT scope without a parent config`),"failed to create authorization tuples");links.push(resolveParentLink(kind,resource,config2.parent));break}case AuthorizationScopeType.OWNER_ONLY:break;case AuthorizationScopeType.PLATFORM:logger2.warn("unhandled PLATFORM authorization scope \u2014 no scope link",{kind:getKindName(kind)});break;default:break}for(let parent of config2.additionalParents)links.push(resolveParentLink(kind,resource,parent));return links}function resolveResourceCreatedEvent(kind,resource,caller,logger2){let config2=getKindMeta(kind).authorization;if(config2===void 0||config2.scopeType===AuthorizationScopeType.NONE||config2.scopeType===AuthorizationScopeType.UNSPECIFIED)return;let metadata=metadataOf(resource);if(metadata===void 0||metadata.id==="")throw internalError(new Error("resource metadata missing after persist"),"failed to create authorization tuples");return{kind,resourceId:metadata.id,orgId:metadata.org,caller,ownerAttribution:config2.ownerType,requiresCreatorTuple:config2.requiresCreatorTuple,parentLinks:resolveParentLinks(kind,config2,resource,metadata.org,logger2),visibilityShapes:[...visibilityShapesFor(kind,metadata.visibility)]}}function newCreateAuthorizationTuplesStep(lifecycle,logger2){return{name:"CreateAuthorizationTuples",async execute(ctx){if(lifecycle===void 0)return;let event=resolveResourceCreatedEvent(ctx.apiResourceKind,ctx.newState,ctx.callerIdentity,logger2);if(event!==void 0)try{await lifecycle.onResourceCreated(event)}catch(error2){throw internalError(error2,"failed to create authorization tuples")}}}}function newCleanupIamPoliciesStep(lifecycle,logger2){return{name:"CleanupIamPolicies",async execute(ctx){if(lifecycle===void 0)return;let metadata=ctx.get(EXISTING_RESOURCE_KEY)?.metadata;if(!(metadata===void 0||metadata.id===""))try{await lifecycle.onResourceDeleted({kind:ctx.apiResourceKind,resourceId:metadata.id,orgId:metadata.org,caller:ctx.callerIdentity})}catch(error2){logger2.warn("authorization cleanup failed \u2014 orphaned IAM policies may remain",{kind:getKindName(ctx.apiResourceKind),resourceId:metadata.id,error:error2 instanceof Error?error2.message:String(error2)})}}}}var OLD_VISIBILITY_KEY="authorizationOldVisibility";function newRecordVisibilityBeforeUpdateStep(resourceKey){return{name:"RecordVisibilityBeforeUpdate",execute(ctx){let resource=ctx.get(resourceKey);ctx.set(OLD_VISIBILITY_KEY,resource?.metadata?.visibility??ApiResourceVisibility.api_resource_visibility_unspecified)}}}function newUpdateVisibilityTuplesStep(lifecycle,resourceKey){return{name:"UpdateVisibilityTuples",async execute(ctx){if(lifecycle===void 0)return;let metadata=ctx.get(resourceKey)?.metadata;if(metadata===void 0||metadata.id==="")return;let oldLevel=ctx.get(OLD_VISIBILITY_KEY)??ApiResourceVisibility.api_resource_visibility_unspecified,{shapesToCreate,shapesToDelete}=diffVisibilityShapes(ctx.apiResourceKind,oldLevel,metadata.visibility);if(!(shapesToCreate.length===0&&shapesToDelete.length===0))try{await lifecycle.onVisibilityChanged({kind:ctx.apiResourceKind,resourceId:metadata.id,orgId:metadata.org,shapesToCreate,shapesToDelete})}catch(error2){throw internalError(error2,"failed to update visibility tuples")}}}}function rowAuthorizationFactsOf(kind,resource){let metadata=resource.metadata,org=metadata?.org??"";return{id:metadata?.id??"",org,visibility:metadata?.visibility??ApiResourceVisibility.api_resource_visibility_unspecified,createdBy:createdByOf(resource),parentLinks:parentLinksOf(kind,resource,org)}}function createdByOf(resource){return resource.status?.audit?.specAudit?.createdBy?.id??""}function parentLinksOf(kind,resource,org){let config2=getKindMeta(kind).authorization;if(config2===void 0)return[];let links=[];switch(config2.scopeType){case AuthorizationScopeType.ORGANIZATION:org!==""&&links.push({relation:"organization",parentKind:getKindEnum("organization"),parentId:org});break;case AuthorizationScopeType.PARENT:config2.parent!==void 0&&pushLink(links,resource,config2.parent);break;case AuthorizationScopeType.OWNER_ONLY:case AuthorizationScopeType.PLATFORM:case AuthorizationScopeType.NONE:case AuthorizationScopeType.UNSPECIFIED:break;default:{let exhaustive=config2.scopeType;throw new Error(`unknown scope type: ${String(exhaustive)}`)}}for(let parent of config2.additionalParents)pushLink(links,resource,parent);return links}function pushLink(links,resource,parent){let parentId=parentIdOf(resource,parent.specField);parentId!==""&&links.push({relation:parent.relation,parentKind:getKindEnum(parent.kind),parentId})}function rowFactsOf(kind,row){return{kind,...rowAuthorizationFactsOf(kind,row)}}function rowFactsOfEntry(kind,entry){return{kind,id:entry.id,org:entry.org,visibility:entry.visibility,createdBy:entry.createdBy,parentLinks:entry.parentLinks}}function objectOf(type2){return{form:"object",type:type2}}function usersetOf(type2,relation){return{form:"userset",type:type2,relation}}function publicWith(type2,condition){return{form:"wildcard",type:type2,condition}}function direct(...subjects){return{node:"this",subjects}}function computed(relation){return{node:"computed",relation}}function from(relation,tupleset){return{node:"from",relation,tupleset}}function union(...members){return{node:"union",members}}function declareKind(input){let type2=kindEnumName(input.kind),relations=new Map;for(let[name,rewrite]of input.relations){if(relations.has(name))throw new Error(`${input.source}: relation '${name}' is declared twice`);relations.set(name,rewrite)}for(let[name,rewrite]of relations)for(let reference of localReferences(rewrite))if(!relations.has(reference.relation))throw new Error(`${input.source}: '${name}' names ${reference.role} '${reference.relation}', which ${type2} does not declare`);let derived=new Map;for(let[name,rule]of input.derived??[]){if(!relations.has(name))throw new Error(`${input.source}: a derived rule for '${name}', which ${type2} does not declare`);derived.set(name,rule)}return{kind:input.kind,type:type2,schema:input.schema,source:input.source,relations,derived}}function localReferences(rewrite){switch(rewrite.node){case"this":return[];case"computed":return[{role:"relation",relation:rewrite.relation}];case"from":return[{role:"tupleset",relation:rewrite.tupleset}];case"union":return rewrite.members.flatMap(localReferences);default:{let exhaustive=rewrite;throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`)}}}var agentDeclaration=declareKind({kind:ApiResourceKind.agent,schema:AgentSchema,source:"fga/model/agentic/agent.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["platform_viewer",direct(usersetOf("identity_provider","platform_user"))],["viewer",union(direct(objectOf("identity_account"),publicWith("identity_account","allow_public"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"),computed("platform_viewer"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_execute",computed("viewer")],["can_create_instance",computed("can_execute")],["can_clone",computed("viewer")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_agentic_agentchannel_v1_spec=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL3NwZWMucHJvdG8SImFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEi+AYKEEFnZW50Q2hhbm5lbFNwZWMSrAEKCWFnZW50X3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUJjukhcugFWCg5hZ2VudF9yZWYua2luZBIzYWdlbnRfcmVmIG11c3QgcmVmZXJlbmNlIGEgcmVzb3VyY2Ugd2l0aCBraW5kPWFnZW50Gg90aGlzLmtpbmQgPT0gNDDIAQHghSwoEg8KB2VuYWJsZWQYAiABKAgSRwoFc2xhY2sYAyABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLlNsYWNrQ2hhbm5lbENvbmZpZ0gAEk0KCHdoYXRzYXBwGAYgASgLMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5XaGF0c0FwcENoYW5uZWxDb25maWdIABLIAQoQZW52aXJvbm1lbnRfcmVmcxgEIAMoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUJ4ukhxkgFuImy6AWkKFWVudmlyb25tZW50X3JlZnMua2luZBI/ZW52aXJvbm1lbnRfcmVmcyBtdXN0IHJlZmVyZW5jZSByZXNvdXJjZXMgd2l0aCBraW5kPWVudmlyb25tZW50Gg90aGlzLmtpbmQgPT0gNTPghSw1ErwBCgdhcHBfcmVmGAUgASgLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlQnW6SG66AWsKDGFwcF9yZWYua2luZBI3YXBwX3JlZiBtdXN0IHJlZmVyZW5jZSBhIHJlc291cmNlIHdpdGgga2luZD1jaGFubmVsX2FwcBoidGhpcy5zbHVnID09ICcnIHx8IHRoaXMua2luZCA9PSA0OOCFLDASIwobcHJvYWN0aXZlX21lc3NhZ2luZ19lbmFibGVkGAcgASgIEkMKCnJ1bl9jb25maWcYCCABKAsyLy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUnVuQ29uZmlnQhgKD3Byb3ZpZGVyX2NvbmZpZxIFukgCCAEiFAoSU2xhY2tDaGFubmVsQ29uZmlnIjkKFVdoYXRzQXBwQ2hhbm5lbENvbmZpZxIgCg9waG9uZV9udW1iZXJfaWQYASABKAlCB7pIBHICEAFiBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_invocation,file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]),AgentChannelSpecSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_spec,0);var file_ai_stigmer_agentic_agentchannel_v1_status=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL3N0YXR1cy5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MSL5AgoSQWdlbnRDaGFubmVsU3RhdHVzElMKDWluc3RhbGxfc3RhdGUYASABKA4yPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbEluc3RhbGxTdGF0ZRJHCgVzbGFjaxgCIAEoCzI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuU2xhY2tJbnN0YWxsU3RhdHVzSAASTQoId2hhdHNhcHAYBCABKAsyOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLldoYXRzQXBwSW5zdGFsbFN0YXR1c0gAEiIKGmNyZWRlbnRpYWxzX2Vudmlyb25tZW50X2lkGAMgASgJEj8KBWF1ZGl0GGMgASgLMjAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRCEQoPcHJvdmlkZXJfc3RhdHVzItABChJTbGFja0luc3RhbGxTdGF0dXMSDwoHdGVhbV9pZBgBIAEoCRIRCgl0ZWFtX25hbWUYAiABKAkSEwoLYm90X3VzZXJfaWQYAyABKAkSFgoOZ3JhbnRlZF9zY29wZXMYBCADKAkSHwoXaW5zdGFsbGVyX3NsYWNrX3VzZXJfaWQYBSABKAkSMAoMaW5zdGFsbGVkX2F0GAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIWCg5jaGFubmVsX2FwcF9pZBgHIAEoCSKvAQoVV2hhdHNBcHBJbnN0YWxsU3RhdHVzEhcKD3Bob25lX251bWJlcl9pZBgBIAEoCRIcChRkaXNwbGF5X3Bob25lX251bWJlchgCIAEoCRIVCg12ZXJpZmllZF9uYW1lGAMgASgJEhYKDmNoYW5uZWxfYXBwX2lkGAQgASgJEjAKDGluc3RhbGxlZF9hdBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAqeAoYQWdlbnRDaGFubmVsSW5zdGFsbFN0YXRlEisKJ2FnZW50X2NoYW5uZWxfaW5zdGFsbF9zdGF0ZV91bnNwZWNpZmllZBAAEhMKD3BlbmRpbmdfaW5zdGFsbBABEg0KCWluc3RhbGxlZBACEgsKB3Jldm9rZWQQA2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_status,file_google_protobuf_timestamp]),AgentChannelStatusSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_status,0);var AgentChannelInstallState;(function(AgentChannelInstallState2){AgentChannelInstallState2[AgentChannelInstallState2.agent_channel_install_state_unspecified=0]="agent_channel_install_state_unspecified",AgentChannelInstallState2[AgentChannelInstallState2.pending_install=1]="pending_install",AgentChannelInstallState2[AgentChannelInstallState2.installed=2]="installed",AgentChannelInstallState2[AgentChannelInstallState2.revoked=3]="revoked"})(AgentChannelInstallState||(AgentChannelInstallState={}));var file_ai_stigmer_agentic_agentchannel_v1_api=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2FwaS5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MSK/AgoMQWdlbnRDaGFubmVsEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiEKBGtpbmQYAiABKAlCE7pIEHIOCgxBZ2VudENoYW5uZWwSTQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YUIGukgDyAEBEkIKBHNwZWMYBCABKAsyNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbFNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5BZ2VudENoYW5uZWxTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_agentchannel_v1_spec,file_ai_stigmer_agentic_agentchannel_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),AgentChannelSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_api,0);var agentChannelDeclaration=declareKind({kind:ApiResourceKind.agent_channel,schema:AgentChannelSchema,source:"fga/model/agentic/agent_channel.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["participant",union(direct(objectOf("identity_account")),computed("owner"))],["viewer",union(direct(objectOf("identity_account")),computed("participant"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_participate",computed("participant")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_agentic_agentexecution_v1_approval=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvYXBwcm92YWwucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSLLAwoPUGVuZGluZ0FwcHJvdmFsEhQKDHRvb2xfY2FsbF9pZBgBIAEoCRIRCgl0b29sX25hbWUYAiABKAkSDwoHbWVzc2FnZRgDIAEoCRIUCgxhcmdzX3ByZXZpZXcYBCABKAkSFAoMcmVxdWVzdGVkX2F0GAUgASgJEhYKDmZyb21fc3ViX2FnZW50GAYgASgIEhYKDnN1Yl9hZ2VudF9uYW1lGAcgASgJEhcKD21jcF9zZXJ2ZXJfc2x1ZxgIIAEoCRIZChFzdWJfYWdlbnRfc3ViamVjdBgJIAEoCRIXCg9hZ2VudF9yYXRpb25hbGUYCiABKAkSFgoOYnJhbmNoX2F0X2RlbnkYCyABKAkSGAoQaGVhZF9zaGFfYXRfZGVueRgMIAEoCRJBCgl0b29sX2tpbmQYDSABKA4yLi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVG9vbEtpbmQSWgoWYXBwcm92YWxfcG9saWN5X3NvdXJjZRgPIAEoDjI6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFBvbGljeVNvdXJjZUoECA4QDyKDAQoZQ2hpbGRBcHByb3ZhbE5vdGlmaWNhdGlvbhIUCgxleGVjdXRpb25faWQYASABKAkSUAoRcGVuZGluZ19hcHByb3ZhbHMYAiADKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUGVuZGluZ0FwcHJvdmFsIp0DCg9BcHByb3ZhbFJlcXVlc3QSGwoTYXBwcm92YWxfcmVxdWVzdF9pZBgBIAEoCRIUCgx0b29sX2NhbGxfaWQYAiABKAkSFAoMcmVxdWVzdGVkX2F0GAMgASgJEhEKCXRvb2xfbmFtZRgEIAEoCRIPCgdtZXNzYWdlGAUgASgJEhQKDGFyZ3NfcHJldmlldxgGIAEoCRIWCg5mcm9tX3N1Yl9hZ2VudBgHIAEoCBIWCg5zdWJfYWdlbnRfbmFtZRgIIAEoCRIZChFzdWJfYWdlbnRfc3ViamVjdBgJIAEoCRIXCg9tY3Bfc2VydmVyX3NsdWcYCiABKAkSQQoJdG9vbF9raW5kGAsgASgOMi4uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xLaW5kEloKFmFwcHJvdmFsX3BvbGljeV9zb3VyY2UYDSABKA4yOi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXBwcm92YWxQb2xpY3lTb3VyY2VKBAgMEA0ilwEKEkFwcHJvdmFsUmV0cmFjdGlvbhIbChNhcHByb3ZhbF9yZXF1ZXN0X2lkGAEgASgJEk4KBnJlYXNvbhgCIAEoDjI+LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFJldHJhY3Rpb25SZWFzb24SFAoMcmV0cmFjdGVkX2F0GAMgASgJIq4BChBBcHByb3ZhbERlY2lzaW9uEhsKE2FwcHJvdmFsX3JlcXVlc3RfaWQYASABKAkSRAoGYWN0aW9uGAIgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsQWN0aW9uEhIKCmRlY2lkZWRfYXQYAyABKAkSEgoKZGVjaWRlZF9ieRgEIAEoCRIPCgdjb21tZW50GAUgASgJIp4DCg1BcHByb3ZhbEV2ZW50EhAKCGV2ZW50X2lkGAEgASgJEhsKE2FwcHJvdmFsX3JlcXVlc3RfaWQYAiABKAkSSwoKZXZlbnRfdHlwZRgDIAEoDjI3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbEV2ZW50VHlwZRIRCgl0aW1lc3RhbXAYBCABKAkSDQoFYWN0b3IYBSABKAkSSgoJcmVxdWVzdGVkGAYgASgLMjUuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsUmVxdWVzdEgAEkkKB2RlY2lkZWQYByABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXBwcm92YWxEZWNpc2lvbkgAEk0KCXJldHJhY3RlZBgIIAEoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFJldHJhY3Rpb25IAEIJCgdwYXlsb2FkInAKE0FwcHJvdmFsRXZlbnRTdHJlYW0SFAoMZXhlY3V0aW9uX2lkGAEgASgJEkMKBmV2ZW50cxgCIAMoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbEV2ZW50YgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum]),PendingApprovalSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_approval,0);var ApprovalEventSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_approval,5),ApprovalEventStreamSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_approval,6);var file_ai_stigmer_agentic_agentexecution_v1_artifact=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvYXJ0aWZhY3QucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSKEAgoRRXhlY3V0aW9uQXJ0aWZhY3QSDAoEbmFtZRgBIAEoCRIUCgxzYW5kYm94X3BhdGgYAiABKAkSUwoEa2luZBgDIAEoDjI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25BcnRpZmFjdEtpbmRCCLpIBYIBAhABEhIKCnNpemVfYnl0ZXMYBCABKAMSEwoLc3RvcmFnZV9rZXkYBSABKAkSEgoKY3JlYXRlZF9hdBgHIAEoCRISCgpleHBpcmVzX2F0GAggASgJEg8KB2VudHJpZXMYCSADKAkSFAoMY29udGVudF9oYXNoGAogASgJYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_buf_validate_validate]);var file_ai_stigmer_agentic_agentexecution_v1_context=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvY29udGV4dC5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIoYDChJTdW1tYXJpemF0aW9uRXZlbnQSEQoJdGltZXN0YW1wGAEgASgJEhUKDXRva2Vuc19iZWZvcmUYAiABKAUSFAoMdG9rZW5zX2FmdGVyGAMgASgFEhkKEWNvbXByZXNzaW9uX3JhdGlvGAQgASgCEhMKC2R1cmF0aW9uX21zGAUgASgFEhsKE3N1bW1hcml6YXRpb25fbW9kZWwYBiABKAkSFwoPbWVzc2FnZXNfYmVmb3JlGAcgASgFEhYKDm1lc3NhZ2VzX2FmdGVyGAggASgFEkkKBnNvdXJjZRgJIAEoDjI5LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5TdW1tYXJpemF0aW9uU291cmNlEiIKGnN1bW1hcml6YXRpb25faW5wdXRfdG9rZW5zGAogASgFEiMKG3N1bW1hcml6YXRpb25fb3V0cHV0X3Rva2VucxgLIAEoBRIeChZzdW1tYXJpemF0aW9uX2Nvc3RfdXNkGAwgASgBIqoCCgtDb250ZXh0SW5mbxIbChNjdXJyZW50X3Rva2VuX2NvdW50GAEgASgFEhwKFGNvbnRleHRfd2luZG93X2xpbWl0GAIgASgFEicKH3N1bW1hcml6YXRpb25fdHJpZ2dlcl90aHJlc2hvbGQYAyABKAUSIwobc3VtbWFyaXphdGlvbl90YXJnZXRfdG9rZW5zGAQgASgFEh0KFXN1bW1hcml6YXRpb25fZW5hYmxlZBgFIAEoCBJWChRzdW1tYXJpemF0aW9uX2V2ZW50cxgGIAMoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5TdW1tYXJpemF0aW9uRXZlbnQSGwoTdXRpbGl6YXRpb25fcGVyY2VudBgHIAEoAmIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_enum]);var file_ai_stigmer_agentic_agentexecution_v1_message=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvbWVzc2FnZS5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIoICCgxBZ2VudE1lc3NhZ2USSQoEdHlwZRgBIAEoDjIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5NZXNzYWdlVHlwZUIIukgFggECEAESDwoHY29udGVudBgCIAEoCRIRCgl0aW1lc3RhbXAYAyABKAkSQgoKdG9vbF9jYWxscxgEIAMoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub29sQ2FsbBIpCghtZXRhZGF0YRgFIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSFAoMaXNfc3RyZWFtaW5nGAYgASgIIqUHCghUb29sQ2FsbBIKCgJpZBgBIAEoCRIMCgRuYW1lGAIgASgJEiUKBGFyZ3MYAyABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0Eg4KBnJlc3VsdBgEIAEoCRJOCgZzdGF0dXMYBSABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVG9vbENhbGxTdGF0dXNCCLpIBYIBAhABEhIKCnN0YXJ0ZWRfYXQYByABKAkSFAoMY29tcGxldGVkX2F0GAggASgJEg0KBWVycm9yGAkgASgJEhkKEXJlcXVpcmVzX2FwcHJvdmFsGAogASgIEhgKEGFwcHJvdmFsX21lc3NhZ2UYCyABKAkSHQoVYXBwcm92YWxfcmVxdWVzdGVkX2F0GAwgASgJEhsKE2FwcHJvdmFsX2RlY2lkZWRfYXQYDSABKAkSEwoLYXBwcm92ZWRfYnkYDiABKAkSTQoPYXBwcm92YWxfYWN0aW9uGA8gASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsQWN0aW9uEhQKDGlzX3N0cmVhbWluZxgQIAEoCBJXChBzdHJlYW1pbmdfc291cmNlGBMgASgOMj0uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xDYWxsU3RyZWFtaW5nU291cmNlEhcKD21jcF9zZXJ2ZXJfc2x1ZxgRIAEoCRIUCgxhcmdzX3ByZXZpZXcYEiABKAkSQQoJdG9vbF9raW5kGBQgASgOMi4uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xLaW5kEksKCm91dHB1dF9yZWYYFSABKAsyNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVG9vbENhbGxPdXRwdXRSZWYSWgoWYXBwcm92YWxfcG9saWN5X3NvdXJjZRgXIAEoDjI6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFBvbGljeVNvdXJjZRIdChVwb2xpY3lfZW5naW5lX3ZlcnNpb24YGCABKAkSHwoXYXBwcm92YWxfY29udGVudF9kaWdlc3QYGSABKAkSGgoSZmlsZV9jaGFuZ2Vfc2V0X2lkGBogASgJSgQIFhAXIpIBChFUb29sQ2FsbE91dHB1dFJlZhITCgtzdG9yYWdlX2tleRgBIAEoCRISCgpzaXplX2J5dGVzGAMgASgDEhQKDGNvbnRlbnRfaGFzaBgEIAEoCRIRCgltaW1lX3R5cGUYBSABKAkSEAoIaXNfaW1hZ2UYBiABKAgSGQoRdHJ1bmNhdGVkX3ByZXZpZXcYByABKAkiwQMKCkZpbGVDaGFuZ2USDAoEcGF0aBgBIAEoCRIVCg1hYnNvbHV0ZV9wYXRoGAIgASgJElMKC2NoYW5nZV90eXBlGAMgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVDaGFuZ2VUeXBlQgi6SAWCAQIQARJdCg1jYXB0dXJlX2xldmVsGAQgASgOMjwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVDaGFuZ2VDYXB0dXJlTGV2ZWxCCLpIBYIBAhABEkEKBmJlZm9yZRgFIAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ29udGVudBJACgVhZnRlchgGIAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ29udGVudBIUCgx1bmlmaWVkX2RpZmYYByABKAkSEwoLbGluZXNfYWRkZWQYCCABKAUSFQoNbGluZXNfcmVtb3ZlZBgJIAEoBRITCgtyZW5hbWVfZnJvbRgKIAEoCSKCAQoLRmlsZUNvbnRlbnQSEAoGaW5saW5lGAEgASgJSAASRgoDcmVmGAIgASgLMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xDYWxsT3V0cHV0UmVmSAASEQoJaXNfYmluYXJ5GAMgASgIQgYKBGJvZHliBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_buf_validate_validate,file_google_protobuf_struct]),AgentMessageSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_message,0);var file_ai_stigmer_agentic_agentexecution_v1_filereview=fileDesc("CjVhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvZmlsZXJldmlldy5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIokFCg1GaWxlQ2hhbmdlU2V0EgoKAmlkGAEgASgJEg8KB3R1cm5faWQYAiABKAkSEgoKaGFybmVzc19pZBgDIAEoCRJTCgZzdGF0dXMYBCABKA4yOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNoYW5nZVNldFN0YXR1c0IIukgFggECEAESTAoRYmFzZWxpbmVfc25hcHNob3QYBSABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU25hcHNob3RSZWYSTQoSY2FuZGlkYXRlX3NuYXBzaG90GAYgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmEkwKEWFwcHJvdmVkX3NuYXBzaG90GAcgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmEkkKB2NoYW5nZXMYCCADKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ2FwdHVyZWRGaWxlQ2hhbmdlEhgKEGFnZ3JlZ2F0ZV9kaWdlc3QYCSABKAkSWwoRZGlmZl9jb21wbGV0ZW5lc3MYCiABKA4yNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRGlmZkNvbXBsZXRlbmVzc0IIukgFggECEAESRQoJZGVjaXNpb25zGAsgAygLMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVEZWNpc2lvbiKoBQoSQ2FwdHVyZWRGaWxlQ2hhbmdlEgoKAmlkGAEgASgJEhMKC3BhdGhfYmVmb3JlGAIgASgJEhIKCnBhdGhfYWZ0ZXIYAyABKAkSTAoEa2luZBgEIAEoDjI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ2hhbmdlS2luZEIIukgFggECEAESVwoNY2FwdHVyZV9jbGFzcxgFIAEoDjI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ2FwdHVyZUNsYXNzQgi6SAWCAQIQARJBCgZiZWZvcmUYBiABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNvbnRlbnQSQAoFYWZ0ZXIYByABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNvbnRlbnQSFQoNYmVmb3JlX3NoYTI1NhgIIAEoCRIUCgxhZnRlcl9zaGEyNTYYCSABKAkSTQoMdW5pZmllZF9kaWZmGAogASgLMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xDYWxsT3V0cHV0UmVmEhUKDWRpZmZfY29tcGxldGUYCyABKAgSEwoLZmlsZV9kaWdlc3QYDCABKAkSXQoOYmxvY2tlZF9yZWFzb24YDSABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZVJldmlld0Jsb2NrUmVhc29uQgi6SAWCAQIQARITCgtsaW5lc19hZGRlZBgOIAEoBRIVCg1saW5lc19yZW1vdmVkGA8gASgFItsBCgtTbmFwc2hvdFJlZhJKCgRraW5kGAEgASgOMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90S2luZEIIukgFggECEAESPQoDZ2l0GAIgASgLMjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkdpdFRyZWVSZWYSQQoDY2FzGAMgASgLMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkNhc01hbmlmZXN0UmVmIisKCkdpdFRyZWVSZWYSEAoIdHJlZV9vaWQYASABKAkSCwoDcmVmGAIgASgJIj8KDkNhc01hbmlmZXN0UmVmEhcKD21hbmlmZXN0X2RpZ2VzdBgBIAEoCRIUCgxhcnRpZmFjdF91cmkYAiABKAkitwMKDEZpbGVEZWNpc2lvbhIKCgJpZBgBIAEoCRIVCg1jaGFuZ2Vfc2V0X2lkGAIgASgJElAKBXNjb3BlGAMgASgOMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVEZWNpc2lvblNjb3BlQgi6SAWCAQIQARIWCg5maWxlX2NoYW5nZV9pZBgEIAEoCRJSCgZhY3Rpb24YBSABKA4yOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZURlY2lzaW9uQWN0aW9uQgi6SAWCAQIQARIXCg9leHBlY3RlZF9kaWdlc3QYBiABKAkSEwoLcmV2aWV3ZXJfaWQYByABKAkSEgoKZGVjaWRlZF9hdBgIIAEoCRIOCgZyZWFzb24YCSABKAkSIAoYYWNrbm93bGVkZ2VfdW5yZXZpZXdhYmxlGAogASgIElIKBm9yaWdpbhgLIAEoDjI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlRGVjaXNpb25PcmlnaW5CCLpIBYIBAhABIqYBChpGaWxlUmV2aWV3QmFzZWxpbmVDYXB0dXJlZBIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJEg8KB3R1cm5faWQYAiABKAkSEgoKaGFybmVzc19pZBgDIAEoCRJMChFiYXNlbGluZV9zbmFwc2hvdBgEIAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5TbmFwc2hvdFJlZiJeChVUdXJuQ29tbWFuZFByb3ZlbmFuY2USHQoVY29uc2VudF90b29sX2NhbGxfaWRzGAEgAygJEiYKHmF1dGhvcml6ZWRfYnlfYXV0b19hcHByb3ZlX2FsbBgCIAEoCCKeAwobRmlsZVJldmlld0NhbmRpZGF0ZUNhcHR1cmVkEhUKDWNoYW5nZV9zZXRfaWQYASABKAkSTQoSY2FuZGlkYXRlX3NuYXBzaG90GAIgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmEkkKB2NoYW5nZXMYAyADKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ2FwdHVyZWRGaWxlQ2hhbmdlEhgKEGFnZ3JlZ2F0ZV9kaWdlc3QYBCABKAkSWwoRZGlmZl9jb21wbGV0ZW5lc3MYBSABKA4yNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRGlmZkNvbXBsZXRlbmVzc0IIukgFggECEAESVwoSY29tbWFuZF9wcm92ZW5hbmNlGAYgASgLMjsuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlR1cm5Db21tYW5kUHJvdmVuYW5jZSJ7ChRGaWxlUmV2aWV3UmVjb25jaWxlZBIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJEkwKEWFwcHJvdmVkX3NuYXBzaG90GAIgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmIo8BChFGaWxlUmV2aWV3RmFpbHVyZRIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJElMKBGtpbmQYAiABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZVJldmlld0ZhaWx1cmVLaW5kQgi6SAWCAQIQARIOCgZkZXRhaWwYAyABKAki6QQKD0ZpbGVSZXZpZXdFdmVudBIQCghldmVudF9pZBgBIAEoCRIVCg1jaGFuZ2Vfc2V0X2lkGAIgASgJElcKCmV2ZW50X3R5cGUYAyABKA4yOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZVJldmlld0V2ZW50VHlwZUIIukgFggECEAESEQoJdGltZXN0YW1wGAQgASgJEg0KBWFjdG9yGAUgASgJEl0KEWJhc2VsaW5lX2NhcHR1cmVkGAYgASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdCYXNlbGluZUNhcHR1cmVkSAASXwoSY2FuZGlkYXRlX2NhcHR1cmVkGAcgASgLMkEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdDYW5kaWRhdGVDYXB0dXJlZEgAEkoKDGZpbGVfZGVjaWRlZBgIIAEoCzIyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlRGVjaXNpb25IABJQCgpyZWNvbmNpbGVkGAkgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdSZWNvbmNpbGVkSAASSQoGZmFpbGVkGAogASgLMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdGYWlsdXJlSABCCQoHcGF5bG9hZCJ0ChVGaWxlUmV2aWV3RXZlbnRTdHJlYW0SFAoMZXhlY3V0aW9uX2lkGAEgASgJEkUKBmV2ZW50cxgCIAMoCzI1LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlUmV2aWV3RXZlbnQi0wEKEkZpbGVDaGFuZ2VQcm9ncmVzcxIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJEhUKDWZpbGVzX2NoYW5nZWQYAiABKAUSEwoLbGluZXNfYWRkZWQYAyABKAUSFQoNbGluZXNfcmVtb3ZlZBgEIAEoBRJOCgdlbnRyaWVzGAUgAygLMj0uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVDaGFuZ2VQcm9ncmVzc0VudHJ5EhMKC2NhcHR1cmVkX2F0GAYgASgJIrwBChdGaWxlQ2hhbmdlUHJvZ3Jlc3NFbnRyeRITCgtwYXRoX2JlZm9yZRgBIAEoCRISCgpwYXRoX2FmdGVyGAIgASgJEkwKBGtpbmQYAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNoYW5nZUtpbmRCCLpIBYIBAhABEhMKC2xpbmVzX2FkZGVkGAQgASgFEhUKDWxpbmVzX3JlbW92ZWQYBSABKAViBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_agentexecution_v1_message,file_buf_validate_validate]),FileChangeSetSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,0);var FileDecisionSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,5);var FileReviewEventSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,11),FileReviewEventStreamSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,12);var file_ai_stigmer_agentic_executioncontext_v1_spec=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9zcGVjLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MSLwAQoURXhlY3V0aW9uQ29udGV4dFNwZWMSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABElQKBGRhdGEYAiADKAsyRi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0U3BlYy5EYXRhRW50cnkaYwoJRGF0YUVudHJ5EgsKA2tleRgBIAEoCRJFCgV2YWx1ZRgCIAEoCzI2LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvblZhbHVlOgI4ASIyCg5FeGVjdXRpb25WYWx1ZRINCgV2YWx1ZRgBIAEoCRIRCglpc19zZWNyZXQYAiABKAhiBnByb3RvMw",[file_buf_validate_validate]);var ExecutionValueSchema=messageDesc2(file_ai_stigmer_agentic_executioncontext_v1_spec,1);var file_ai_stigmer_agentic_session_v1_spec=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9zcGVjLnByb3RvEh1haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MSKWBwoLU2Vzc2lvblNwZWMSGQoRYWdlbnRfaW5zdGFuY2VfaWQYASABKAkSDwoHc3ViamVjdBgCIAEoCRIYChBoYXJuZXNzX3N0YXRlX2lkGAMgASgJEiAKGGhhcm5lc3Nfc3RhdGVfaWRfaGlzdG9yeRgNIAMoCRJKCghtZXRhZGF0YRgFIAMoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25TcGVjLk1ldGFkYXRhRW50cnkSSAoRd29ya3NwYWNlX2VudHJpZXMYBiADKAsyLS5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5Xb3Jrc3BhY2VFbnRyeRLZAQoRbWNwX3NlcnZlcl91c2FnZXMYByADKAsyKy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuTWNwU2VydmVyVXNhZ2VCkAG6SIwBkgGIASKFAboBgQEKHnNlc3Npb25fbWNwX3NlcnZlcl91c2FnZXMua2luZBI/bWNwX3NlcnZlcl91c2FnZXMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1tY3Bfc2VydmVyGh50aGlzLm1jcF9zZXJ2ZXJfcmVmLmtpbmQgPT0gNDQSuAEKCnNraWxsX3JlZnMYCCADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCbrpIZ5IBZCJiugFfChdzZXNzaW9uX3NraWxsX3JlZnMua2luZBIzc2tpbGxfcmVmcyBtdXN0IHJlZmVyZW5jZSByZXNvdXJjZXMgd2l0aCBraW5kPXNraWxsGg90aGlzLmtpbmQgPT0gNDPghSwrEjcKB2hhcm5lc3MYCiABKA4yJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5IYXJuZXNzEj4KC2N1cnNvcl9tb2RlGAsgASgOMikuYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuQ3Vyc29yTW9kZRJIChBleGVjdXRpb25fdGFyZ2V0GAwgASgOMi4uYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuRXhlY3V0aW9uVGFyZ2V0Gi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4AWIGcHJvdG8z",[file_ai_stigmer_agentic_agent_v1_spec,file_ai_stigmer_agentic_session_v1_enum,file_ai_stigmer_agentic_session_v1_workspace,file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]),SessionSpecSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_spec,0);var file_ai_stigmer_agentic_agentexecution_v1_spec=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvc3BlYy5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIuEKChJBZ2VudEV4ZWN1dGlvblNwZWMSEgoKc2Vzc2lvbl9pZBgBIAEoCRIQCghhZ2VudF9pZBgCIAEoCRJACgxzZXNzaW9uX3NwZWMYDSABKAsyKi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uU3BlYxIYCgdtZXNzYWdlGAMgASgJQge6SARyAhABEk8KEGV4ZWN1dGlvbl9jb25maWcYBCABKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRXhlY3V0aW9uQ29uZmlnEl0KC3J1bnRpbWVfZW52GAUgAygLMkguYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uU3BlYy5SdW50aW1lRW52RW50cnkSFgoOY2FsbGJhY2tfdG9rZW4YBiABKAwSGAoQYXV0b19hcHByb3ZlX2FsbBgHIAEoCBIaChJwYXJlbnRfd29ya2Zsb3dfaWQYCCABKAkSRQoLYXR0YWNobWVudHMYCSADKAsyMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXR0YWNobWVudBIbChN3b3Jrc3BhY2VfZmlsZV9yZWZzGAogAygJEhsKE2FjdGl2aXR5X3Rhc2tfcXVldWUYCyABKAkSHwoXc3VwZXJzZWRlc19leGVjdXRpb25faWQYDCABKAkSVwoUY29udmVyc2F0aW9uX2NhdGNodXAYDiABKAsyOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29udmVyc2F0aW9uQ2F0Y2h1cBJXChRkZWNsYXJlZF9wcmVmZXJlbmNlcxgPIAEoCzI5LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5EZWNsYXJlZFByZWZlcmVuY2VzElEKEXJlY2FsbGVkX21lbW9yaWVzGBAgASgLMjYuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlJlY2FsbGVkTWVtb3JpZXMaaQoPUnVudGltZUVudkVudHJ5EgsKA2tleRgBIAEoCRJFCgV2YWx1ZRgCIAEoCzI2LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvblZhbHVlOgI4ATq4A7pItAMaywEKIWFnZW50X2V4ZWN1dGlvbi5zZXNzaW9uX2V4Y2x1c2l2ZRJyc2Vzc2lvbl9pZCBhbmQgc2Vzc2lvbl9zcGVjIGFyZSBtdXR1YWxseSBleGNsdXNpdmUg4oCUIHJlZmVyZW5jZSBhbiBleGlzdGluZyBzZXNzaW9uIG9yIGRlZmluZSBhIG5ldyBvbmUsIG5vdCBib3RoGjIhKHRoaXMuc2Vzc2lvbl9pZCAhPSAnJyAmJiBoYXModGhpcy5zZXNzaW9uX3NwZWMpKRrjAQoqYWdlbnRfZXhlY3V0aW9uLnNlc3Npb25fc3BlY19oYXJuZXNzX3N0YXRlEnBzZXNzaW9uX3NwZWMuaGFybmVzc19zdGF0ZV9pZCBtdXN0IGJlIGVtcHR5IOKAlCBoYXJuZXNzIHN0YXRlIGlzIGNyZWF0ZWQgYnkgdGhlIHJ1bm5lciBhZnRlciB0aGUgZmlyc3QgZXhlY3V0aW9uGkMhaGFzKHRoaXMuc2Vzc2lvbl9zcGVjKSB8fCB0aGlzLnNlc3Npb25fc3BlYy5oYXJuZXNzX3N0YXRlX2lkID09ICcnIvoECg9FeGVjdXRpb25Db25maWcSEgoKbW9kZWxfbmFtZRgBIAEoCRJZChJjb250ZXh0X21hbmFnZW1lbnQYAiABKAsyPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29udGV4dE1hbmFnZW1lbnRDb25maWcSFwoPbWF4X3Rvb2xfcm91bmRzGAMgASgFEh0KFW1heF90b29sX3Jlc3VsdF9jaGFycxgEIAEoBRIUCgxtYXhfY29zdF91c2QYBSABKAESWQoQaW50ZXJhY3Rpb25fbW9kZRgGIAEoDjI1LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5JbnRlcmFjdGlvbk1vZGVCCLpIBYIBAhABEjkKGHN0cnVjdHVyZWRfb3V0cHV0X3NjaGVtYRgHIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSFwoPYnVpbGRfZnJvbV9wbGFuGAggASgIElMKDWFwcHJvdmFsX21vZGUYCSABKA4yMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXBwcm92YWxNb2RlQgi6SAWCAQIQARJRCgxzZXJ2aWNlX3RpZXIYCiABKA4yMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU2VydmljZVRpZXJCCLpIBYIBAhABElMKDXRoaW5raW5nX21vZGUYCyABKA4yMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVGhpbmtpbmdNb2RlQgi6SAWCAQIQASKKAQoXQ29udGV4dE1hbmFnZW1lbnRDb25maWcSHQoVZGlzYWJsZV9zdW1tYXJpemF0aW9uGAEgASgIEikKGGN1c3RvbV90cmlnZ2VyX3RocmVzaG9sZBgCIAEoBUIHukgEGgIoABIlChRjdXN0b21fdGFyZ2V0X3Rva2VucxgDIAEoBUIHukgEGgIoACLUAgoKQXR0YWNobWVudBLYAQoIZmlsZW5hbWUYASABKAlCxQG6SMEBugG5AQobYXR0YWNobWVudC5maWxlbmFtZS5ub19wYXRoEk5maWxlbmFtZSBtdXN0IGJlIGEgYmFyZSBmaWxlbmFtZSB3aXRob3V0IHBhdGggc2VwYXJhdG9ycyBvciB0cmF2ZXJzYWwgc2VnbWVudHMaSiF0aGlzLmNvbnRhaW5zKCcvJykgJiYgIXRoaXMuY29udGFpbnMoJ1xcJykgJiYgdGhpcyAhPSAnLicgJiYgdGhpcyAhPSAnLi4ncgIQARIcCgtzdG9yYWdlX2tleRgCIAEoCUIHukgEcgIQARISCgptb3VudF9wYXRoGAMgASgJEhQKDGNvbnRlbnRfdHlwZRgEIAEoCRIPCgdleHRyYWN0GAUgASgIEhIKCmxvY2FsX3BhdGgYBiABKAkiVQoTQ29udmVyc2F0aW9uQ2F0Y2h1cBIOCgZkaWdlc3QYASABKAkSLgoKd2luZG93X2VuZBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiQAoTRGVjbGFyZWRQcmVmZXJlbmNlcxITCgtvcmdfY29udGV4dBgBIAEoCRIUCgx1c2VyX2NvbnRleHQYAiABKAkibAoQUmVjYWxsZWRNZW1vcmllcxIPCgdlbmFibGVkGAEgASgIEkcKBWZhY3RzGAIgAygLMjguYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlJlY2FsbGVkTWVtb3J5RmFjdCI4ChJSZWNhbGxlZE1lbW9yeUZhY3QSEQoJbWVtb3J5X2lkGAEgASgJEg8KB2NvbnRlbnQYAiABKAliBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_executioncontext_v1_spec,file_ai_stigmer_agentic_session_v1_spec,file_buf_validate_validate,file_google_protobuf_struct,file_google_protobuf_timestamp]),AgentExecutionSpecSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,0),ExecutionConfigSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,1);var DeclaredPreferencesSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,5),RecalledMemoriesSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,6),RecalledMemoryFactSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,7);var file_ai_stigmer_agentic_agentexecution_v1_todo=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvdG9kby5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIpEBCghUb2RvSXRlbRIKCgJpZBgBIAEoCRIPCgdjb250ZW50GAIgASgJEkAKBnN0YXR1cxgDIAEoDjIwLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub2RvU3RhdHVzEhIKCmNyZWF0ZWRfYXQYBCABKAkSEgoKdXBkYXRlZF9hdBgFIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_enum]);var file_ai_stigmer_agentic_agentexecution_v1_subagent=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvc3ViYWdlbnQucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSKIBAoRU3ViQWdlbnRFeGVjdXRpb24SCgoCaWQYASABKAkSDAoEbmFtZRgCIAEoCRINCgVpbnB1dBgDIAEoCRIOCgZvdXRwdXQYBCABKAkSTgoGc3RhdHVzGAUgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlN1YkFnZW50U3RhdHVzQgi6SAWCAQIQARISCgpzdGFydGVkX2F0GAYgASgJEhQKDGNvbXBsZXRlZF9hdBgHIAEoCRINCgVlcnJvchgIIAEoCRIpCghtZXRhZGF0YRgJIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSRAoIbWVzc2FnZXMYCyADKAsyMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRNZXNzYWdlEg8KB3N1YmplY3QYDSABKAkSUQoFdG9kb3MYDiADKAsyQi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU3ViQWdlbnRFeGVjdXRpb24uVG9kb3NFbnRyeRpcCgpUb2Rvc0VudHJ5EgsKA2tleRgBIAEoCRI9CgV2YWx1ZRgCIAEoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub2RvSXRlbToCOAFiBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_agentexecution_v1_message,file_ai_stigmer_agentic_agentexecution_v1_todo,file_buf_validate_validate,file_google_protobuf_struct]);var file_ai_stigmer_agentic_agentexecution_v1_usage=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvdXNhZ2UucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSKxAwoKVG9rZW5Vc2FnZRIUCgxpbnB1dF90b2tlbnMYASABKAMSFQoNb3V0cHV0X3Rva2VucxgCIAEoAxIUCgx0b3RhbF90b2tlbnMYAyABKAMSIwobY2FjaGVfY3JlYXRpb25faW5wdXRfdG9rZW5zGAQgASgDEh8KF2NhY2hlX3JlYWRfaW5wdXRfdG9rZW5zGAUgASgDEhgKEHJlYXNvbmluZ190b2tlbnMYBiABKAMSHgoWdG9vbF91c2VfcHJvbXB0X3Rva2VucxgHIAEoAxIaChJhdWRpb19pbnB1dF90b2tlbnMYCCABKAMSGwoTYXVkaW9fb3V0cHV0X3Rva2VucxgJIAEoAxJqChZwcm92aWRlcl90b2tlbl9kZXRhaWxzGBQgAygLMkouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRva2VuVXNhZ2UuUHJvdmlkZXJUb2tlbkRldGFpbHNFbnRyeRo7ChlQcm92aWRlclRva2VuRGV0YWlsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoAzoCOAEiugMKD1ByaWNpbmdTbmFwc2hvdBIgChhwcmljaW5nX3JlZ2lzdHJ5X3ZlcnNpb24YASABKAkSOAoUcHJpY2luZ19lZmZlY3RpdmVfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhAKCGN1cnJlbmN5GAMgASgJEiYKHmlucHV0X3ByaWNlX21pY3Jvc19wZXJfbWlsbGlvbhgKIAEoAxInCh9vdXRwdXRfcHJpY2VfbWljcm9zX3Blcl9taWxsaW9uGAsgASgDEi8KJ2NhY2hlX2NyZWF0aW9uX3ByaWNlX21pY3Jvc19wZXJfbWlsbGlvbhgMIAEoAxIrCiNjYWNoZV9yZWFkX3ByaWNlX21pY3Jvc19wZXJfbWlsbGlvbhgNIAEoAxIqCiJyZWFzb25pbmdfcHJpY2VfbWljcm9zX3Blcl9taWxsaW9uGA4gASgDEiwKJGN1cnNvcl90b2tlbl9yYXRlX21pY3Jvc19wZXJfbWlsbGlvbhgPIAEoAxIdChVtYXJrdXBfcG9saWN5X3ZlcnNpb24YHiABKAkSEQoJY29zdF90aWVyGB8gASgJIqkCCglDb3N0U3RhbXASEAoIY3VycmVuY3kYASABKAkSHAoUcHJvdmlkZXJfY29zdF9taWNyb3MYAiABKAMSJwofY3VzdG9tZXJfYmlsbGFibGVfYW1vdW50X21pY3JvcxgDIAEoAxJXChJjYWxjdWxhdGlvbl9zdGF0dXMYBCABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29zdENhbGN1bGF0aW9uU3RhdHVzEkYKB3ByaWNpbmcYBSABKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUHJpY2luZ1NuYXBzaG90EiIKGmN1cnNvcl9wbGF0Zm9ybV9mZWVfbWljcm9zGAYgASgDItQDCgtQcm94eVRpbWluZxI1ChFwcm94eV9yZWNlaXZlZF9hdBgBIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASPwobdXBzdHJlYW1fcmVxdWVzdF9zdGFydGVkX2F0GAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI6ChZmaXJzdF9yZXNwb25zZV9ieXRlX2F0GAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI5ChVsYXN0X3Jlc3BvbnNlX2J5dGVfYXQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjYKEnByb3h5X2NvbXBsZXRlZF9hdBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGAoQdXBzdHJlYW1fdHRmYl9tcxgKIAEoAxIYChB1cHN0cmVhbV90dGxiX21zGAsgASgDEhoKEnN0cmVhbV9kdXJhdGlvbl9tcxgMIAEoAxIfChdwcm94eV90b3RhbF9kdXJhdGlvbl9tcxgNIAEoAxIVCg1yZXF1ZXN0X2J5dGVzGBQgASgDEhYKDnJlc3BvbnNlX2J5dGVzGBUgASgDIvoBCgtCaWxsaW5nTGluaxJOCgxkZWJpdF9zdGF0dXMYASABKA4yOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQmlsbGluZ0RlYml0U3RhdHVzEhYKDnJlc2VydmF0aW9uX2lkGAIgASgJEhgKEGJpbGxpbmdfZGViaXRfaWQYAyABKAkSLgoKZGViaXRlZF9hdBgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASHQoVYmlsbGluZ19hdHRlbXB0X2NvdW50GAUgASgFEhoKEmxhc3RfYmlsbGluZ19lcnJvchgGIAEoCSL+CgoSTGxtQ2FsbFVzYWdlUmVjb3JkEhcKD3VzYWdlX3JlY29yZF9pZBgBIAEoCRIUCgxleGVjdXRpb25faWQYAiABKAkSGQoRcm9vdF9leGVjdXRpb25faWQYAyABKAkSEAoIc2VxdWVuY2UYBCABKAUSFwoPaWRlbXBvdGVuY3lfa2V5GAUgASgJEh4KFmNhbm9uaWNhbF9wYXlsb2FkX2hhc2gYBiABKAkSDwoHY2FsbF9pZBgJIAEoCRIvCgtvYnNlcnZlZF9hdBgKIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLgoKY3JlYXRlZF9hdBgLIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASUgoPbWV0ZXJpbmdfc291cmNlGBQgASgOMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlVzYWdlTWV0ZXJpbmdTb3VyY2USSgoLdHJ1c3RfbGV2ZWwYFSABKA4yNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVXNhZ2VUcnVzdExldmVsElEKDHVzYWdlX3N0YXR1cxgWIAEoDjI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Vc2FnZUNvbXBsZXRpb25TdGF0dXMSEwoLaXNfYmlsbGFibGUYFyABKAgSEAoIcHJvdmlkZXIYHiABKAkSFwoPcmVxdWVzdGVkX21vZGVsGB8gASgJEhYKDnJlc29sdmVkX21vZGVsGCAgASgJEhAKCGVuZHBvaW50GCEgASgJEhEKCXN0cmVhbWluZxgiIAEoCBIUCgxzZXJ2aWNlX3RpZXIYIyABKAkSGwoTcHJvdmlkZXJfcmVxdWVzdF9pZBgkIAEoCRIPCgdoYXJuZXNzGCUgASgJEhkKEWN1cnNvcl9hY2NvdW50X2lkGCYgASgJEhUKDWN1cnNvcl9rZXlfaWQYJyABKAkSGAoQaHR0cF9zdGF0dXNfY29kZRgoIAEoBRIVCg1maW5pc2hfcmVhc29uGCkgASgJEhIKCmVycm9yX2NvZGUYKiABKAkSUAoRY3Vyc29yX2tleV9zb3VyY2UYKyABKA4yNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ3Vyc29yS2V5U291cmNlEhAKCHRoaW5raW5nGCwgASgJEkAKBnRva2VucxgyIAEoCzIwLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub2tlblVzYWdlEj0KBGNvc3QYMyABKAsyLy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29zdFN0YW1wEkcKDHByb3h5X3RpbWluZxg8IAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Qcm94eVRpbWluZxIbChNwcm92aWRlcl91c2FnZV9qc29uGEYgASgJEkIKB2JpbGxpbmcYUCABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQmlsbGluZ0xpbmsSDgoGb3JnX2lkGAcgASgJEhIKCnNlc3Npb25faWQYCCABKAkSVAoGbGFiZWxzGFogAygLMkQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkxsbUNhbGxVc2FnZVJlY29yZC5MYWJlbHNFbnRyeRotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIr4CChRVc2FnZVJlcG9ydEFnZ3JlZ2F0ZRIUCgxpbnB1dF90b2tlbnMYASABKAMSFQoNb3V0cHV0X3Rva2VucxgCIAEoAxIUCgx0b3RhbF90b2tlbnMYAyABKAMSIwobY2FjaGVfY3JlYXRpb25faW5wdXRfdG9rZW5zGAQgASgDEh8KF2NhY2hlX3JlYWRfaW5wdXRfdG9rZW5zGAUgASgDEhgKEHJlYXNvbmluZ190b2tlbnMYBiABKAMSFgoObGxtX2NhbGxfY291bnQYCiABKAUSHAoUYmlsbGFibGVfY29zdF9taWNyb3MYFCABKAMSHAoUcHJvdmlkZXJfY29zdF9taWNyb3MYFSABKAMSFQoNcHJpbWFyeV9tb2RlbBgeIAEoCRIYChBwcmltYXJ5X3Byb3ZpZGVyGB8gASgJIvABCgpNb2RlbFVzYWdlEg0KBW1vZGVsGAEgASgJEhAKCHByb3ZpZGVyGAIgASgJEhQKDGlucHV0X3Rva2VucxgDIAEoAxIVCg1vdXRwdXRfdG9rZW5zGAQgASgDEiMKG2NhY2hlX2NyZWF0aW9uX2lucHV0X3Rva2VucxgFIAEoAxIfChdjYWNoZV9yZWFkX2lucHV0X3Rva2VucxgGIAEoAxISCgpjYWxsX2NvdW50GAcgASgFEhwKFGJpbGxhYmxlX2Nvc3RfbWljcm9zGAggASgDEhwKFHByb3ZpZGVyX2Nvc3RfbWljcm9zGAkgASgDIq0DChVTdHJlYW1pbmdVc2FnZVN1bW1hcnkSFAoMaW5wdXRfdG9rZW5zGAEgASgDEhUKDW91dHB1dF90b2tlbnMYAiABKAMSGQoRY2FjaGVfcmVhZF90b2tlbnMYAyABKAMSGgoSY2FjaGVfd3JpdGVfdG9rZW5zGAQgASgDEhQKDHRvdGFsX3Rva2VucxgFIAEoAxISCgp0dXJuX2NvdW50GAYgASgFEhoKEmVzdGltYXRlZF9jb3N0X3VzZBgHIAEoARINCgVtb2RlbBgIIAEoCRITCgtvYnNlcnZlZF9hdBgJIAEoCRJRChZyZXF1ZXN0ZWRfc2VydmljZV90aWVyGAogASgOMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNlcnZpY2VUaWVyEh4KFnJlcXVlc3RlZF9tb2RlbF9wYXJhbXMYCyABKAkSUwoXcmVxdWVzdGVkX3RoaW5raW5nX21vZGUYDCABKA4yMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVGhpbmtpbmdNb2RlKq4CChNVc2FnZU1ldGVyaW5nU291cmNlEiUKIVVTQUdFX01FVEVSSU5HX1NPVVJDRV9VTlNQRUNJRklFRBAAEjEKLVVTQUdFX01FVEVSSU5HX1NPVVJDRV9QUk9YWV9QUk9WSURFUl9SRVBPUlRFRBABEjYKMlVTQUdFX01FVEVSSU5HX1NPVVJDRV9SVU5ORVJfUFJPVklERVJfUkVQT1JURURfT1NTEAISIwofVVNBR0VfTUVURVJJTkdfU09VUkNFX0VTVElNQVRFRBADEjMKL1VTQUdFX01FVEVSSU5HX1NPVVJDRV9QUk9WSURFUl9BRE1JTl9SRUNPTkNJTEVEEAQSKwonVVNBR0VfTUVURVJJTkdfU09VUkNFX01BTlVBTF9BREpVU1RNRU5UEAUqqAEKD1VzYWdlVHJ1c3RMZXZlbBIhCh1VU0FHRV9UUlVTVF9MRVZFTF9VTlNQRUNJRklFRBAAEicKI1VTQUdFX1RSVVNUX0xFVkVMX0JJTExJTkdfQVVUSE9SSVRZEAESJQohVVNBR0VfVFJVU1RfTEVWRUxfU0VSVkVSX09CU0VSVkVEEAISIgoeVVNBR0VfVFJVU1RfTEVWRUxfRElTUExBWV9PTkxZEAMq/AIKFVVzYWdlQ29tcGxldGlvblN0YXR1cxInCiNVU0FHRV9DT01QTEVUSU9OX1NUQVRVU19VTlNQRUNJRklFRBAAEiQKIFVTQUdFX0NPTVBMRVRJT05fU1RBVFVTX0NPTVBMRVRFEAESLgoqVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfU1RSRUFNX0lOVEVSUlVQVEVEEAISNQoxVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfUFJPVklERVJfRVJST1JfV0lUSF9VU0FHRRADEjMKL1VTQUdFX0NPTVBMRVRJT05fU1RBVFVTX1BST1ZJREVSX0VSUk9SX05PX1VTQUdFEAQSKgomVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfRVNUSU1BVEVEX09OTFkQBRImCiJVU0FHRV9DT01QTEVUSU9OX1NUQVRVU19SRUNPTkNJTEVEEAYSJAogVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfQ09ORkxJQ1QQByqfAgoSQmlsbGluZ0RlYml0U3RhdHVzEiQKIEJJTExJTkdfREVCSVRfU1RBVFVTX1VOU1BFQ0lGSUVEEAASJwojQklMTElOR19ERUJJVF9TVEFUVVNfTk9UX0FQUExJQ0FCTEUQARIgChxCSUxMSU5HX0RFQklUX1NUQVRVU19QRU5ESU5HEAISIAocQklMTElOR19ERUJJVF9TVEFUVVNfREVCSVRFRBADEikKJUJJTExJTkdfREVCSVRfU1RBVFVTX0ZBSUxFRF9SRVRSWUFCTEUQBBIoCiRCSUxMSU5HX0RFQklUX1NUQVRVU19GQUlMRURfVEVSTUlOQUwQBRIhCh1CSUxMSU5HX0RFQklUX1NUQVRVU19DT05GTElDVBAGKo8CChVDb3N0Q2FsY3VsYXRpb25TdGF0dXMSJwojQ09TVF9DQUxDVUxBVElPTl9TVEFUVVNfVU5TUEVDSUZJRUQQABIkCiBDT1NUX0NBTENVTEFUSU9OX1NUQVRVU19DT01QVVRFRBABEiUKIUNPU1RfQ0FMQ1VMQVRJT05fU1RBVFVTX0VTVElNQVRFRBACEisKJ0NPU1RfQ0FMQ1VMQVRJT05fU1RBVFVTX1BSSUNFX05PVF9GT1VORBADEiYKIkNPU1RfQ0FMQ1VMQVRJT05fU1RBVFVTX1JFQ09OQ0lMRUQQBBIrCidDT1NUX0NBTENVTEFUSU9OX1NUQVRVU19NQU5VQUxfQURKVVNURUQQBSpXCg9DdXJzb3JLZXlTb3VyY2USIQodQ1VSU09SX0tFWV9TT1VSQ0VfVU5TUEVDSUZJRUQQABIhCh1DVVJTT1JfS0VZX1NPVVJDRV9NQU5BR0VEX0tFWRABYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_google_protobuf_timestamp]);var UsageReportAggregateSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_usage,6);var UsageMeteringSource;(function(UsageMeteringSource2){UsageMeteringSource2[UsageMeteringSource2.UNSPECIFIED=0]="UNSPECIFIED",UsageMeteringSource2[UsageMeteringSource2.PROXY_PROVIDER_REPORTED=1]="PROXY_PROVIDER_REPORTED",UsageMeteringSource2[UsageMeteringSource2.RUNNER_PROVIDER_REPORTED_OSS=2]="RUNNER_PROVIDER_REPORTED_OSS",UsageMeteringSource2[UsageMeteringSource2.ESTIMATED=3]="ESTIMATED",UsageMeteringSource2[UsageMeteringSource2.PROVIDER_ADMIN_RECONCILED=4]="PROVIDER_ADMIN_RECONCILED",UsageMeteringSource2[UsageMeteringSource2.MANUAL_ADJUSTMENT=5]="MANUAL_ADJUSTMENT"})(UsageMeteringSource||(UsageMeteringSource={}));var UsageTrustLevel;(function(UsageTrustLevel2){UsageTrustLevel2[UsageTrustLevel2.UNSPECIFIED=0]="UNSPECIFIED",UsageTrustLevel2[UsageTrustLevel2.BILLING_AUTHORITY=1]="BILLING_AUTHORITY",UsageTrustLevel2[UsageTrustLevel2.SERVER_OBSERVED=2]="SERVER_OBSERVED",UsageTrustLevel2[UsageTrustLevel2.DISPLAY_ONLY=3]="DISPLAY_ONLY"})(UsageTrustLevel||(UsageTrustLevel={}));var UsageCompletionStatus;(function(UsageCompletionStatus2){UsageCompletionStatus2[UsageCompletionStatus2.UNSPECIFIED=0]="UNSPECIFIED",UsageCompletionStatus2[UsageCompletionStatus2.COMPLETE=1]="COMPLETE",UsageCompletionStatus2[UsageCompletionStatus2.STREAM_INTERRUPTED=2]="STREAM_INTERRUPTED",UsageCompletionStatus2[UsageCompletionStatus2.PROVIDER_ERROR_WITH_USAGE=3]="PROVIDER_ERROR_WITH_USAGE",UsageCompletionStatus2[UsageCompletionStatus2.PROVIDER_ERROR_NO_USAGE=4]="PROVIDER_ERROR_NO_USAGE",UsageCompletionStatus2[UsageCompletionStatus2.ESTIMATED_ONLY=5]="ESTIMATED_ONLY",UsageCompletionStatus2[UsageCompletionStatus2.RECONCILED=6]="RECONCILED",UsageCompletionStatus2[UsageCompletionStatus2.CONFLICT=7]="CONFLICT"})(UsageCompletionStatus||(UsageCompletionStatus={}));var BillingDebitStatus;(function(BillingDebitStatus2){BillingDebitStatus2[BillingDebitStatus2.UNSPECIFIED=0]="UNSPECIFIED",BillingDebitStatus2[BillingDebitStatus2.NOT_APPLICABLE=1]="NOT_APPLICABLE",BillingDebitStatus2[BillingDebitStatus2.PENDING=2]="PENDING",BillingDebitStatus2[BillingDebitStatus2.DEBITED=3]="DEBITED",BillingDebitStatus2[BillingDebitStatus2.FAILED_RETRYABLE=4]="FAILED_RETRYABLE",BillingDebitStatus2[BillingDebitStatus2.FAILED_TERMINAL=5]="FAILED_TERMINAL",BillingDebitStatus2[BillingDebitStatus2.CONFLICT=6]="CONFLICT"})(BillingDebitStatus||(BillingDebitStatus={}));var CostCalculationStatus;(function(CostCalculationStatus2){CostCalculationStatus2[CostCalculationStatus2.UNSPECIFIED=0]="UNSPECIFIED",CostCalculationStatus2[CostCalculationStatus2.COMPUTED=1]="COMPUTED",CostCalculationStatus2[CostCalculationStatus2.ESTIMATED=2]="ESTIMATED",CostCalculationStatus2[CostCalculationStatus2.PRICE_NOT_FOUND=3]="PRICE_NOT_FOUND",CostCalculationStatus2[CostCalculationStatus2.RECONCILED=4]="RECONCILED",CostCalculationStatus2[CostCalculationStatus2.MANUAL_ADJUSTED=5]="MANUAL_ADJUSTED"})(CostCalculationStatus||(CostCalculationStatus={}));var CursorKeySource;(function(CursorKeySource2){CursorKeySource2[CursorKeySource2.UNSPECIFIED=0]="UNSPECIFIED",CursorKeySource2[CursorKeySource2.MANAGED_KEY=1]="MANAGED_KEY"})(CursorKeySource||(CursorKeySource={}));var file_ai_stigmer_agentic_agentexecution_v1_writeback=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvd3JpdGViYWNrLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEimgIKEldvcmtzcGFjZVdyaXRlQmFjaxIcChR3b3Jrc3BhY2VfZW50cnlfbmFtZRgBIAEoCRITCgticmFuY2hfbmFtZRgCIAEoCRITCgtiYXNlX2JyYW5jaBgDIAEoCRISCgpjb21taXRfc2hhGAQgASgJEhgKEHB1bGxfcmVxdWVzdF91cmwYBSABKAkSGwoTcHVsbF9yZXF1ZXN0X251bWJlchgGIAEoBRIUCgxkaWZmX3N1bW1hcnkYByABKAkSTAoFcGhhc2UYCCABKA4yPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuV29ya3NwYWNlV3JpdGVCYWNrUGhhc2USDQoFZXJyb3IYCSABKAkq0AEKF1dvcmtzcGFjZVdyaXRlQmFja1BoYXNlEioKJldPUktTUEFDRV9XUklURV9CQUNLX1BIQVNFX1VOU1BFQ0lGSUVEEAASIgoeV09SS1NQQUNFX1dSSVRFX0JBQ0tfQ09NTUlUVEVEEAESHwobV09SS1NQQUNFX1dSSVRFX0JBQ0tfUFVTSEVEEAISIwofV09SS1NQQUNFX1dSSVRFX0JBQ0tfUFJfQ1JFQVRFRBADEh8KG1dPUktTUEFDRV9XUklURV9CQUNLX0ZBSUxFRBAEYgZwcm90bzM");var WorkspaceWriteBackPhase;(function(WorkspaceWriteBackPhase2){WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_PHASE_UNSPECIFIED=0]="WORKSPACE_WRITE_BACK_PHASE_UNSPECIFIED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_COMMITTED=1]="WORKSPACE_WRITE_BACK_COMMITTED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_PUSHED=2]="WORKSPACE_WRITE_BACK_PUSHED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_PR_CREATED=3]="WORKSPACE_WRITE_BACK_PR_CREATED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_FAILED=4]="WORKSPACE_WRITE_BACK_FAILED"})(WorkspaceWriteBackPhase||(WorkspaceWriteBackPhase={}));var file_ai_stigmer_agentic_agentexecution_v1_api=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvYXBpLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEiywIKDkFnZW50RXhlY3V0aW9uEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiMKBGtpbmQYAiABKAlCFbpIEnIQCg5BZ2VudEV4ZWN1dGlvbhJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESRgoEc3BlYxgEIAEoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvblNwZWMSSgoGc3RhdHVzGAUgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uU3RhdHVzIrcMChRBZ2VudEV4ZWN1dGlvblN0YXR1cxI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0EkQKCG1lc3NhZ2VzGAEgAygLMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50TWVzc2FnZRJNCgVwaGFzZRgCIAEoDjI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25QaGFzZUIIukgFggECEAESVQoUc3ViX2FnZW50X2V4ZWN1dGlvbnMYBCADKAsyNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU3ViQWdlbnRFeGVjdXRpb24SDQoFZXJyb3IYBiABKAkSEgoKc3RhcnRlZF9hdBgHIAEoCRIUCgxjb21wbGV0ZWRfYXQYCCABKAkSVAoFdG9kb3MYCSADKAsyRS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb25TdGF0dXMuVG9kb3NFbnRyeRIWCg5jYWxsYmFja190b2tlbhgKIAEoDBJQChFwZW5kaW5nX2FwcHJvdmFscxgQIAMoCzI1LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5QZW5kaW5nQXBwcm92YWwSWAoVYXBwcm92YWxfZXZlbnRfc3RyZWFtGBYgASgLMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsRXZlbnRTdHJlYW0SRwoMY29udGV4dF9pbmZvGA4gASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkNvbnRleHRJbmZvEkoKCWFydGlmYWN0cxgPIAMoCzI3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25BcnRpZmFjdBJXChV3b3Jrc3BhY2Vfd3JpdGVfYmFja3MYESADKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuV29ya3NwYWNlV3JpdGVCYWNrEksKDnNldHVwX3Byb2dyZXNzGBIgASgLMjMuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNldHVwUHJvZ3Jlc3MSVAoPc3RyZWFtaW5nX3VzYWdlGBQgASgLMjsuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlN0cmVhbWluZ1VzYWdlU3VtbWFyeRIyChFzdHJ1Y3R1cmVkX291dHB1dBgVIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSTQoQZmlsZV9jaGFuZ2Vfc2V0cxgXIAMoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ2hhbmdlU2V0El0KGGZpbGVfcmV2aWV3X2V2ZW50X3N0cmVhbRgYIAEoCzI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlUmV2aWV3RXZlbnRTdHJlYW0SVgoUZmlsZV9jaGFuZ2VfcHJvZ3Jlc3MYGSABKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNoYW5nZVByb2dyZXNzEl4KGHJlY2FsbGVkX21lbW9yaWVzX3JlcG9ydBgaIAEoCzI8LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5SZWNhbGxlZE1lbW9yaWVzUmVwb3J0GlwKClRvZG9zRW50cnkSCwoDa2V5GAEgASgJEj0KBXZhbHVlGAIgASgLMi4uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvZG9JdGVtOgI4AUoECAwQDVIQcmVzb2x2ZWRfY29udGV4dCImCg1TZXR1cFByb2dyZXNzEhUKDWN1cnJlbnRfcGhhc2UYASABKAkiaAoWUmVjYWxsZWRNZW1vcmllc1JlcG9ydBIYChBzZWxlY3Rpb25fYWN0aXZlGAEgASgIEhsKE2luamVjdGVkX21lbW9yeV9pZHMYAiADKAkSFwoPZW1iZWRkaW5nX21vZGVsGAMgASgJYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_approval,file_ai_stigmer_agentic_agentexecution_v1_artifact,file_ai_stigmer_agentic_agentexecution_v1_context,file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_agentexecution_v1_filereview,file_ai_stigmer_agentic_agentexecution_v1_message,file_ai_stigmer_agentic_agentexecution_v1_spec,file_ai_stigmer_agentic_agentexecution_v1_subagent,file_ai_stigmer_agentic_agentexecution_v1_todo,file_ai_stigmer_agentic_agentexecution_v1_usage,file_ai_stigmer_agentic_agentexecution_v1_writeback,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_struct]),AgentExecutionSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_api,0),AgentExecutionStatusSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_api,1);var agentExecutionDeclaration=declareKind({kind:ApiResourceKind.agent_execution,schema:AgentExecutionSchema,source:"fga/model/agentic/agent_execution.fga",relations:[["session",direct(objectOf("session"))],["owner",from("owner","session")],["viewer",union(from("viewer","session"),computed("owner"))],["can_view",union(computed("viewer"),from("can_view","session"))],["can_edit",computed("owner")]]});var file_ai_stigmer_agentic_agentinstance_v1_spec=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRpbnN0YW5jZS92MS9zcGVjLnByb3RvEiNhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRpbnN0YW5jZS52MSKpAgoRQWdlbnRJbnN0YW5jZVNwZWMSGQoIYWdlbnRfaWQYASABKAlCB7pIBHICEAESEwoLZGVzY3JpcHRpb24YAiABKAkSyAEKEGVudmlyb25tZW50X3JlZnMYAyADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCeLpIcZIBbiJsugFpChVlbnZpcm9ubWVudF9yZWZzLmtpbmQSP2Vudmlyb25tZW50X3JlZnMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1lbnZpcm9ubWVudBoPdGhpcy5raW5kID09IDUz4IUsNUoECAQQBVITZGF0YXN0b3JlX3BhcnRpdGlvbmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]);var file_ai_stigmer_agentic_agentinstance_v1_api=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRpbnN0YW5jZS92MS9hcGkucHJvdG8SI2FpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxIsMCCg1BZ2VudEluc3RhbmNlEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiIKBGtpbmQYAiABKAlCFLpIEXIPCg1BZ2VudEluc3RhbmNlEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJECgRzcGVjGAQgASgLMjYuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuQWdlbnRJbnN0YW5jZVNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_agentinstance_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),AgentInstanceSchema=messageDesc2(file_ai_stigmer_agentic_agentinstance_v1_api,0);function defaultOfBlueprint(blueprint){let blueprintType=kindEnumName(blueprint.kind);return async(object,row,loader2)=>{let blueprintId=parentIdOf(row,blueprintSpecFieldOf(object.type,blueprint.kind));if(blueprintId==="")return[];let loaded=await loader2.load({type:blueprintType,id:blueprintId});return loaded===void 0||!isMessage2(loaded,blueprint.schema)||blueprint.defaultInstanceIdOf(loaded)!==object.id?[]:[{object,relation:"default_of",subject:{form:"object",object:{type:blueprintType,id:blueprintId}}}]}}function blueprintSpecFieldOf(instanceType,blueprintKind){let instanceKind=kindByEnumName(instanceType),entry=getKindMeta(instanceKind).authorization?.additionalParents?.find(parent=>getKindEnum(parent.kind)===blueprintKind);if(entry===void 0)throw new Error(`${instanceType} declares default_of but kind_meta names no ${kindEnumName(blueprintKind)} parent`);return entry.specField}var agentInstanceDeclaration=declareKind({kind:ApiResourceKind.agent_instance,schema:AgentInstanceSchema,source:"fga/model/agentic/agent_instance.fga",relations:[["organization",direct(objectOf("organization"))],["agent",direct(objectOf("agent"))],["default_of",direct(objectOf("agent"))],["owner",direct(objectOf("identity_account"))],["viewer",union(direct(objectOf("identity_account"),publicWith("identity_account","allow_public"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"),from("viewer","default_of"))],["can_view",computed("viewer")],["can_execute",computed("can_view")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]],derived:[["default_of",defaultOfBlueprint({kind:ApiResourceKind.agent,schema:AgentSchema,defaultInstanceIdOf:agent=>agent.status?.defaultInstanceId??""})]]});var file_ai_stigmer_agentic_agentshare_v1_spec=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9zcGVjLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MSLWCQoOQWdlbnRTaGFyZVNwZWMSrAEKCWFnZW50X3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUJjukhcugFWCg5hZ2VudF9yZWYua2luZBIzYWdlbnRfcmVmIG11c3QgcmVmZXJlbmNlIGEgcmVzb3VyY2Ugd2l0aCBraW5kPWFnZW50Gg90aGlzLmtpbmQgPT0gNDDIAQHghSwoEg8KB2VuYWJsZWQYAiABKAgSRgoIYXVkaWVuY2UYAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MS5BZ2VudFNoYXJlQXVkaWVuY2USsAIKD2FsbG93ZWRfb3JpZ2lucxgEIAMoCUKWArpIkgKSAY4CECAiiQK6AYUCChZhbGxvd2VkX29yaWdpbnMuZm9ybWF0Em5hbGxvd2VkX29yaWdpbnMgZW50cmllcyBtdXN0IGJlIGV4YWN0IHdlYiBvcmlnaW5zIGxpa2UgaHR0cHM6Ly9leGFtcGxlLmNvbSAobm8gcGF0aCwgcXVlcnksIG9yIHRyYWlsaW5nIHNsYXNoKRp7dGhpcy5tYXRjaGVzKCdeaHR0cHM/Oi8vW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8oXFwuW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8pKig6WzAtOV17MSw1fSk/JCcpEkYKCG1lc3NhZ2VzGAUgASgLMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZU1lc3NhZ2VzEsgBChBlbnZpcm9ubWVudF9yZWZzGAYgAygLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlQni6SHGSAW4ibLoBaQoVZW52aXJvbm1lbnRfcmVmcy5raW5kEj9lbnZpcm9ubWVudF9yZWZzIG11c3QgcmVmZXJlbmNlIHJlc291cmNlcyB3aXRoIGtpbmQ9ZW52aXJvbm1lbnQaD3RoaXMua2luZCA9PSA1M+CFLDUSQwoKcnVuX2NvbmZpZxgHIAEoCzIvLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5SdW5Db25maWc6sAK6SKwCGp8BCihhZ2VudF9zaGFyZS5lbnZpcm9ubWVudF9yZWZzX3B1YmxpY19vbmx5EjplbnZpcm9ubWVudF9yZWZzIGNhbiBvbmx5IGJlIHNldCBvbiBwdWJsaWMtYXVkaWVuY2Ugc2hhcmVzGjd0aGlzLmF1ZGllbmNlICE9IDIgfHwgdGhpcy5lbnZpcm9ubWVudF9yZWZzLnNpemUoKSA9PSAwGocBCiJhZ2VudF9zaGFyZS5ydW5fY29uZmlnX3B1YmxpY19vbmx5EjRydW5fY29uZmlnIGNhbiBvbmx5IGJlIHNldCBvbiBwdWJsaWMtYXVkaWVuY2Ugc2hhcmVzGit0aGlzLmF1ZGllbmNlICE9IDIgfHwgIWhhcyh0aGlzLnJ1bl9jb25maWcpInkKEkFnZW50U2hhcmVNZXNzYWdlcxIeCgxyYXRlX2xpbWl0ZWQYASABKAlCCLpIBXIDGKwCEh0KC3VuYXZhaWxhYmxlGAIgASgJQgi6SAVyAxisAhIkChJjb252ZXJzYXRpb25fZW5kZWQYAyABKAlCCLpIBXIDGKwCKnkKEkFnZW50U2hhcmVBdWRpZW5jZRIkCiBhZ2VudF9zaGFyZV9hdWRpZW5jZV91bnNwZWNpZmllZBAAEh8KG2FnZW50X3NoYXJlX2F1ZGllbmNlX3B1YmxpYxABEhwKGGFnZW50X3NoYXJlX2F1ZGllbmNlX29yZxACYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_invocation,file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]);var AgentShareAudience;(function(AgentShareAudience2){AgentShareAudience2[AgentShareAudience2.unspecified=0]="unspecified",AgentShareAudience2[AgentShareAudience2.public=1]="public",AgentShareAudience2[AgentShareAudience2.org=2]="org"})(AgentShareAudience||(AgentShareAudience={}));var file_ai_stigmer_agentic_agentshare_v1_status=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9zdGF0dXMucHJvdG8SIGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxIn8KEEFnZW50U2hhcmVTdGF0dXMSPwoFYXVkaXQYYyABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdBIYChBzaGFyZV9saW5rX3Rva2VuGAEgASgJEhAKCGFnZW50X2lkGAIgASgJYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_status]),AgentShareStatusSchema=messageDesc2(file_ai_stigmer_agentic_agentshare_v1_status,0);var file_ai_stigmer_agentic_agentshare_v1_api=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9hcGkucHJvdG8SIGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxIrMCCgpBZ2VudFNoYXJlEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEh8KBGtpbmQYAiABKAlCEbpIDnIMCgpBZ2VudFNoYXJlEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARI+CgRzcGVjGAQgASgLMjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZVNwZWMSQgoGc3RhdHVzGAUgASgLMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZVN0YXR1c2IGcHJvdG8z",[file_ai_stigmer_agentic_agentshare_v1_spec,file_ai_stigmer_agentic_agentshare_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),AgentShareSchema=messageDesc2(file_ai_stigmer_agentic_agentshare_v1_api,0);var agentShareDeclaration=declareKind({kind:ApiResourceKind.agent_share,schema:AgentShareSchema,source:"fga/model/agentic/agent_share.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["viewer",union(direct(objectOf("identity_account")),computed("owner"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_iam_apikey_v1_spec=fileDesc("CiNhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvc3BlYy5wcm90bxIYYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxIoYBCgpBcGlLZXlTcGVjEhYKCGtleV9oYXNoGAEgASgJQgTIhSwBEhkKC2ZpbmdlcnByaW50GAIgASgJQgTIhSwBEi4KCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhUKDW5ldmVyX2V4cGlyZXMYBCABKAhiBnByb3RvMw",[file_ai_stigmer_commons_apiresource_field_options,file_google_protobuf_timestamp]);var file_ai_stigmer_iam_apikey_v1_api=fileDesc("CiJhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvYXBpLnByb3RvEhhhaS5zdGlnbWVyLmlhbS5hcGlrZXkudjEihwIKBkFwaUtleRItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEhsKBGtpbmQYAiABKAlCDbpICnIICgZBcGlLZXkSRQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YRIyCgRzcGVjGAQgASgLMiQuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleVNwZWMSNgoGc3RhdHVzGAUgASgLMiYuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleVN0YXR1cyKBAQoMQXBpS2V5U3RhdHVzEj8KBWF1ZGl0GGMgASgLMjAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXQSMAoMbGFzdF91c2VkX2F0GAEgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_apikey_v1_spec,file_buf_validate_validate,file_google_protobuf_timestamp]),ApiKeySchema=messageDesc2(file_ai_stigmer_iam_apikey_v1_api,0);var apiKeyDeclaration=declareKind({kind:ApiResourceKind.api_key,schema:ApiKeySchema,source:"fga/model/iam/api_key.fga",relations:[["owner",direct(objectOf("identity_account"))],["can_view",computed("owner")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_rotate",computed("owner")],["can_revoke",computed("owner")],["can_use",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("owner")]]});var file_ai_stigmer_agentic_artifact_v1_enum=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvZW51bS5wcm90bxIeYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxKoUBChRBcnRpZmFjdFN0b3JhZ2VTdGF0ZRIdChlzdG9yYWdlX3N0YXRlX3Vuc3BlY2lmaWVkEAASGQoVc3RvcmFnZV9zdGF0ZV9wZW5kaW5nEAESGAoUc3RvcmFnZV9zdGF0ZV9zdG9yZWQQAhIZChVzdG9yYWdlX3N0YXRlX2RlbGV0ZWQQA2IGcHJvdG8z"),ArtifactStorageState;(function(ArtifactStorageState2){ArtifactStorageState2[ArtifactStorageState2.storage_state_unspecified=0]="storage_state_unspecified",ArtifactStorageState2[ArtifactStorageState2.storage_state_pending=1]="storage_state_pending",ArtifactStorageState2[ArtifactStorageState2.storage_state_stored=2]="storage_state_stored",ArtifactStorageState2[ArtifactStorageState2.storage_state_deleted=3]="storage_state_deleted"})(ArtifactStorageState||(ArtifactStorageState={}));var file_ai_stigmer_agentic_artifact_v1_spec=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvc3BlYy5wcm90bxIeYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxIuQBCgxBcnRpZmFjdFNwZWMSIwoMY29udGVudF90eXBlGAEgASgJQg26SArIAQFyBRABGP8BEiMKDGRpc3BsYXlfbmFtZRgCIAEoCUINukgKyAEBcgUQARj/ARJGCgZzb3VyY2UYAyABKAsyLi5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuQXJ0aWZhY3RTb3VyY2VCBrpIA8gBARJCCglyZXRlbnRpb24YBCABKAsyLy5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuUmV0ZW50aW9uUG9saWN5Il4KDkFydGlmYWN0U291cmNlEh0KFXdvcmtmbG93X2V4ZWN1dGlvbl9pZBgBIAEoCRIaChJhZ2VudF9leGVjdXRpb25faWQYAiABKAkSEQoJdGFza19uYW1lGAMgASgJIiMKD1JldGVudGlvblBvbGljeRIQCgh0dGxfZGF5cxgBIAEoBWIGcHJvdG8z",[file_buf_validate_validate]);var file_ai_stigmer_agentic_artifact_v1_api=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvYXBpLnByb3RvEh5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEipwIKCEFydGlmYWN0EjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEh0KBGtpbmQYAiABKAlCD7pIDHIKCghBcnRpZmFjdBJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESOgoEc3BlYxgEIAEoCzIsLmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5BcnRpZmFjdFNwZWMSPgoGc3RhdHVzGAUgASgLMi4uYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxLkFydGlmYWN0U3RhdHVzItwBCg5BcnRpZmFjdFN0YXR1cxI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0EhQKDGNvbnRlbnRfaGFzaBgBIAEoCRISCgpzaXplX2J5dGVzGAIgASgDEksKDXN0b3JhZ2Vfc3RhdGUYAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuQXJ0aWZhY3RTdG9yYWdlU3RhdGUSEgoKZXhwaXJlc19hdBgEIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_artifact_v1_enum,file_ai_stigmer_agentic_artifact_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),ArtifactSchema=messageDesc2(file_ai_stigmer_agentic_artifact_v1_api,0),ArtifactStatusSchema=messageDesc2(file_ai_stigmer_agentic_artifact_v1_api,1);var artifactDeclaration=declareKind({kind:ApiResourceKind.artifact,schema:ArtifactSchema,source:"fga/model/agentic/artifact.fga",relations:[["organization",direct(objectOf("organization"))],["owner",direct(objectOf("identity_account"))],["viewer",union(direct(objectOf("identity_account")),from("viewer","organization"))],["can_view",union(computed("owner"),computed("viewer"))],["can_edit",from("admin","organization")]]});var file_ai_stigmer_agentic_channelapp_v1_spec=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9zcGVjLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MSLEAQoOQ2hhbm5lbEFwcFNwZWMSSAoFc2xhY2sYASABKAsyNy5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5TbGFja0NoYW5uZWxBcHBDb25maWdIABJOCgh3aGF0c2FwcBgCIAEoCzI6LmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLldoYXRzQXBwQ2hhbm5lbEFwcENvbmZpZ0gAQhgKD3Byb3ZpZGVyX2NvbmZpZxIFukgCCAEidAoVU2xhY2tDaGFubmVsQXBwQ29uZmlnEhoKCWNsaWVudF9pZBgBIAEoCUIHukgEcgIQARIeCg1jbGllbnRfc2VjcmV0GAIgASgJQge6SARyAhABEh8KDnNpZ25pbmdfc2VjcmV0GAMgASgJQge6SARyAhABIo4BChhXaGF0c0FwcENoYW5uZWxBcHBDb25maWcSFwoGYXBwX2lkGAEgASgJQge6SARyAhABEhsKCmFwcF9zZWNyZXQYAiABKAlCB7pIBHICEAESHQoMYWNjZXNzX3Rva2VuGAMgASgJQge6SARyAhABEh0KDHZlcmlmeV90b2tlbhgEIAEoCUIHukgEcgIQAWIGcHJvdG8z",[file_buf_validate_validate]);var file_ai_stigmer_agentic_channelapp_v1_api=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9hcGkucHJvdG8SIGFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxIrcCCgpDaGFubmVsQXBwEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEh8KBGtpbmQYAiABKAlCEbpIDnIMCgpDaGFubmVsQXBwEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARI+CgRzcGVjGAQgASgLMjAuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcFNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_channelapp_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),ChannelAppSchema=messageDesc2(file_ai_stigmer_agentic_channelapp_v1_api,0);var channelAppDeclaration=declareKind({kind:ApiResourceKind.channel_app,schema:ChannelAppSchema,source:"fga/model/agentic/channel_app.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["viewer",union(direct(objectOf("identity_account")),computed("owner"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var environmentDeclaration=declareKind({kind:ApiResourceKind.environment,schema:EnvironmentSchema,source:"fga/model/agentic/environment.fga",relations:[["organization",direct(objectOf("organization"))],["creator",direct(objectOf("identity_account"))],["owner",direct(objectOf("identity_account"))],["viewer",union(direct(objectOf("identity_account"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_read_secrets",computed("creator")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_agentic_executioncontext_v1_api=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9hcGkucHJvdG8SJmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxIs8CChBFeGVjdXRpb25Db250ZXh0EjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiUKBGtpbmQYAiABKAlCF7pIFHISChBFeGVjdXRpb25Db250ZXh0Ek0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJKCgRzcGVjGAQgASgLMjwuYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dFNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),ExecutionContextSchema=messageDesc2(file_ai_stigmer_agentic_executioncontext_v1_api,0);var executionContextDeclaration=declareKind({kind:ApiResourceKind.execution_context,schema:ExecutionContextSchema,source:"fga/model/agentic/execution_context.fga",relations:[["owner",direct(objectOf("identity_account"))],["can_view",computed("owner")],["can_edit",computed("owner")]]});var file_ai_stigmer_iam_iampolicy_v1_api=fileDesc("CiVhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvYXBpLnByb3RvEhthaS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEimQIKCUlhbVBvbGljeRItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEh4KBGtpbmQYAiABKAlCELpIDXILCglJYW1Qb2xpY3kSRQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YRI4CgRzcGVjGAQgASgLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMSPAoGc3RhdHVzGAUgASgLMiwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVN0YXR1cyJSCg9JYW1Qb2xpY3lTdGF0dXMSPwoFYXVkaXQYASABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_iampolicy_v1_spec,file_buf_validate_validate]),IamPolicySchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_api,0);var iamPolicyDeclaration=declareKind({kind:ApiResourceKind.iam_policy,schema:IamPolicySchema,source:"fga/model/iam/iam_policy.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["viewer",from("admin","organization")],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var identityAccountDeclaration=declareKind({kind:ApiResourceKind.identity_account,schema:IdentityAccountSchema,source:"fga/model/iam/identity_account.fga",relations:[["owner",direct(objectOf("identity_account"))],["can_view",computed("owner")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("owner")]]});var mcpServerDeclaration=declareKind({kind:ApiResourceKind.mcp_server,schema:McpServerSchema,source:"fga/model/agentic/mcp_server.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["platform_viewer",direct(usersetOf("identity_provider","platform_user"))],["viewer",union(direct(objectOf("identity_account"),publicWith("identity_account","allow_public"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"),computed("platform_viewer"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_use",computed("viewer")],["can_clone",computed("viewer")],["can_connect",computed("viewer")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_agentic_memory_v1_spec=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3NwZWMucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEikgEKCk1lbW9yeVNwZWMSGwoHY29udGVudBgBIAEoCUIKukgHcgUQARj0AxIjChtzdWJqZWN0X2lkZW50aXR5X2FjY291bnRfaWQYAiABKAkSQgoKcHJvdmVuYW5jZRgDIAEoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5UHJvdmVuYW5jZSJqChBNZW1vcnlQcm92ZW5hbmNlEhAKCGFnZW50X2lkGAEgASgJEhIKCnNlc3Npb25faWQYAiABKAkSGgoSYWdlbnRfZXhlY3V0aW9uX2lkGAMgASgJEhQKDHRvb2xfY2FsbF9pZBgEIAEoCWIGcHJvdG8z",[file_buf_validate_validate]);var MemoryProvenanceSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_spec,1);var file_ai_stigmer_agentic_memory_v1_enum=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2VudW0ucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEqkgEKFE1lbW9yeUxpZmVjeWNsZVN0YXRlEh8KG2xpZmVjeWNsZV9zdGF0ZV91bnNwZWNpZmllZBAAEhwKGGxpZmVjeWNsZV9zdGF0ZV9wcm9wb3NlZBABEh0KGWxpZmVjeWNsZV9zdGF0ZV9jb25maXJtZWQQAhIcChhsaWZlY3ljbGVfc3RhdGVfcmVqZWN0ZWQQA2IGcHJvdG8z"),MemoryLifecycleState;(function(MemoryLifecycleState2){MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_unspecified=0]="lifecycle_state_unspecified",MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_proposed=1]="lifecycle_state_proposed",MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_confirmed=2]="lifecycle_state_confirmed",MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_rejected=3]="lifecycle_state_rejected"})(MemoryLifecycleState||(MemoryLifecycleState={}));var file_ai_stigmer_agentic_memory_v1_status=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3N0YXR1cy5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MSLSAQoMTWVtb3J5U3RhdHVzEksKD2xpZmVjeWNsZV9zdGF0ZRgBIAEoDjIyLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5TGlmZWN5Y2xlU3RhdGUSNAoQc3RhdGVfY2hhbmdlZF9hdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASPwoFYXVkaXQYYyABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdGIGcHJvdG8z",[file_ai_stigmer_agentic_memory_v1_enum,file_ai_stigmer_commons_apiresource_status,file_google_protobuf_timestamp]),MemoryStatusSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_status,0);var file_ai_stigmer_agentic_memory_v1_api=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2FwaS5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MSKbAgoGTWVtb3J5EjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEhsKBGtpbmQYAiABKAlCDbpICnIICgZNZW1vcnkSTQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YUIGukgDyAEBEjYKBHNwZWMYBCABKAsyKC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeVNwZWMSOgoGc3RhdHVzGAUgASgLMiouYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_memory_v1_spec,file_ai_stigmer_agentic_memory_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),MemorySchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_api,0);var memoryDeclaration=declareKind({kind:ApiResourceKind.memory,schema:MemorySchema,source:"fga/model/agentic/memory.fga",relations:[["organization",direct(objectOf("organization"))],["subject",direct(objectOf("identity_account"))],["can_view",computed("subject")],["can_edit",computed("subject")],["can_delete",computed("subject")]]});var file_ai_stigmer_iam_oauthapp_v1_api=fileDesc("CiRhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9hcGkucHJvdG8SGmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxIqcCCghPQXV0aEFwcBItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEh0KBGtpbmQYAiABKAlCD7pIDHIKCghPQXV0aEFwcBJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESNgoEc3BlYxgEIAEoCzIoLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwU3BlYxJGCgZzdGF0dXMYBSABKAsyNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdFN0YXR1c2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_oauthapp_v1_spec,file_buf_validate_validate]),OAuthAppSchema=messageDesc2(file_ai_stigmer_iam_oauthapp_v1_api,0);var oauthAppDeclaration=declareKind({kind:ApiResourceKind.oauth_app,schema:OAuthAppSchema,source:"fga/model/iam/oauth_app.fga",relations:[["organization",direct(objectOf("organization"))],["owner",direct(objectOf("identity_account"))],["viewer",union(direct(objectOf("identity_account")),computed("owner"),from("admin","organization"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var organizationDeclaration=declareKind({kind:ApiResourceKind.organization,schema:OrganizationSchema,source:"fga/model/tenancy/organization.fga",relations:[["owner",direct(objectOf("identity_account"))],["admin",union(direct(objectOf("identity_account")),computed("owner"))],["member",union(direct(objectOf("identity_account")),computed("admin"))],["viewer",union(direct(objectOf("identity_account")),computed("member"))],["guest",direct(objectOf("identity_account"))],["can_view",computed("viewer")],["can_edit",computed("admin")],["can_delete",computed("owner")],["can_manage_members",computed("admin")],["can_assign_roles",computed("owner")],["can_create_project",computed("admin")],["can_create_agent",computed("admin")],["can_create_workflow",computed("admin")],["can_create_session",union(computed("member"),computed("guest"))],["can_create_environment",computed("member")],["can_create_skill",computed("admin")],["can_create_plugin",computed("admin")],["can_create_idp",computed("admin")],["can_create_identity_account",computed("admin")],["can_create_oauth_app",computed("admin")],["can_create_platform_client",computed("admin")],["can_create_channel_app",computed("admin")],["can_create_execution_in",union(computed("member"),computed("guest"))],["can_create_agent_share",computed("admin")],["can_grant_access",computed("admin")],["can_view_access",computed("viewer")],["can_view_billing",computed("viewer")],["can_manage_billing",computed("admin")]]});var file_ai_stigmer_agentic_plugin_v1_spec=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3NwZWMucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEigwIKClBsdWdpblNwZWMSDAoEbmFtZRgBIAEoCRIPCgd2ZXJzaW9uGAIgASgJEhMKC2Rlc2NyaXB0aW9uGAMgASgJEjoKBmF1dGhvchgEIAEoCzIqLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luQXV0aG9yEhAKCGhvbWVwYWdlGAUgASgJEhIKCnJlcG9zaXRvcnkYBiABKAkSDwoHbGljZW5zZRgHIAEoCRIQCghrZXl3b3JkcxgIIAMoCRI8CgdkaWFsZWN0GAkgASgOMisuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5EaWFsZWN0IjgKDFBsdWdpbkF1dGhvchIMCgRuYW1lGAEgASgJEg0KBWVtYWlsGAIgASgJEgsKA3VybBgDIAEoCSqhAQoNUGx1Z2luRGlhbGVjdBIeChpQTFVHSU5fRElBTEVDVF9VTlNQRUNJRklFRBAAEiAKHFBMVUdJTl9ESUFMRUNUX0FHRU5UX1BMVUdJTlMQARIZChVQTFVHSU5fRElBTEVDVF9DTEFVREUQAhIZChVQTFVHSU5fRElBTEVDVF9DVVJTT1IQAxIYChRQTFVHSU5fRElBTEVDVF9DT0RFWBAEYgZwcm90bzM"),PluginSpecSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_spec,0),PluginAuthorSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_spec,1),PluginDialect;(function(PluginDialect2){PluginDialect2[PluginDialect2.UNSPECIFIED=0]="UNSPECIFIED",PluginDialect2[PluginDialect2.AGENT_PLUGINS=1]="AGENT_PLUGINS",PluginDialect2[PluginDialect2.CLAUDE=2]="CLAUDE",PluginDialect2[PluginDialect2.CURSOR=3]="CURSOR",PluginDialect2[PluginDialect2.CODEX=4]="CODEX"})(PluginDialect||(PluginDialect={}));var file_ai_stigmer_agentic_plugin_v1_status=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3N0YXR1cy5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MSLqAgoMUGx1Z2luU3RhdHVzEj8KBWF1ZGl0GGMgASgLMjAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXQSKAoGZGlnZXN0GAEgASgJQhi6SBVyEzIRXiR8XlthLWYwLTldezY0fSQSHAoUYXJ0aWZhY3Rfc3RvcmFnZV9rZXkYAiABKAkSOAoFc3RhdGUYAyABKA4yKS5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpblN0YXRlEg0KBWVycm9yGAQgASgJEkkKDG1hdGVyaWFsaXplZBgFIAEoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luTWF0ZXJpYWxpemF0aW9uEj0KCHdhcm5pbmdzGAYgAygLMisuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5XYXJuaW5nIl8KFVBsdWdpbk1hdGVyaWFsaXphdGlvbhIOCgZza2lsbHMYASABKAUSEwoLbWNwX3NlcnZlcnMYAiABKAUSDgoGYWdlbnRzGAMgASgFEhEKCXdvcmtmbG93cxgEIAEoBSI8Cg1QbHVnaW5XYXJuaW5nEgwKBGtpbmQYASABKAkSDwoHbWVzc2FnZRgCIAEoCRIMCgRwYXRoGAMgASgJKnkKC1BsdWdpblN0YXRlEhwKGFBMVUdJTl9TVEFURV9VTlNQRUNJRklFRBAAEhsKF1BMVUdJTl9TVEFURV9JTlNUQUxMSU5HEAESFgoSUExVR0lOX1NUQVRFX1JFQURZEAISFwoTUExVR0lOX1NUQVRFX0ZBSUxFRBADYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),PluginStatusSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_status,0),PluginMaterializationSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_status,1),PluginWarningSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_status,2),PluginState;(function(PluginState2){PluginState2[PluginState2.UNSPECIFIED=0]="UNSPECIFIED",PluginState2[PluginState2.INSTALLING=1]="INSTALLING",PluginState2[PluginState2.READY=2]="READY",PluginState2[PluginState2.FAILED=3]="FAILED"})(PluginState||(PluginState={}));var file_ai_stigmer_agentic_plugin_v1_api=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2FwaS5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MSKbAgoGUGx1Z2luEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEhsKBGtpbmQYAiABKAlCDbpICnIICgZQbHVnaW4STQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YUIGukgDyAEBEjYKBHNwZWMYBCABKAsyKC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpblNwZWMSOgoGc3RhdHVzGAUgASgLMiouYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5TdGF0dXMiZAoKUGx1Z2luTGlzdBITCgthcGlfdmVyc2lvbhgBIAEoCRIMCgRraW5kGAIgASgJEjMKBWl0ZW1zGAMgAygLMiQuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5iBnByb3RvMw",[file_ai_stigmer_agentic_plugin_v1_spec,file_ai_stigmer_agentic_plugin_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),PluginSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_api,0);var pluginDeclaration=declareKind({kind:ApiResourceKind.plugin,schema:PluginSchema,source:"fga/model/agentic/plugin.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["platform_viewer",direct(usersetOf("identity_provider","platform_user"))],["viewer",union(direct(objectOf("identity_account"),publicWith("identity_account","allow_public"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"),computed("platform_viewer"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_use",computed("viewer")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_tenancy_project_v1_spec=fileDesc("CihhaS9zdGlnbWVyL3RlbmFuY3kvcHJvamVjdC92MS9zcGVjLnByb3RvEh1haS5zdGlnbWVyLnRlbmFuY3kucHJvamVjdC52MSJ+CgtQcm9qZWN0U3BlYxITCgtlbnRyeV9wb2ludBgBIAEoCRITCgtkZXNjcmlwdGlvbhgCIAEoCRJFCgdtZW1iZXJzGAMgAygLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io]);var file_ai_stigmer_tenancy_project_v1_status=fileDesc("CiphaS9zdGlnbWVyL3RlbmFuY3kvcHJvamVjdC92MS9zdGF0dXMucHJvdG8SHWFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxIuwBChVSZWNvbmNpbGlhdGlvblN1bW1hcnkSRQoHY3JlYXRlZBgBIAMoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRJFCgd1cGRhdGVkGAIgAygLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlEkUKB2RlbGV0ZWQYAyADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UiowEKDVByb2plY3RTdGF0dXMSUQoTbGFzdF9yZWNvbmNpbGlhdGlvbhgBIAEoCzI0LmFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxLlJlY29uY2lsaWF0aW9uU3VtbWFyeRI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0YgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_status]),ReconciliationSummarySchema=messageDesc2(file_ai_stigmer_tenancy_project_v1_status,0),ProjectStatusSchema=messageDesc2(file_ai_stigmer_tenancy_project_v1_status,1);var file_ai_stigmer_tenancy_project_v1_api=fileDesc("CidhaS9zdGlnbWVyL3RlbmFuY3kvcHJvamVjdC92MS9hcGkucHJvdG8SHWFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxIqkCCgdQcm9qZWN0EjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVdGVuYW5jeS5zdGlnbWVyLmFpL3YxEhwKBGtpbmQYAiABKAlCDrpIC3IJCgdQcm9qZWN0Ek0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJACgRzcGVjGAQgASgLMiouYWkuc3RpZ21lci50ZW5hbmN5LnByb2plY3QudjEuUHJvamVjdFNwZWNCBrpIA8gBARI8CgZzdGF0dXMYBSABKAsyLC5haS5zdGlnbWVyLnRlbmFuY3kucHJvamVjdC52MS5Qcm9qZWN0U3RhdHVzYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_tenancy_project_v1_spec,file_ai_stigmer_tenancy_project_v1_status,file_buf_validate_validate]),ProjectSchema=messageDesc2(file_ai_stigmer_tenancy_project_v1_api,0);var projectDeclaration=declareKind({kind:ApiResourceKind.project,schema:ProjectSchema,source:"fga/model/tenancy/project.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["viewer",union(direct(objectOf("identity_account")),computed("owner"),from("viewer","organization"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var scheduleDeclaration=declareKind({kind:ApiResourceKind.schedule,schema:ScheduleSchema,source:"fga/model/agentic/schedule.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["viewer",union(direct(objectOf("identity_account")),computed("owner"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_agentic_session_v1_api=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9hcGkucHJvdG8SHWFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxIqsCCgdTZXNzaW9uEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEhwKBGtpbmQYAiABKAlCDrpIC3IJCgdTZXNzaW9uEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARI4CgRzcGVjGAQgASgLMiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvblNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_session_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),SessionSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_api,0);var sessionDeclaration=declareKind({kind:ApiResourceKind.session,schema:SessionSchema,source:"fga/model/agentic/session.fga",relations:[["organization",direct(objectOf("organization"))],["agent_instance",direct(objectOf("agent_instance"))],["channel",direct(objectOf("agent_channel"))],["schedule",direct(objectOf("schedule"))],["owner",direct(objectOf("identity_account"))],["viewer",union(direct(objectOf("identity_account")),computed("owner"))],["can_view",union(computed("viewer"),from("viewer","channel"),from("viewer","schedule"))],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_create_execution_in",computed("viewer")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var skillDeclaration=declareKind({kind:ApiResourceKind.skill,schema:SkillSchema,source:"fga/model/agentic/skill.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["platform_viewer",direct(usersetOf("identity_provider","platform_user"))],["viewer",union(direct(objectOf("identity_account"),publicWith("identity_account","allow_public"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"),computed("platform_viewer"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_use",computed("viewer")],["can_clone",computed("viewer")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var workflowDeclaration=declareKind({kind:ApiResourceKind.workflow,schema:WorkflowSchema,source:"fga/model/agentic/workflow.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["platform_viewer",direct(usersetOf("identity_provider","platform_user"))],["viewer",union(direct(objectOf("identity_account"),publicWith("identity_account","allow_public"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"),computed("platform_viewer"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_execute",computed("viewer")],["can_clone",computed("viewer")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_agentic_workflowexecution_v1_enum=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvZW51bS5wcm90bxInYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxKtsBCg5FeGVjdXRpb25QaGFzZRIfChtFWEVDVVRJT05fUEhBU0VfVU5TUEVDSUZJRUQQABIVChFFWEVDVVRJT05fUEVORElORxABEhkKFUVYRUNVVElPTl9JTl9QUk9HUkVTUxACEhcKE0VYRUNVVElPTl9DT01QTEVURUQQAxIUChBFWEVDVVRJT05fRkFJTEVEEAQSFwoTRVhFQ1VUSU9OX0NBTkNFTExFRBAFEhgKFEVYRUNVVElPTl9URVJNSU5BVEVEEAYSFAoQRVhFQ1VUSU9OX1BBVVNFRBAHKoQCChBXb3JrZmxvd1Rhc2tUeXBlEiIKHldPUktGTE9XX1RBU0tfVFlQRV9VTlNQRUNJRklFRBAAEiIKHldPUktGTE9XX1RBU0tfQUdFTlRfSU5WT0NBVElPThABEhoKFldPUktGTE9XX1RBU0tfQVBQUk9WQUwQAhIaChZXT1JLRkxPV19UQVNLX0FQSV9DQUxMEAMSHQoZV09SS0ZMT1dfVEFTS19DT05ESVRJT05BTBAEEhoKFldPUktGTE9XX1RBU0tfUEFSQUxMRUwQBRIbChdXT1JLRkxPV19UQVNLX1RSQU5TRk9STRAGEhgKFFdPUktGTE9XX1RBU0tfQ1VTVE9NEAcq6gEKEldvcmtmbG93VGFza1N0YXR1cxIkCiBXT1JLRkxPV19UQVNLX1NUQVRVU19VTlNQRUNJRklFRBAAEhkKFVdPUktGTE9XX1RBU0tfUEVORElORxABEh0KGVdPUktGTE9XX1RBU0tfSU5fUFJPR1JFU1MQAhIbChdXT1JLRkxPV19UQVNLX0NPTVBMRVRFRBADEhgKFFdPUktGTE9XX1RBU0tfRkFJTEVEEAQSGQoVV09SS0ZMT1dfVEFTS19TS0lQUEVEEAUSIgoeV09SS0ZMT1dfVEFTS19XQUlUSU5HX0FQUFJPVkFMEAZiBnByb3RvMw"),ExecutionPhase2;(function(ExecutionPhase3){ExecutionPhase3[ExecutionPhase3.EXECUTION_PHASE_UNSPECIFIED=0]="EXECUTION_PHASE_UNSPECIFIED",ExecutionPhase3[ExecutionPhase3.EXECUTION_PENDING=1]="EXECUTION_PENDING",ExecutionPhase3[ExecutionPhase3.EXECUTION_IN_PROGRESS=2]="EXECUTION_IN_PROGRESS",ExecutionPhase3[ExecutionPhase3.EXECUTION_COMPLETED=3]="EXECUTION_COMPLETED",ExecutionPhase3[ExecutionPhase3.EXECUTION_FAILED=4]="EXECUTION_FAILED",ExecutionPhase3[ExecutionPhase3.EXECUTION_CANCELLED=5]="EXECUTION_CANCELLED",ExecutionPhase3[ExecutionPhase3.EXECUTION_TERMINATED=6]="EXECUTION_TERMINATED",ExecutionPhase3[ExecutionPhase3.EXECUTION_PAUSED=7]="EXECUTION_PAUSED"})(ExecutionPhase2||(ExecutionPhase2={}));var WorkflowTaskType;(function(WorkflowTaskType2){WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_TYPE_UNSPECIFIED=0]="WORKFLOW_TASK_TYPE_UNSPECIFIED",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_AGENT_INVOCATION=1]="WORKFLOW_TASK_AGENT_INVOCATION",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_APPROVAL=2]="WORKFLOW_TASK_APPROVAL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_API_CALL=3]="WORKFLOW_TASK_API_CALL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_CONDITIONAL=4]="WORKFLOW_TASK_CONDITIONAL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_PARALLEL=5]="WORKFLOW_TASK_PARALLEL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_TRANSFORM=6]="WORKFLOW_TASK_TRANSFORM",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_CUSTOM=7]="WORKFLOW_TASK_CUSTOM"})(WorkflowTaskType||(WorkflowTaskType={}));var WorkflowTaskStatus;(function(WorkflowTaskStatus2){WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_STATUS_UNSPECIFIED=0]="WORKFLOW_TASK_STATUS_UNSPECIFIED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_PENDING=1]="WORKFLOW_TASK_PENDING",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_IN_PROGRESS=2]="WORKFLOW_TASK_IN_PROGRESS",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_COMPLETED=3]="WORKFLOW_TASK_COMPLETED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_FAILED=4]="WORKFLOW_TASK_FAILED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_SKIPPED=5]="WORKFLOW_TASK_SKIPPED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_WAITING_APPROVAL=6]="WORKFLOW_TASK_WAITING_APPROVAL"})(WorkflowTaskStatus||(WorkflowTaskStatus={}));var file_ai_stigmer_agentic_workflowexecution_v1_spec=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvc3BlYy5wcm90bxInYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxIrwEChVXb3JrZmxvd0V4ZWN1dGlvblNwZWMSHAoUd29ya2Zsb3dfaW5zdGFuY2VfaWQYASABKAkSEwoLd29ya2Zsb3dfaWQYBiABKAkSFwoPdHJpZ2dlcl9tZXNzYWdlGAMgASgJEm0KEHRyaWdnZXJfbWV0YWRhdGEYBCADKAsyUy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb25TcGVjLlRyaWdnZXJNZXRhZGF0YUVudHJ5EmMKC3J1bnRpbWVfZW52GAUgAygLMk4uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uU3BlYy5SdW50aW1lRW52RW50cnkSFgoOY2FsbGJhY2tfdG9rZW4YByABKAwSSAoQZXhlY3V0aW9uX3RhcmdldBgIIAEoDjIuLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLkV4ZWN1dGlvblRhcmdldBo2ChRUcmlnZ2VyTWV0YWRhdGFFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBGmkKD1J1bnRpbWVFbnZFbnRyeRILCgNrZXkYASABKAkSRQoFdmFsdWUYAiABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25WYWx1ZToCOAFiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_spec,file_ai_stigmer_agentic_session_v1_enum]);var file_ai_stigmer_agentic_workflowexecution_v1_api=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvYXBpLnByb3RvEidhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEi3QIKEVdvcmtmbG93RXhlY3V0aW9uEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiYKBGtpbmQYAiABKAlCGLpIFXITChFXb3JrZmxvd0V4ZWN1dGlvbhJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESTAoEc3BlYxgEIAEoCzI+LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvblNwZWMSUAoGc3RhdHVzGAUgASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uU3RhdHVzIqQFChdXb3JrZmxvd0V4ZWN1dGlvblN0YXR1cxI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0ElAKBXBoYXNlGAEgASgOMjcuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvblBoYXNlQgi6SAWCAQIQARJECgV0YXNrcxgCIAMoCzI1LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd1Rhc2sSJwoGb3V0cHV0GAMgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBINCgVlcnJvchgEIAEoCRISCgpzdGFydGVkX2F0GAUgASgJEhQKDGNvbXBsZXRlZF9hdBgGIAEoCRIcChR0ZW1wb3JhbF93b3JrZmxvd19pZBgHIAEoCRJbChFwZW5kaW5nX2FwcHJvdmFscxgJIAMoCzJALmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd1BlbmRpbmdBcHByb3ZhbBIZChF0b3RhbF9jb3N0X21pY3JvcxgKIAEoAxIaChJ0b3RhbF9pbnB1dF90b2tlbnMYCyABKAMSGwoTdG90YWxfb3V0cHV0X3Rva2VucxgMIAEoAxIdChV3b3JrZmxvd192ZXJzaW9uX2hhc2gYDSABKAkSYAoUcGVuZGluZ19maWxlX3Jldmlld3MYDiADKAsyQi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dQZW5kaW5nRmlsZVJldmlldyKEAQoXV29ya2Zsb3dQZW5kaW5nQXBwcm92YWwSRwoIYXBwcm92YWwYASABKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUGVuZGluZ0FwcHJvdmFsEiAKGGNoaWxkX2FnZW50X2V4ZWN1dGlvbl9pZBgCIAEoCSJUChlXb3JrZmxvd1BlbmRpbmdGaWxlUmV2aWV3EiAKGGNoaWxkX2FnZW50X2V4ZWN1dGlvbl9pZBgBIAEoCRIVCg1jaGFuZ2Vfc2V0X2lkGAIgAygJIv8DCgxXb3JrZmxvd1Rhc2sSDwoHdGFza19pZBgBIAEoCRIRCgl0YXNrX25hbWUYAiABKAkSVgoJdGFza190eXBlGAMgASgOMjkuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93VGFza1R5cGVCCLpIBYIBAhABEiYKBWlucHV0GAQgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBInCgZvdXRwdXQYBSABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0ElUKBnN0YXR1cxgGIAEoDjI7LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd1Rhc2tTdGF0dXNCCLpIBYIBAhABEhIKCnN0YXJ0ZWRfYXQYByABKAkSFAoMY29tcGxldGVkX2F0GAggASgJEg0KBWVycm9yGAkgASgJEikKCG1ldGFkYXRhGAogASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBIUCgxhcnRpZmFjdF9pZHMYCyADKAkSEwoLY29zdF9taWNyb3MYDCABKAMSFAoMaW5wdXRfdG9rZW5zGA0gASgDEhUKDW91dHB1dF90b2tlbnMYDiABKAMSDwoHdWlfaGludBgPIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_approval,file_ai_stigmer_agentic_workflowexecution_v1_enum,file_ai_stigmer_agentic_workflowexecution_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_struct]),WorkflowExecutionSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_api,0),WorkflowExecutionStatusSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_api,1);var workflowExecutionDeclaration=declareKind({kind:ApiResourceKind.workflow_execution,schema:WorkflowExecutionSchema,source:"fga/model/agentic/workflow_execution.fga",relations:[["organization",direct(objectOf("organization"))],["workflow_instance",direct(objectOf("workflow_instance"))],["owner",direct(objectOf("identity_account"))],["viewer",union(direct(objectOf("identity_account")),computed("owner"),from("execution_viewer","workflow_instance"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_agentic_workflowinstance_v1_spec=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dpbnN0YW5jZS92MS9zcGVjLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MSKBAwoUV29ya2Zsb3dJbnN0YW5jZVNwZWMSHAoLd29ya2Zsb3dfaWQYASABKAlCB7pIBHICEAESEwoLZGVzY3JpcHRpb24YAiABKAkSyAEKEGVudmlyb25tZW50X3JlZnMYAyADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCeLpIcZIBbiJsugFpChVlbnZpcm9ubWVudF9yZWZzLmtpbmQSP2Vudmlyb25tZW50X3JlZnMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1lbnZpcm9ubWVudBoPdGhpcy5raW5kID09IDUz4IUsNRJrChRleGVjdXRpb25fdmlzaWJpbGl0eRgEIAEoDjJDLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93RXhlY3V0aW9uVmlzaWJpbGl0eUIIukgFggECEAEqpwEKG1dvcmtmbG93RXhlY3V0aW9uVmlzaWJpbGl0eRItCil3b3JrZmxvd19leGVjdXRpb25fdmlzaWJpbGl0eV91bnNwZWNpZmllZBAAEikKJXdvcmtmbG93X2V4ZWN1dGlvbl92aXNpYmlsaXR5X3ByaXZhdGUQARIuCip3b3JrZmxvd19leGVjdXRpb25fdmlzaWJpbGl0eV9vcmdhbml6YXRpb24QAmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]),WorkflowInstanceSpecSchema=messageDesc2(file_ai_stigmer_agentic_workflowinstance_v1_spec,0),WorkflowExecutionVisibility;(function(WorkflowExecutionVisibility2){WorkflowExecutionVisibility2[WorkflowExecutionVisibility2.unspecified=0]="unspecified",WorkflowExecutionVisibility2[WorkflowExecutionVisibility2.private=1]="private",WorkflowExecutionVisibility2[WorkflowExecutionVisibility2.organization=2]="organization"})(WorkflowExecutionVisibility||(WorkflowExecutionVisibility={}));var file_ai_stigmer_agentic_workflowinstance_v1_api=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dpbnN0YW5jZS92MS9hcGkucHJvdG8SJmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxIs8CChBXb3JrZmxvd0luc3RhbmNlEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiUKBGtpbmQYAiABKAlCF7pIFHISChBXb3JrZmxvd0luc3RhbmNlEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJKCgRzcGVjGAQgASgLMjwuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEuV29ya2Zsb3dJbnN0YW5jZVNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_workflowinstance_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),WorkflowInstanceSchema=messageDesc2(file_ai_stigmer_agentic_workflowinstance_v1_api,0);var executionViewer=(object,row)=>{if(!isMessage2(row,WorkflowInstanceSchema))return Promise.resolve([]);let level=row.spec?.executionVisibility??WorkflowExecutionVisibility.unspecified;switch(level){case WorkflowExecutionVisibility.organization:{let org=row.metadata?.org??"";return Promise.resolve(org===""?[]:[{object,relation:"execution_viewer",subject:{form:"userset",object:{type:"organization",id:org},relation:"viewer"}}])}case WorkflowExecutionVisibility.private:case WorkflowExecutionVisibility.unspecified:return Promise.resolve([]);default:{let exhaustive=level;throw new Error(`unknown execution visibility: ${String(exhaustive)}`)}}},workflowInstanceDeclaration=declareKind({kind:ApiResourceKind.workflow_instance,schema:WorkflowInstanceSchema,source:"fga/model/agentic/workflow_instance.fga",relations:[["organization",direct(objectOf("organization"))],["workflow",direct(objectOf("workflow"))],["default_of",direct(objectOf("workflow"))],["owner",direct(objectOf("identity_account"))],["viewer",union(direct(objectOf("identity_account"),publicWith("identity_account","allow_public"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"),from("viewer","default_of"))],["execution_viewer",direct(objectOf("identity_account"),usersetOf("organization","member"),usersetOf("organization","viewer"))],["can_view",computed("viewer")],["can_execute",computed("can_view")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]],derived:[["default_of",defaultOfBlueprint({kind:ApiResourceKind.workflow,schema:WorkflowSchema,defaultInstanceIdOf:workflow=>workflow.status?.defaultInstanceId??""})],["execution_viewer",executionViewer]]});function newModel(declarations){let byKind=new Map,byType=new Map;for(let declaration of declarations){if(byKind.has(declaration.kind))throw new Error(`${declaration.type} is declared twice in the model`);byKind.set(declaration.kind,declaration),byType.set(declaration.type,declaration)}return{declarations,byKind:kind=>byKind.get(kind),byType:type2=>byType.get(type2)}}var builtInModel=newModel([identityAccountDeclaration,iamPolicyDeclaration,apiKeyDeclaration,oauthAppDeclaration,organizationDeclaration,projectDeclaration,agentDeclaration,agentChannelDeclaration,agentShareDeclaration,channelAppDeclaration,agentInstanceDeclaration,agentExecutionDeclaration,artifactDeclaration,environmentDeclaration,executionContextDeclaration,mcpServerDeclaration,memoryDeclaration,scheduleDeclaration,sessionDeclaration,skillDeclaration,workflowDeclaration,workflowInstanceDeclaration,workflowExecutionDeclaration,pluginDeclaration]);var ACCOUNT_TYPE="identity_account",ALLOW_PUBLIC_CONDITION="allow_public";function formatObjectRef(object){return`${object.type}:${object.id}`}function pairKey(object,relation){return`${formatObjectRef(object)}#${relation}`}var ROW_RECORDED_OWNER_KINDS=new Set([ApiResourceKind.organization]);function account(id){return{form:"object",object:{type:ACCOUNT_TYPE,id}}}function deriveTuples(facts){let object={type:kindEnumName(facts.kind),id:facts.id},config2=getKindMeta(facts.kind).authorization;if(config2===void 0)return[];let tuples=[];for(let link of facts.parentLinks)tuples.push({object,relation:link.relation,subject:{form:"object",object:{type:kindEnumName(link.parentKind),id:link.parentId}}});let stampIsPerson=isPersonStamp(facts.createdBy);switch(config2.ownerType){case OwnerAttributionType.DIRECT:stampIsPerson&&!ROW_RECORDED_OWNER_KINDS.has(facts.kind)&&tuples.push({object,relation:"owner",subject:account(facts.createdBy)});break;case OwnerAttributionType.SELF:tuples.push({object,relation:"owner",subject:account(facts.id)});break;case OwnerAttributionType.INHERITED:case OwnerAttributionType.NONE:case OwnerAttributionType.UNSPECIFIED:break;default:{let exhaustive=config2.ownerType;throw new Error(`unknown owner attribution: ${String(exhaustive)}`)}}config2.requiresCreatorTuple&&stampIsPerson&&tuples.push({object,relation:"creator",subject:account(facts.createdBy)});for(let shape of visibilityShapesFor(facts.kind,facts.visibility)){let subject=visibilitySubject(shape,facts.org);subject!==void 0&&tuples.push({object,relation:"viewer",subject})}return tuples}function visibilitySubject(shape,org){switch(shape){case"org-viewer":return org===""?void 0:{form:"userset",object:{type:"organization",id:org},relation:"viewer"};case"public-viewer":return{form:"wildcard",type:ACCOUNT_TYPE,condition:ALLOW_PUBLIC_CONDITION};case"platform-viewer":return;default:{let exhaustive=shape;throw new Error(`unknown visibility shape: ${String(exhaustive)}`)}}}function newDerivedTupleSource(deps,person,seed){let model=deps.model??builtInModel,rows=new Map,derived=new Map,seeded=new Map;for(let facts of seed?.facts??[])seeded.set(formatObjectRef({type:kindEnumName(facts.kind),id:facts.id}),facts);let personRows,loader2={load(object){let key=formatObjectRef(object),held=rows.get(key);if(held!==void 0)return held;let loading=loadRow(deps,model,object);return rows.set(key,loading),loading}};function derivedTuplesOf(object){let key=formatObjectRef(object),held=derived.get(key);if(held!==void 0)return held;let declaration=model.byType(object.type),known=seeded.get(key),deriving;return declaration===void 0?deriving=Promise.resolve([]):known!==void 0?deriving=Promise.resolve(deriveTuples(known)):deriving=loader2.load(object).then(row=>row===void 0?[]:deriveTuples(rowFactsOf(declaration.kind,row))),derived.set(key,deriving),deriving}function rowTuples(){return personRows===void 0&&(personRows=deps.policies.findByPrincipal(ACCOUNT_TYPE,person.accountId).then(found=>found.map(tupleOfRow))),personRows}return{loader:loader2,personTuples:rowTuples,async tuplesOf(object,relation){let onPair=tuple=>tuple.relation===relation&&tuple.object.type===object.type&&tuple.object.id===object.id,fromRows=(await rowTuples()).filter(onPair),declaration=model.byType(object.type);if(declaration===void 0)return fromRows;let fromRow=(await derivedTuplesOf(object)).filter(onPair),rule=declaration.derived.get(relation);if(rule===void 0)return[...fromRows,...fromRow];let row=await loader2.load(object),fromRule=row===void 0?[]:await rule(object,row,loader2);return[...fromRows,...fromRow,...fromRule]}}}async function loadRow(deps,model,object){let declaration=model.byType(object.type),kind=kindByEnumName(object.type);if(!(declaration===void 0||kind===ApiResourceKind.api_resource_kind_unknown||object.id==="")){if(kind===ApiResourceKind.identity_account)return deps.accounts.findById(object.id);try{return await deps.store.getResource(kind,object.id,declaration.schema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}}function tupleOfRow(row){let spec=row.spec,principal=spec?.principal,resource=spec?.resource,object={type:resource?.kind??"",id:resource?.id??""},principalObject={type:principal?.kind??"",id:principal?.id??""},subject;return principal!==void 0&&principal.relation!==""?subject={form:"userset",object:principalObject,relation:principal.relation}:principalObject.id==="*"?subject={form:"wildcard",type:principalObject.type,condition:void 0}:subject={form:"object",object:principalObject},{object,relation:spec?.relation??"",subject}}var MAX_RESOLUTION_DEPTH=25,AuthorizationEvaluationError=class extends Error{reason;constructor(reason,message6){super(message6),this.name="AuthorizationEvaluationError",this.reason=reason}};async function checkRelation(deps,object,relation,person,context2){if(deps.model.byType(object.type)===void 0)throw new AuthorizationEvaluationError("undeclared-target-kind",`no declaration for kind '${object.type}' (target ${formatObjectRef(object)})`);return new Walk(deps,person,context2).resolve(object,relation,0)}var Walk=class{deps;person;context;memo=new Map;inProgress=new Set;constructor(deps,person,context2){this.deps=deps,this.person=person,this.context=context2}resolve(object,relation,depth){let key=pairKey(object,relation);if(this.inProgress.has(key))throw new AuthorizationEvaluationError("resolution-cycle",`'${key}' re-entered while being resolved \u2014 the declarations cycle`);if(depth>MAX_RESOLUTION_DEPTH)throw new AuthorizationEvaluationError("resolution-depth-exceeded",`resolving '${key}' exceeded ${MAX_RESOLUTION_DEPTH} hops`);let held=this.memo.get(key);if(held!==void 0)return held;let declaration=this.deps.model.byType(object.type),rewrite=declaration?.relations.get(relation);if(declaration===void 0||rewrite===void 0)return Promise.resolve(!1);this.inProgress.add(key);let result=this.evaluate(rewrite,object,relation,depth).finally(()=>this.inProgress.delete(key));return this.memo.set(key,result),result}async evaluate(rewrite,object,relation,depth){switch(rewrite.node){case"this":{let tuples=await this.deps.source.tuplesOf(object,relation);for(let tuple of tuples)if(await this.subjectHolds(tuple.subject,rewrite.subjects,depth))return!0;return!1}case"computed":return this.resolve(object,rewrite.relation,depth+1);case"from":{let linkTypes=this.objectTypesOf(object,rewrite.tupleset),links=await this.deps.source.tuplesOf(object,rewrite.tupleset);for(let link of links)if(link.subject.form==="object"&&linkTypes.has(link.subject.object.type)&&await this.resolve(link.subject.object,rewrite.relation,depth+1))return!0;return!1}case"union":{for(let member2 of rewrite.members)if(await this.evaluate(member2,object,relation,depth))return!0;return!1}default:{let exhaustive=rewrite;throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`)}}}async subjectHolds(subject,restriction,depth){switch(subject.form){case"object":return subject.object.type===ACCOUNT_TYPE&&restriction.some(allowed=>allowed.form==="object"&&allowed.type===ACCOUNT_TYPE)&&this.person.aliases.has(subject.object.id);case"userset":return restriction.some(allowed=>allowed.form==="userset"&&allowed.type===subject.object.type&&allowed.relation===subject.relation)&&await this.resolve(subject.object,subject.relation,depth+1);case"wildcard":return restriction.some(entry=>entry.form==="wildcard"&&entry.type===subject.type&&entry.condition===subject.condition)&&this.conditionHolds(subject.condition);default:{let exhaustive=subject;throw new Error(`unknown subject form: ${JSON.stringify(exhaustive)}`)}}}conditionHolds(condition){if(condition===ALLOW_PUBLIC_CONDITION)return this.context.allow;throw new AuthorizationEvaluationError("unknown-condition",`the model declares no condition '${String(condition)}'`)}objectTypesOf(object,tupleset){let rewrite=this.deps.model.byType(object.type)?.relations.get(tupleset),types3=new Set,collect=node=>{if(node.node==="this")for(let subject of node.subjects)subject.form==="object"&&types3.add(subject.type);else node.node==="union"&&node.members.forEach(collect)};return rewrite!==void 0&&collect(rewrite),types3}};var ACCOUNT_ID_PREFIX="ida";function accountIdFor(idpId){if(idpId==="")throw new Error("idp_id must not be empty");return derivedId(ACCOUNT_ID_PREFIX,idpId)}var LOCAL_IDP_ID_PREFIX="local|";function localIdpIdFor(identityId){return`${LOCAL_IDP_ID_PREFIX}${identityId}`}function idpIdOf(caller){return caller.issuer===""&&caller.rawToken===""?localIdpIdFor(caller.identityId):jwtSubjectOf(caller.rawToken)}function jwtSubjectOf(rawToken){let segments=rawToken.split(".");if(segments.length!==3)return"";try{let payload=JSON.parse(Buffer.from(segments[1]??"","base64url").toString("utf8"));return typeof payload.sub=="string"?payload.sub:""}catch{return""}}var MACHINE_ACCOUNT_SUFFIX="@clients";function isMachineSubject(idpId){return idpId.endsWith(MACHINE_ACCOUNT_SUFFIX)}var ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE="Identity account not found for the authenticated user",NO_IDP_ID_MESSAGE="Cannot provision account: no IDP ID in authentication context",USERINFO_UNAVAILABLE_PREFIX="Failed to fetch user profile from identity provider: ";function accountNotFoundMessage(handle){return`Identity account not found: ${handle}`}var CREATE_IS_INTERNAL_MESSAGE="this RPC is internal to the platform",FEDERATION_UNIMPLEMENTED_REASON="federated identity accounts are served by the Enterprise and Cloud editions";function federationUnimplementedMessage(method){return`${method} is not implemented: ${FEDERATION_UNIMPLEMENTED_REASON}`}function idpIdImmutableMessage(existingIdpId){return`spec.idp_id is immutable (account subject is '${existingIdpId}') \u2014 create a new account for a different subject`}async function identityIdForSubject(accounts,subject){let account2=await accounts.findDirectByIdpId(subject);if(account2===void 0)return subject;let id=account2.metadata?.id??"";if(id==="")throw new Error(`identity account for subject '${subject}' carries no id \u2014 refusing to stamp an empty principal`);return id}async function accountForCaller(accounts,caller){let byId=await accounts.findById(caller.identityId);if(byId!==void 0)return byId;let subject=idpIdOf(caller);if(subject!=="")return accounts.findDirectByIdpId(subject)}async function accountForStamp(accounts,stamp){if(stamp!=="")return await accounts.findById(stamp)??await accounts.findDirectByIdpId(stamp)}function personFor(caller,account2){let accountId=account2?.metadata?.id??caller.identityId;if(!isPersonStamp(accountId))throw new Error(`caller '${accountId}' names no person \u2014 the built-in authorizer evaluates people only`);let aliases=new Set([accountId]),subject=account2?.spec?.idpId??"";return subject!==""&&aliases.add(subject),{accountId,aliases}}async function resolvePerson(accounts,caller){return personFor(caller,await accountForCaller(accounts,caller))}var NOT_FOUND_EXEMPT_KINDS=new Set([ApiResourceKind.identity_account,ApiResourceKind.iam_policy]),UNKNOWN_PERMISSION_DENY_REASON="authorization cannot be performed with unknown permission",EMPTY_IDENTITY_DENY_REASON="authorization cannot be performed on empty identity string",EMPTY_RESOURCE_ID_DENY_REASON="authorization cannot be performed on empty api-resource-id",UNKNOWN_KIND_DENY_REASON="authorization cannot be performed on unknown api-resource-kind",UNSERVED_KIND_DENY_REASON="authorization cannot be performed on a kind this edition does not serve";function newBuiltInAuthorizer(deps){let model=deps.model??builtInModel;return{async authorize(caller,check){if(check.permission===IamPermission.unspecified)return deny(UNKNOWN_PERMISSION_DENY_REASON);if(caller.identityId==="")return deny(EMPTY_IDENTITY_DENY_REASON);if(check.resourceId==="")return deny(EMPTY_RESOURCE_ID_DENY_REASON);if(check.resourceKind===ApiResourceKind.api_resource_kind_unknown)return deny(UNKNOWN_KIND_DENY_REASON);if(!kindServedByEdition(check.resourceKind,deps.edition))return deny(UNSERVED_KIND_DENY_REASON);let object={type:kindEnumName(check.resourceKind),id:check.resourceId},relation=IamPermission[check.permission];try{let person=await resolvePerson(deps.accounts,caller),source=newDerivedTupleSource({store:deps.store,policies:deps.policies,accounts:deps.accounts,model},person);return await source.loader.load(object)===void 0&&!NOT_FOUND_EXEMPT_KINDS.has(check.resourceKind)?(deps.logger.debug("authorization target not found",{account:person.accountId,permission:relation,object:formatObjectRef(object)}),{kind:"not-found"}):await checkRelation({model,source},object,relation,person,{allow:!0})?{kind:"allow"}:(deps.logger.debug("authorization denied",{account:person.accountId,permission:relation,object:formatObjectRef(object)}),deny(""))}catch(error2){return{kind:"unavailable",cause:error2 instanceof Error?error2:new Error(String(error2))}}}}}function deny(reason){return{kind:"deny",reason}}var AUTHORIZATION_UNAVAILABLE_MESSAGE="authorization check could not be completed",AUTHORIZATION_DENIED_FALLBACK_MESSAGE="permission denied";function newPermissiveSingleTeamAuthorizer(){return{authorize(){return Promise.resolve({kind:"allow"})}}}function newAuthorizeStep(method,authorizer){return{name:"Authorize",execute(ctx){return authorizeDirect(method,authorizer,ctx.callerIdentity,ctx.input)}}}async function authorizeDirect(method,authorizer,identity2,input,override){if(identity2.callerClass==="internal"||getOption(method,is_public)||getOption(method,is_skip_authorization)||!hasOption(method,config))return;let config2=getOption(method,config);return authorizeResolvedResource(authorizer,identity2,{permission:config2.permission,resourceKind:override?.resourceKind??resolveResourceKind(input,config2),resourceId:override?.resourceId??resolveResourceId(input,config2)},config2.errorMsg)}async function authorizeResolvedResource(authorizer,identity2,check,errorMsg){if(identity2.callerClass==="internal")return;let decision=await evaluateAuthorizer(authorizer,identity2,check);switch(decision.kind){case"allow":return;case"deny":throw new ConnectError(errorMsg!==""?errorMsg:decision.reason!==""?decision.reason:AUTHORIZATION_DENIED_FALLBACK_MESSAGE,Code.PermissionDenied);case"not-found":throw check.resourceId===""||check.resourceKind===ApiResourceKind.api_resource_kind_unknown?internalError(new Error("authorizer answered not-found for a non-resource-scoped check"),AUTHORIZATION_UNAVAILABLE_MESSAGE):notFoundError(getKindName(check.resourceKind),check.resourceId);case"unavailable":throw internalError(decision.cause,AUTHORIZATION_UNAVAILABLE_MESSAGE);default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),AUTHORIZATION_UNAVAILABLE_MESSAGE)}}}async function evaluateAuthorizer(authorizer,identity2,check){try{return await authorizer.authorize(identity2,check)}catch(error2){return{kind:"unavailable",cause:error2 instanceof Error?error2:new Error(String(error2))}}}function resolveResourceKind(input,config2){if(config2.resourceKindPath==="")return config2.resourceKind;let value=resolveDotPath(input,config2.resourceKindPath);return typeof value=="number"?value:typeof value=="string"?kindByEnumName(value):ApiResourceKind.api_resource_kind_unknown}function resolveResourceId(input,config2){if(config2.resourceId!=="")return config2.resourceId;if(config2.fieldPath==="")return"";let value=resolveDotPath(input,config2.fieldPath);return typeof value=="string"?value:""}function resolveDotPath(input,path14){let current=input;for(let segment of path14.split(".")){if(current===null||typeof current!="object")return;current=current[snakeToCamel(segment)]}return current}function snakeToCamel(segment){return segment.replace(/_([a-z0-9])/g,(_,ch)=>ch.toUpperCase())}var RUN_GATE_CHECKS={agent:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.agent},agentInstance:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.agent_instance},session:{permission:IamPermission.can_create_execution_in,resourceKind:ApiResourceKind.session},workflow:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.workflow},workflowInstance:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.workflow_instance}},RUN_GATE_CHECK_LIST=Object.values(RUN_GATE_CHECKS);function isRunGateCheck(check){return RUN_GATE_CHECK_LIST.some(candidate=>candidate.permission===check.permission&&candidate.resourceKind===check.resourceKind)}function newAuthorizeRunTargetStep(authorizer,resolveRunTarget){return{name:"AuthorizeRunTarget",async execute(ctx){let target=resolveRunTarget(ctx.newState);target!==void 0&&await authorizeResolvedResource(authorizer,ctx.callerIdentity,{permission:target.permission,resourceKind:target.resourceKind,resourceId:target.resourceId},target.deniedMessage)}}}var ADMITTED={kind:"allow"};function newLaneAdmittedAuthorizer(inner,isAdmittedLane){return{authorize(caller,check){return isRunGateCheck(check)&&isAdmittedLane(caller)?Promise.resolve(ADMITTED):inner.authorize(caller,check)}}}var LIST_RELATION="can_view",LISTING={allow:!1};function newBuiltInListReadScope(deps){let model=deps.model??builtInModel;async function visibleAmong(caller,kind,candidates){if(candidates.length===0)return new Set;let started=performance.now(),person=await resolvePerson(deps.accounts,caller),source=newDerivedTupleSource({store:deps.store,policies:deps.policies,accounts:deps.accounts,model},person,{facts:candidates}),type2=kindEnumName(kind),answers=await Promise.all(candidates.map(async facts=>{let object={type:type2,id:facts.id};return await checkRelation({model,source},object,LIST_RELATION,person,LISTING)?facts.id:void 0})),kept=new Set;for(let id of answers)id!==void 0&&kept.add(id);return deps.logger.debug("list scope evaluated candidates",{account:person.accountId,kind:type2,offered:candidates.length,kept:kept.size,elapsedMs:Math.round(performance.now()-started)}),kept}function requireDeclared(kind){let declaration=model.byKind(kind);if(declaration===void 0)throw new AuthorizationEvaluationError("undeclared-target-kind",`no declaration for kind '${kindEnumName(kind)}' \u2014 a list lane asked the scope about a kind the model does not declare`);return declaration}async function everyRowOf(declaration){let kind=declaration.kind,rows=await deps.store.listResources(kind),facts=[];for(let bytes of rows)try{facts.push(rowFactsOf(kind,fromBinary2(declaration.schema,bytes)))}catch(error2){deps.logger.warn("list scope skipped a row that does not decode",{kind:kindEnumName(kind),error:error2 instanceof Error?error2.message:String(error2)})}return facts}return{async restrictListEntries(caller,kind,entries){requireDeclared(kind);let unique2=new Map;for(let entry of entries)unique2.has(entry.id)||unique2.set(entry.id,rowFactsOfEntry(kind,entry));return caller.callerClass==="internal"?new Set(unique2.keys()):visibleAmong(caller,kind,[...unique2.values()])},async authorizedResourceIds(caller,kind){let candidates=await everyRowOf(requireDeclared(kind));return caller.callerClass==="internal"?new Set(candidates.map(facts=>facts.id)):visibleAmong(caller,kind,candidates)}}}var ORGANIZATION2=kindEnumName(ApiResourceKind.organization);function newBuiltInOrganizationDirectory(deps){let model=deps.model??builtInModel;return{refusesEnumeration:!0,async listMyOrganizationIds(caller){if(caller.callerClass==="internal")return"all";let person=await resolvePerson(deps.accounts,caller),source=newDerivedTupleSource({store:deps.store,policies:deps.policies,accounts:deps.accounts,model},person),candidates=new Set;for(let tuple of await source.personTuples())tuple.object.type===ORGANIZATION2&&tuple.object.id!==""&&candidates.add(tuple.object.id);let visible=[];for(let id of candidates)await checkRelation({model,source},{type:ORGANIZATION2,id},"can_view",person,{allow:!1})&&visible.push(id);return visible}}}function authorizationPostureOf(inputs){return inputs.unitAuthorizer?"unit-authorizer":inputs.requireAuthentication?"built-in":"trusted-local"}var ScheduleFireCallerRefusedError=class extends Error{constructor(reason){super(reason),this.name="ScheduleFireCallerRefusedError"}};function scheduleHasNoPersonMessage(scheduleId){return`schedule ${scheduleId} was created by nobody this server recognizes as a person; recreate it while signed in`}function newBuiltInScheduleFireCaller(deps){return{async mintFireCaller(_org,scheduleId){let schedule=await deps.store.getResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema),stamp=auditOf(ScheduleSchema,schedule)?.specAudit?.createdBy?.id??"",account2=await accountForStamp(deps.accounts,stamp);if(account2===void 0)throw new ScheduleFireCallerRefusedError(scheduleHasNoPersonMessage(scheduleId));return accountAsCaller(account2)}}}var ABSENT_LICENSE_STATUS={status:()=>Promise.resolve({state:LicenseState.absent})};var file_ai_stigmer_agentic_agent_v1_io=fileDesc("CiRhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnQvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MSIgCgdBZ2VudElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiLgoWR2V0RGVmYXVsdEFnZW50UmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAFiBnByb3RvMw",[file_buf_validate_validate]),AgentIdSchema=messageDesc2(file_ai_stigmer_agentic_agent_v1_io,0);var file_ai_stigmer_commons_apiresource_rpc_service_options=fileDesc("CjhhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvcnBjX3NlcnZpY2Vfb3B0aW9ucy5wcm90bxIeYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlOo4BChFhcGlfcmVzb3VyY2Vfa2luZBIfLmdvb2dsZS5wcm90b2J1Zi5TZXJ2aWNlT3B0aW9ucxj0vwUgASgOMj8uYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUtpbmRSD2FwaVJlc291cmNlS2luZGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind,file_google_protobuf_descriptor]),api_resource_kind=extDesc(file_ai_stigmer_commons_apiresource_rpc_service_options,0);var file_ai_stigmer_agentic_agent_v1_command=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnQvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxMskFChZBZ2VudENvbW1hbmRDb250cm9sbGVyEk8KBWFwcGx5EiIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50GiIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50EpsBCgZjcmVhdGUSIi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuQWdlbnQaIi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuQWdlbnQiScK4GEUIBhAeIgxtZXRhZGF0YS5vcmcqMXVuYXV0aG9yaXplZCB0byBjcmVhdGUgYWdlbnQgaW4gdGhpcyBvcmdhbml6YXRpb24ShQEKBnVwZGF0ZRIiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudBoiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudCIzwrgYLwgCECgiC21ldGFkYXRhLmlkKhx1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGFnZW50Eq0BChB1cGRhdGVWaXNpYmlsaXR5EjUuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlVwZGF0ZVZpc2liaWxpdHlJbnB1dBoiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudCI+wrgYOggCECgiC3Jlc291cmNlX2lkKid1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGFnZW50IHZpc2liaWxpdHkSgQEKBmRlbGV0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudElkGiIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50Ii3CuBgpCAMQKCIFdmFsdWUqHHVuYXV0aG9yaXplZCB0byBkZWxldGUgYWdlbnQaBKD/KyhiBnByb3RvMw",[file_ai_stigmer_agentic_agent_v1_api,file_ai_stigmer_agentic_agent_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentCommandController=serviceDesc(file_ai_stigmer_agentic_agent_v1_command,0);var file_ai_stigmer_agentic_agent_v1_query=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnQvdjEvcXVlcnkucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MTL4AgoUQWdlbnRRdWVyeUNvbnRyb2xsZXISewoDZ2V0EiQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50SWQaIi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuQWdlbnQiKsK4GCYIARAoIgV2YWx1ZSoZdW5hdXRob3JpemVkIHRvIGdldCBhZ2VudBJwCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRoiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudCIE0LgYARJrCgpnZXREZWZhdWx0EjMuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkdldERlZmF1bHRBZ2VudFJlcXVlc3QaIi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuQWdlbnQiBNC4GAEaBKD/KyhiBnByb3RvMw",[file_ai_stigmer_agentic_agent_v1_api,file_ai_stigmer_agentic_agent_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentQueryController=serviceDesc(file_ai_stigmer_agentic_agent_v1_query,0);var apiResourceKindKey=createContextKey(ApiResourceKind.api_resource_kind_unknown,{description:"api_resource_kind service option of the target service"});function createApiResourceInterceptor(){return next=>request=>{if(!request.stream&&hasOption(request.service,api_resource_kind)){let kind=getOption(request.service,api_resource_kind);kind!==ApiResourceKind.api_resource_kind_unknown&&request.contextValues.set(apiResourceKindKey,kind)}return next(request)}}var INTERNAL_FALLBACK_MESSAGE="internal server error",Pipeline=class{pipelineName;steps;logger;constructor(pipelineName,steps,logger2){this.pipelineName=pipelineName,this.steps=steps,this.logger=logger2}get name(){return this.pipelineName}get stepCount(){return this.steps.length}async execute(ctx){for(let step of this.steps){let startedAt=performance.now();try{await step.execute(ctx)}catch(error2){throw this.logger.warn("pipeline step failed",{pipeline:this.pipelineName,step:step.name,durationMs:Math.round(performance.now()-startedAt),error:error2 instanceof Error?error2.message:String(error2)}),error2 instanceof ConnectError?error2:internalError(error2,INTERNAL_FALLBACK_MESSAGE)}this.logger.debug("pipeline step completed",{pipeline:this.pipelineName,step:step.name,durationMs:Math.round(performance.now()-startedAt)})}}},PipelineBuilder=class{name;logger;steps=[];constructor(name,logger2){this.name=name,this.logger=logger2}addStep(step){return this.steps.push(step),this}build(){return new Pipeline(this.name,this.steps,this.logger)}};function newPipeline(name,logger2){return new PipelineBuilder(name,logger2)}var LOADED_EXECUTION_KEY="loadedExecution",RequestContext=class{input;schema;callerIdentity;apiResourceKind;state;metadata=new Map;constructor(schema2,input,callerIdentity,apiResourceKind=ApiResourceKind.api_resource_kind_unknown){this.schema=schema2,this.input=input,this.state=clone(schema2,input),this.callerIdentity=callerIdentity,this.apiResourceKind=apiResourceKind}get newState(){return this.state}setNewState(state2){this.state=state2}get(key){return this.metadata.get(key)}set(key,value){this.metadata.set(key,value)}};var STAMPED_KEYS_CONTEXT_KEY="serverStampedReservedLabels";function recordServerStampedReservedLabels(ctx,...keys){let existing=ctx.get(STAMPED_KEYS_CONTEXT_KEY),stamped=existing instanceof Set?existing:new Set;for(let key of keys)stamped.add(key);ctx.set(STAMPED_KEYS_CONTEXT_KEY,stamped)}function serverStampedReservedLabels(ctx){let stamped=ctx.get(STAMPED_KEYS_CONTEXT_KEY);return stamped instanceof Set?stamped:new Set}var RESERVED_LABEL_PREFIX="stigmer.ai/",CLIENT_CONTRACT_ALLOWLIST=new Map([[ApiResourceKind.environment,new Set(["stigmer.ai/personal"])]]);function reservedLabelMutations(stored,requested){let mutations=[];for(let[key,value]of Object.entries(requested))key.startsWith(RESERVED_LABEL_PREFIX)&&stored[key]!==value&&mutations.push(key);return mutations.sort()}function newGuardReservedLabelsStep(authorizer,positions={}){let stateOf=positions.stateOf??(ctx=>ctx.newState),existingKey=positions.existingKey??EXISTING_RESOURCE_KEY;return{name:"GuardReservedLabels",async execute(ctx){if(ctx.callerIdentity.callerClass==="internal"||ctx.callerIdentity.origin==="in-process")return;let state2=stateOf(ctx),requested=state2===void 0?{}:metadataOf(state2)?.labels??{},existing=ctx.get(existingKey),stored=existing===void 0?{}:metadataOf(existing)?.labels??{},allowlist=CLIENT_CONTRACT_ALLOWLIST.get(ctx.apiResourceKind)??new Set,stamped=serverStampedReservedLabels(ctx),mutations=reservedLabelMutations(stored,requested).filter(key=>!allowlist.has(key)&&!stamped.has(key));if(mutations.length===0)return;let decision;try{decision=await authorizer.authorize(ctx.callerIdentity,{permission:IamPermission.can_write_reserved_labels,resourceKind:ApiResourceKind.platform,resourceId:"stigmer"})}catch(error2){throw reservedLabelCheckFailure(error2)}switch(decision.kind){case"allow":return;case"deny":case"not-found":throw new ConnectError(`Labels in the reserved '${RESERVED_LABEL_PREFIX}' namespace are platform-managed and cannot be set or changed by this request: ${mutations.join(", ")}. Stored reserved labels may be echoed back unchanged or removed.`,Code.InvalidArgument);case"unavailable":throw reservedLabelCheckFailure(decision.cause);default:{let exhaustive=decision;throw reservedLabelCheckFailure(new Error(`unknown decision ${JSON.stringify(exhaustive)}`))}}}}}function reservedLabelCheckFailure(error2){return internalError(error2 instanceof Error?error2:new Error(String(error2)),"reserved-label validation could not be completed")}var PUBLIC_VISIBILITY_DENY_MESSAGE="Public visibility is granted by the platform team. Ask a platform operator to publish this resource.";function newGuardPublicVisibilityStep(authorizer){return{name:"GuardPublicVisibility",async execute(ctx){ctx.callerIdentity.callerClass!=="internal"&&metadataOf(ctx.newState)?.visibility===ApiResourceVisibility.visibility_public&&await requireOperatorMaySetPublic(authorizer,ctx.callerIdentity)}}}function newAuthorizeVisibilityTransitionStep(targetKey,authorizer){return{name:"AuthorizeVisibilityTransition",async execute(ctx){if(ctx.callerIdentity.callerClass==="internal"||ctx.input.visibility!==ApiResourceVisibility.visibility_public)return;let target=ctx.get(targetKey);if(target===void 0)throw internalError(new Error("AuthorizeVisibilityTransition ran without a loaded target \u2014 step must be placed after the load step"),"visibility authorization requires the loaded resource");metadataOf(target)?.visibility!==ApiResourceVisibility.visibility_public&&await requireOperatorMaySetPublic(authorizer,ctx.callerIdentity)}}}async function requireOperatorMaySetPublic(authorizer,caller){let decision;try{decision=await authorizer.authorize(caller,{permission:IamPermission.can_set_public_visibility,resourceKind:ApiResourceKind.platform,resourceId:"stigmer"})}catch(error2){throw publicVisibilityCheckFailure(error2)}switch(decision.kind){case"allow":return;case"deny":case"not-found":throw new ConnectError(PUBLIC_VISIBILITY_DENY_MESSAGE,Code.PermissionDenied);case"unavailable":throw publicVisibilityCheckFailure(decision.cause);default:{let exhaustive=decision;throw publicVisibilityCheckFailure(new Error(`unknown decision ${JSON.stringify(exhaustive)}`))}}}function publicVisibilityCheckFailure(error2){return internalError(error2 instanceof Error?error2:new Error(String(error2)),"public-visibility authorization could not be completed")}function newBuildUpdateStateStep(){return{name:"BuildUpdateState",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not found in context - LoadExisting must run first"),"build update state");let merged=clone(ctx.schema,ctx.input);preserveImmutableFields(merged,existing),hasStatusField(ctx.schema)&&(clearStatusField(ctx.schema,merged),copyStatusFromExisting(ctx.schema,merged,existing),updateAuditFields(ctx.schema,merged,existing,ctx.callerIdentity)),ctx.setNewState(merged)}}}function preserveImmutableFields(merged,existing){let mergedMeta=metadataOf(merged),existingMeta=metadataOf(existing);if(mergedMeta===void 0||existingMeta===void 0)throw internalError(new Error("metadata is nil"),"preserve immutable fields");mergedMeta.id=existingMeta.id,mergedMeta.slug=existingMeta.slug,mergedMeta.org=existingMeta.org,mergedMeta.visibility=existingMeta.visibility}function copyStatusFromExisting(schema2,merged,existing){let existingRoot=reflect2(schema2,existing),statusField=messageFieldByName(existingRoot,"status");if(statusField===void 0||!existingRoot.isSet(statusField))return;let statusCopy=reflect2(statusField.message,clone(statusField.message,existingRoot.get(statusField).message));reflect2(schema2,merged).set(statusField,statusCopy)}function updateAuditFields(schema2,resource,existing,identity2){let now=timestampNow(),actor=auditActorFor(identity2),{createdBy,createdAt}=creationAuditOf(schema2,existing,"spec_audit");setAuditReflect(schema2,resource,create2(ApiResourceAuditSchema,{specAudit:updatedAuditInfo(createdBy,createdAt,actor,now),statusAudit:create2(ApiResourceAuditInfoSchema,{createdBy:actor,createdAt:now,updatedBy:actor,updatedAt:now,event:"updated"})}))}function newCheckDuplicateStep(store){return{name:"CheckDuplicate",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"duplicate check");if(metadata.slug==="")throw internalError(new Error("resource slug is empty"),"duplicate check");let existing;try{existing=await findResourceBySlug(store,ctx.apiResourceKind,ctx.schema,metadata.slug,metadata.org)}catch(error2){throw internalError(error2,"failed to check for duplicates")}if(existing!==void 0){let existingMetadata=metadataOf(existing);throw alreadyExistsError(getKindName(ctx.apiResourceKind),`slug '${metadata.slug}' in org '${existingMetadata?.org??""}' (id: ${existingMetadata?.id??""})`)}}}}var RESOURCE_ID_KEY="resourceId";function newExtractResourceIdStep(){return{name:"ExtractResourceId",execute(ctx){let id=idValueOf(ctx.input);if(id==="")throw invalidArgumentError("resource id is required");ctx.set(RESOURCE_ID_KEY,id)}}}function newLoadExistingForDeleteStep(store,resourceSchema){return{name:"LoadExistingForDelete",async execute(ctx){let id=requireResourceId(ctx),resource;try{resource=await store.getResource(ctx.apiResourceKind,id,resourceSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError(getKindName(ctx.apiResourceKind),id):error2}ctx.set(EXISTING_RESOURCE_KEY,resource)}}}function newDeleteResourceStep(store){return{name:"DeleteResource",async execute(ctx){let id=requireResourceId(ctx);try{await store.deleteResource(ctx.apiResourceKind,id)}catch(error2){throw internalError(error2,`failed to delete ${getKindName(ctx.apiResourceKind)}`)}}}}function requireResourceId(ctx){let id=ctx.get(RESOURCE_ID_KEY);if(typeof id!="string"||id==="")throw internalError(new Error("resource id not found in context (ExtractResourceId must run first)"),"delete pipeline ordering");return id}function apiResourceKindName(kind){return enumToJson(ApiResourceKindSchema,kind)}function extractFieldValue(schema2,msg,fieldPath){let parts=fieldPath.split("."),current=reflect2(schema2,msg);for(let i6=0;i6<parts.length;i6++){let part=parts[i6],field2=findFieldByProtoName(current,part);if(field2===void 0)return"";if(i6===parts.length-1)return scalarString(current,field2);if(field2.fieldKind!=="message")return"";current=current.get(field2)}return""}function extractLabelValue(schema2,msg,labelKey){let root5=reflect2(schema2,msg),metadataField=root5.fields.find(f5=>f5.name==="metadata");if(metadataField===void 0||metadataField.fieldKind!=="message")return"";let metadata=root5.get(metadataField),labelsField=metadata.fields.find(f5=>f5.name==="labels");if(labelsField===void 0||labelsField.fieldKind!=="map")return"";let value=metadata.get(labelsField).get(labelKey);return typeof value=="string"?value:""}function scanForFieldMatch(rows,schema2,fieldPath,value){for(let data of rows){let msg;try{msg=fromBinary2(schema2,data)}catch{continue}if(extractFieldValue(schema2,msg,fieldPath)===value)return msg}}function filterRowsByLabel(rows,schema2,labelKey,labelValue){let results=[];for(let data of rows){let msg;try{msg=fromBinary2(schema2,data)}catch{continue}extractLabelValue(schema2,msg,labelKey)===labelValue&&results.push(data)}return results}function findFieldByProtoName(message6,part){return message6.fields.find(f5=>f5.name===part)??message6.fields.find(f5=>f5.name===toSnakeCase(part))}function scalarString(message6,field2){if(field2.fieldKind==="list"||field2.fieldKind==="map"||field2.fieldKind==="message")return"";let value=message6.get(field2);return typeof value=="string"?value:typeof value=="number"||typeof value=="bigint"?String(value):typeof value=="boolean"?value?"true":"false":value instanceof Uint8Array?Buffer.from(value).toString("latin1"):""}function toSnakeCase(value){let result="";for(let i6=0;i6<value.length;i6++){let ch=value[i6];i6>0&&ch>="A"&&ch<="Z"&&(result+="_"),result+=ch}return result.toLowerCase()}function newIndexSearchStep(store,extractor,logger2){return{name:"IndexSearch",async execute(ctx){let resource=ctx.newState,metadata=metadataOf(resource);if(metadata===void 0||metadata.id===""){logger2.warn("IndexSearch: resource has no metadata or ID, skipping indexing");return}let entry=extractor.getSearchIndexEntry(resource);if(entry===void 0){logger2.warn("IndexSearch: extractor returned no entry, skipping indexing",{id:metadata.id});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,metadata.id,entry)}catch(error2){logger2.warn("IndexSearch: failed to update search index (best-effort)",{id:metadata.id,kind:apiResourceKindName(ctx.apiResourceKind),error:error2 instanceof Error?error2.message:String(error2)})}}}}function newDeleteSearchIndexStep(store,logger2){return{name:"DeleteSearchIndex",async execute(ctx){let id=ctx.get(RESOURCE_ID_KEY);if(typeof id!="string"||id==="")throw internalError(new Error("resource id not found in context (ExtractResourceId must run first)"),"delete search index ordering");try{await store.deleteSearchIndex(ctx.apiResourceKind,id)}catch(error2){logger2.warn("DeleteSearchIndex: failed to remove search index entry (best-effort)",{id,kind:apiResourceKindName(ctx.apiResourceKind),error:error2 instanceof Error?error2.message:String(error2)})}}}}var RESERVED_LABEL_PREFIX2="stigmer.ai/",DEFAULT_INSTANCE_LABEL=`${RESERVED_LABEL_PREFIX2}default-instance`,SYSTEM_MANAGED_LABEL=`${RESERVED_LABEL_PREFIX2}system-managed`,RESERVED_LABEL_TRUE="true",PLUGIN_LABEL=`${RESERVED_LABEL_PREFIX2}plugin`,PLUGIN_VERSION_LABEL=`${RESERVED_LABEL_PREFIX2}plugin-version`;function pluginIdOf(metadata){let value=metadata?.labels[PLUGIN_LABEL];return value===void 0||value===""?void 0:value}function isDefaultInstance(metadata){return metadata?.labels[DEFAULT_INSTANCE_LABEL]===RESERVED_LABEL_TRUE}var MANAGED_KIND_NOUNS=new Map([[ApiResourceKind.skill,"skill"],[ApiResourceKind.mcp_server,"MCP server"],[ApiResourceKind.agent,"agent"],[ApiResourceKind.workflow,"workflow"]]);function pluginManagedRefusal(kind,slug,pluginSlug){return`${MANAGED_KIND_NOUNS.get(kind)??ApiResourceKind[kind]??String(kind)} '${slug}' is managed by plugin '${pluginSlug}'; change the plugin and push it again, or compose your own agent over it`}function newGuardPluginManagedStep(store,positions={}){let existingKey=positions.existingKey??EXISTING_RESOURCE_KEY;return{name:"GuardPluginManaged",async execute(ctx){if(ctx.callerIdentity.callerClass==="internal"||ctx.callerIdentity.origin==="in-process")return;let existing=ctx.get(existingKey);if(existing===void 0)return;let metadata=metadataOf(existing),pluginId=pluginIdOf(metadata);if(pluginId===void 0)return;let pluginSlug;try{pluginSlug=(await store.getResource(ApiResourceKind.plugin,pluginId,PluginSchema)).metadata?.slug??pluginId}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw internalError(error2,"plugin ownership could not be checked")}throw new ConnectError(pluginManagedRefusal(ctx.apiResourceKind,metadata?.slug??"",pluginSlug),Code.FailedPrecondition)}}}var EXISTS_IN_DATABASE_KEY="existsInDatabase",SHOULD_CREATE_KEY="shouldCreate";function newLoadForApplyStep(store){return{name:"LoadForApply",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0||metadata.slug===""){ctx.set(EXISTS_IN_DATABASE_KEY,!1),ctx.set(SHOULD_CREATE_KEY,!0);return}let existing=await findResourceBySlug(store,ctx.apiResourceKind,ctx.schema,metadata.slug,metadata.org);if(existing===void 0){ctx.set(EXISTS_IN_DATABASE_KEY,!1),ctx.set(SHOULD_CREATE_KEY,!0);return}ctx.set(EXISTING_RESOURCE_KEY,existing),ctx.set(EXISTS_IN_DATABASE_KEY,!0),ctx.set(SHOULD_CREATE_KEY,!1),metadata.id===""&&(metadata.id=metadataOf(existing)?.id??"")}}}function withResolvedApplyId(schema2,original,resolved){let enriched=clone(schema2,original),metadata=metadataOf(enriched),resolvedId=metadataOf(resolved.newState)?.id??"";return metadata!==void 0&&metadata.id===""&&resolvedId!==""&&(metadata.id=resolvedId),enriched}var TARGET_RESOURCE_KEY="targetResource";function newLoadTargetStep(store,targetSchema){return{name:"LoadTarget",async execute(ctx){let resourceId=idValueOf(ctx.input);if(resourceId==="")throw invalidArgumentError("resource id is required");let target;try{target=await store.getResource(ctx.apiResourceKind,resourceId,targetSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError(getKindName(ctx.apiResourceKind),resourceId):error2}ctx.set(TARGET_RESOURCE_KEY,target)}}}function newLoadByReferenceStep(store,targetSchema){return{name:"LoadByReference",async execute(ctx){let ref=ctx.input;if(ref.slug==="")throw invalidArgumentError("slug is required in reference");let kind=ctx.apiResourceKind;if(ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==kind)throw invalidArgumentError(`kind mismatch: expected ${apiResourceKindName(kind)}, got ${apiResourceKindName(ref.kind)}`);requireOrgForReference(kind,ref.org);let target=await findResourceBySlug(store,kind,targetSchema,ref.slug,ref.org);if(target===void 0)throw notFoundError(getKindName(kind),ref.slug);ctx.set(TARGET_RESOURCE_KEY,target)}}}var API_RESOURCE_REFERENCE_TYPE="ai.stigmer.commons.apiresource.ApiResourceReference";function newNormalizeReferencesStep(){return{name:"NormalizeReferences",execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"normalize references");metadata.org!==""&&forEachSpecReference(ctx.schema,ctx.newState,ref=>{let orgField=ref.fields.find(f5=>f5.name==="org");orgField!==void 0&&ref.get(orgField)===""&&ref.set(orgField,metadata.org)})}}}function newValidateReferencesStep(store){return{name:"ValidateReferences",async execute(ctx){let refs=[];forEachSpecReference(ctx.schema,ctx.newState,ref=>{refs.push({kind:numberField(ref,"kind"),slug:stringField(ref,"slug"),org:stringField(ref,"org")})});let missingMcpServers=[];for(let ref of refs)ref.slug!==""&&ref.kind===ApiResourceKind.mcp_server&&await findResourceBySlug(store,ApiResourceKind.mcp_server,McpServerSchema,ref.slug,ref.org)===void 0&&missingMcpServers.push(`'${ref.slug}' (org: ${ref.org})`);if(missingMcpServers.length>0)throw failedPreconditionError(`referenced MCP server(s) not found: ${missingMcpServers.join(", ")}. Verify the slug and org are correct. Use 'stigmer get mcp-servers' to list available MCP servers.`)}}}function collectSpecReferences(schema2,msg){let refs=[];return forEachSpecReference(schema2,msg,ref=>{refs.push({kind:numberField(ref,"kind"),slug:stringField(ref,"slug"),org:stringField(ref,"org")})}),refs}function forEachSpecReference(schema2,msg,fn){let root5=reflect2(schema2,msg),specField=messageFieldByName(root5,"spec");specField===void 0||!root5.isSet(specField)||walk(root5.get(specField),fn)}function walk(msg,fn){for(let field2 of msg.fields)if(field2.fieldKind==="list"){if(field2.listKind!=="message")continue;for(let item of msg.get(field2))visit(item,fn)}else if(field2.fieldKind==="map"){if(field2.mapKind!=="message")continue;let map5=msg.get(field2);for(let[,value]of map5)visit(value,fn)}else if(field2.fieldKind==="message"){if(!msg.isSet(field2))continue;visit(msg.get(field2),fn)}}function visit(sub,fn){sub.desc.typeName===API_RESOURCE_REFERENCE_TYPE?fn(sub):walk(sub,fn)}function stringField(msg,name){let field2=msg.fields.find(f5=>f5.name===name);if(field2===void 0)return"";let value=msg.get(field2);return typeof value=="string"?value:""}function numberField(msg,name){let field2=msg.fields.find(f5=>f5.name===name);if(field2===void 0)return 0;let value=msg.get(field2);return typeof value=="number"?value:0}function newPersistStep(store){return{name:"Persist",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"persist");if(metadata.id==="")throw internalError(new Error("resource ID is empty, cannot persist"),"persist");try{await store.saveResource(ctx.apiResourceKind,metadata.id,ctx.schema,ctx.newState)}catch(error2){throw internalError(error2,"failed to save resource to store")}}}}function newResolveSlugStep(){return{name:"ResolveSlug",execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"slug resolution");if(metadata.slug===""){if(metadata.name==="")throw invalidArgumentError("resource name is required");metadata.slug=generateSlug(metadata.name)}}}}function generateSlug(name){let slug=name.toLowerCase();return slug=slug.replaceAll(" ","-").replaceAll(".","-"),slug=slug.replace(/[^a-z0-9\- ]/g,""),slug=slug.replace(/-{2,}/g,"-"),slug.replace(/^-+|-+$/g,"")}var file_buf_validate_validate2=fileDesc2("ChtidWYvdmFsaWRhdGUvdmFsaWRhdGUucHJvdG8SDGJ1Zi52YWxpZGF0ZSI3CgRSdWxlEgoKAmlkGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEgoKZXhwcmVzc2lvbhgDIAEoCSKGAQoMTWVzc2FnZVJ1bGVzEhYKDmNlbF9leHByZXNzaW9uGAUgAygJEh8KA2NlbBgDIAMoCzISLmJ1Zi52YWxpZGF0ZS5SdWxlEi0KBW9uZW9mGAQgAygLMh4uYnVmLnZhbGlkYXRlLk1lc3NhZ2VPbmVvZlJ1bGVKBAgBEAJSCGRpc2FibGVkIjQKEE1lc3NhZ2VPbmVvZlJ1bGUSDgoGZmllbGRzGAEgAygJEhAKCHJlcXVpcmVkGAIgASgIIh4KCk9uZW9mUnVsZXMSEAoIcmVxdWlyZWQYASABKAgiiwkKCkZpZWxkUnVsZXMSFgoOY2VsX2V4cHJlc3Npb24YHSADKAkSHwoDY2VsGBcgAygLMhIuYnVmLnZhbGlkYXRlLlJ1bGUSEAoIcmVxdWlyZWQYGSABKAgSJAoGaWdub3JlGBsgASgOMhQuYnVmLnZhbGlkYXRlLklnbm9yZRIpCgVmbG9hdBgBIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GbG9hdFJ1bGVzSAASKwoGZG91YmxlGAIgASgLMhkuYnVmLnZhbGlkYXRlLkRvdWJsZVJ1bGVzSAASKQoFaW50MzIYAyABKAsyGC5idWYudmFsaWRhdGUuSW50MzJSdWxlc0gAEikKBWludDY0GAQgASgLMhguYnVmLnZhbGlkYXRlLkludDY0UnVsZXNIABIrCgZ1aW50MzIYBSABKAsyGS5idWYudmFsaWRhdGUuVUludDMyUnVsZXNIABIrCgZ1aW50NjQYBiABKAsyGS5idWYudmFsaWRhdGUuVUludDY0UnVsZXNIABIrCgZzaW50MzIYByABKAsyGS5idWYudmFsaWRhdGUuU0ludDMyUnVsZXNIABIrCgZzaW50NjQYCCABKAsyGS5idWYudmFsaWRhdGUuU0ludDY0UnVsZXNIABItCgdmaXhlZDMyGAkgASgLMhouYnVmLnZhbGlkYXRlLkZpeGVkMzJSdWxlc0gAEi0KB2ZpeGVkNjQYCiABKAsyGi5idWYudmFsaWRhdGUuRml4ZWQ2NFJ1bGVzSAASLwoIc2ZpeGVkMzIYCyABKAsyGy5idWYudmFsaWRhdGUuU0ZpeGVkMzJSdWxlc0gAEi8KCHNmaXhlZDY0GAwgASgLMhsuYnVmLnZhbGlkYXRlLlNGaXhlZDY0UnVsZXNIABInCgRib29sGA0gASgLMhcuYnVmLnZhbGlkYXRlLkJvb2xSdWxlc0gAEisKBnN0cmluZxgOIAEoCzIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlc0gAEikKBWJ5dGVzGA8gASgLMhguYnVmLnZhbGlkYXRlLkJ5dGVzUnVsZXNIABInCgRlbnVtGBAgASgLMhcuYnVmLnZhbGlkYXRlLkVudW1SdWxlc0gAEi8KCHJlcGVhdGVkGBIgASgLMhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXNIABIlCgNtYXAYEyABKAsyFi5idWYudmFsaWRhdGUuTWFwUnVsZXNIABIlCgNhbnkYFCABKAsyFi5idWYudmFsaWRhdGUuQW55UnVsZXNIABIvCghkdXJhdGlvbhgVIAEoCzIbLmJ1Zi52YWxpZGF0ZS5EdXJhdGlvblJ1bGVzSAASMgoKZmllbGRfbWFzaxgcIAEoCzIcLmJ1Zi52YWxpZGF0ZS5GaWVsZE1hc2tSdWxlc0gAEjEKCXRpbWVzdGFtcBgWIAEoCzIcLmJ1Zi52YWxpZGF0ZS5UaW1lc3RhbXBSdWxlc0gAQgYKBHR5cGVKBAgYEBlKBAgaEBtSB3NraXBwZWRSDGlnbm9yZV9lbXB0eSJVCg9QcmVkZWZpbmVkUnVsZXMSHwoDY2VsGAEgAygLMhIuYnVmLnZhbGlkYXRlLlJ1bGVKBAgYEBlKBAgaEBtSB3NraXBwZWRSDGlnbm9yZV9lbXB0eSL4FgoKRmxvYXRSdWxlcxJ9CgVjb25zdBgBIAEoAkJuwkhrCmkKC2Zsb2F0LmNvbnN0Glp0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICdtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSmQEKAmx0GAIgASgCQooBwkiGAQqDAQoIZmxvYXQubHQadyFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPj0gcnVsZXMubHQpPyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASqQEKA2x0ZRgDIAEoAkKZAcJIlQEKkgEKCWZsb2F0Lmx0ZRqEASFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUpPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEtAHCgJndBgEIAEoAkLBB8JIvQcKhgEKCGZsb2F0Lmd0GnohaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwq9AQoLZmxvYXQuZ3RfbHQarQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrHAQoVZmxvYXQuZ3RfbHRfZXhjbHVzaXZlGq0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKzQEKDGZsb2F0Lmd0X2x0ZRq8AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCtcBChZmbG9hdC5ndF9sdGVfZXhjbHVzaXZlGrwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARKcCAoDZ3RlGAUgASgCQowIwkiICAqVAQoJZmxvYXQuZ3RlGocBIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCswBCgxmbG9hdC5ndGVfbHQauwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCtYBChZmbG9hdC5ndGVfbHRfZXhjbHVzaXZlGrsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrcAQoNZmxvYXQuZ3RlX2x0ZRrKAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK5gEKF2Zsb2F0Lmd0ZV9sdGVfZXhjbHVzaXZlGsoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEnkKAmluGAYgAygCQm3CSGoKaAoIZmxvYXQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnAKBm5vdF9pbhgHIAMoAkJgwkhdClsKDGZsb2F0Lm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEm8KBmZpbml0ZRgIIAEoCEJfwkhcCloKDGZsb2F0LmZpbml0ZRpKcnVsZXMuZmluaXRlID8gKHRoaXMuaXNOYW4oKSB8fCB0aGlzLmlzSW5mKCkgPyAnbXVzdCBiZSBmaW5pdGUnIDogJycpIDogJycSKwoHZXhhbXBsZRgJIAMoAkIawkgXChUKDWZsb2F0LmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIooXCgtEb3VibGVSdWxlcxJ+CgVjb25zdBgBIAEoAUJvwkhsCmoKDGRvdWJsZS5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEpoBCgJsdBgCIAEoAUKLAcJIhwEKhAEKCWRvdWJsZS5sdBp3IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+PSBydWxlcy5sdCk/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKqAQoDbHRlGAMgASgBQpoBwkiWAQqTAQoKZG91YmxlLmx0ZRqEASFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUpPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEtUHCgJndBgEIAEoAULGB8JIwgcKhwEKCWRvdWJsZS5ndBp6IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKvgEKDGRvdWJsZS5ndF9sdBqtAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCsgBChZkb3VibGUuZ3RfbHRfZXhjbHVzaXZlGq0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKzgEKDWRvdWJsZS5ndF9sdGUavAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrYAQoXZG91YmxlLmd0X2x0ZV9leGNsdXNpdmUavAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEqEICgNndGUYBSABKAFCkQjCSI0ICpYBCgpkb3VibGUuZ3RlGocBIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCs0BCg1kb3VibGUuZ3RlX2x0GrsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrXAQoXZG91YmxlLmd0ZV9sdF9leGNsdXNpdmUauwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCt0BCg5kb3VibGUuZ3RlX2x0ZRrKAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK5wEKGGRvdWJsZS5ndGVfbHRlX2V4Y2x1c2l2ZRrKAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ6CgJpbhgGIAMoAUJuwkhrCmkKCWRvdWJsZS5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAcgAygBQmHCSF4KXAoNZG91YmxlLm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEnAKBmZpbml0ZRgIIAEoCEJgwkhdClsKDWRvdWJsZS5maW5pdGUaSnJ1bGVzLmZpbml0ZSA/ICh0aGlzLmlzTmFuKCkgfHwgdGhpcy5pc0luZigpID8gJ211c3QgYmUgZmluaXRlJyA6ICcnKSA6ICcnEiwKB2V4YW1wbGUYCSADKAFCG8JIGAoWCg5kb3VibGUuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4isBQKCkludDMyUnVsZXMSfQoFY29uc3QYASABKAVCbsJIawppCgtpbnQzMi5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEoQBCgJsdBgCIAEoBUJ2wkhzCnEKCGludDMyLmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpUBCgNsdGUYAyABKAVChQHCSIEBCn8KCWludDMyLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAAS+QYKAmd0GAQgASgFQuoGwkjmBgp0CghpbnQzMi5ndBpoIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKrQEKC2ludDMyLmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq1AQoVaW50MzIuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvQEKDGludDMyLmd0X2x0ZRqsAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKxQEKFmludDMyLmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEsUHCgNndGUYBSABKAVCtQfCSLEHCoIBCglpbnQzMi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq8AQoMaW50MzIuZ3RlX2x0GqsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCsQBChZpbnQzMi5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrMAQoNaW50MzIuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrUAQoXaW50MzIuZ3RlX2x0ZV9leGNsdXNpdmUauAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESeQoCaW4YBiADKAVCbcJIagpoCghpbnQzMi5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScAoGbm90X2luGAcgAygFQmDCSF0KWwoMaW50MzIubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSKwoHZXhhbXBsZRgIIAMoBUIawkgXChUKDWludDMyLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIrAUCgpJbnQ2NFJ1bGVzEn0KBWNvbnN0GAEgASgDQm7CSGsKaQoLaW50NjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKEAQoCbHQYAiABKANCdsJIcwpxCghpbnQ2NC5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKVAQoDbHRlGAMgASgDQoUBwkiBAQp/CglpbnQ2NC5sdGUaciFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEvkGCgJndBgEIAEoA0LqBsJI5gYKdAoIaW50NjQuZ3QaaCFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCq0BCgtpbnQ2NC5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtQEKFWludDY0Lmd0X2x0X2V4Y2x1c2l2ZRqbAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr0BCgxpbnQ2NC5ndF9sdGUarAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCsUBChZpbnQ2NC5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLFBwoDZ3RlGAUgASgDQrUHwkixBwqCAQoJaW50NjQuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKvAEKDGludDY0Lmd0ZV9sdBqrAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrEAQoWaW50NjQuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzAEKDWludDY0Lmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK1AEKF2ludDY0Lmd0ZV9sdGVfZXhjbHVzaXZlGrgBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEnkKAmluGAYgAygDQm3CSGoKaAoIaW50NjQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnAKBm5vdF9pbhgHIAMoA0JgwkhdClsKDGludDY0Lm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEisKB2V4YW1wbGUYCSADKANCGsJIFwoVCg1pbnQ2NC5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiLCFAoLVUludDMyUnVsZXMSfgoFY29uc3QYASABKA1Cb8JIbApqCgx1aW50MzIuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKFAQoCbHQYAiABKA1Cd8JIdApyCgl1aW50MzIubHQaZSFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASlwEKA2x0ZRgDIAEoDUKHAcJIgwEKgAEKCnVpbnQzMi5sdGUaciFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEv4GCgJndBgEIAEoDULvBsJI6wYKdQoJdWludDMyLmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwquAQoMdWludDMyLmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq2AQoWdWludDMyLmd0X2x0X2V4Y2x1c2l2ZRqbAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr4BCg11aW50MzIuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrGAQoXdWludDMyLmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEsoHCgNndGUYBSABKA1CugfCSLYHCoMBCgp1aW50MzIuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKvQEKDXVpbnQzMi5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxQEKF3VpbnQzMi5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrNAQoOdWludDMyLmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK1QEKGHVpbnQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ6CgJpbhgGIAMoDUJuwkhrCmkKCXVpbnQzMi5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAcgAygNQmHCSF4KXAoNdWludDMyLm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEiwKB2V4YW1wbGUYCCADKA1CG8JIGAoWCg51aW50MzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4iwhQKC1VJbnQ2NFJ1bGVzEn4KBWNvbnN0GAEgASgEQm/CSGwKagoMdWludDY0LmNvbnN0Glp0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICdtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycShQEKAmx0GAIgASgEQnfCSHQKcgoJdWludDY0Lmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpcBCgNsdGUYAyABKARChwHCSIMBCoABCgp1aW50NjQubHRlGnIhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ211c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABL+BgoCZ3QYBCABKARC7wbCSOsGCnUKCXVpbnQ2NC5ndBpoIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKrgEKDHVpbnQ2NC5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtgEKFnVpbnQ2NC5ndF9sdF9leGNsdXNpdmUamwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq+AQoNdWludDY0Lmd0X2x0ZRqsAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKxgEKF3VpbnQ2NC5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLKBwoDZ3RlGAUgASgEQroHwki2BwqDAQoKdWludDY0Lmd0ZRp1IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCr0BCg11aW50NjQuZ3RlX2x0GqsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCsUBChd1aW50NjQuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzQEKDnVpbnQ2NC5ndGVfbHRlGroBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtUBChh1aW50NjQuZ3RlX2x0ZV9leGNsdXNpdmUauAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESegoCaW4YBiADKARCbsJIawppCgl1aW50NjQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnEKBm5vdF9pbhgHIAMoBEJhwkheClwKDXVpbnQ2NC5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIsCgdleGFtcGxlGAggAygEQhvCSBgKFgoOdWludDY0LmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIsIUCgtTSW50MzJSdWxlcxJ+CgVjb25zdBgBIAEoEUJvwkhsCmoKDHNpbnQzMi5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEoUBCgJsdBgCIAEoEUJ3wkh0CnIKCXNpbnQzMi5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKXAQoDbHRlGAMgASgRQocBwkiDAQqAAQoKc2ludDMyLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAAS/gYKAmd0GAQgASgRQu8GwkjrBgp1CglzaW50MzIuZ3QaaCFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCq4BCgxzaW50MzIuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrYBChZzaW50MzIuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvgEKDXNpbnQzMi5ndF9sdGUarAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCsYBChdzaW50MzIuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAESygcKA2d0ZRgFIAEoEUK6B8JItgcKgwEKCnNpbnQzMi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq9AQoNc2ludDMyLmd0ZV9sdBqrAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrFAQoXc2ludDMyLmd0ZV9sdF9leGNsdXNpdmUaqQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs0BCg5zaW50MzIuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrVAQoYc2ludDMyLmd0ZV9sdGVfZXhjbHVzaXZlGrgBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEnoKAmluGAYgAygRQm7CSGsKaQoJc2ludDMyLmluGlwhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJxCgZub3RfaW4YByADKBFCYcJIXgpcCg1zaW50MzIubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLAoHZXhhbXBsZRgIIAMoEUIbwkgYChYKDnNpbnQzMi5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiLCFAoLU0ludDY0UnVsZXMSfgoFY29uc3QYASABKBJCb8JIbApqCgxzaW50NjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKFAQoCbHQYAiABKBJCd8JIdApyCglzaW50NjQubHQaZSFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASlwEKA2x0ZRgDIAEoEkKHAcJIgwEKgAEKCnNpbnQ2NC5sdGUaciFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEv4GCgJndBgEIAEoEkLvBsJI6wYKdQoJc2ludDY0Lmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwquAQoMc2ludDY0Lmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq2AQoWc2ludDY0Lmd0X2x0X2V4Y2x1c2l2ZRqbAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr4BCg1zaW50NjQuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrGAQoXc2ludDY0Lmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEsoHCgNndGUYBSABKBJCugfCSLYHCoMBCgpzaW50NjQuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKvQEKDXNpbnQ2NC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxQEKF3NpbnQ2NC5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrNAQoOc2ludDY0Lmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK1QEKGHNpbnQ2NC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ6CgJpbhgGIAMoEkJuwkhrCmkKCXNpbnQ2NC5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAcgAygSQmHCSF4KXAoNc2ludDY0Lm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEiwKB2V4YW1wbGUYCCADKBJCG8JIGAoWCg5zaW50NjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i0xQKDEZpeGVkMzJSdWxlcxJ/CgVjb25zdBgBIAEoB0JwwkhtCmsKDWZpeGVkMzIuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKGAQoCbHQYAiABKAdCeMJIdQpzCgpmaXhlZDMyLmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpgBCgNsdGUYAyABKAdCiAHCSIQBCoEBCgtmaXhlZDMyLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASgwcKAmd0GAQgASgHQvQGwkjwBgp2CgpmaXhlZDMyLmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqvAQoNZml4ZWQzMi5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtwEKF2ZpeGVkMzIuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvwEKDmZpeGVkMzIuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrHAQoYZml4ZWQzMi5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLPBwoDZ3RlGAUgASgHQr8Hwki7BwqEAQoLZml4ZWQzMi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq+AQoOZml4ZWQzMi5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxgEKGGZpeGVkMzIuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzgEKD2ZpeGVkMzIuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrWAQoZZml4ZWQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ7CgJpbhgGIAMoB0JvwkhsCmoKCmZpeGVkMzIuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnIKBm5vdF9pbhgHIAMoB0JiwkhfCl0KDmZpeGVkMzIubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLQoHZXhhbXBsZRgIIAMoB0IcwkgZChcKD2ZpeGVkMzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i0xQKDEZpeGVkNjRSdWxlcxJ/CgVjb25zdBgBIAEoBkJwwkhtCmsKDWZpeGVkNjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKGAQoCbHQYAiABKAZCeMJIdQpzCgpmaXhlZDY0Lmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpgBCgNsdGUYAyABKAZCiAHCSIQBCoEBCgtmaXhlZDY0Lmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASgwcKAmd0GAQgASgGQvQGwkjwBgp2CgpmaXhlZDY0Lmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqvAQoNZml4ZWQ2NC5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtwEKF2ZpeGVkNjQuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvwEKDmZpeGVkNjQuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrHAQoYZml4ZWQ2NC5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLPBwoDZ3RlGAUgASgGQr8Hwki7BwqEAQoLZml4ZWQ2NC5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq+AQoOZml4ZWQ2NC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxgEKGGZpeGVkNjQuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzgEKD2ZpeGVkNjQuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrWAQoZZml4ZWQ2NC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ7CgJpbhgGIAMoBkJvwkhsCmoKCmZpeGVkNjQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnIKBm5vdF9pbhgHIAMoBkJiwkhfCl0KDmZpeGVkNjQubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLQoHZXhhbXBsZRgIIAMoBkIcwkgZChcKD2ZpeGVkNjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i5RQKDVNGaXhlZDMyUnVsZXMSgAEKBWNvbnN0GAEgASgPQnHCSG4KbAoOc2ZpeGVkMzIuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKHAQoCbHQYAiABKA9CecJIdgp0CgtzZml4ZWQzMi5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKZAQoDbHRlGAMgASgPQokBwkiFAQqCAQoMc2ZpeGVkMzIubHRlGnIhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ211c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKIBwoCZ3QYBCABKA9C+QbCSPUGCncKC3NmaXhlZDMyLmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqwAQoOc2ZpeGVkMzIuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrgBChhzZml4ZWQzMi5ndF9sdF9leGNsdXNpdmUamwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrAAQoPc2ZpeGVkMzIuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrIAQoZc2ZpeGVkMzIuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES1AcKA2d0ZRgFIAEoD0LEB8JIwAcKhQEKDHNmaXhlZDMyLmd0ZRp1IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCr8BCg9zZml4ZWQzMi5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxwEKGXNmaXhlZDMyLmd0ZV9sdF9leGNsdXNpdmUaqQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs8BChBzZml4ZWQzMi5ndGVfbHRlGroBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtcBChpzZml4ZWQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ8CgJpbhgGIAMoD0JwwkhtCmsKC3NmaXhlZDMyLmluGlwhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJzCgZub3RfaW4YByADKA9CY8JIYApeCg9zZml4ZWQzMi5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIuCgdleGFtcGxlGAggAygPQh3CSBoKGAoQc2ZpeGVkMzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i5RQKDVNGaXhlZDY0UnVsZXMSgAEKBWNvbnN0GAEgASgQQnHCSG4KbAoOc2ZpeGVkNjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKHAQoCbHQYAiABKBBCecJIdgp0CgtzZml4ZWQ2NC5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKZAQoDbHRlGAMgASgQQokBwkiFAQqCAQoMc2ZpeGVkNjQubHRlGnIhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ211c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKIBwoCZ3QYBCABKBBC+QbCSPUGCncKC3NmaXhlZDY0Lmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqwAQoOc2ZpeGVkNjQuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrgBChhzZml4ZWQ2NC5ndF9sdF9leGNsdXNpdmUamwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrAAQoPc2ZpeGVkNjQuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrIAQoZc2ZpeGVkNjQuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES1AcKA2d0ZRgFIAEoEELEB8JIwAcKhQEKDHNmaXhlZDY0Lmd0ZRp1IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCr8BCg9zZml4ZWQ2NC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxwEKGXNmaXhlZDY0Lmd0ZV9sdF9leGNsdXNpdmUaqQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs8BChBzZml4ZWQ2NC5ndGVfbHRlGroBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtcBChpzZml4ZWQ2NC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ8CgJpbhgGIAMoEEJwwkhtCmsKC3NmaXhlZDY0LmluGlwhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJzCgZub3RfaW4YByADKBBCY8JIYApeCg9zZml4ZWQ2NC5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIuCgdleGFtcGxlGAggAygQQh3CSBoKGAoQc2ZpeGVkNjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4iwAEKCUJvb2xSdWxlcxJ8CgVjb25zdBgBIAEoCEJtwkhqCmgKCmJvb2wuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxIqCgdleGFtcGxlGAIgAygIQhnCSBYKFAoMYm9vbC5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAIi6jwKC1N0cmluZ1J1bGVzEoABCgVjb25zdBgBIAEoCUJxwkhuCmwKDHN0cmluZy5jb25zdBpcdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCBgJXNgJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycScQoDbGVuGBMgASgEQmTCSGEKXwoKc3RyaW5nLmxlbhpRdWludCh0aGlzLnNpemUoKSkgIT0gcnVsZXMubGVuID8gJ211c3QgYmUgJXMgY2hhcmFjdGVycycuZm9ybWF0KFtydWxlcy5sZW5dKSA6ICcnEokBCgdtaW5fbGVuGAIgASgEQnjCSHUKcwoOc3RyaW5nLm1pbl9sZW4aYXVpbnQodGhpcy5zaXplKCkpIDwgcnVsZXMubWluX2xlbiA/ICdtdXN0IGJlIGF0IGxlYXN0ICVzIGNoYXJhY3RlcnMnLmZvcm1hdChbcnVsZXMubWluX2xlbl0pIDogJycSiAEKB21heF9sZW4YAyABKARCd8JIdApyCg5zdHJpbmcubWF4X2xlbhpgdWludCh0aGlzLnNpemUoKSkgPiBydWxlcy5tYXhfbGVuID8gJ211c3QgYmUgYXQgbW9zdCAlcyBjaGFyYWN0ZXJzJy5mb3JtYXQoW3J1bGVzLm1heF9sZW5dKSA6ICcnEosBCglsZW5fYnl0ZXMYFCABKARCeMJIdQpzChBzdHJpbmcubGVuX2J5dGVzGl91aW50KGJ5dGVzKHRoaXMpLnNpemUoKSkgIT0gcnVsZXMubGVuX2J5dGVzID8gJ211c3QgYmUgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubGVuX2J5dGVzXSkgOiAnJxKUAQoJbWluX2J5dGVzGAQgASgEQoABwkh9CnsKEHN0cmluZy5taW5fYnl0ZXMaZ3VpbnQoYnl0ZXModGhpcykuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9ieXRlcyA/ICdtdXN0IGJlIGF0IGxlYXN0ICVzIGJ5dGVzJy5mb3JtYXQoW3J1bGVzLm1pbl9ieXRlc10pIDogJycSkgEKCW1heF9ieXRlcxgFIAEoBEJ/wkh8CnoKEHN0cmluZy5tYXhfYnl0ZXMaZnVpbnQoYnl0ZXModGhpcykuc2l6ZSgpKSA+IHJ1bGVzLm1heF9ieXRlcyA/ICdtdXN0IGJlIGF0IG1vc3QgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubWF4X2J5dGVzXSkgOiAnJxKHAQoHcGF0dGVybhgGIAEoCUJ2wkhzCnEKDnN0cmluZy5wYXR0ZXJuGl8hdGhpcy5tYXRjaGVzKHJ1bGVzLnBhdHRlcm4pID8gJ2RvZXMgbm90IG1hdGNoIHJlZ2V4IHBhdHRlcm4gYCVzYCcuZm9ybWF0KFtydWxlcy5wYXR0ZXJuXSkgOiAnJxJ+CgZwcmVmaXgYByABKAlCbsJIawppCg1zdHJpbmcucHJlZml4GlghdGhpcy5zdGFydHNXaXRoKHJ1bGVzLnByZWZpeCkgPyAnZG9lcyBub3QgaGF2ZSBwcmVmaXggYCVzYCcuZm9ybWF0KFtydWxlcy5wcmVmaXhdKSA6ICcnEnwKBnN1ZmZpeBgIIAEoCUJswkhpCmcKDXN0cmluZy5zdWZmaXgaViF0aGlzLmVuZHNXaXRoKHJ1bGVzLnN1ZmZpeCkgPyAnZG9lcyBub3QgaGF2ZSBzdWZmaXggYCVzYCcuZm9ybWF0KFtydWxlcy5zdWZmaXhdKSA6ICcnEooBCghjb250YWlucxgJIAEoCUJ4wkh1CnMKD3N0cmluZy5jb250YWlucxpgIXRoaXMuY29udGFpbnMocnVsZXMuY29udGFpbnMpID8gJ2RvZXMgbm90IGNvbnRhaW4gc3Vic3RyaW5nIGAlc2AnLmZvcm1hdChbcnVsZXMuY29udGFpbnNdKSA6ICcnEpEBCgxub3RfY29udGFpbnMYFyABKAlCe8JIeAp2ChNzdHJpbmcubm90X2NvbnRhaW5zGl90aGlzLmNvbnRhaW5zKHJ1bGVzLm5vdF9jb250YWlucykgPyAnY29udGFpbnMgc3Vic3RyaW5nIGAlc2AnLmZvcm1hdChbcnVsZXMubm90X2NvbnRhaW5zXSkgOiAnJxJ6CgJpbhgKIAMoCUJuwkhrCmkKCXN0cmluZy5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAsgAygJQmHCSF4KXAoNc3RyaW5nLm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEtkBCgVlbWFpbBgMIAEoCELHAcJIwwEKWwoMc3RyaW5nLmVtYWlsEh1tdXN0IGJlIGEgdmFsaWQgZW1haWwgYWRkcmVzcxosIXJ1bGVzLmVtYWlsIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc0VtYWlsKCkKZAoSc3RyaW5nLmVtYWlsX2VtcHR5EjJ2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgZW1haWwgYWRkcmVzcxoaIXJ1bGVzLmVtYWlsIHx8IHRoaXMgIT0gJydIABLhAQoIaG9zdG5hbWUYDSABKAhCzAHCSMgBCl8KD3N0cmluZy5ob3N0bmFtZRIYbXVzdCBiZSBhIHZhbGlkIGhvc3RuYW1lGjIhcnVsZXMuaG9zdG5hbWUgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSG9zdG5hbWUoKQplChVzdHJpbmcuaG9zdG5hbWVfZW1wdHkSLXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBob3N0bmFtZRodIXJ1bGVzLmhvc3RuYW1lIHx8IHRoaXMgIT0gJydIABLBAQoCaXAYDiABKAhCsgHCSK4BCk8KCXN0cmluZy5pcBIabXVzdCBiZSBhIHZhbGlkIElQIGFkZHJlc3MaJiFydWxlcy5pcCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcCgpClsKD3N0cmluZy5pcF9lbXB0eRIvdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIGFkZHJlc3MaFyFydWxlcy5pcCB8fCB0aGlzICE9ICcnSAAS0AEKBGlwdjQYDyABKAhCvwHCSLsBClYKC3N0cmluZy5pcHY0EhxtdXN0IGJlIGEgdmFsaWQgSVB2NCBhZGRyZXNzGikhcnVsZXMuaXB2NCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcCg0KQphChFzdHJpbmcuaXB2NF9lbXB0eRIxdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjQgYWRkcmVzcxoZIXJ1bGVzLmlwdjQgfHwgdGhpcyAhPSAnJ0gAEtABCgRpcHY2GBAgASgIQr8Bwki7AQpWCgtzdHJpbmcuaXB2NhIcbXVzdCBiZSBhIHZhbGlkIElQdjYgYWRkcmVzcxopIXJ1bGVzLmlwdjYgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXAoNikKYQoRc3RyaW5nLmlwdjZfZW1wdHkSMXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBJUHY2IGFkZHJlc3MaGSFydWxlcy5pcHY2IHx8IHRoaXMgIT0gJydIABK5AQoDdXJpGBEgASgIQqkBwkilAQpLCgpzdHJpbmcudXJpEhNtdXN0IGJlIGEgdmFsaWQgVVJJGighcnVsZXMudXJpIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc1VyaSgpClYKEHN0cmluZy51cmlfZW1wdHkSKHZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBVUkkaGCFydWxlcy51cmkgfHwgdGhpcyAhPSAnJ0gAEmoKB3VyaV9yZWYYEiABKAhCV8JIVApSCg5zdHJpbmcudXJpX3JlZhIdbXVzdCBiZSBhIHZhbGlkIFVSSSBSZWZlcmVuY2UaISFydWxlcy51cmlfcmVmIHx8IHRoaXMuaXNVcmlSZWYoKUgAEokCCgdhZGRyZXNzGBUgASgIQvUBwkjxAQp7Cg5zdHJpbmcuYWRkcmVzcxInbXVzdCBiZSBhIHZhbGlkIGhvc3RuYW1lLCBvciBpcCBhZGRyZXNzGkAhcnVsZXMuYWRkcmVzcyB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNIb3N0bmFtZSgpIHx8IHRoaXMuaXNJcCgpCnIKFHN0cmluZy5hZGRyZXNzX2VtcHR5Ejx2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgaG9zdG5hbWUsIG9yIGlwIGFkZHJlc3MaHCFydWxlcy5hZGRyZXNzIHx8IHRoaXMgIT0gJydIABKSAgoEdXVpZBgWIAEoCEKBAsJI/QEKnwEKC3N0cmluZy51dWlkEhRtdXN0IGJlIGEgdmFsaWQgVVVJRBp6IXJ1bGVzLnV1aWQgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykKWQoRc3RyaW5nLnV1aWRfZW1wdHkSKXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBVVUlEGhkhcnVsZXMudXVpZCB8fCB0aGlzICE9ICcnSAAS6gEKBXR1dWlkGCEgASgIQtgBwkjUAQptCgxzdHJpbmcudHV1aWQSHG11c3QgYmUgYSB2YWxpZCB0cmltbWVkIFVVSUQaPyFydWxlcy50dXVpZCB8fCB0aGlzID09ICcnIHx8IHRoaXMubWF0Y2hlcygnXlswLTlhLWZBLUZdezMyfSQnKQpjChJzdHJpbmcudHV1aWRfZW1wdHkSMXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCB0cmltbWVkIFVVSUQaGiFydWxlcy50dXVpZCB8fCB0aGlzICE9ICcnSAASkAIKEWlwX3dpdGhfcHJlZml4bGVuGBogASgIQvIBwkjuAQpyChhzdHJpbmcuaXBfd2l0aF9wcmVmaXhsZW4SGW11c3QgYmUgYSB2YWxpZCBJUCBwcmVmaXgaOyFydWxlcy5pcF93aXRoX3ByZWZpeGxlbiB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCgpCngKHnN0cmluZy5pcF93aXRoX3ByZWZpeGxlbl9lbXB0eRIudmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIHByZWZpeBomIXJ1bGVzLmlwX3dpdGhfcHJlZml4bGVuIHx8IHRoaXMgIT0gJydIABLJAgoTaXB2NF93aXRoX3ByZWZpeGxlbhgbIAEoCEKpAsJIpQIKjQEKGnN0cmluZy5pcHY0X3dpdGhfcHJlZml4bGVuEi9tdXN0IGJlIGEgdmFsaWQgSVB2NCBhZGRyZXNzIHdpdGggcHJlZml4IGxlbmd0aBo+IXJ1bGVzLmlwdjRfd2l0aF9wcmVmaXhsZW4gfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXBQcmVmaXgoNCkKkgEKIHN0cmluZy5pcHY0X3dpdGhfcHJlZml4bGVuX2VtcHR5EkR2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBhZGRyZXNzIHdpdGggcHJlZml4IGxlbmd0aBooIXJ1bGVzLmlwdjRfd2l0aF9wcmVmaXhsZW4gfHwgdGhpcyAhPSAnJ0gAEskCChNpcHY2X3dpdGhfcHJlZml4bGVuGBwgASgIQqkCwkilAgqNAQoac3RyaW5nLmlwdjZfd2l0aF9wcmVmaXhsZW4SL211c3QgYmUgYSB2YWxpZCBJUHY2IGFkZHJlc3Mgd2l0aCBwcmVmaXggbGVuZ3RoGj4hcnVsZXMuaXB2Nl93aXRoX3ByZWZpeGxlbiB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCg2KQqSAQogc3RyaW5nLmlwdjZfd2l0aF9wcmVmaXhsZW5fZW1wdHkSRHZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBJUHY2IGFkZHJlc3Mgd2l0aCBwcmVmaXggbGVuZ3RoGighcnVsZXMuaXB2Nl93aXRoX3ByZWZpeGxlbiB8fCB0aGlzICE9ICcnSAAS7AEKCWlwX3ByZWZpeBgdIAEoCELWAcJI0gEKZgoQc3RyaW5nLmlwX3ByZWZpeBIZbXVzdCBiZSBhIHZhbGlkIElQIHByZWZpeBo3IXJ1bGVzLmlwX3ByZWZpeCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCh0cnVlKQpoChZzdHJpbmcuaXBfcHJlZml4X2VtcHR5Ei52YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVAgcHJlZml4Gh4hcnVsZXMuaXBfcHJlZml4IHx8IHRoaXMgIT0gJydIABL9AQoLaXB2NF9wcmVmaXgYHiABKAhC5QHCSOEBCm8KEnN0cmluZy5pcHY0X3ByZWZpeBIbbXVzdCBiZSBhIHZhbGlkIElQdjQgcHJlZml4GjwhcnVsZXMuaXB2NF9wcmVmaXggfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXBQcmVmaXgoNCwgdHJ1ZSkKbgoYc3RyaW5nLmlwdjRfcHJlZml4X2VtcHR5EjB2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBwcmVmaXgaICFydWxlcy5pcHY0X3ByZWZpeCB8fCB0aGlzICE9ICcnSAAS/QEKC2lwdjZfcHJlZml4GB8gASgIQuUBwkjhAQpvChJzdHJpbmcuaXB2Nl9wcmVmaXgSG211c3QgYmUgYSB2YWxpZCBJUHY2IHByZWZpeBo8IXJ1bGVzLmlwdjZfcHJlZml4IHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc0lwUHJlZml4KDYsIHRydWUpCm4KGHN0cmluZy5pcHY2X3ByZWZpeF9lbXB0eRIwdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjYgcHJlZml4GiAhcnVsZXMuaXB2Nl9wcmVmaXggfHwgdGhpcyAhPSAnJ0gAEq8CCg1ob3N0X2FuZF9wb3J0GCAgASgIQpUCwkiRAgqTAQoUc3RyaW5nLmhvc3RfYW5kX3BvcnQSO211c3QgYmUgYSB2YWxpZCBob3N0IChob3N0bmFtZSBvciBJUCBhZGRyZXNzKSBhbmQgcG9ydCBwYWlyGj4hcnVsZXMuaG9zdF9hbmRfcG9ydCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNIb3N0QW5kUG9ydCh0cnVlKQp5ChpzdHJpbmcuaG9zdF9hbmRfcG9ydF9lbXB0eRI3dmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIGhvc3QgYW5kIHBvcnQgcGFpchoiIXJ1bGVzLmhvc3RfYW5kX3BvcnQgfHwgdGhpcyAhPSAnJ0gAEu4BCgR1bGlkGCMgASgIQt0BwkjZAQp8CgtzdHJpbmcudWxpZBIUbXVzdCBiZSBhIHZhbGlkIFVMSUQaVyFydWxlcy51bGlkIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5tYXRjaGVzKCdeWzAtN11bMC05QS1ISktNTlAtVFYtWmEtaGprbW5wLXR2LXpdezI1fSQnKQpZChFzdHJpbmcudWxpZF9lbXB0eRIpdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIFVMSUQaGSFydWxlcy51bGlkIHx8IHRoaXMgIT0gJydIABLUAgoMcHJvdG9idWZfZnFuGCUgASgIQrsCwki3AgqvAQoTc3RyaW5nLnByb3RvYnVmX2ZxbhItbXVzdCBiZSBhIHZhbGlkIGZ1bGx5LXF1YWxpZmllZCBQcm90b2J1ZiBuYW1lGmkhcnVsZXMucHJvdG9idWZfZnFuIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5tYXRjaGVzKCdeW0EtWmEtel9dW0EtWmEtel8wLTldKihcXC5bQS1aYS16X11bQS1aYS16XzAtOV0qKSokJykKggEKGXN0cmluZy5wcm90b2J1Zl9mcW5fZW1wdHkSQnZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBmdWxseS1xdWFsaWZpZWQgUHJvdG9idWYgbmFtZRohIXJ1bGVzLnByb3RvYnVmX2ZxbiB8fCB0aGlzICE9ICcnSAASkQMKEHByb3RvYnVmX2RvdF9mcW4YJiABKAhC9ALCSPACCs0BChdzdHJpbmcucHJvdG9idWZfZG90X2ZxbhJAbXVzdCBiZSBhIHZhbGlkIGZ1bGx5LXF1YWxpZmllZCBQcm90b2J1ZiBuYW1lIHdpdGggYSBsZWFkaW5nIGRvdBpwIXJ1bGVzLnByb3RvYnVmX2RvdF9mcW4gfHwgdGhpcyA9PSAnJyB8fCB0aGlzLm1hdGNoZXMoJ15cXC5bQS1aYS16X11bQS1aYS16XzAtOV0qKFxcLltBLVphLXpfXVtBLVphLXpfMC05XSopKiQnKQqdAQodc3RyaW5nLnByb3RvYnVmX2RvdF9mcW5fZW1wdHkSVXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBmdWxseS1xdWFsaWZpZWQgUHJvdG9idWYgbmFtZSB3aXRoIGEgbGVhZGluZyBkb3QaJSFydWxlcy5wcm90b2J1Zl9kb3RfZnFuIHx8IHRoaXMgIT0gJydIABKcBQoQd2VsbF9rbm93bl9yZWdleBgYIAEoDjIYLmJ1Zi52YWxpZGF0ZS5Lbm93blJlZ2V4QuUEwkjhBArqAQojc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX25hbWUSIG11c3QgYmUgYSB2YWxpZCBIVFRQIGhlYWRlciBuYW1lGqABcnVsZXMud2VsbF9rbm93bl9yZWdleCAhPSAxIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5tYXRjaGVzKCFoYXMocnVsZXMuc3RyaWN0KSB8fCBydWxlcy5zdHJpY3QgPydeOj9bMC05YS16QS1aISMkJSZcJyorLS5eX3x+XHg2MF0rJCcgOideW15cdTAwMDBcdTAwMEFcdTAwMERdKyQnKQqNAQopc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX25hbWVfZW1wdHkSNXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBIVFRQIGhlYWRlciBuYW1lGilydWxlcy53ZWxsX2tub3duX3JlZ2V4ICE9IDEgfHwgdGhpcyAhPSAnJwrhAQokc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX3ZhbHVlEiFtdXN0IGJlIGEgdmFsaWQgSFRUUCBoZWFkZXIgdmFsdWUalQFydWxlcy53ZWxsX2tub3duX3JlZ2V4ICE9IDIgfHwgdGhpcy5tYXRjaGVzKCFoYXMocnVsZXMuc3RyaWN0KSB8fCBydWxlcy5zdHJpY3QgPydeW15cdTAwMDAtXHUwMDA4XHUwMDBBLVx1MDAxRlx1MDA3Rl0qJCcgOideW15cdTAwMDBcdTAwMEFcdTAwMERdKiQnKUgAEg4KBnN0cmljdBgZIAEoCBIsCgdleGFtcGxlGCIgAygJQhvCSBgKFgoOc3RyaW5nLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkIMCgp3ZWxsX2tub3duIt0RCgpCeXRlc1J1bGVzEnoKBWNvbnN0GAEgASgMQmvCSGgKZgoLYnl0ZXMuY29uc3QaV3RoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgYmUgJXgnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxJrCgNsZW4YDSABKARCXsJIWwpZCglieXRlcy5sZW4aTHVpbnQodGhpcy5zaXplKCkpICE9IHJ1bGVzLmxlbiA/ICdtdXN0IGJlICVzIGJ5dGVzJy5mb3JtYXQoW3J1bGVzLmxlbl0pIDogJycSgwEKB21pbl9sZW4YAiABKARCcsJIbwptCg1ieXRlcy5taW5fbGVuGlx1aW50KHRoaXMuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9sZW4gPyAnbXVzdCBiZSBhdCBsZWFzdCAlcyBieXRlcycuZm9ybWF0KFtydWxlcy5taW5fbGVuXSkgOiAnJxKCAQoHbWF4X2xlbhgDIAEoBEJxwkhuCmwKDWJ5dGVzLm1heF9sZW4aW3VpbnQodGhpcy5zaXplKCkpID4gcnVsZXMubWF4X2xlbiA/ICdtdXN0IGJlIGF0IG1vc3QgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubWF4X2xlbl0pIDogJycSigEKB3BhdHRlcm4YBCABKAlCecJIdgp0Cg1ieXRlcy5wYXR0ZXJuGmMhc3RyaW5nKHRoaXMpLm1hdGNoZXMocnVsZXMucGF0dGVybikgPyAnbXVzdCBtYXRjaCByZWdleCBwYXR0ZXJuIGAlc2AnLmZvcm1hdChbcnVsZXMucGF0dGVybl0pIDogJycSewoGcHJlZml4GAUgASgMQmvCSGgKZgoMYnl0ZXMucHJlZml4GlYhdGhpcy5zdGFydHNXaXRoKHJ1bGVzLnByZWZpeCkgPyAnZG9lcyBub3QgaGF2ZSBwcmVmaXggJXgnLmZvcm1hdChbcnVsZXMucHJlZml4XSkgOiAnJxJ5CgZzdWZmaXgYBiABKAxCacJIZgpkCgxieXRlcy5zdWZmaXgaVCF0aGlzLmVuZHNXaXRoKHJ1bGVzLnN1ZmZpeCkgPyAnZG9lcyBub3QgaGF2ZSBzdWZmaXggJXgnLmZvcm1hdChbcnVsZXMuc3VmZml4XSkgOiAnJxJ9Cghjb250YWlucxgHIAEoDEJrwkhoCmYKDmJ5dGVzLmNvbnRhaW5zGlQhdGhpcy5jb250YWlucyhydWxlcy5jb250YWlucykgPyAnZG9lcyBub3QgY29udGFpbiAleCcuZm9ybWF0KFtydWxlcy5jb250YWluc10pIDogJycSoQEKAmluGAggAygMQpQBwkiQAQqNAQoIYnl0ZXMuaW4agAFnZXRGaWVsZChydWxlcywgJ2luJykuc2l6ZSgpID4gMCAmJiAhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJwCgZub3RfaW4YCSADKAxCYMJIXQpbCgxieXRlcy5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxLlAQoCaXAYCiABKAhC1gHCSNIBCm4KCGJ5dGVzLmlwEhptdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcxpGIXJ1bGVzLmlwIHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gNCB8fCB0aGlzLnNpemUoKSA9PSAxNgpgCg5ieXRlcy5pcF9lbXB0eRIvdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIGFkZHJlc3MaHSFydWxlcy5pcCB8fCB0aGlzLnNpemUoKSAhPSAwSAAS3gEKBGlwdjQYCyABKAhCzQHCSMkBCl8KCmJ5dGVzLmlwdjQSHG11c3QgYmUgYSB2YWxpZCBJUHY0IGFkZHJlc3MaMyFydWxlcy5pcHY0IHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gNApmChBieXRlcy5pcHY0X2VtcHR5EjF2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBhZGRyZXNzGh8hcnVsZXMuaXB2NCB8fCB0aGlzLnNpemUoKSAhPSAwSAAS3wEKBGlwdjYYDCABKAhCzgHCSMoBCmAKCmJ5dGVzLmlwdjYSHG11c3QgYmUgYSB2YWxpZCBJUHY2IGFkZHJlc3MaNCFydWxlcy5pcHY2IHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gMTYKZgoQYnl0ZXMuaXB2Nl9lbXB0eRIxdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjYgYWRkcmVzcxofIXJ1bGVzLmlwdjYgfHwgdGhpcy5zaXplKCkgIT0gMEgAEs8BCgR1dWlkGA8gASgIQr4Bwki6AQpYCgpieXRlcy51dWlkEhRtdXN0IGJlIGEgdmFsaWQgVVVJRBo0IXJ1bGVzLnV1aWQgfHwgdGhpcy5zaXplKCkgPT0gMCB8fCB0aGlzLnNpemUoKSA9PSAxNgpeChBieXRlcy51dWlkX2VtcHR5Eil2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgVVVJRBofIXJ1bGVzLnV1aWQgfHwgdGhpcy5zaXplKCkgIT0gMEgAEisKB2V4YW1wbGUYDiADKAxCGsJIFwoVCg1ieXRlcy5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCDAoKd2VsbF9rbm93biLBAwoJRW51bVJ1bGVzEnwKBWNvbnN0GAEgASgFQm3CSGoKaAoKZW51bS5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEhQKDGRlZmluZWRfb25seRgCIAEoCBJ4CgJpbhgDIAMoBUJswkhpCmcKB2VudW0uaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEm8KBm5vdF9pbhgEIAMoBUJfwkhcCloKC2VudW0ubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSKgoHZXhhbXBsZRgFIAMoBUIZwkgWChQKDGVudW0uZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACIu0DCg1SZXBlYXRlZFJ1bGVzEpYBCgltaW5faXRlbXMYASABKARCggHCSH8KfQoScmVwZWF0ZWQubWluX2l0ZW1zGmd1aW50KHRoaXMuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9pdGVtcyA/ICdtdXN0IGNvbnRhaW4gYXQgbGVhc3QgJWQgaXRlbShzKScuZm9ybWF0KFtydWxlcy5taW5faXRlbXNdKSA6ICcnEpwBCgltYXhfaXRlbXMYAiABKARCiAHCSIQBCoEBChJyZXBlYXRlZC5tYXhfaXRlbXMaa3VpbnQodGhpcy5zaXplKCkpID4gcnVsZXMubWF4X2l0ZW1zID8gJ211c3QgY29udGFpbiBubyBtb3JlIHRoYW4gJXMgaXRlbShzKScuZm9ybWF0KFtydWxlcy5tYXhfaXRlbXNdKSA6ICcnEnAKBnVuaXF1ZRgDIAEoCEJgwkhdClsKD3JlcGVhdGVkLnVuaXF1ZRIocmVwZWF0ZWQgdmFsdWUgbXVzdCBjb250YWluIHVuaXF1ZSBpdGVtcxoeIXJ1bGVzLnVuaXF1ZSB8fCB0aGlzLnVuaXF1ZSgpEicKBWl0ZW1zGAQgASgLMhguYnVmLnZhbGlkYXRlLkZpZWxkUnVsZXMqCQjoBxCAgICAAiKKAwoITWFwUnVsZXMSjwEKCW1pbl9wYWlycxgBIAEoBEJ8wkh5CncKDW1hcC5taW5fcGFpcnMaZnVpbnQodGhpcy5zaXplKCkpIDwgcnVsZXMubWluX3BhaXJzID8gJ21hcCBtdXN0IGJlIGF0IGxlYXN0ICVkIGVudHJpZXMnLmZvcm1hdChbcnVsZXMubWluX3BhaXJzXSkgOiAnJxKOAQoJbWF4X3BhaXJzGAIgASgEQnvCSHgKdgoNbWFwLm1heF9wYWlycxpldWludCh0aGlzLnNpemUoKSkgPiBydWxlcy5tYXhfcGFpcnMgPyAnbWFwIG11c3QgYmUgYXQgbW9zdCAlZCBlbnRyaWVzJy5mb3JtYXQoW3J1bGVzLm1heF9wYWlyc10pIDogJycSJgoEa2V5cxgEIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GaWVsZFJ1bGVzEigKBnZhbHVlcxgFIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GaWVsZFJ1bGVzKgkI6AcQgICAgAIiJgoIQW55UnVsZXMSCgoCaW4YAiADKAkSDgoGbm90X2luGAMgAygJIr8WCg1EdXJhdGlvblJ1bGVzEpsBCgVjb25zdBgCIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkJxwkhuCmwKDmR1cmF0aW9uLmNvbnN0Glp0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICdtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSogEKAmx0GAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQnnCSHYKdAoLZHVyYXRpb24ubHQaZSFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAAStAEKA2x0ZRgEIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkKJAcJIhQEKggEKDGR1cmF0aW9uLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASowcKAmd0GAUgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQvkGwkj1Bgp3CgtkdXJhdGlvbi5ndBpoIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKsAEKDmR1cmF0aW9uLmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq4AQoYZHVyYXRpb24uZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKwAEKD2R1cmF0aW9uLmd0X2x0ZRqsAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKyAEKGWR1cmF0aW9uLmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEu8HCgNndGUYBiABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CxAfCSMAHCoUBCgxkdXJhdGlvbi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq/AQoPZHVyYXRpb24uZ3RlX2x0GqsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCscBChlkdXJhdGlvbi5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrPAQoQZHVyYXRpb24uZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrXAQoaZHVyYXRpb24uZ3RlX2x0ZV9leGNsdXNpdmUauAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESlwEKAmluGAcgAygLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQnDCSG0KawoLZHVyYXRpb24uaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEo4BCgZub3RfaW4YCCADKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CY8JIYApeCg9kdXJhdGlvbi5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxJJCgdleGFtcGxlGAkgAygLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQh3CSBoKGAoQZHVyYXRpb24uZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i6wUKDkZpZWxkTWFza1J1bGVzErkBCgVjb25zdBgBIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCjQHCSIkBCoYBChBmaWVsZF9tYXNrLmNvbnN0GnJ0aGlzLnBhdGhzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKS5wYXRocyA/ICdtdXN0IGVxdWFsIHBhdGhzICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKS5wYXRoc10pIDogJycS0wEKAmluGAIgAygJQsYBwkjCAQq/AQoNZmllbGRfbWFzay5pbhqtASF0aGlzLnBhdGhzLmFsbChwLCBwIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSB8fCBnZXRGaWVsZChydWxlcywgJ2luJykuZXhpc3RzKGYsIHAuc3RhcnRzV2l0aChmKycuJykpKSA/ICdtdXN0IG9ubHkgY29udGFpbiBwYXRocyBpbiAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEu0BCgZub3RfaW4YAyADKAlC3AHCSNgBCtUBChFmaWVsZF9tYXNrLm5vdF9pbhq/ASF0aGlzLnBhdGhzLmFsbChwLCAhKHAgaW4gZ2V0RmllbGQocnVsZXMsICdub3RfaW4nKSB8fCBnZXRGaWVsZChydWxlcywgJ25vdF9pbicpLmV4aXN0cyhmLCBwLnN0YXJ0c1dpdGgoZisnLicpKSkpID8gJ211c3Qgbm90IGNvbnRhaW4gYW55IHBhdGhzIGluICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnbm90X2luJyldKSA6ICcnEkwKB2V4YW1wbGUYBCADKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQh/CSBwKGgoSZmllbGRfbWFzay5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAIisBcKDlRpbWVzdGFtcFJ1bGVzEp0BCgVjb25zdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCcsJIbwptCg90aW1lc3RhbXAuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKkAQoCbHQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQnrCSHcKdQoMdGltZXN0YW1wLmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAErYBCgNsdGUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQooBwkiGAQqDAQoNdGltZXN0YW1wLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASZgoGbHRfbm93GAcgASgIQlTCSFEKTwoQdGltZXN0YW1wLmx0X25vdxo7KHJ1bGVzLmx0X25vdyAmJiB0aGlzID4gbm93KSA/ICdtdXN0IGJlIGxlc3MgdGhhbiBub3cnIDogJydIABKpBwoCZ3QYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQv4Gwkj6Bgp4Cgx0aW1lc3RhbXAuZ3QaaCFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCrEBCg90aW1lc3RhbXAuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrkBChl0aW1lc3RhbXAuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKwQEKEHRpbWVzdGFtcC5ndF9sdGUarAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCskBChp0aW1lc3RhbXAuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES9QcKA2d0ZRgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCyQfCSMUHCoYBCg10aW1lc3RhbXAuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKwAEKEHRpbWVzdGFtcC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKyAEKGnRpbWVzdGFtcC5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrQAQoRdGltZXN0YW1wLmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK2AEKG3RpbWVzdGFtcC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJpCgZndF9ub3cYCCABKAhCV8JIVApSChB0aW1lc3RhbXAuZ3Rfbm93Gj4ocnVsZXMuZ3Rfbm93ICYmIHRoaXMgPCBub3cpID8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG5vdycgOiAnJ0gBErEBCgZ3aXRoaW4YCSABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25ChQHCSIEBCn8KEHRpbWVzdGFtcC53aXRoaW4aa3RoaXMgPCBub3ctcnVsZXMud2l0aGluIHx8IHRoaXMgPiBub3crcnVsZXMud2l0aGluID8gJ211c3QgYmUgd2l0aGluICVzIG9mIG5vdycuZm9ybWF0KFtydWxlcy53aXRoaW5dKSA6ICcnEksKB2V4YW1wbGUYCiADKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQh7CSBsKGQoRdGltZXN0YW1wLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIjkKClZpb2xhdGlvbnMSKwoKdmlvbGF0aW9ucxgBIAMoCzIXLmJ1Zi52YWxpZGF0ZS5WaW9sYXRpb24inwEKCVZpb2xhdGlvbhImCgVmaWVsZBgFIAEoCzIXLmJ1Zi52YWxpZGF0ZS5GaWVsZFBhdGgSJQoEcnVsZRgGIAEoCzIXLmJ1Zi52YWxpZGF0ZS5GaWVsZFBhdGgSDwoHcnVsZV9pZBgCIAEoCRIPCgdtZXNzYWdlGAMgASgJEg8KB2Zvcl9rZXkYBCABKAhKBAgBEAJSCmZpZWxkX3BhdGgiPQoJRmllbGRQYXRoEjAKCGVsZW1lbnRzGAEgAygLMh4uYnVmLnZhbGlkYXRlLkZpZWxkUGF0aEVsZW1lbnQi6QIKEEZpZWxkUGF0aEVsZW1lbnQSFAoMZmllbGRfbnVtYmVyGAEgASgFEhIKCmZpZWxkX25hbWUYAiABKAkSPgoKZmllbGRfdHlwZRgDIAEoDjIqLmdvb2dsZS5wcm90b2J1Zi5GaWVsZERlc2NyaXB0b3JQcm90by5UeXBlEjwKCGtleV90eXBlGAQgASgOMiouZ29vZ2xlLnByb3RvYnVmLkZpZWxkRGVzY3JpcHRvclByb3RvLlR5cGUSPgoKdmFsdWVfdHlwZRgFIAEoDjIqLmdvb2dsZS5wcm90b2J1Zi5GaWVsZERlc2NyaXB0b3JQcm90by5UeXBlEg8KBWluZGV4GAYgASgESAASEgoIYm9vbF9rZXkYByABKAhIABIRCgdpbnRfa2V5GAggASgDSAASEgoIdWludF9rZXkYCSABKARIABIUCgpzdHJpbmdfa2V5GAogASgJSABCCwoJc3Vic2NyaXB0KqEBCgZJZ25vcmUSFgoSSUdOT1JFX1VOU1BFQ0lGSUVEEAASGAoUSUdOT1JFX0lGX1pFUk9fVkFMVUUQARIRCg1JR05PUkVfQUxXQVlTEAMiBAgCEAIqDElHTk9SRV9FTVBUWSoOSUdOT1JFX0RFRkFVTFQqF0lHTk9SRV9JRl9ERUZBVUxUX1ZBTFVFKhVJR05PUkVfSUZfVU5QT1BVTEFURUQqbgoKS25vd25SZWdleBIbChdLTk9XTl9SRUdFWF9VTlNQRUNJRklFRBAAEiAKHEtOT1dOX1JFR0VYX0hUVFBfSEVBREVSX05BTUUQARIhCh1LTk9XTl9SRUdFWF9IVFRQX0hFQURFUl9WQUxVRRACOlYKB21lc3NhZ2USHy5nb29nbGUucHJvdG9idWYuTWVzc2FnZU9wdGlvbnMYhwkgASgLMhouYnVmLnZhbGlkYXRlLk1lc3NhZ2VSdWxlc1IHbWVzc2FnZTpOCgVvbmVvZhIdLmdvb2dsZS5wcm90b2J1Zi5PbmVvZk9wdGlvbnMYhwkgASgLMhguYnVmLnZhbGlkYXRlLk9uZW9mUnVsZXNSBW9uZW9mOk4KBWZpZWxkEh0uZ29vZ2xlLnByb3RvYnVmLkZpZWxkT3B0aW9ucxiHCSABKAsyGC5idWYudmFsaWRhdGUuRmllbGRSdWxlc1IFZmllbGQ6XQoKcHJlZGVmaW5lZBIdLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE9wdGlvbnMYiAkgASgLMh0uYnVmLnZhbGlkYXRlLlByZWRlZmluZWRSdWxlc1IKcHJlZGVmaW5lZEJuChJidWlsZC5idWYudmFsaWRhdGVCDVZhbGlkYXRlUHJvdG9QAVpHYnVmLmJ1aWxkL2dlbi9nby9idWZidWlsZC9wcm90b3ZhbGlkYXRlL3Byb3RvY29sYnVmZmVycy9nby9idWYvdmFsaWRhdGU",[file_google_protobuf_descriptor2,file_google_protobuf_duration2,file_google_protobuf_field_mask2,file_google_protobuf_timestamp2]),RuleSchema=messageDesc3(file_buf_validate_validate2,0);var FieldRulesSchema=messageDesc3(file_buf_validate_validate2,4);var FloatRulesSchema=messageDesc3(file_buf_validate_validate2,6),DoubleRulesSchema=messageDesc3(file_buf_validate_validate2,7),Int32RulesSchema=messageDesc3(file_buf_validate_validate2,8),Int64RulesSchema=messageDesc3(file_buf_validate_validate2,9),UInt32RulesSchema=messageDesc3(file_buf_validate_validate2,10),UInt64RulesSchema=messageDesc3(file_buf_validate_validate2,11),SInt32RulesSchema=messageDesc3(file_buf_validate_validate2,12),SInt64RulesSchema=messageDesc3(file_buf_validate_validate2,13),Fixed32RulesSchema=messageDesc3(file_buf_validate_validate2,14),Fixed64RulesSchema=messageDesc3(file_buf_validate_validate2,15),SFixed32RulesSchema=messageDesc3(file_buf_validate_validate2,16),SFixed64RulesSchema=messageDesc3(file_buf_validate_validate2,17),BoolRulesSchema=messageDesc3(file_buf_validate_validate2,18),StringRulesSchema=messageDesc3(file_buf_validate_validate2,19),BytesRulesSchema=messageDesc3(file_buf_validate_validate2,20),EnumRulesSchema=messageDesc3(file_buf_validate_validate2,21),RepeatedRulesSchema=messageDesc3(file_buf_validate_validate2,22),MapRulesSchema=messageDesc3(file_buf_validate_validate2,23),AnyRulesSchema=messageDesc3(file_buf_validate_validate2,24),DurationRulesSchema=messageDesc3(file_buf_validate_validate2,25),FieldMaskRulesSchema=messageDesc3(file_buf_validate_validate2,26),TimestampRulesSchema=messageDesc3(file_buf_validate_validate2,27);var ViolationSchema=messageDesc3(file_buf_validate_validate2,29),FieldPathSchema=messageDesc3(file_buf_validate_validate2,30),FieldPathElementSchema=messageDesc3(file_buf_validate_validate2,31),Ignore2;(function(Ignore3){Ignore3[Ignore3.UNSPECIFIED=0]="UNSPECIFIED",Ignore3[Ignore3.IF_ZERO_VALUE=1]="IF_ZERO_VALUE",Ignore3[Ignore3.ALWAYS=3]="ALWAYS"})(Ignore2||(Ignore2={}));var KnownRegex2;(function(KnownRegex3){KnownRegex3[KnownRegex3.UNSPECIFIED=0]="UNSPECIFIED",KnownRegex3[KnownRegex3.HTTP_HEADER_NAME=1]="HTTP_HEADER_NAME",KnownRegex3[KnownRegex3.HTTP_HEADER_VALUE=2]="HTTP_HEADER_VALUE"})(KnownRegex2||(KnownRegex2={}));var message=extDesc2(file_buf_validate_validate2,0),oneof=extDesc2(file_buf_validate_validate2,1),field=extDesc2(file_buf_validate_validate2,2),predefined=extDesc2(file_buf_validate_validate2,3);var CompilationError=class extends Error{constructor(message6,options){super(message6,options),this.name="CompilationError",Object.setPrototypeOf(this,new.target.prototype)}},RuntimeError=class extends Error{constructor(message6,options){super(message6,options),this.name="RuntimeError",Object.setPrototypeOf(this,new.target.prototype)}},ValidationError=class extends Error{constructor(violations){super(validationErrorMessage(violations)),this.name="ValidationError",Object.setPrototypeOf(this,new.target.prototype),this.violations=violations}};function validationErrorMessage(violations){return violations.length==0?"validation failed":violations.length==1?violations[0].toString():violations[0].toString()+`, and ${violations.length-1} more violation${violations.length>2?"s":""}`}var Violation=class{constructor(message6,ruleId,field2,rule,forKey){this.message=message6,this.ruleId=ruleId,this.field=field2,this.rule=rule,this.forKey=forKey}toString(){let path14=pathToString(this.field);return path14.length>0&&(path14+=": "),path14+`${this.message} [${this.ruleId}]`}};function violationToProto(violation){return[create2(ViolationSchema,{field:violation.field.length>0?pathToProto(violation.field):void 0,rule:violation.rule.length>0?pathToProto(violation.rule):void 0,ruleId:violation.ruleId,message:violation.message.length>0?violation.message:void 0,forKey:violation.forKey}),ViolationSchema]}function pathToProto(path14){let elements=[];for(let[i6,e6]of path14.entries())switch(e6.kind){case"field":elements.push(create2(FieldPathElementSchema,{fieldName:e6.name,fieldNumber:e6.number,fieldType:fieldType(e6)}));break;case"extension":elements.push(create2(FieldPathElementSchema,{fieldName:"["+e6.typeName+"]",fieldNumber:e6.number,fieldType:e6.proto.type}));break;case"oneof":elements.push(create2(FieldPathElementSchema,{fieldName:e6.name}));break;case"list_sub":{let prevProto=elements[elements.length-1];if(prevProto){let prevPath=path14[i6-1];prevProto.subscript=getListSub(e6.index,prevPath)}break}case"map_sub":{let prevProto=elements[elements.length-1];if(prevProto){let prevPath=path14[i6-1];setMapSub(prevProto,e6.key,prevPath)}break}}return create2(FieldPathSchema,{elements})}function fieldType(field2){return field2.fieldKind=="message"&&field2.delimitedEncoding?FieldDescriptorProto_Type2.GROUP:field2.proto.type}function getListSub(index2,prevPath){return prevPath?.kind=="field"&&prevPath.fieldKind=="list"?{case:"index",value:BigInt(index2)}:{case:void 0}}function setMapSub(proto2,key,prevPath){if(!(prevPath?.kind!="field"||prevPath.fieldKind!="map")){switch(proto2.keyType=prevPath.mapKey,prevPath.mapKind){case"scalar":proto2.valueType=prevPath.scalar;break;case"enum":proto2.valueType=FieldDescriptorProto_Type2.ENUM;break;case"message":proto2.valueType=FieldDescriptorProto_Type2.MESSAGE;break}switch(typeof key){case"boolean":prevPath.mapKey===ScalarType2.BOOL&&(proto2.subscript={case:"boolKey",value:key});break;case"string":prevPath.mapKey===ScalarType2.STRING&&(proto2.subscript={case:"stringKey",value:key});break;case"number":case"bigint":switch(prevPath.mapKey){case ScalarType2.INT32:case ScalarType2.SINT32:case ScalarType2.SFIXED32:case ScalarType2.INT64:case ScalarType2.SINT64:case ScalarType2.SFIXED64:proto2.subscript={case:"intKey",value:BigInt(key)};break;case ScalarType2.UINT32:case ScalarType2.FIXED32:case ScalarType2.UINT64:case ScalarType2.FIXED64:proto2.subscript={case:"uintKey",value:BigInt(key)};break}break}}}var Cursor=class _Cursor{static create(root5,failFast){return new _Cursor(root5,failFast,[],buildPath(root5))}constructor(root5,failFast,violations,builder2){this.root=root5,this.failFast=failFast,this.violations=violations,this.builder=builder2}get violated(){return this.violations.length>0}violate(message6,ruleId,rulePath,forMapKey=!1){this.violations.push(new Violation(message6,ruleId,this.builder.toPath(),rulePath,forMapKey)),this.failFast&&this.throwIfViolated()}throwIfViolated(){if(this.violated)throw new ValidationError(this.violations)}getPath(){return this.builder.toPath()}add(path14){return this.cloneWith(this.builder.clone().add(path14))}field(field2){return this.cloneWith(this.builder.clone().field(field2))}oneof(oneof2){return this.cloneWith(this.builder.clone().oneof(oneof2))}extension(ext){return this.cloneWith(this.builder.clone().extension(ext))}list(index2){return this.cloneWith(this.builder.clone().list(index2))}mapKey(key){return this.cloneWith(this.builder.clone().map(key))}cloneWith(path14){return new _Cursor(this.root,this.failFast,this.violations,path14)}};var EvalNoop=class _EvalNoop{static get(){return _EvalNoop.instance}eval(){}prune(){return!0}};EvalNoop.instance=new EvalNoop;var EvalMany=class{constructor(...evals){this.many=evals.flat()}add(...evals){return this.many.push(...evals),this}eval(val,cursor){for(let e6 of this.many)e6.eval(val,cursor)}prune(){return this.many=this.many.filter(e6=>!e6.prune()),this.many.length==0}},EvalListItems=class{constructor(condition,pass2){this.condition=condition,this.pass=pass2}eval(val,cursor){for(let i6=0;i6<val.size;i6++){let t=val.get(i6);this.condition.check(t)&&this.pass.eval(t,cursor.list(i6))}}prune(){return this.pass.prune()||this.condition.never}},EvalMapEntries=class{constructor(keyCondition,key,valueCondition,value){this.keyCondition=keyCondition,this.key=key,this.valueCondition=valueCondition,this.value=value}eval(val,cursor){if(!(this.keyCondition.never&&this.valueCondition.never))for(let[key,value]of val){let c5=cursor.mapKey(key);this.keyCondition.check(key)&&this.key.eval(key,c5),this.valueCondition.check(value)&&this.value.eval(value,c5)}}prune(){let key=this.key.prune()||this.keyCondition.never,value=this.value.prune()||this.valueCondition.never;return key&&value}},EvalField=class{constructor(field2,required,legacyRequired,condition,pass2){this.field=field2,this.required=required,this.legacyRequired=legacyRequired,this.condition=condition,this.pass=pass2}eval(val,cursor){if((this.required||this.legacyRequired)&&!val.isSet(this.field)){this.required?cursor.field(this.field).violate("value is required","required",[FieldRulesSchema.field.required]):cursor.field(this.field).violate("value is required","legacy_required",[]);return}if(this.condition.check(val)){let fieldVal=val.get(this.field);this.pass.eval(fieldVal,cursor.field(this.field))}}prune(){return this.condition.never&&!this.required&&!this.legacyRequired}},EvalOneofRequired=class{constructor(oneof2){this.oneof=oneof2}eval(val,cursor){this.oneof.fields.some(f5=>val.isSet(f5))||cursor.oneof(this.oneof).violate("exactly one field is required in oneof","required",[])}prune(){return!1}},EvalEnumDefinedOnly=class{constructor(descEnum,rulePath,rules){this.rulePath=rulePath,this.definedOnly=rules.definedOnly?new Set(descEnum.values.map(v=>v.number)):void 0}eval(val,cursor){this.definedOnly!==void 0&&!this.definedOnly.has(val)&&cursor.violate("value must be one of the defined enum values","enum.defined_only",this.rulePath.clone().field(EnumRulesSchema.field.definedOnly).toPath())}prune(){return this.definedOnly==null}},EvalAnyRules=class{constructor(rulePath,rules){this.rulePath=rulePath,this.in=rules.in,this.notIn=rules.notIn}eval(val,cursor){let any=val.message;this.in.length>0&&!this.in.includes(any.typeUrl)&&cursor.violate("type URL must be in the allow list","any.in",this.rulePath.clone().field(AnyRulesSchema.field.in).toPath()),this.notIn.length>0&&this.notIn.includes(any.typeUrl)&&cursor.violate("type URL must not be in the block list","any.not_in",this.rulePath.clone().field(AnyRulesSchema.field.notIn).toPath())}prune(){return this.in.length+this.notIn.length==0}},EvalMessageOneofRule=class{constructor(fields2,required){this.fields=fields2,this.required=required}eval(val,cursor){let setFields=this.fields.filter(field2=>val.isSet(field2));if(setFields.length>1){let oneofNames=this.fields.map(f5=>f5.name).join(", ");cursor.violate(`only one of ${oneofNames} can be set`,"message.oneof",[])}if(this.required&&setFields.length==0){let oneofNames=this.fields.map(f5=>f5.name).join(", ");cursor.violate(`one of ${oneofNames} must be set`,"message.oneof",[])}}prune(){return this.fields.length==0}};var messageToRuleType=new Map([[AnySchema.typeName,"any"],[DurationSchema.typeName,"duration"],[TimestampSchema.typeName,"timestamp"],[FloatValueSchema.typeName,"float"],[DoubleValueSchema.typeName,"double"],[Int32ValueSchema.typeName,"int32"],[Int64ValueSchema.typeName,"int64"],[UInt32ValueSchema.typeName,"uint32"],[UInt64ValueSchema.typeName,"uint64"],[BoolValueSchema.typeName,"bool"],[StringValueSchema.typeName,"string"],[FieldMaskSchema.typeName,"fieldMask"],[BytesValueSchema.typeName,"bytes"]]),scalarToRuleType=new Map([[ScalarType2.FLOAT,"float"],[ScalarType2.DOUBLE,"double"],[ScalarType2.INT32,"int32"],[ScalarType2.INT64,"int64"],[ScalarType2.UINT32,"uint32"],[ScalarType2.UINT64,"uint64"],[ScalarType2.SINT32,"sint32"],[ScalarType2.SINT64,"sint64"],[ScalarType2.FIXED32,"fixed32"],[ScalarType2.FIXED64,"fixed64"],[ScalarType2.SFIXED32,"sfixed32"],[ScalarType2.SFIXED64,"sfixed64"],[ScalarType2.BOOL,"bool"],[ScalarType2.STRING,"string"],[ScalarType2.BYTES,"bytes"]]),ruleMessageTypeToScalarType=new Map([[DoubleRulesSchema.typeName,ScalarType2.DOUBLE],[FloatRulesSchema.typeName,ScalarType2.FLOAT],[Int64RulesSchema.typeName,ScalarType2.INT64],[UInt64RulesSchema.typeName,ScalarType2.UINT64],[Int32RulesSchema.typeName,ScalarType2.INT32],[Fixed64RulesSchema.typeName,ScalarType2.FIXED64],[Fixed32RulesSchema.typeName,ScalarType2.FIXED32],[BoolRulesSchema.typeName,ScalarType2.BOOL],[BytesRulesSchema.typeName,ScalarType2.BYTES],[UInt32RulesSchema.typeName,ScalarType2.UINT32],[SFixed32RulesSchema.typeName,ScalarType2.SFIXED32],[SFixed64RulesSchema.typeName,ScalarType2.SFIXED64],[SInt32RulesSchema.typeName,ScalarType2.SINT32],[SInt64RulesSchema.typeName,ScalarType2.SINT64]]);function getRuleScalarType(rule){return ruleMessageTypeToScalarType.get(rule.$typeName)}function getRuleDescriptor(typeName){for(let d5 of[FloatRulesSchema,DoubleRulesSchema,Int32RulesSchema,Int64RulesSchema,UInt32RulesSchema,UInt64RulesSchema,SInt32RulesSchema,SInt64RulesSchema,Fixed32RulesSchema,Fixed64RulesSchema,SFixed32RulesSchema,SFixed64RulesSchema,BoolRulesSchema,StringRulesSchema,BytesRulesSchema,EnumRulesSchema,RepeatedRulesSchema,MapRulesSchema,AnyRulesSchema,DurationRulesSchema,FieldMaskRulesSchema,TimestampRulesSchema])if(typeName==d5.typeName)return d5;throw new Error(`unable to find descriptor for ${typeName}`)}function getListRules(rulePath,fieldRules,fieldContext){let listRules=getRulePath(rulePath,"repeated");return[getRules(fieldRules,"repeated",fieldContext),listRules,listRules.clone().field(RepeatedRulesSchema.field.items)]}function getMapRules(rulePath,fieldRules,fieldContext){let mapRules=getRulePath(rulePath,"map");return[getRules(fieldRules,"map",fieldContext),mapRules,mapRules.clone().field(MapRulesSchema.field.keys),mapRules.clone().field(MapRulesSchema.field.values)]}function getEnumRules(rulePath,fieldRules,fieldContext){return[getRules(fieldRules,"enum",fieldContext),getRulePath(rulePath,"enum")]}function getMessageRules(descMessage,rulePath,fieldRules,fieldContext){let type2=messageToRuleType.get(descMessage.typeName);return[getRules(fieldRules,type2,fieldContext),getRulePath(rulePath,type2)]}function getScalarRules(scalar,rulePath,fieldRules,fieldContext){let type2=scalarToRuleType.get(scalar);return[getRules(fieldRules,type2,fieldContext),getRulePath(rulePath,type2)]}function getRulePath(base,type2){if(type2==null)return base;let field2=FieldRulesSchema.field[type2];if(field2==null)throw new CompilationError(`cannot find rule "${type2}"`);return base.clone().field(field2)}function getRules(fieldRules,want,context2){let got=fieldRules?.type.case;if(!(fieldRules==null||got==null)){if(got!=want)throw new CompilationError(want==null?`rule "${got}" cannot be used on ${context2.toString()}`:`expected rule "${want}", got "${got}" on ${context2.toString()}`);return fieldRules.type.value}}var always={check(){return!0},always:!0,never:!1},never={check(){return!1},always:!1,never:!0};function ignoreListOrMapField(field2,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new FieldIsSet(field2);case Ignore2.ALWAYS:return never}}function ignoreMessageField(field2,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:case Ignore2.IF_ZERO_VALUE:return new FieldIsSet(field2);case Ignore2.ALWAYS:return never}}function ignoreScalarOrEnumField(field2,ignore){if(ignore==Ignore2.ALWAYS)return never;if(field2.presence==FeatureSet_FieldPresence2.IMPLICIT)switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new FieldIsSet(field2)}return new FieldIsSet(field2)}function ignoreEnumValue(enu,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new ScalarNot(ScalarType2.INT32,enu.values[0].number);case Ignore2.ALWAYS:return never}}function ignoreScalarValue(scalar,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new ScalarNot(scalar,scalarZeroValue2(scalar,!1));case Ignore2.ALWAYS:return never}}function ignoreMessageValue(ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:case Ignore2.IF_ZERO_VALUE:return always;case Ignore2.ALWAYS:return never}}var ScalarNot=class{constructor(scalar,not2){this.scalar=scalar,this.not=not2,this.always=!1,this.never=!1}check(val){return!scalarEquals(this.scalar,this.not,val)}},FieldIsSet=class{constructor(field2){this.field=field2,this.always=!1,this.never=!1}check(val){return val.isSet(this.field)}};var privateSymbol=Symbol.for("@bufbuild/cel/error");function celError(value,exprId){return isCelError(value)?value:(typeof exprId=="number"&&(exprId=BigInt(exprId)),value instanceof Error?new _CelError(value.message,value,exprId):typeof value=="string"?new _CelError(value,void 0,exprId):new _CelError(`${value}`,value,exprId))}function celErrorMerge(first,...rest){return new _CelError(first.message,rest,first.exprId)}function isCelError(v){return typeof v=="object"&&v!==null&&privateSymbol in v}var _CelError=class extends Error{_cause;_exprId;[privateSymbol]={};constructor(message6,_cause,_exprId){super(message6),this._cause=_cause,this._exprId=_exprId}get exprId(){return this._exprId}get cause(){return this._cause}};var privateSymbol2=Symbol.for("@bufbuild/cel/uint");function celUint(v){return new Uint(v)}function isCelUint(v){return typeof v=="object"&&v!==null&&privateSymbol2 in v}var Uint=class{_value;[privateSymbol2]={};constructor(_value){this._value=_value}get value(){return this._value}};function celFromScalar(type2,v){switch(type2){case ScalarType2.UINT32:case ScalarType2.UINT64:case ScalarType2.FIXED32:case ScalarType2.FIXED64:return celUint(BigInt(v));case ScalarType2.INT32:case ScalarType2.SINT32:case ScalarType2.SFIXED32:return BigInt(v);default:return v}}var privateSymbol3=Symbol.for("@bufbuild/cel/list");function celList(arrayOrReflectList){return isReflectList2(arrayOrReflectList)?new RepeatedFieldList(arrayOrReflectList):new ArrayList(arrayOrReflectList)}function celListConcat(...lists){return new ConcatList(lists)}function isCelList(v){return typeof v=="object"&&v!==null&&privateSymbol3 in v}var ArrayList=class{_array;[privateSymbol3]={};constructor(_array){this._array=_array}get size(){return this._array.length}get(index2){if(!(index2<0||index2>=this.size))return toCel(this._array[index2])}*values(){for(let element of this._array.values())yield toCel(element)}[Symbol.iterator](){return this.values()}},RepeatedFieldList=class{_list;[privateSymbol3]={};constructor(_list){this._list=_list}get size(){return this._list.size}get(index2){let val=this._list.get(index2);if(val!==void 0)return celFromListElem(this._list.field(),val)}*values(){for(let val of this._list)yield celFromListElem(this._list.field(),val)}[Symbol.iterator](){return this.values()}},ConcatList=class{_lists;[privateSymbol3]={};_size;constructor(_lists){this._lists=_lists;let size=0;for(let list11 of _lists)size+=list11.size;this._size=size}get size(){return this._size}get(index2){if(!(index2<0||index2>=this.size))for(let list11 of this._lists){if(index2<list11.size)return list11.get(index2);index2=index2-list11.size}}*values(){for(let list11 of this._lists)yield*list11.values()}[Symbol.iterator](){return this.values()}};function celFromListElem(desc,v){switch(desc.listKind){case"enum":return BigInt(v);case"message":return reflectMsgToCel(v);case"scalar":return celFromScalar(desc.scalar,v)}}var EMPTY_LIST=celList([]);var contextStack=[];function setEvalContext(context2){return contextStack.push(context2),()=>contextStack.pop()}function getEvalContext(){if(contextStack.length===0)throw new Error("cannot use `getEvalContext` outside of an evaluation");return contextStack[contextStack.length-1]}function withEvalContext(context2,next){return{id:next.id,eval(ctx){let unset=setEvalContext(context2);try{return next.eval(ctx)}finally{unset()}}}}function getMsgDesc(typeName){let schema2=getEvalContext().registry.getMessage(typeName);if(!schema2)throw new Error(`Message ${typeName} not found in registry`);return schema2}var privateSymbol4=Symbol.for("@bufbuild/cel/type"),CelScalar={INT:celScalarType("int"),UINT:celScalarType("uint"),BOOL:celScalarType("bool"),STRING:celScalarType("string"),BYTES:celScalarType("bytes"),DOUBLE:celScalarType("double"),NULL:celScalarType("null_type"),DYN:celScalarType("dyn"),TYPE:celScalarType("type")},TIMESTAMP=objectType(TimestampSchema),DURATION=objectType(DurationSchema);function mapType(key,value){return{[privateSymbol4]:{},kind:"map",key,value,name:"map",toString(){return`map(${key}, ${value})`}}}function listType(element){return{[privateSymbol4]:{},kind:"list",element,name:"list",toString(){return`list(${element})`}}}function objectType(descOrTypeName){let name,desc;return typeof descOrTypeName=="string"?(name=descOrTypeName,desc=void 0):(name=descOrTypeName.typeName,desc=descOrTypeName),{[privateSymbol4]:{},kind:"object",desc,name,toString(){return name}}}function celScalarType(scalar){return{[privateSymbol4]:{},kind:"scalar",scalar,name:scalar,toString(){return scalar}}}function celType(v){switch(typeof v){case"bigint":return CelScalar.INT;case"boolean":return CelScalar.BOOL;case"number":return CelScalar.DOUBLE;case"string":return CelScalar.STRING;case"object":switch(!0){case v===null:return CelScalar.NULL;case v instanceof Uint8Array:return CelScalar.BYTES;case isReflectMessage2(v):return celTypeOfMessage(v);case isCelList(v):return listType(CelScalar.DYN);case isCelMap(v):return mapType(CelScalar.DYN,CelScalar.DYN);case isCelUint(v):return CelScalar.UINT;default:if(isObjectCelType(v))return CelScalar.TYPE}}throw new Error(`Not a CEL value: ${v}`)}function isCelType(v){return typeof v=="object"&&v!==null&&isObjectCelType(v)}function isObjectCelType(v){return privateSymbol4 in v}function celTypeOfMessage(v){let typeName=v.desc.typeName;if(isReflectMessageAny(v)&&(typeName=typeUrlToName2(v.message.typeUrl),typeName===ValueSchema.typeName)){let value=anyUnpack(v.message,ValueSchema);return value?valueToType(value):CelScalar.NULL}switch(typeName){case FloatValueSchema.typeName:case DoubleValueSchema.typeName:return CelScalar.DOUBLE;case UInt64ValueSchema.typeName:case UInt32ValueSchema.typeName:return CelScalar.UINT;case Int32ValueSchema.typeName:case Int64ValueSchema.typeName:return CelScalar.INT;case StringValueSchema.typeName:return CelScalar.STRING;case BytesValueSchema.typeName:return CelScalar.BYTES;case BoolValueSchema.typeName:return CelScalar.BOOL;case StructSchema.typeName:return mapType(CelScalar.STRING,CelScalar.DYN);case ListValueSchema.typeName:return listType(CelScalar.DYN);case ValueSchema.typeName:return valueToType(v.message)}return typeName===v.desc.typeName?objectType(v.desc):objectType(typeName)}function valueToType(v){switch(v.kind.case){case"boolValue":return CelScalar.BOOL;case"listValue":return listType(CelScalar.DYN);case"nullValue":case void 0:return CelScalar.NULL;case"numberValue":return CelScalar.DOUBLE;case"stringValue":return CelScalar.STRING;case"structValue":return mapType(CelScalar.STRING,CelScalar.DYN)}}function isReflectMessageAny(v){return v.desc.typeName===AnySchema.typeName}function typeUrlToName2(url){let slash=url.lastIndexOf("/"),name=slash>=0?url.substring(slash+1):url;if(!name.length)throw new Error(`invalid type url: ${url}`);return name}function toCel(v){switch(typeof v){case"bigint":case"boolean":case"number":case"string":return v;case"object":break;default:throw new Error(`unsupported input ${typeof v}`)}switch(!0){case v===null:case v instanceof Uint8Array:case isCelList(v):case isCelMap(v):case isCelUint(v):case isCelType(v):return v}if(isArray(v)||isReflectList2(v))return celList(v);if(isMap(v)||isReflectMap2(v))return celMap(v);if(isMessage2(v)){let value=wktToCel(v);return value!==void 0?value:reflect2(getMsgDesc(v.$typeName),v)}if(isReflectMessage2(v))return reflectMsgToCel(v);if(v.constructor.name==="Object")return celMap(new Map(Object.entries(v)));throw new Error(`Unsupported input ${v}`)}function unwrapAny(v){if(!isReflectAny(v))return v;let unpacked=anyUnpack(v.message,getEvalContext().registry);if(unpacked===void 0)throw new Error(`invalid Any or ${v.message.typeUrl} not found in registry`);let value=wktToCel(unpacked);return value!==void 0?value:reflect2(getMsgDesc(unpacked.$typeName),unpacked)}function reflectMsgToCel(v){let value=wktToCel(v.message);return value!==void 0?value:v}function isReflectAny(v){return isReflectMessage2(v,AnySchema)}function isArray(v){return Array.isArray(v)}function isMap(v){return v instanceof Map}function wktToCel(msg){return isWrapper2(msg)?unwrapWrapper(msg):jsonWrapperToCel(msg)}function unwrapWrapper(v){switch(v.$typeName){case Int32ValueSchema.typeName:return BigInt(v.value);case UInt32ValueSchema.typeName:return celUint(BigInt(v.value));case UInt64ValueSchema.typeName:return celUint(v.value)}return v.value}function jsonWrapperToCel(msg){switch(!0){case isMessage2(msg,StructSchema):return structToCel(msg);case isMessage2(msg,ValueSchema):return valueToCel(msg);case isMessage2(msg,ListValueSchema):return listValueToCel(msg)}}function structToCel(s2){let map5=new Map;for(let[k5,v]of Object.entries(s2.fields))map5.set(k5,valueToCel(v));return celMap(map5)}function valueToCel(v){switch(v.kind.case){case"boolValue":case"numberValue":case"stringValue":return v.kind.value;case"nullValue":case void 0:return null;case"structValue":return structToCel(v.kind.value);case"listValue":return listValueToCel(v.kind.value)}}function listValueToCel(l3){return celList(l3.values)}var privateSymbol5=Symbol.for("@bufbuild/cel/map");function celMap(mapOrReflectMap){return isReflectMap2(mapOrReflectMap)?new ProtoMap(mapOrReflectMap):new NativeMap(mapOrReflectMap)}function isCelMap(v){return typeof v=="object"&&v!==null&&privateSymbol5 in v}var NativeMap=class{_map;[privateSymbol5]={};constructor(_map){this._map=_map}get size(){return this._map.size}get(key){if(isCelUint(key)&&(key=key.value),typeof key=="number"){if(!Number.isInteger(key))return;key=BigInt(key)}let value=this._map.get(key);if(value!==void 0)return toCel(value);if(typeof key=="bigint"){for(let mapKey of this._map.keys())if(isCelUint(mapKey)&&mapKey.value===key)return toCel(this._map.get(mapKey))}}has(key){return this.get(key)!=null}forEach(callback,thisArg){this._map.forEach((value,key,_)=>callback.call(thisArg,toCel(value),key,this))}*entries(){for(let[key,value]of this._map.entries())yield[key,toCel(value)]}keys(){return this._map.keys()}*values(){for(let value of this._map.values())yield toCel(value)}[Symbol.iterator](){return this.entries()}},ProtoMap=class{_map;[privateSymbol5]={};constructor(_map){this._map=_map}get size(){return this._map.size}get(key){let value=this._map.get(mapKeyFromCel(this._map.field(),key));if(value!==void 0)return celFromMapValue(this._map.field(),value)}has(key){return this._map.has(mapKeyFromCel(this._map.field(),key))}forEach(callback,thisArg){this._map.forEach((value,key,_)=>callback.call(thisArg,celFromMapValue(this._map.field(),value),celFromMapKey(this._map.field(),key),this))}*entries(){for(let[key,value]of this._map.entries())yield[celFromMapKey(this._map.field(),key),celFromMapValue(this._map.field(),value)]}*keys(){for(let key of this._map.keys())yield celFromMapKey(this._map.field(),key)}*values(){for(let value of this._map.keys())yield celFromMapValue(this._map.field(),value)}[Symbol.iterator](){return this.entries()}};function mapKeyFromCel(desc,v){switch(isCelUint(v)&&(v=v.value),desc.mapKey){case ScalarType2.SINT32:case ScalarType2.INT32:case ScalarType2.FIXED32:case ScalarType2.UINT32:case ScalarType2.SFIXED32:return typeof v=="bigint"?Number(v):v;case ScalarType2.SINT64:case ScalarType2.INT64:case ScalarType2.FIXED64:case ScalarType2.UINT64:case ScalarType2.SFIXED64:return v==="number"&&Number.isInteger(v)?BigInt(v):v;default:return v}}function celFromMapKey(desc,v){return celFromScalar(desc.mapKey,v)}function celFromMapValue(desc,v){switch(desc.mapKind){case"enum":return BigInt(v);case"message":return reflectMsgToCel(v);case"scalar":return celFromScalar(desc.scalar,v)}}var EMPTY_MAP=celMap(new Map);var wktRegistry=createRegistry(TimestampSchema,DurationSchema,AnySchema,file_google_protobuf_wrappers,file_google_protobuf_struct2);function createRegistryWithWKT(...inputs){return createRegistry(wktRegistry,...inputs)}var Namespace=class _Namespace{_name;_aliases;constructor(name=""){this._name=name,this._aliases=new Map}static ROOT=new _Namespace;name(){return this._name}aliases(){return this._aliases}resolveCandidateNames(name){if(name.startsWith(".")){let qn=name.substring(1),alias2=this.findAlias(qn);return alias2!==void 0?[alias2]:[qn]}let alias=this.findAlias(name);if(alias!==void 0)return[alias];if(this.name()==="")return[name];let nextCont=this.name(),candidates=[nextCont+"."+name];for(let i6=nextCont.lastIndexOf(".");i6>=0;i6=nextCont.lastIndexOf("."))nextCont=nextCont.substring(0,i6),candidates.push(nextCont+"."+name);return candidates.push(name),candidates}findAlias(name){let simple=name,qualifier="",dot=name.indexOf(".");dot>=0&&(simple=name.substring(0,dot),qualifier=name.substring(dot));let alias=this._aliases.get(simple);if(alias!==void 0)return alias+qualifier}};var privateSymbol6=Symbol.for("@bufbuild/cel/resolver");function createResolver(...inputs){let groups=new Map;for(let input of inputs){let funcs=isFuncResolver(input)||Array.isArray(input)?input:[input];for(let func of funcs){let group4=groups.get(func.name);group4===void 0&&(group4=[],groups.set(func.name,group4)),group4.push(func)}}return new Resolver(new Map(new Array(...groups.entries()).map(([name,funcs])=>[name,createFuncGroup(name,funcs)])))}function isFuncResolver(v){return typeof v=="object"&&v!==null&&privateSymbol6 in v}var Resolver=class{_groups;[privateSymbol6]={};constructor(_groups){this._groups=_groups}*[Symbol.iterator](){for(let group4 of this._groups.values())yield*group4}find(name){return this._groups.get(name)}};function createFuncGroup(name,funcs){let set2=[];for(let func of funcs){for(let i6=0;i6<set2.length;i6++)if(func.id===set2[i6].id){set2.splice(i6,1);break}set2.push(func)}return new Group(name,set2)}var Group=class{_name;_funcs;constructor(_name,_funcs){this._name=_name,this._funcs=_funcs}*[Symbol.iterator](){yield*this._funcs}get name(){return this._name}call(id,target,args){args=args.map(arg=>unwrapAny(arg));for(let func of this._funcs){let result=func.call(id,target,args);if(result!==void 0)return result}}};var CONDITIONAL="_?_:_";var EQUALS="_==_";var GREATER_EQUALS="_>=_";var INDEX="_[_]";var LESS_EQUALS="_<=_",LOGICAL_AND="_&&_";var LOGICAL_OR="_||_";var NOT_EQUALS="_!=_",NOT_STRICTLY_FALSE="@not_strictly_false";var OLD_NOT_STRICTLY_FALSE="__not_strictly_false__",OPT_INDEX="_[?_]",OPT_SELECT="_?._";var ONE_SECOND=1000000000n,MAX_DURATION_NANOS=9223372036854775807n,MIN_DURATION_NANOS=-9223372036854775808n;function createDuration(seconds=0n,ns=0n){let fullNanos=seconds*ONE_SECOND+BigInt(ns);if(fullNanos>MAX_DURATION_NANOS||fullNanos<MIN_DURATION_NANOS)throw new Error("duration out of range");return create2(DurationSchema,{seconds:fullNanos/ONE_SECOND,nanos:Number(fullNanos%ONE_SECOND)})}var DURATION_STRING_LENGTH_LIMIT=128,UNITS=Object.freeze({ns:1n,us:1000n,\u00B5s:1000n,ms:1000n*1000n,s:1000n*1000n*1000n,m:1000n*1000n*1000n*60n,h:1000n*1000n*1000n*60n*60n}),INT_REGEXP=/^\d+/,UNIT_REGEXP=new RegExp(`^(${Object.keys(UNITS).join("|")})`);function parseDuration(str2){if(str2.length>DURATION_STRING_LENGTH_LIMIT)throw badDurationStr(`duration string exceeds ${DURATION_STRING_LENGTH_LIMIT} characters`);if(/^[-+]?0$/.test(str2))return createDuration();let[sign3,values]=/^[+-]/.test(str2)?[str2[0]==="+"?1n:-1n,str2.slice(1)]:[1n,str2],fullNanos=0n,remainder=values;for(;remainder.length>0;){let int3=INT_REGEXP.exec(remainder)?.[0];remainder=remainder.slice(int3?.length??0),remainder[0]==="."&&(remainder=remainder.slice(1));let fraction=INT_REGEXP.exec(remainder)?.[0];remainder=remainder.slice(fraction?.length??0);let unit=UNIT_REGEXP.exec(remainder)?.[0];if(remainder=remainder.slice(unit?.length??0),(int3??fraction)===void 0||unit===void 0)throw badDurationStr("invalid syntax");let factor=UNITS[unit];fullNanos+=BigInt(int3??0)*factor,fullNanos+=BigInt(fraction??0)*factor/10n**BigInt(fraction?.length??0)}return createDuration(0n,sign3*fullNanos)}function badDurationStr(e6){return new Error(`Failed to parse duration: ${e6}`)}var MAX_TIMESTAMP_SECONDS=253402300799n,MIN_TIMESTAMP_SECONDS=-62135596800n,ONE_SECOND2=1000000000n;function createTimestamp(s2=0n,ns=0n){let fullNanos=s2*ONE_SECOND2+BigInt(ns),shift=fullNanos%ONE_SECOND2<0n?1n:0n,seconds=fullNanos/ONE_SECOND2-shift,nanos=Number(fullNanos%ONE_SECOND2+shift*ONE_SECOND2);if(seconds>MAX_TIMESTAMP_SECONDS||seconds<MIN_TIMESTAMP_SECONDS)throw new Error("timestamp out of range");return create2(TimestampSchema,{seconds,nanos})}function equals2(lhs,rhs){if(lhs===rhs)return!0;if(isCelUint(lhs)&&(lhs=lhs.value),isCelUint(rhs)&&(rhs=rhs.value),(typeof lhs=="number"||typeof lhs=="bigint")&&(typeof rhs=="number"||typeof rhs=="bigint"))return lhs==rhs;switch(!0){case lhs instanceof Uint8Array:return rhs instanceof Uint8Array&&equalsBytes(lhs,rhs);case isCelList(lhs):return isCelList(rhs)&&equalsList(lhs,rhs);case isCelMap(lhs):return isCelMap(rhs)&&equalsMap(lhs,rhs);case isCelType(lhs):return isCelType(rhs)&&equalsType(lhs,rhs)}return isReflectMessage2(lhs)?!isReflectMessage2(rhs)||lhs.desc.typeName!==rhs.desc.typeName?!1:equals(lhs.desc,lhs.message,rhs.message,{registry:getEvalContext().registry,unpackAny:!0,unknown:!0,extensions:!0}):!1}function equalsType(lhs,rhs){return lhs.kind===rhs.kind&&lhs.name===rhs.name}function equalsList(lhs,rhs){if(lhs.size!==rhs.size)return!1;for(let i6=0;i6<lhs.size;i6++)if(!equals2(lhs.get(i6),rhs.get(i6)))return!1;return!0}function equalsMap(lhs,rhs){if(lhs.size!==rhs.size)return!1;for(let[k5,v]of lhs){let rv=rhs.get(k5);if(rv===void 0||!equals2(v,rv))return!1}return!0}function equalsBytes(lhs,rhs){if(lhs.length!==rhs.length)return!1;for(let i6=0;i6<lhs.length;i6++)if(lhs[i6]!==rhs[i6])return!1;return!0}var privateSymbol7=Symbol.for("@bufbuild/cel/func");function celFunc(name,args,result,impl){return new Func(name,void 0,args,result,impl)}function celMethod(name,target,args,result,impl){return new Method(name,target,args,result,impl)}var Callable=class{_name;_target;_args;_result;_impl;_id;[privateSymbol7]={};constructor(_name,_target,_args,_result,_impl,_id=""){this._name=_name,this._target=_target,this._args=_args,this._result=_result,this._impl=_impl,this._id=_id}get id(){if(this._id===""){let qualifier=this.target?`${this.target.name}.`:"";this._id=`${qualifier}${this.name}(${this.arguments.map(p3=>p3.name).join(",")})`}return this._id}get name(){return this._name}get target(){return this._target}get arguments(){return this._args}get result(){return this._result}call(id,target,args){if(args.length==this.arguments.length){for(let i6=0;i6<args.length;i6++)if(!isSubtypeOf(args[i6],this.arguments[i6]))return;try{return toCel(this._impl.apply(target,args))}catch(ex){return celError(ex,id)}}}},Func=class extends Callable{call(id,target,args){if(target===void 0)return super.call(id,void 0,args)}},Method=class extends Callable{call(id,target,args){if(!(target===void 0||!isSubtypeOf(target,this.target)))return super.call(id,target,args)}};function isSubtypeOf(val,typ){return typ===CelScalar.DYN||equalsType(celType(val),typ)}var MAX_INT=9223372036854775807n,MIN_INT=-9223372036854775808n,MAX_UINT=18446744073709551615n;function safeInt(value,op2="type conversion"){let numeric=typeof value=="string"?BigInt(value):value;if(typeof numeric=="bigint"){if(numeric>=MIN_INT&&numeric<=MAX_INT)return numeric}else if(Number.isFinite(numeric)&&numeric>Number(MIN_INT)&&numeric<Number(MAX_INT))return BigInt(Math.trunc(numeric));throw celError(`int overflow during ${op2}`)}function safeUint(value,op2="type conversion"){let numeric=typeof value=="string"?BigInt(value):value;if(typeof numeric=="bigint"||Number.isFinite(numeric)){let int3=typeof numeric=="number"?BigInt(Math.trunc(numeric)):numeric;if(numeric>=0&&int3<=MAX_UINT)return celUint(int3)}throw celError(`uint overflow during ${op2}`)}function bytesConcat(l3,r5){let val=new Uint8Array(l3.length+r5.length);return val.set(l3),val.set(r5,l3.length),val}function timestampSum(l3,r5){return createTimestamp(l3.message.seconds+r5.message.seconds,l3.message.nanos+r5.message.nanos)}function durationSum(l3,r5){return createDuration(l3.message.seconds+r5.message.seconds,l3.message.nanos+r5.message.nanos)}function durationDifference(l3,r5){return createDuration(l3.message.seconds-r5.message.seconds,l3.message.nanos-r5.message.nanos)}function timestampDifference(l3,r5){return createTimestamp(l3.message.seconds-r5.message.seconds,l3.message.nanos-r5.message.nanos)}function safeDivide(type2,l3,r5){if(r5===0n)throw celError(`${type2.name} divide by zero`);return safeInt(l3/r5,`divide by ${r5}`)}function safeModulo(type2,l3,r5){if(r5===0n)throw celError(`${type2.name} modulus by zero`);return l3%r5}var LIST=listType(CelScalar.DYN),{BYTES,DOUBLE,INT,STRING,UINT}=CelScalar,math_default=[celFunc("_+_",[INT,INT],INT,(l3,r5)=>safeInt(l3+r5,"_+_")),celFunc("_+_",[UINT,UINT],UINT,(l3,r5)=>safeUint(l3.value+r5.value,"_+_")),celFunc("_+_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3+r5),celFunc("_+_",[DURATION,DURATION],DURATION,durationSum),celFunc("_+_",[TIMESTAMP,DURATION],TIMESTAMP,timestampSum),celFunc("_+_",[DURATION,TIMESTAMP],TIMESTAMP,timestampSum),celFunc("_+_",[STRING,STRING],STRING,(l3,r5)=>l3+r5),celFunc("_+_",[BYTES,BYTES],BYTES,bytesConcat),celFunc("_+_",[LIST,LIST],LIST,celListConcat),celFunc("_-_",[INT,INT],INT,(l3,r5)=>safeInt(l3-r5,"_-_")),celFunc("_-_",[UINT,UINT],UINT,(l3,r5)=>safeUint(l3.value-r5.value,"_-_")),celFunc("_-_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3-r5),celFunc("_-_",[TIMESTAMP,TIMESTAMP],DURATION,durationDifference),celFunc("_-_",[DURATION,DURATION],DURATION,durationDifference),celFunc("_-_",[TIMESTAMP,DURATION],TIMESTAMP,timestampDifference),celFunc("_*_",[INT,INT],INT,(l3,r5)=>safeInt(l3*r5,"_*_")),celFunc("_*_",[UINT,UINT],UINT,(l3,r5)=>safeUint(l3.value*r5.value,"_*_")),celFunc("_*_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3*r5),celFunc("_/_",[INT,INT],INT,(l3,r5)=>safeDivide(INT,l3,r5)),celFunc("_/_",[UINT,UINT],UINT,(l3,r5)=>celUint(safeDivide(UINT,l3.value,r5.value))),celFunc("_/_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3/r5),celFunc("_%_",[INT,INT],INT,(l3,r5)=>safeModulo(INT,l3,r5)),celFunc("_%_",[UINT,UINT],UINT,(l3,r5)=>celUint(safeModulo(UINT,l3.value,r5.value))),celFunc("-_",[INT],INT,x2=>safeInt(-x2)),celFunc("-_",[DOUBLE],DOUBLE,x2=>-x2)];var encoder=new TextEncoder,decoder=new TextDecoder(void 0,{fatal:!0});function stringToBool(x2){switch(x2){case"true":case"True":case"TRUE":case"t":case"1":return!0;case"false":case"False":case"FALSE":case"f":case"0":return!1}throw new Error(`Unable to convert string '${x2}' to bool`)}function bytesToString(x2){try{return decoder.decode(x2)}catch(e6){throw new Error(`Failed to decode bytes as string: ${e6}`)}}function stringToTimestamp(x2){try{return fromJson(TimestampSchema,x2)}catch(e6){throw new Error(`Failed to parse timestamp: ${e6}`)}}function toType(x2){return isMessage2(x2)?objectType(getMsgDesc(x2.$typeName)):celType(x2)}function identity(x2){return x2}var{BOOL,BYTES:BYTES2,DOUBLE:DOUBLE2,DYN,INT:INT2,STRING:STRING2,TYPE,UINT:UINT2}=CelScalar,cast_default=[celFunc("int",[INT2],INT2,identity),celFunc("int",[UINT2],INT2,x2=>safeInt(x2.value)),celFunc("int",[DOUBLE2],INT2,safeInt),celFunc("int",[STRING2],INT2,safeInt),celFunc("int",[TIMESTAMP],INT2,x2=>safeInt(x2.message.seconds)),celFunc("int",[DURATION],INT2,x2=>safeInt(x2.message.seconds)),celFunc("uint",[UINT2],UINT2,identity),celFunc("uint",[INT2],UINT2,safeUint),celFunc("uint",[DOUBLE2],UINT2,safeUint),celFunc("uint",[STRING2],UINT2,safeUint),celFunc("double",[DOUBLE2],DOUBLE2,identity),celFunc("double",[INT2],DOUBLE2,x2=>Number(x2)),celFunc("double",[UINT2],DOUBLE2,x2=>Number(x2.value)),celFunc("double",[STRING2],DOUBLE2,x2=>Number(x2)),celFunc("bool",[BOOL],BOOL,identity),celFunc("bool",[STRING2],BOOL,stringToBool),celFunc("bytes",[BYTES2],BYTES2,identity),celFunc("bytes",[STRING2],BYTES2,x2=>encoder.encode(x2)),celFunc("string",[STRING2],STRING2,identity),celFunc("string",[BOOL],STRING2,x2=>x2.toString()),celFunc("string",[INT2],STRING2,x2=>x2.toString()),celFunc("string",[UINT2],STRING2,x2=>x2.value.toString()),celFunc("string",[DOUBLE2],STRING2,x2=>x2.toString()),celFunc("string",[BYTES2],STRING2,bytesToString),celFunc("string",[TIMESTAMP],STRING2,x2=>toJson(TimestampSchema,x2.message)),celFunc("string",[DURATION],STRING2,x2=>toJson(DurationSchema,x2.message)),celFunc("timestamp",[TIMESTAMP],TIMESTAMP,identity),celFunc("timestamp",[STRING2],TIMESTAMP,stringToTimestamp),celFunc("timestamp",[INT2],TIMESTAMP,x2=>timestampFromMs(Number(x2))),celFunc("duration",[DURATION],DURATION,identity),celFunc("duration",[STRING2],DURATION,parseDuration),celFunc("duration",[INT2],DURATION,x2=>create2(DurationSchema,{seconds:x2})),celFunc("type",[DYN],TYPE,toType),celFunc("dyn",[DYN],DYN,identity)];var CONTAINS="contains";var ENDS_WITH="endsWith";var MATCHES="matches";var SIZE="size";var STARTS_WITH="startsWith";var TIME_GET_DATE="getDate",TIME_GET_DAY_OF_MONTH="getDayOfMonth",TIME_GET_DAY_OF_WEEK="getDayOfWeek",TIME_GET_DAY_OF_YEAR="getDayOfYear",TIME_GET_FULL_YEAR="getFullYear",TIME_GET_HOURS="getHours",TIME_GET_MILLISECONDS="getMilliseconds",TIME_GET_MINUTES="getMinutes",TIME_GET_MONTH="getMonth",TIME_GET_SECONDS="getSeconds";var invalidPatterns=[/\\[1-9]/,/\\k<.>/,/\(\?\=/,/\(\?\!/,/\(\?\<\=/,/\(\?\<\!/,/\\c[A-Z]/,/\\u[0-9a-fA-F]{4}/,/\\0(?!\d)/,/\[\\b.*\]/],flagPattern=new RegExp(/^\(\?(?<flags>[ims\-]+)\)/);function matches(pattern){for(let invalidPattern of invalidPatterns)if(invalidPattern.test(pattern))throw new Error(`Error evaluating pattern ${pattern}, invalid RE2 syntax`);let flags="",flagMatches=pattern.match(flagPattern);if(flagMatches){for(let flag of flagMatches?.groups?.flags??""){if(flag=="-")break;flags+=flag}pattern=pattern.substring(flagMatches[0].length)}return new RegExp(pattern,flags).test(this)}function compareDuration(lhs,rhs){let cmp=lhs.message.seconds-rhs.message.seconds;return cmp==0n?lhs.message.nanos-rhs.message.nanos:cmp<0n?-1:1}function compareTimestamp(lhs,rhs){let cmp=lhs.message.seconds-rhs.message.seconds;return cmp==0n?lhs.message.nanos-rhs.message.nanos:cmp<0n?-1:1}function compareBytes(lhs,rhs){let minLen=Math.min(lhs.length,rhs.length);for(let i6=0;i6<minLen;i6++){if(lhs[i6]<rhs[i6])return-1;if(lhs[i6]>rhs[i6])return 1}return lhs.length-rhs.length}function inList(value,list11){for(let v of list11)if(equals2(v,value))return!0;return!1}function inMap(value,map5){return map5.has(value)}var{BOOL:BOOL2,BYTES:BYTES3,DOUBLE:DOUBLE3,DYN:DYN2,INT:INT3,STRING:STRING3,UINT:UINT3}=CelScalar,LIST2=listType(CelScalar.DYN),MAP=mapType(CelScalar.DYN,CelScalar.DYN),logic_default=[celFunc("!_",[BOOL2],BOOL2,x2=>!x2),celFunc(EQUALS,[DYN2,DYN2],BOOL2,equals2),celFunc(NOT_EQUALS,[DYN2,DYN2],BOOL2,(l3,r5)=>!equals2(l3,r5)),celFunc("_<_",[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)<0),celFunc("_<_",[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[STRING3,STRING3],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[INT3,INT3],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[INT3,UINT3],BOOL2,(l3,r5)=>l3<r5.value),celFunc("_<_",[UINT3,INT3],BOOL2,(l3,r5)=>l3.value<r5),celFunc("_<_",[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value<r5.value),celFunc("_<_",[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)<r5),celFunc("_<_",[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3<Number(r5)),celFunc("_<_",[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3<Number(r5.value)),celFunc("_<_",[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)<r5),celFunc("_<_",[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)<0),celFunc("_<_",[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)<0),celFunc(LESS_EQUALS,[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)<=0),celFunc(LESS_EQUALS,[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[STRING3,STRING3],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[INT3,INT3],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[INT3,UINT3],BOOL2,(l3,r5)=>l3<=r5.value),celFunc(LESS_EQUALS,[UINT3,INT3],BOOL2,(l3,r5)=>l3.value<=r5),celFunc(LESS_EQUALS,[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value<=r5.value),celFunc(LESS_EQUALS,[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)<=r5),celFunc(LESS_EQUALS,[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3<=Number(r5)),celFunc(LESS_EQUALS,[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3<=Number(r5.value)),celFunc(LESS_EQUALS,[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)<=r5),celFunc(LESS_EQUALS,[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)<=0),celFunc(LESS_EQUALS,[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)<=0),celFunc("_>_",[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)>0),celFunc("_>_",[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[STRING3,STRING3],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[INT3,INT3],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[INT3,UINT3],BOOL2,(l3,r5)=>l3>r5.value),celFunc("_>_",[UINT3,INT3],BOOL2,(l3,r5)=>l3.value>r5),celFunc("_>_",[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value>r5.value),celFunc("_>_",[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)>r5),celFunc("_>_",[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3>Number(r5)),celFunc("_>_",[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3>Number(r5.value)),celFunc("_>_",[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)>r5),celFunc("_>_",[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)>0),celFunc("_>_",[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)>0),celFunc(GREATER_EQUALS,[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)>=0),celFunc(GREATER_EQUALS,[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[STRING3,STRING3],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[INT3,INT3],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[INT3,UINT3],BOOL2,(l3,r5)=>l3>=r5.value),celFunc(GREATER_EQUALS,[UINT3,INT3],BOOL2,(l3,r5)=>l3.value>=r5),celFunc(GREATER_EQUALS,[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value>=r5.value),celFunc(GREATER_EQUALS,[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)>=r5),celFunc(GREATER_EQUALS,[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3>=Number(r5)),celFunc(GREATER_EQUALS,[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3>=Number(r5.value)),celFunc(GREATER_EQUALS,[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)>=r5),celFunc(GREATER_EQUALS,[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)>=0),celFunc(GREATER_EQUALS,[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)>=0),celFunc(SIZE,[BYTES3],INT3,x2=>BigInt(x2.length)),celFunc(SIZE,[LIST2],INT3,x2=>BigInt(x2.size)),celFunc(SIZE,[STRING3],INT3,x2=>BigInt([...x2].length)),celFunc(SIZE,[MAP],INT3,x2=>BigInt(x2.size)),celMethod(SIZE,BYTES3,[],INT3,function(){return BigInt(this.length)}),celMethod(SIZE,LIST2,[],INT3,function(){return BigInt(this.size)}),celMethod(SIZE,STRING3,[],INT3,function(){return BigInt([...this].length)}),celMethod(SIZE,MAP,[],INT3,function(){return BigInt(this.size)}),celFunc("@in",[DYN2,LIST2],BOOL2,inList),celFunc("@in",[STRING3,MAP],BOOL2,inMap),celFunc("@in",[DOUBLE3,MAP],BOOL2,inMap),celFunc("@in",[INT3,MAP],BOOL2,inMap),celFunc("@in",[BOOL2,MAP],BOOL2,inMap),celFunc("@in",[UINT3,MAP],BOOL2,inMap),celMethod(CONTAINS,STRING3,[STRING3],BOOL2,String.prototype.includes),celMethod(ENDS_WITH,STRING3,[STRING3],BOOL2,String.prototype.endsWith),celMethod(STARTS_WITH,STRING3,[STRING3],BOOL2,String.prototype.startsWith),celMethod(MATCHES,STRING3,[STRING3],BOOL2,matches)];function getDayOfYear(date2){let start=new Date(0,0,1);start.setFullYear(date2.getFullYear());let diff=date2.getTime()-start.getTime(),oneDay=1e3*60*60*24;return Math.floor(diff/oneDay)}function convertToDate(msg,tz){let ts=msg.message,val=timestampDate(ts);if(tz===void 0)return new Date(val.getUTCFullYear(),val.getUTCMonth(),val.getUTCDate(),val.getUTCHours(),val.getUTCMinutes(),val.getUTCSeconds(),val.getUTCMilliseconds());let timeOffset=tz.match(/^(?<sign>[+-]?)(?<hours>\d\d):(?<minutes>\d\d)$/);if(timeOffset?.groups){let sign3=timeOffset.groups.sign=="-"?1:-1,hours=parseInt(timeOffset.groups.hours),minutes=parseInt(timeOffset.groups.minutes),offset=sign3*(hours*60*60*1e3+minutes*60*1e3);return val=new Date(val.getTime()-offset),new Date(val.getUTCFullYear(),val.getUTCMonth(),val.getUTCDate(),val.getUTCHours(),val.getUTCMinutes(),val.getUTCSeconds(),val.getUTCMilliseconds())}let format3=new Intl.DateTimeFormat("en-US",{hourCycle:"h23",hour12:!1,timeZone:tz,year:"numeric",month:"numeric",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit"}),year2,month,day,hour,minute,second;for(let part of format3.formatToParts(val))switch(part.type){case"year":year2=parseInt(part.value);break;case"month":month=parseInt(part.value)-1;break;case"day":day=parseInt(part.value);break;case"hour":hour=parseInt(part.value);break;case"minute":minute=parseInt(part.value);break;case"second":second=parseInt(part.value);break}if(year2===void 0||month===void 0||day===void 0||hour===void 0||minute===void 0||second===void 0)throw new Error(`Error converting ${toJson(TimestampSchema,ts)} to IANA timezone ${tz}`);return new Date(year2,month,day,hour,minute,second,val.getUTCMilliseconds())}var{STRING:STRING4,INT:INT4}=CelScalar;function celTimeMethods(name,func){function method(tz){let date2=convertToDate(this,tz),result=func(date2);try{return BigInt(result)}catch{throw new Error(`Error converting ${result} of ${String(date2)} of ${toJson(TimestampSchema,this.message)} to BigInt`)}}return[celMethod(name,TIMESTAMP,[],INT4,method),celMethod(name,TIMESTAMP,[STRING4],INT4,method)]}var time_default=[celMethod(TIME_GET_SECONDS,DURATION,[],INT4,function(){return this.message.seconds}),celMethod(TIME_GET_MINUTES,DURATION,[],INT4,function(){return this.message.seconds/60n}),celMethod(TIME_GET_HOURS,DURATION,[],INT4,function(){return this.message.seconds/3600n}),celMethod(TIME_GET_MILLISECONDS,DURATION,[],INT4,function(){return BigInt(this.message.nanos)/1000000n}),...celTimeMethods(TIME_GET_FULL_YEAR,x2=>x2.getFullYear()),...celTimeMethods(TIME_GET_MONTH,x2=>x2.getMonth()),...celTimeMethods(TIME_GET_DATE,x2=>x2.getDate()),...celTimeMethods(TIME_GET_DAY_OF_MONTH,x2=>x2.getDate()-1),...celTimeMethods(TIME_GET_DAY_OF_WEEK,x2=>x2.getDay()),...celTimeMethods(TIME_GET_DAY_OF_YEAR,x2=>getDayOfYear(x2)),...celTimeMethods(TIME_GET_SECONDS,x2=>x2.getSeconds()),...celTimeMethods(TIME_GET_MINUTES,x2=>x2.getMinutes()),...celTimeMethods(TIME_GET_HOURS,x2=>x2.getHours()),...celTimeMethods(TIME_GET_MILLISECONDS,x2=>x2.getMilliseconds())];var privateSymbol8=Symbol.for("@bufbuild/cel/env");function celEnv(options){return new _CelEnv(options?.namespace?new Namespace(options?.namespace):void 0,options?.registry?createRegistryWithWKT(options.registry):createRegistryWithWKT(),createResolver(math_default,cast_default,time_default,logic_default,options?.funcs??[]))}var _CelEnv=class{_namespace;_registry;_funcs;[privateSymbol8]={};constructor(_namespace,_registry,_funcs){this._namespace=_namespace,this._registry=_registry,this._funcs=_funcs}get namespace(){return this._namespace}get registry(){return this._registry}get funcs(){return this._funcs}};var file_cel_expr_syntax=fileDesc2("ChVjZWwvZXhwci9zeW50YXgucHJvdG8SCGNlbC5leHByIlUKClBhcnNlZEV4cHISHAoEZXhwchgCIAEoCzIOLmNlbC5leHByLkV4cHISKQoLc291cmNlX2luZm8YAyABKAsyFC5jZWwuZXhwci5Tb3VyY2VJbmZvItoICgRFeHByEgoKAmlkGAIgASgDEigKCmNvbnN0X2V4cHIYAyABKAsyEi5jZWwuZXhwci5Db25zdGFudEgAEioKCmlkZW50X2V4cHIYBCABKAsyFC5jZWwuZXhwci5FeHByLklkZW50SAASLAoLc2VsZWN0X2V4cHIYBSABKAsyFS5jZWwuZXhwci5FeHByLlNlbGVjdEgAEigKCWNhbGxfZXhwchgGIAEoCzITLmNlbC5leHByLkV4cHIuQ2FsbEgAEi4KCWxpc3RfZXhwchgHIAEoCzIZLmNlbC5leHByLkV4cHIuQ3JlYXRlTGlzdEgAEjIKC3N0cnVjdF9leHByGAggASgLMhsuY2VsLmV4cHIuRXhwci5DcmVhdGVTdHJ1Y3RIABI6ChJjb21wcmVoZW5zaW9uX2V4cHIYCSABKAsyHC5jZWwuZXhwci5FeHByLkNvbXByZWhlbnNpb25IABoVCgVJZGVudBIMCgRuYW1lGAEgASgJGksKBlNlbGVjdBIfCgdvcGVyYW5kGAEgASgLMg4uY2VsLmV4cHIuRXhwchINCgVmaWVsZBgCIAEoCRIRCgl0ZXN0X29ubHkYAyABKAgaVgoEQ2FsbBIeCgZ0YXJnZXQYASABKAsyDi5jZWwuZXhwci5FeHByEhAKCGZ1bmN0aW9uGAIgASgJEhwKBGFyZ3MYAyADKAsyDi5jZWwuZXhwci5FeHByGkgKCkNyZWF0ZUxpc3QSIAoIZWxlbWVudHMYASADKAsyDi5jZWwuZXhwci5FeHByEhgKEG9wdGlvbmFsX2luZGljZXMYAiADKAUa6QEKDENyZWF0ZVN0cnVjdBIUCgxtZXNzYWdlX25hbWUYASABKAkSMgoHZW50cmllcxgCIAMoCzIhLmNlbC5leHByLkV4cHIuQ3JlYXRlU3RydWN0LkVudHJ5Go4BCgVFbnRyeRIKCgJpZBgBIAEoAxITCglmaWVsZF9rZXkYAiABKAlIABIhCgdtYXBfa2V5GAMgASgLMg4uY2VsLmV4cHIuRXhwckgAEh0KBXZhbHVlGAQgASgLMg4uY2VsLmV4cHIuRXhwchIWCg5vcHRpb25hbF9lbnRyeRgFIAEoCEIKCghrZXlfa2luZBr4AQoNQ29tcHJlaGVuc2lvbhIQCghpdGVyX3ZhchgBIAEoCRIRCglpdGVyX3ZhcjIYCCABKAkSIgoKaXRlcl9yYW5nZRgCIAEoCzIOLmNlbC5leHByLkV4cHISEAoIYWNjdV92YXIYAyABKAkSIQoJYWNjdV9pbml0GAQgASgLMg4uY2VsLmV4cHIuRXhwchImCg5sb29wX2NvbmRpdGlvbhgFIAEoCzIOLmNlbC5leHByLkV4cHISIQoJbG9vcF9zdGVwGAYgASgLMg4uY2VsLmV4cHIuRXhwchIeCgZyZXN1bHQYByABKAsyDi5jZWwuZXhwci5FeHByQgsKCWV4cHJfa2luZCLNAgoIQ29uc3RhbnQSMAoKbnVsbF92YWx1ZRgBIAEoDjIaLmdvb2dsZS5wcm90b2J1Zi5OdWxsVmFsdWVIABIUCgpib29sX3ZhbHVlGAIgASgISAASFQoLaW50NjRfdmFsdWUYAyABKANIABIWCgx1aW50NjRfdmFsdWUYBCABKARIABIWCgxkb3VibGVfdmFsdWUYBSABKAFIABIWCgxzdHJpbmdfdmFsdWUYBiABKAlIABIVCgtieXRlc192YWx1ZRgHIAEoDEgAEjcKDmR1cmF0aW9uX3ZhbHVlGAggASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQgIYAUgAEjkKD3RpbWVzdGFtcF92YWx1ZRgJIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCAhgBSABCDwoNY29uc3RhbnRfa2luZCKcBQoKU291cmNlSW5mbxIWCg5zeW50YXhfdmVyc2lvbhgBIAEoCRIQCghsb2NhdGlvbhgCIAEoCRIUCgxsaW5lX29mZnNldHMYAyADKAUSNgoJcG9zaXRpb25zGAQgAygLMiMuY2VsLmV4cHIuU291cmNlSW5mby5Qb3NpdGlvbnNFbnRyeRI5CgttYWNyb19jYWxscxgFIAMoCzIkLmNlbC5leHByLlNvdXJjZUluZm8uTWFjcm9DYWxsc0VudHJ5EjIKCmV4dGVuc2lvbnMYBiADKAsyHi5jZWwuZXhwci5Tb3VyY2VJbmZvLkV4dGVuc2lvbhowCg5Qb3NpdGlvbnNFbnRyeRILCgNrZXkYASABKAMSDQoFdmFsdWUYAiABKAU6AjgBGkEKD01hY3JvQ2FsbHNFbnRyeRILCgNrZXkYASABKAMSHQoFdmFsdWUYAiABKAsyDi5jZWwuZXhwci5FeHByOgI4ARqxAgoJRXh0ZW5zaW9uEgoKAmlkGAEgASgJEkUKE2FmZmVjdGVkX2NvbXBvbmVudHMYAiADKA4yKC5jZWwuZXhwci5Tb3VyY2VJbmZvLkV4dGVuc2lvbi5Db21wb25lbnQSNwoHdmVyc2lvbhgDIAEoCzImLmNlbC5leHByLlNvdXJjZUluZm8uRXh0ZW5zaW9uLlZlcnNpb24aJwoHVmVyc2lvbhINCgVtYWpvchgBIAEoAxINCgVtaW5vchgCIAEoAyJvCglDb21wb25lbnQSGQoVQ09NUE9ORU5UX1VOU1BFQ0lGSUVEEAASFAoQQ09NUE9ORU5UX1BBUlNFUhABEhoKFkNPTVBPTkVOVF9UWVBFX0NIRUNLRVIQAhIVChFDT01QT05FTlRfUlVOVElNRRADQi4KDGRldi5jZWwuZXhwckILU3ludGF4UHJvdG9QAVoMY2VsLmRldi9leHBy+AEBYgZwcm90bzM",[file_google_protobuf_duration2,file_google_protobuf_struct2,file_google_protobuf_timestamp2]),ParsedExprSchema=messageDesc3(file_cel_expr_syntax,0),ExprSchema=messageDesc3(file_cel_expr_syntax,1);var SourceInfo_Extension_Component;(function(SourceInfo_Extension_Component2){SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.UNSPECIFIED=0]="UNSPECIFIED",SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.PARSER=1]="PARSER",SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.TYPE_CHECKER=2]="TYPE_CHECKER",SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.RUNTIME=3]="RUNTIME"})(SourceInfo_Extension_Component||(SourceInfo_Extension_Component={}));var LogicManager=class _LogicManager{builder;function;terms;ops;variadicASTs;constructor(builder2,functionName,term,variadicASTs){this.builder=builder2,this.function=functionName,this.terms=[term],this.ops=[],this.variadicASTs=variadicASTs}static newVariadicLogicManager(builder2,functionName,term){return new _LogicManager(builder2,functionName,term,!0)}static newBalancingLogicManager(builder2,functionName,term){return new _LogicManager(builder2,functionName,term,!1)}addTerm(op2,term){this.terms.push(term),this.ops.push(op2)}toExpr(){return this.terms.length===1?this.terms[0]:this.variadicASTs?this.builder.nextExpr(this.ops[0],{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:this.function,args:this.terms}}):this.balancedTree(0,this.ops.length-1)}balancedTree(lo,hi){let mid=Math.floor((lo+hi+1)/2),left;mid===lo?left=this.terms[mid]:left=this.balancedTree(lo,mid-1);let right;return mid===hi?right=this.terms[mid+1]:right=this.balancedTree(mid+1,hi),this.builder.nextExpr(this.ops[mid],{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:this.function,args:[left,right]}})}};var encoder2=new TextEncoder,accuVarName="@result",Builder=class{#prevId=0n;sourceInfo={$typeName:"cel.expr.SourceInfo",syntaxVersion:"",location:"",lineOffsets:[],positions:{},macroCalls:{},extensions:[]};nextExpr(offset,exprKind){return this.sourceInfo.positions[(++this.#prevId).toString()]=offset,{$typeName:"cel.expr.Expr",id:this.#prevId,exprKind}}nextEntry(offset,keyKind,value){return this.sourceInfo.positions[(++this.#prevId).toString()]=offset,{$typeName:"cel.expr.Expr.CreateStruct.Entry",id:this.#prevId,keyKind,value,optionalEntry:!1}}newConstExpr(offset,constantKind){return this.nextExpr(offset,{case:"constExpr",value:{$typeName:"cel.expr.Constant",constantKind}})}newCallExpr(offset,functionName,args){if(functionName==="has"&&args.length===1&&args[0].exprKind?.case==="selectExpr")return this.expandHasMacro(offset,args[0]);if((functionName==="_||_"||functionName==="_&&_")&&args.length>1){let logicManager=LogicManager.newBalancingLogicManager(this,functionName,args[0]);for(let i6=1;i6<args.length;i6+=1)logicManager.addTerm(offset,args[i6]);return logicManager.toExpr()}return this.nextExpr(offset,{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:functionName,args}})}newMemberCallExpr(offset,target,functionName,args){return this.maybeExpand(offset,this.nextExpr(offset,{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:functionName,target,args}}))}newStringExpr(offset,sequence){return this.newConstExpr(offset,{case:"stringValue",value:sequence.reduce((string,chunk)=>{if(typeof chunk!="string"){if(chunk.some(cp=>cp>=55296&&cp<57344))throw new Error("surrogate code points are not allowed");return string+String.fromCodePoint(...chunk)}return string+chunk},"")})}newBytesExpr(offset,sequence){let chunks=[],totalSize=0;for(let rawChunk of sequence){let chunk=typeof rawChunk=="string"?encoder2.encode(rawChunk):rawChunk;chunks.push(chunk),totalSize+=chunk.length}let value=new Uint8Array(totalSize),chunkOffset=0;for(let chunk of chunks)value.set(chunk,chunkOffset),chunkOffset+=chunk.length;return this.newConstExpr(offset,{case:"bytesValue",value})}newBoolExpr(offset,keyword){return this.newConstExpr(offset,{case:"boolValue",value:keyword==="true"})}newInt64Expr(offset,digits){return this.newConstExpr(offset,{case:"int64Value",value:digits[0]==="-"?-BigInt(digits.slice(1)):BigInt(digits)})}newUnsignedInt64Expr(offset,digits){return this.newConstExpr(offset,{case:"uint64Value",value:BigInt(digits)})}newDoubleExpr(offset,digits){return this.newConstExpr(offset,{case:"doubleValue",value:parseFloat(digits)})}newNullExpr(offset){return this.newConstExpr(offset,{case:"nullValue",value:0})}newIdentExpr(offset,name){return this.nextExpr(offset,{case:"identExpr",value:{$typeName:"cel.expr.Expr.Ident",name}})}newInfixExpr(offset,op2,args){return this.newCallExpr(offset,op2==="in"?"@in":`_${op2}_`,args)}newSelectExpr(offset,operand,field2){return this.nextExpr(offset,{case:"selectExpr",value:{$typeName:"cel.expr.Expr.Select",operand,field:field2,testOnly:!1}})}newIndexExpr(offset,operand,index2){return this.newCallExpr(offset,"_[_]",[operand,index2])}expandHasMacro(offset,target){return target.exprKind.case!=="selectExpr"?this.newCallExpr(offset,"has",[target]):(target.exprKind.value.testOnly=!0,target)}newListExpr(offset,elements){return this.nextExpr(offset,{case:"listExpr",value:{$typeName:"cel.expr.Expr.CreateList",elements,optionalIndices:[]}})}newBoolMacro(offset,iterRange,iterVar,init,loopStep,loopCondition){return this.nextExpr(offset,{case:"comprehensionExpr",value:{$typeName:"cel.expr.Expr.Comprehension",accuVar:accuVarName,accuInit:this.newConstExpr(offset,{case:"boolValue",value:init}),iterVar,iterVar2:"",iterRange,loopStep,loopCondition,result:this.newIdentExpr(offset,accuVarName)}})}newListMacro(offset,iterRange,iterVar,loopStep){return this.nextExpr(offset,{case:"comprehensionExpr",value:{$typeName:"cel.expr.Expr.Comprehension",accuVar:accuVarName,accuInit:this.newListExpr(offset,[]),iterVar,iterVar2:"",iterRange,loopCondition:this.newConstExpr(offset,{case:"boolValue",value:!0}),loopStep,result:this.newIdentExpr(offset,accuVarName)}})}expandExistsMacro(offset,target,x2,test){return this.newBoolMacro(offset,target,x2,!1,this.newCallExpr(offset,"_||_",[this.newIdentExpr(offset,accuVarName),test]),this.newCallExpr(offset,"@not_strictly_false",[this.newCallExpr(offset,"!_",[this.newIdentExpr(offset,accuVarName)])]))}expandAllMacro(offset,target,x2,test){return this.newBoolMacro(offset,target,x2,!0,this.newCallExpr(offset,"_&&_",[this.newIdentExpr(offset,accuVarName),test]),this.newCallExpr(offset,"@not_strictly_false",[this.newIdentExpr(offset,accuVarName)]))}expandMapMacro(offset,target,x2,step){return this.newListMacro(offset,target,x2,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newListExpr(offset,[step])]))}expandMapFilterMacro(offset,target,x2,test,step){return this.newListMacro(offset,target,x2,this.newCallExpr(offset,"_?_:_",[test,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newListExpr(offset,[step])]),this.newIdentExpr(offset,accuVarName)]))}expandFilterMacro(offset,target,x2,step){return this.newListMacro(offset,target,x2,this.newCallExpr(offset,"_?_:_",[step,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newListExpr(offset,[this.newIdentExpr(offset,x2)])]),this.newIdentExpr(offset,accuVarName)]))}expandExistsOne(offset,iterRange,iterVar,step){return this.nextExpr(offset,{case:"comprehensionExpr",value:{$typeName:"cel.expr.Expr.Comprehension",accuVar:accuVarName,accuInit:this.newConstExpr(offset,{case:"int64Value",value:BigInt(0)}),iterVar,iterVar2:"",iterRange,loopCondition:this.newConstExpr(offset,{case:"boolValue",value:!0}),loopStep:this.newCallExpr(offset,"_?_:_",[step,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newConstExpr(offset,{case:"int64Value",value:BigInt(1)})]),this.newIdentExpr(offset,accuVarName)]),result:this.newCallExpr(offset,"_==_",[this.newIdentExpr(offset,accuVarName),this.newConstExpr(offset,{case:"int64Value",value:BigInt(1)})])}})}maybeExpand(offset,call){if(call.exprKind.case==="callExpr"){let callExpr=call.exprKind.value,varName=callExpr.args[0];if(varName!==void 0&&call.exprKind.value.target!==void 0&&varName.exprKind?.case==="identExpr"){if(callExpr.args.length===2)switch(callExpr.function){case"exists":return this.expandExistsMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"all":return this.expandAllMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"map":return this.expandMapMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"filter":return this.expandFilterMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"exists_one":case"existsOne":return this.expandExistsOne(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1])}if(callExpr.args.length===3&&callExpr.function=="map")return this.expandMapFilterMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1],call.exprKind.value.args[2])}}return call}newMapEntry(offset,key,value){return this.nextEntry(offset,{case:"mapKey",value:key},value)}newStructExpr(offset,entries,messageName=""){return this.nextExpr(offset,{case:"structExpr",value:{$typeName:"cel.expr.Expr.CreateStruct",entries,messageName}})}newStructEntry(offset,field2,value){return this.nextEntry(offset,{case:"fieldKey",value:field2},value)}};var runtime;(function(runtime2){class GrammarLocation{source;start;constructor(source,start){this.source=source,this.start=start}toString(){return String(this.source)}offset(loc){return{line:loc.line+this.start.line-1,column:loc.line===1?loc.column+this.start.column-1:loc.column,offset:loc.offset+this.start.offset}}static offsetStart(range2){return range2.source instanceof GrammarLocation?range2.source.offset(range2.start):range2.start}static offsetEnd(range2){return range2.source instanceof GrammarLocation?range2.source.offset(range2.end):range2.end}}runtime2.GrammarLocation=GrammarLocation;function padEnd(str2,targetLength,padString){return padString=padString||" ",str2.length>targetLength?str2:(targetLength-=str2.length,padString+=padString.repeat(targetLength),str2+padString.slice(0,targetLength))}runtime2.padEnd=padEnd;class ParseFailure{}runtime2.ParseFailure=ParseFailure;function isFailure(r5){return!r5.success}runtime2.isFailure=isFailure;function getLine2(input,offset){let line=1;for(let i6=0;i6<offset;i6++)input[i6]==="\r"?(input[i6+1]===`
+caused by: ${_Layerr.fullStack(cause)}`:err2.stack??""}static info(err2){assertError(err2);let output={},cause=_Layerr.cause(err2);return cause&&Object.assign(output,_Layerr.info(cause)),err2._info&&Object.assign(output,err2._info),output}toString(){let output=this.name||this.constructor.name||this.constructor.prototype.name;return this.message&&(output=`${output}: ${this.message}`),output}};var ENCODING="0123456789ABCDEFGHJKMNPQRSTVWXYZ",ENCODING_LEN=32,TIME_MAX=0xffffffffffff,TIME_LEN=10,RANDOM_LEN=16,ERROR_INFO=Object.freeze({source:"ulid"});function detectPRNG(root5){let rootLookup=root5||detectRoot(),globalCrypto=rootLookup&&(rootLookup.crypto||rootLookup.msCrypto)||(typeof import_node_crypto.default<"u"?import_node_crypto.default:null);if(typeof globalCrypto?.getRandomValues=="function")return()=>{let buffer=new Uint8Array(1);return globalCrypto.getRandomValues(buffer),buffer[0]/255};if(typeof globalCrypto?.randomBytes=="function")return()=>globalCrypto.randomBytes(1).readUInt8()/255;if(import_node_crypto.default?.randomBytes)return()=>import_node_crypto.default.randomBytes(1).readUInt8()/255;throw new Layerr({info:{code:"PRNG_DETECT",...ERROR_INFO}},"Failed to find a reliable PRNG")}function detectRoot(){return inWebWorker()?self:typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:null}function encodeRandom(len,prng){let str2="";for(;len>0;len--)str2=randomChar(prng)+str2;return str2}function encodeTime(now,len){if(isNaN(now))throw new Layerr({info:{code:"ENC_TIME_NAN",...ERROR_INFO}},`Time must be a number: ${now}`);if(now>TIME_MAX)throw new Layerr({info:{code:"ENC_TIME_SIZE_EXCEED",...ERROR_INFO}},`Cannot encode a time larger than ${TIME_MAX}: ${now}`);if(now<0)throw new Layerr({info:{code:"ENC_TIME_NEG",...ERROR_INFO}},`Time must be positive: ${now}`);if(Number.isInteger(now)===!1)throw new Layerr({info:{code:"ENC_TIME_TYPE",...ERROR_INFO}},`Time must be an integer: ${now}`);let mod2,str2="";for(let currentLen=len;currentLen>0;currentLen--)mod2=now%ENCODING_LEN,str2=ENCODING.charAt(mod2)+str2,now=(now-mod2)/ENCODING_LEN;return str2}function inWebWorker(){return typeof WorkerGlobalScope<"u"&&self instanceof WorkerGlobalScope}function randomChar(prng){let rand=Math.floor(prng()*ENCODING_LEN);return rand===ENCODING_LEN&&(rand=ENCODING_LEN-1),ENCODING.charAt(rand)}function ulid(seedTime,prng){let currentPRNG=prng||detectPRNG(),seed=isNaN(seedTime)?Date.now():seedTime;return encodeTime(seed,TIME_LEN)+encodeRandom(RANDOM_LEN,currentPRNG)}function metadataOf(msg){return msg.metadata}function idValueOf(msg){let value=msg.value;return typeof value=="string"?value:""}function camelCaseFieldName(specField){return specField.replace(/_([a-z0-9])/g,(_,ch)=>ch.toUpperCase())}function parentIdOf(resource,specField){let spec=resource.spec;if(spec===void 0)return"";let value=spec[camelCaseFieldName(specField)];return typeof value=="string"?value:""}function messageFieldByName(msg,name){let field2=msg.fields.find(f5=>f5.name===name);return field2!==void 0&&field2.fieldKind==="message"?field2:void 0}function getStatusField(schema2,msg){let root5=reflect2(schema2,msg),field2=messageFieldByName(root5,"status");if(!(field2===void 0||!root5.isSet(field2)))return root5.get(field2)}function getOrCreateStatusField(schema2,msg){let root5=reflect2(schema2,msg),field2=messageFieldByName(root5,"status");if(field2!==void 0)return root5.isSet(field2)||root5.set(field2,reflect2(field2.message)),root5.get(field2)}function hasStatusField(schema2){return schema2.fields.some(f5=>f5.name==="status"&&f5.fieldKind==="message")}function newBuildNewStateStep(){return{name:"BuildNewState",execute(ctx){let resource=ctx.newState,metadata=metadataOf(resource);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"build new state");hasStatusField(ctx.schema)&&clearStatusField(ctx.schema,resource),metadata.id===""&&(metadata.id=generateId(getIdPrefix(ctx.apiResourceKind))),hasStatusField(ctx.schema)&&setAuditFieldsForCreate(ctx.schema,resource,ctx.callerIdentity),metadata.visibility===ApiResourceVisibility.api_resource_visibility_unspecified&&(metadata.visibility=defaultVisibilityFor(ctx.apiResourceKind))}}}function clearStatusField(schema2,msg){let root5=reflect2(schema2,msg),field2=root5.fields.find(f5=>f5.name==="status"&&f5.fieldKind==="message");field2!==void 0&&root5.isSet(field2)&&root5.clear(field2)}function setAuditFieldsForCreate(schema2,resource,identity2){let now=timestampNow(),actor=auditActorFor(identity2),info=create2(ApiResourceAuditInfoSchema,{createdBy:actor,createdAt:now,updatedBy:actor,updatedAt:now,event:"created"});setAuditReflect(schema2,resource,create2(ApiResourceAuditSchema,{specAudit:info,statusAudit:info}))}function setAuditFieldsForUpdate(schema2,resource,slot,identity2){let now=timestampNow(),actor=auditActorFor(identity2),{createdBy,createdAt}=creationAuditOf(schema2,resource,slot);setAuditSlotReflect(schema2,resource,slot,updatedAuditInfo(createdBy,createdAt,actor,now))}var operatorEmail="",operatorName="",operatorIdentityInstalled=!1;function setOperatorIdentity(email,displayName){if(operatorIdentityInstalled)throw new Error("operator identity already installed (boot wiring bug)");operatorIdentityInstalled=!0,operatorEmail=email,operatorName=displayName}function operatorIdentitySnapshot(){return{email:operatorEmail,displayName:operatorName}}function auditActorFor(identity2){return create2(ApiResourceAuditActorSchema,{id:identity2.identityId,email:identity2.email??"",displayName:identity2.displayName??""})}function updatedAuditInfo(createdBy,createdAt,actor,now){return create2(ApiResourceAuditInfoSchema,{createdBy:createdBy??actor,createdAt:createdAt??now,updatedBy:actor,updatedAt:now,event:"updated"})}function creationAuditOf(schema2,resource,slot){let audit=auditOf(schema2,resource),info=slot==="spec_audit"?audit?.specAudit:audit?.statusAudit;return{createdBy:info?.createdBy!==void 0?clone(ApiResourceAuditActorSchema,info.createdBy):void 0,createdAt:info?.createdAt!==void 0?{...info.createdAt}:void 0}}function auditOf(schema2,resource){let status=getStatusField(schema2,resource);if(status===void 0)return;let auditField=messageFieldByName(status,"audit");if(!(auditField===void 0||!status.isSet(auditField)))return status.get(auditField).message}function setAuditReflect(schema2,resource,audit){let status=getOrCreateStatusField(schema2,resource);if(status===void 0)return;let auditField=messageFieldByName(status,"audit");auditField!==void 0&&status.set(auditField,reflect2(ApiResourceAuditSchema,audit))}function setAuditSlotReflect(schema2,resource,slot,info){let status=getOrCreateStatusField(schema2,resource);if(status===void 0)return;let auditField=messageFieldByName(status,"audit");if(auditField===void 0)return;status.isSet(auditField)||status.set(auditField,reflect2(auditField.message));let auditMsg=status.get(auditField),slotField=messageFieldByName(auditMsg,slot);slotField!==void 0&&auditMsg.set(slotField,reflect2(ApiResourceAuditInfoSchema,info))}function generateId(prefix){return`${prefix}_${ulid().toLowerCase()}`}var CROCKFORD_ALPHABET="0123456789abcdefghjkmnpqrstvwxyz",DERIVED_ID_CHARS=26,DERIVED_ID_BITS=BigInt(DERIVED_ID_CHARS*5),SHA256_BITS=256n;function derivedId(prefix,canonicalText){let digest3=(0,import_node_crypto2.createHash)("sha256").update(canonicalText,"utf8").digest(),bits2=0n;for(let byte of digest3)bits2=bits2<<8n|BigInt(byte);let top=bits2>>SHA256_BITS-DERIVED_ID_BITS,encoded="";for(let i6=0;i6<DERIVED_ID_CHARS;i6++)encoded=CROCKFORD_ALPHABET[Number(top&31n)]+encoded,top>>=5n;return`${prefix}_${encoded}`}var AUTHENTICATION_TOKEN_MISSING_MESSAGE="authentication token missing",AUTHENTICATION_EXEMPT_SERVICES=new Set(["grpc.health.v1.Health"]);function isAuthenticationExempt(method){return getOption(method,is_public)||AUTHENTICATION_EXEMPT_SERVICES.has(method.parent.typeName)}var callerIdentityKey=createContextKey(void 0,{description:"caller identity produced at chain position 1"});function callerIdentityOf(ctx){let identity2=ctx.values.get(callerIdentityKey);if(identity2===void 0)throw internalError(new Error("no caller identity in context (chain wiring bug)"),"internal server error");return identity2}function trustedLocalIdentity(){return trustedLocalIdentityFor(operatorIdentitySnapshot())}var SYSTEM_OPERATOR_IDENTITY_ID="system";function trustedLocalIdentityFor(operator){return operator.email===""?{identityId:SYSTEM_OPERATOR_IDENTITY_ID,callerClass:"user",issuer:"",rawToken:""}:{identityId:operator.email,callerClass:"user",issuer:"",rawToken:"",email:operator.email,displayName:operator.displayName}}function createVerifierChainInterceptor(verifiers,guards,logger2,requireAuthentication=!1){return next=>async request=>{request.header.delete(IN_PROCESS_CALLER_HEADER);let token=parseBearerToken(request.header.get("authorization")??""),identity2;if(token!==""){if(identity2=await authenticateBearerToken(verifiers,token,logger2),identity2===void 0&&verifiers.length>0)throw logger2.warn("presented token not claimed by any identity verifier",{verifiers:verifiers.map(v=>v.name).join(", ")}),new ConnectError("the presented token was not accepted by any configured identity verifier",Code.Unauthenticated)}else if(requireAuthentication&&!isAuthenticationExempt(request.method))throw new ConnectError(AUTHENTICATION_TOKEN_MISSING_MESSAGE,Code.Unauthenticated);let stamped=identity2??trustedLocalIdentity();return request.contextValues.set(callerIdentityKey,stamped),await runCallerGuards(guards,stamped,request,logger2),next(request)}}async function runCallerGuards(guards,caller,request,logger2){for(let guard of guards)try{await guard.guard(caller,request.method,request.header)}catch(error2){let procedure=`/${request.service.typeName}/${request.method.name}`;throw error2 instanceof ConnectError?(logger2.warn("caller guard refused the request",{guard:guard.name,procedure,code:Code[error2.code]}),error2):(logger2.error("caller guard failed",{guard:guard.name,procedure,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"internal server error"))}}var IN_PROCESS_CALLER_HEADER="x-stigmer-inprocess-caller";function encodeInProcessCaller(caller){return Buffer.from(JSON.stringify(caller)).toString("base64url")}function createInProcessCallerInterceptor(){return next=>request=>{let encoded=request.header.get(IN_PROCESS_CALLER_HEADER),identity2;if(encoded!==null){request.header.delete(IN_PROCESS_CALLER_HEADER);try{identity2={...JSON.parse(Buffer.from(encoded,"base64url").toString("utf8")),origin:"in-process"}}catch(error2){throw internalError(error2 instanceof Error?error2:new Error(String(error2)),"internal server error")}}else identity2={...trustedLocalIdentity(),callerClass:"internal",origin:"in-process"};return request.contextValues.set(callerIdentityKey,identity2),next(request)}}async function authenticateBearerToken(verifiers,token,logger2){for(let verifier of verifiers){let claimed;try{claimed=await verifier.verify(token)}catch(error2){throw error2 instanceof ConnectError?error2:(logger2.error("identity verifier failed",{verifier:verifier.name,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"internal server error"))}if(claimed!==null)return claimed}}function parseBearerToken(joinedHeaderValue){let header=joinedHeaderValue.split(",")[0]??"",prefix="bearer ";return header.length<=prefix.length||header.slice(0,prefix.length).toLowerCase()!==prefix?"":header.slice(prefix.length).trim()}function rfc3339Seconds(date2){return date2.toISOString().replace(/\.\d{3}Z$/,"Z")}function accountAsCaller(account2){return{...principalOf(account2),callerClass:"user",issuer:"",rawToken:""}}function accountAsRunnerCaller(account2,rawToken){if(rawToken==="")throw new Error("a runner caller carries the credential it presented \u2014 refusing to build one with none");return{...principalOf(account2),callerClass:"runner",issuer:"",rawToken}}function principalOf(account2){let accountId=account2.metadata?.id??"";if(accountId==="")throw new Error("identity account carries no id \u2014 refusing to build a caller for an empty principal");let email=account2.spec?.email??"",displayName=account2.metadata?.name??"";return{identityId:accountId,...email!==""?{email}:{},...displayName!==""?{displayName}:{}}}var POLICY_ID_PREFIX="iamp",IAM_POLICY_API_VERSION="iam.stigmer.ai/v1",IAM_POLICY_KIND="IamPolicy",TRIPLE_DELIMITERS=[":","#","@"];function completeTriple(spec){if(spec.principal===void 0||spec.resource===void 0)throw new Error("policy spec must carry principal and resource");return{principal:spec.principal,resource:spec.resource,relation:spec.relation}}function canonicalTripleText(spec){let{principal,resource,relation}=completeTriple(spec);return`${principal.kind}:${principal.id}#${principal.relation}@${resource.kind}:${resource.id}#${relation}`}function malformedTripleField(spec){let fields2=[["principal.kind",spec.principal?.kind??""],["principal.id",spec.principal?.id??""],["principal.relation",spec.principal?.relation??""],["resource.kind",spec.resource?.kind??""],["resource.id",spec.resource?.id??""],["relation",spec.relation]];for(let[path14,value]of fields2)if(TRIPLE_DELIMITERS.some(delimiter=>value.includes(delimiter)))return path14}function policyIdFor(spec){let text=canonicalTripleText(spec),malformed=malformedTripleField(spec);if(malformed!==void 0)throw new Error(malformedTripleMessage(malformed));return derivedId(POLICY_ID_PREFIX,text)}var BLUEPRINT_KINDS=[ApiResourceKind.agent,ApiResourceKind.workflow,ApiResourceKind.skill,ApiResourceKind.mcp_server,ApiResourceKind.environment,ApiResourceKind.schedule],ROLES_RECONCILED_KEY="membership_rules_reconciled",USER_GRANT_PRINCIPAL_KINDS=[ApiResourceKind.identity_account];function policyNotFoundMessage(id){return`IAM policy not found: ${id}`}function noGrantableRolesMessage(kind){return`No roles can be granted on resource kind '${kind}'. Role assignments for this resource kind are system-managed.`}function roleNotGrantableMessage(role,kind,grantable){return`Role '${role}' cannot be granted on resource kind '${kind}'. Grantable roles: [${grantable.join(", ")}]`}var AUTHENTICATION_REQUIRED_MESSAGE="Authentication required to check permissions";function unknownResourceKindMessage(kind){return`Unknown resource kind: '${kind}'`}var PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE="per-resource access grants are served by the Enterprise and Cloud editions",AUTHORIZATION_QUERIES_UNIMPLEMENTED_MESSAGE="authorization queries are served by the Enterprise and Cloud editions";function unknownPermissionMessage(relation){return`unknown permission '${relation}'`}function unknownPrincipalKindMessage(kind){return`Unknown principal kind: '${kind}'`}function principalNotGrantableMessage(kind){let grantable=USER_GRANT_PRINCIPAL_KINDS.map(k5=>kindEnumName(k5));return`Principal kind '${kind}' cannot be granted a role. Grantable principal kinds: [${grantable.join(", ")}]`}function malformedTripleMessage(field2){return`policy ${field2} must not contain ':', '#' or '@'`}var file_ai_stigmer_iam_iampolicy_v1_spec=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvc3BlYy5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxIr4BCg1JYW1Qb2xpY3lTcGVjEkYKCXByaW5jaXBhbBgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEkUKCHJlc291cmNlGAIgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmQga6SAPIAQESHgoIcmVsYXRpb24YAyABKAlCDLpICcgBAXIEEAEYQCJkCg5BcGlSZXNvdXJjZVJlZhIbCgRraW5kGAEgASgJQg26SArIAQFyBRABGIACEhkKAmlkGAIgASgJQg26SArIAQFyBRABGIACEhoKCHJlbGF0aW9uGAMgASgJQgi6SAVyAxiAAmIGcHJvdG8z",[file_buf_validate_validate]),IamPolicySpecSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_spec,0),ApiResourceRefSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_spec,1);function relationOf(role){if(role===IamRole.iam_role_unspecified)throw new Error("iam_role_unspecified is not a relation");return IamRole[role]}function organizationRole(accountId,role,organizationId){return create2(IamPolicySpecSchema,{principal:{kind:kindEnumName(ApiResourceKind.identity_account),id:accountId},relation:relationOf(role),resource:{kind:kindEnumName(ApiResourceKind.organization),id:organizationId}})}var CREATOR_SCAN_SCHEMAS=new Map([[ApiResourceKind.organization,OrganizationSchema],[ApiResourceKind.agent,AgentSchema],[ApiResourceKind.workflow,WorkflowSchema],[ApiResourceKind.skill,SkillSchema],[ApiResourceKind.mcp_server,McpServerSchema],[ApiResourceKind.environment,EnvironmentSchema],[ApiResourceKind.schedule,ScheduleSchema]]),ORGANIZATION=kindEnumName(ApiResourceKind.organization),IDENTITY_ACCOUNT=kindEnumName(ApiResourceKind.identity_account);function isPersonStamp(stamp){return stamp!==""&&stamp!==SYSTEM_OPERATOR_IDENTITY_ID}function isPersonAccount(account2){let spec=account2.spec;return spec!==void 0&&!spec.isMachineAccount&&spec.provisioningMode!==IdentityAccountProvisioningMode.machine}function roleFor(question){let{accountId,subject,email,operatorEmail:operatorEmail2,organization,blueprintsInOrganization,organizationHasRows}=question,isMine=stamp=>stamp!==""&&(stamp===subject||stamp===accountId);return isMine(organization.createdBy)?IamRole.owner:blueprintsInOrganization.some(b7=>isMine(b7.createdBy))?IamRole.admin:operatorEmail2!==""&&email===operatorEmail2?IamRole.admin:![organization.createdBy,...blueprintsInOrganization.map(b7=>b7.createdBy)].some(stamp=>isPersonStamp(stamp)&&!isMine(stamp))&&!organizationHasRows?IamRole.admin:IamRole.member}function createdAtMillisOf(account2){let stamp=account2.status?.audit?.specAudit?.createdAt;return stamp===void 0?Number.NEGATIVE_INFINITY:Number(stamp.seconds)*1e3+Math.floor(stamp.nanos/1e6)}function newMembershipRules(deps){let{grantPath,policies,store,operatorEmail:operatorEmail2}=deps;async function scan2(kind){let schema2=CREATOR_SCAN_SCHEMAS.get(kind);if(schema2===void 0)throw new Error(`no schema to decode ${kindEnumName(kind)} rows for the creator scan`);return(await store.listResources(kind)).map(bytes=>{let resource=fromBinary2(schema2,bytes),metadata=metadataOf(resource);return{id:metadata?.id??"",org:metadata?.org??"",createdBy:auditOf(schema2,resource)?.specAudit?.createdBy?.id??""}})}async function scanBlueprints(){let scanned=[];for(let kind of BLUEPRINT_KINDS)scanned.push(...await scan2(kind));return scanned}async function organizationsHeldBy(accountId){let rows=await policies.findByPrincipal(IDENTITY_ACCOUNT,accountId);return new Set(rows.filter(row=>row.spec?.resource?.kind===ORGANIZATION).map(row=>row.spec?.resource?.id??""))}async function scanWorld(){return{organizations:await scan2(ApiResourceKind.organization),blueprints:await scanBlueprints()}}async function applyRulesTo(account2,caller,world){let accountId=account2.metadata?.id??"";if(accountId==="")throw new Error("membership rules: the account carries no id");let subject=account2.spec?.idpId??"",email=account2.spec?.email??"",held=await organizationsHeldBy(accountId);for(let organization of world.organizations){if(held.has(organization.id))continue;let blueprintsInOrganization=world.blueprints.filter(blueprint=>blueprint.org===organization.id),role=roleFor({accountId,subject,email,operatorEmail:operatorEmail2,organization,blueprintsInOrganization,organizationHasRows:(await policies.findByResource(ORGANIZATION,organization.id)).length>0});await grantPath.grant(organizationRole(accountId,role,organization.id),caller)}}async function scanPersonAccounts(){return(await store.listResources(ApiResourceKind.identity_account)).map(bytes=>fromBinary2(IdentityAccountSchema,bytes)).filter(isPersonAccount).sort((a5,b7)=>{let byCreation=createdAtMillisOf(a5)-createdAtMillisOf(b7);return byCreation!==0?byCreation:(a5.metadata?.id??"").localeCompare(b7.metadata?.id??"")})}return{async onAccountCreated(account2,caller){if(caller.callerClass!=="user")return;if((account2.metadata?.id??"")==="")throw new Error("membership rules: the provisioned account carries no id");let organizations=await scan2(ApiResourceKind.organization);organizations.length!==0&&await applyRulesTo(account2,caller,{organizations,blueprints:await scanBlueprints()})},async ensureRolesForExistingAccounts(){if(await store.bootstrapState.get(ROLES_RECONCILED_KEY)!=="")return;let accounts=await scanPersonAccounts();if(accounts.length>0){let world=await scanWorld();for(let account2 of accounts)await applyRulesTo(account2,accountAsCaller(account2),world)}await store.bootstrapState.set(ROLES_RECONCILED_KEY,rfc3339Seconds(new Date))},async ensureOperatorOwnership(operator){let accountId=operator.metadata?.id??"";if(accountId==="")throw new Error("membership rules: the operator account carries no id");let actor=accountAsCaller(operator);for(let organization of await scan2(ApiResourceKind.organization))(await policies.findByResourceWithRelations(ORGANIZATION,organization.id,[relationOf(IamRole.owner)])).length>0||await grantPath.grant(organizationRole(accountId,IamRole.owner,organization.id),actor)}}}var ResourceNotFoundError=class extends Error{constructor(detail){super(`resource not found: ${detail}`),this.name="ResourceNotFoundError"}},AuditNotFoundError=class extends Error{constructor(detail){super(`audit record not found: ${detail}`),this.name="AuditNotFoundError"}},IN_FLIGHT_CLAIM_TTL_MS=300*1e3,DELIVERED_SIGNAL_DEDUPE_TTL_MS=1440*60*1e3,PENDING_OAUTH_STATE_TTL_MS=600*1e3;async function findResourceBySlug(store,kind,schema2,slug,org){let rows=await store.listResources(kind);for(let data of rows){let resource;try{resource=fromBinary2(schema2,data)}catch{continue}let metadata=metadataOf(resource);if(!(metadata===void 0||metadata.slug!==slug)&&!(org!==""&&metadata.org!==org))return resource}}async function findResourceByLabelAndOrg(store,kind,schema2,labelKey,labelValue,org){let rows=await store.listResources(kind);for(let data of rows){let resource;try{resource=fromBinary2(schema2,data)}catch{continue}let metadata=metadataOf(resource);if(metadata!==void 0&&metadata.labels[labelKey]===labelValue&&metadata.org===org)return resource}}function requireOrgForReference(kind,org){if(org!=="")return;let scopeType,kindName2;try{let meta=getKindMeta(kind);scopeType=meta.authorization?.scopeType,kindName2=meta.name}catch(error2){throw internalError(error2,"failed to resolve kind metadata for reference org check")}if(scopeType===AuthorizationScopeType.ORGANIZATION)throw invalidArgumentError(`org is required for ${kindName2} lookup`)}function compareCreatedAtDesc(a5,b7){return a5===void 0||b7===void 0?a5===void 0&&b7===void 0?0:a5!==void 0?-1:1:a5.seconds!==b7.seconds?a5.seconds>b7.seconds?-1:1:a5.nanos!==b7.nanos?a5.nanos>b7.nanos?-1:1:0}function matchesAllLabels(resourceLabels,filterLabels){return Object.entries(filterLabels).every(([key,value])=>resourceLabels[key]===value)}var EXISTING_RESOURCE_KEY="existingResource";function newLoadExistingStep(store){return{name:"LoadExisting",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"load existing");let existing;if(metadata.id!=="")try{existing=await store.getResource(ctx.apiResourceKind,metadata.id,ctx.schema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError(getKindName(ctx.apiResourceKind),metadata.id):error2}else if(metadata.slug!==""){let found=await findResourceBySlug(store,ctx.apiResourceKind,ctx.schema,metadata.slug,metadata.org);if(found===void 0)throw notFoundError(getKindName(ctx.apiResourceKind),metadata.slug);existing=found,metadata.id=metadataOf(existing)?.id??""}else throw invalidArgumentError("resource id or slug is required for update");ctx.set(EXISTING_RESOURCE_KEY,existing)}}}async function notifyDefaultInstanceLinked(lifecycle,event){lifecycle?.onDefaultInstanceLinked!==void 0&&await lifecycle.onDefaultInstanceLinked(event)}function visibilityShapesFor(kind,level){let config2=getKindMeta(kind).authorization?.visibility,shapes=new Set,orgFloor=config2?.defaultsToOrgVisibility===!0&&config2.supportsOrg===!0;switch(level){case ApiResourceVisibility.visibility_org:config2?.supportsOrg===!0&&shapes.add("org-viewer");break;case ApiResourceVisibility.visibility_public:config2?.supportsPublic===!0&&(shapes.add("public-viewer"),orgFloor&&shapes.add("org-viewer"));break;case ApiResourceVisibility.visibility_platform:config2?.supportsPlatform===!0&&(shapes.add("platform-viewer"),orgFloor&&shapes.add("org-viewer"));break;default:break}return shapes}function diffVisibilityShapes(kind,oldLevel,newLevel){if(oldLevel===newLevel)return{shapesToCreate:[],shapesToDelete:[]};let oldShapes=visibilityShapesFor(kind,oldLevel),newShapes=visibilityShapesFor(kind,newLevel);return{shapesToCreate:[...newShapes].filter(shape=>!oldShapes.has(shape)),shapesToDelete:[...oldShapes].filter(shape=>!newShapes.has(shape))}}function resolveParentLink(kind,resource,parentConfig){let parentId=parentIdOf(resource,parentConfig.specField);if(parentId==="")throw internalError(new Error(`parent id for relation '${parentConfig.relation}' (spec field '${parentConfig.specField}') is missing on ${getKindName(kind)}`),"failed to create authorization tuples");return{relation:parentConfig.relation,parentKind:getKindEnum(parentConfig.kind),parentId}}function resolveParentLinks(kind,config2,resource,orgId,logger2){let links=[];switch(config2.scopeType){case AuthorizationScopeType.ORGANIZATION:{if(orgId==="")throw internalError(new Error(`organization id is required to create authorization tuples for ${getKindName(kind)}`),"failed to create authorization tuples");links.push({relation:"organization",parentKind:getKindEnum("organization"),parentId:orgId});break}case AuthorizationScopeType.PARENT:{if(config2.parent===void 0)throw internalError(new Error(`${getKindName(kind)} declares PARENT scope without a parent config`),"failed to create authorization tuples");links.push(resolveParentLink(kind,resource,config2.parent));break}case AuthorizationScopeType.OWNER_ONLY:break;case AuthorizationScopeType.PLATFORM:logger2.warn("unhandled PLATFORM authorization scope \u2014 no scope link",{kind:getKindName(kind)});break;default:break}for(let parent of config2.additionalParents)links.push(resolveParentLink(kind,resource,parent));return links}function resolveResourceCreatedEvent(kind,resource,caller,logger2){let config2=getKindMeta(kind).authorization;if(config2===void 0||config2.scopeType===AuthorizationScopeType.NONE||config2.scopeType===AuthorizationScopeType.UNSPECIFIED)return;let metadata=metadataOf(resource);if(metadata===void 0||metadata.id==="")throw internalError(new Error("resource metadata missing after persist"),"failed to create authorization tuples");return{kind,resourceId:metadata.id,orgId:metadata.org,caller,ownerAttribution:config2.ownerType,requiresCreatorTuple:config2.requiresCreatorTuple,parentLinks:resolveParentLinks(kind,config2,resource,metadata.org,logger2),visibilityShapes:[...visibilityShapesFor(kind,metadata.visibility)]}}function newCreateAuthorizationTuplesStep(lifecycle,logger2){return{name:"CreateAuthorizationTuples",async execute(ctx){if(lifecycle===void 0)return;let event=resolveResourceCreatedEvent(ctx.apiResourceKind,ctx.newState,ctx.callerIdentity,logger2);if(event!==void 0)try{await lifecycle.onResourceCreated(event)}catch(error2){throw internalError(error2,"failed to create authorization tuples")}}}}function newCleanupIamPoliciesStep(lifecycle,logger2){return{name:"CleanupIamPolicies",async execute(ctx){if(lifecycle===void 0)return;let metadata=ctx.get(EXISTING_RESOURCE_KEY)?.metadata;if(!(metadata===void 0||metadata.id===""))try{await lifecycle.onResourceDeleted({kind:ctx.apiResourceKind,resourceId:metadata.id,orgId:metadata.org,caller:ctx.callerIdentity})}catch(error2){logger2.warn("authorization cleanup failed \u2014 orphaned IAM policies may remain",{kind:getKindName(ctx.apiResourceKind),resourceId:metadata.id,error:error2 instanceof Error?error2.message:String(error2)})}}}}var OLD_VISIBILITY_KEY="authorizationOldVisibility";function newRecordVisibilityBeforeUpdateStep(resourceKey){return{name:"RecordVisibilityBeforeUpdate",execute(ctx){let resource=ctx.get(resourceKey);ctx.set(OLD_VISIBILITY_KEY,resource?.metadata?.visibility??ApiResourceVisibility.api_resource_visibility_unspecified)}}}function newUpdateVisibilityTuplesStep(lifecycle,resourceKey){return{name:"UpdateVisibilityTuples",async execute(ctx){if(lifecycle===void 0)return;let metadata=ctx.get(resourceKey)?.metadata;if(metadata===void 0||metadata.id==="")return;let oldLevel=ctx.get(OLD_VISIBILITY_KEY)??ApiResourceVisibility.api_resource_visibility_unspecified,{shapesToCreate,shapesToDelete}=diffVisibilityShapes(ctx.apiResourceKind,oldLevel,metadata.visibility);if(!(shapesToCreate.length===0&&shapesToDelete.length===0))try{await lifecycle.onVisibilityChanged({kind:ctx.apiResourceKind,resourceId:metadata.id,orgId:metadata.org,shapesToCreate,shapesToDelete})}catch(error2){throw internalError(error2,"failed to update visibility tuples")}}}}function rowAuthorizationFactsOf(kind,resource){let metadata=resource.metadata,org=metadata?.org??"";return{id:metadata?.id??"",org,visibility:metadata?.visibility??ApiResourceVisibility.api_resource_visibility_unspecified,createdBy:createdByOf(resource),parentLinks:parentLinksOf(kind,resource,org)}}function createdByOf(resource){return resource.status?.audit?.specAudit?.createdBy?.id??""}function parentLinksOf(kind,resource,org){let config2=getKindMeta(kind).authorization;if(config2===void 0)return[];let links=[];switch(config2.scopeType){case AuthorizationScopeType.ORGANIZATION:org!==""&&links.push({relation:"organization",parentKind:getKindEnum("organization"),parentId:org});break;case AuthorizationScopeType.PARENT:config2.parent!==void 0&&pushLink(links,resource,config2.parent);break;case AuthorizationScopeType.OWNER_ONLY:case AuthorizationScopeType.PLATFORM:case AuthorizationScopeType.NONE:case AuthorizationScopeType.UNSPECIFIED:break;default:{let exhaustive=config2.scopeType;throw new Error(`unknown scope type: ${String(exhaustive)}`)}}for(let parent of config2.additionalParents)pushLink(links,resource,parent);return links}function pushLink(links,resource,parent){let parentId=parentIdOf(resource,parent.specField);parentId!==""&&links.push({relation:parent.relation,parentKind:getKindEnum(parent.kind),parentId})}function rowFactsOf(kind,row){return{kind,...rowAuthorizationFactsOf(kind,row)}}function rowFactsOfEntry(kind,entry){return{kind,id:entry.id,org:entry.org,visibility:entry.visibility,createdBy:entry.createdBy,parentLinks:entry.parentLinks}}function objectOf(type2){return{form:"object",type:type2}}function usersetOf(type2,relation){return{form:"userset",type:type2,relation}}function publicWith(type2,condition){return{form:"wildcard",type:type2,condition}}function direct(...subjects){return{node:"this",subjects}}function computed(relation){return{node:"computed",relation}}function from(relation,tupleset){return{node:"from",relation,tupleset}}function union(...members){return{node:"union",members}}function declareKind(input){let type2=kindEnumName(input.kind),relations=new Map;for(let[name,rewrite]of input.relations){if(relations.has(name))throw new Error(`${input.source}: relation '${name}' is declared twice`);relations.set(name,rewrite)}for(let[name,rewrite]of relations)for(let reference of localReferences(rewrite))if(!relations.has(reference.relation))throw new Error(`${input.source}: '${name}' names ${reference.role} '${reference.relation}', which ${type2} does not declare`);let derived=new Map;for(let[name,rule]of input.derived??[]){if(!relations.has(name))throw new Error(`${input.source}: a derived rule for '${name}', which ${type2} does not declare`);derived.set(name,rule)}return{kind:input.kind,type:type2,schema:input.schema,source:input.source,relations,derived}}function localReferences(rewrite){switch(rewrite.node){case"this":return[];case"computed":return[{role:"relation",relation:rewrite.relation}];case"from":return[{role:"tupleset",relation:rewrite.tupleset}];case"union":return rewrite.members.flatMap(localReferences);default:{let exhaustive=rewrite;throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`)}}}var agentDeclaration=declareKind({kind:ApiResourceKind.agent,schema:AgentSchema,source:"fga/model/agentic/agent.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["platform_viewer",direct(usersetOf("identity_provider","platform_user"))],["viewer",union(direct(objectOf("identity_account"),publicWith("identity_account","allow_public"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"),computed("platform_viewer"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_execute",computed("viewer")],["can_create_instance",computed("can_execute")],["can_clone",computed("viewer")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_agentic_agentchannel_v1_spec=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL3NwZWMucHJvdG8SImFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEi+AYKEEFnZW50Q2hhbm5lbFNwZWMSrAEKCWFnZW50X3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUJjukhcugFWCg5hZ2VudF9yZWYua2luZBIzYWdlbnRfcmVmIG11c3QgcmVmZXJlbmNlIGEgcmVzb3VyY2Ugd2l0aCBraW5kPWFnZW50Gg90aGlzLmtpbmQgPT0gNDDIAQHghSwoEg8KB2VuYWJsZWQYAiABKAgSRwoFc2xhY2sYAyABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLlNsYWNrQ2hhbm5lbENvbmZpZ0gAEk0KCHdoYXRzYXBwGAYgASgLMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5XaGF0c0FwcENoYW5uZWxDb25maWdIABLIAQoQZW52aXJvbm1lbnRfcmVmcxgEIAMoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUJ4ukhxkgFuImy6AWkKFWVudmlyb25tZW50X3JlZnMua2luZBI/ZW52aXJvbm1lbnRfcmVmcyBtdXN0IHJlZmVyZW5jZSByZXNvdXJjZXMgd2l0aCBraW5kPWVudmlyb25tZW50Gg90aGlzLmtpbmQgPT0gNTPghSw1ErwBCgdhcHBfcmVmGAUgASgLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlQnW6SG66AWsKDGFwcF9yZWYua2luZBI3YXBwX3JlZiBtdXN0IHJlZmVyZW5jZSBhIHJlc291cmNlIHdpdGgga2luZD1jaGFubmVsX2FwcBoidGhpcy5zbHVnID09ICcnIHx8IHRoaXMua2luZCA9PSA0OOCFLDASIwobcHJvYWN0aXZlX21lc3NhZ2luZ19lbmFibGVkGAcgASgIEkMKCnJ1bl9jb25maWcYCCABKAsyLy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUnVuQ29uZmlnQhgKD3Byb3ZpZGVyX2NvbmZpZxIFukgCCAEiFAoSU2xhY2tDaGFubmVsQ29uZmlnIjkKFVdoYXRzQXBwQ2hhbm5lbENvbmZpZxIgCg9waG9uZV9udW1iZXJfaWQYASABKAlCB7pIBHICEAFiBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_invocation,file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]),AgentChannelSpecSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_spec,0);var file_ai_stigmer_agentic_agentchannel_v1_status=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL3N0YXR1cy5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MSL5AgoSQWdlbnRDaGFubmVsU3RhdHVzElMKDWluc3RhbGxfc3RhdGUYASABKA4yPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbEluc3RhbGxTdGF0ZRJHCgVzbGFjaxgCIAEoCzI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuU2xhY2tJbnN0YWxsU3RhdHVzSAASTQoId2hhdHNhcHAYBCABKAsyOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLldoYXRzQXBwSW5zdGFsbFN0YXR1c0gAEiIKGmNyZWRlbnRpYWxzX2Vudmlyb25tZW50X2lkGAMgASgJEj8KBWF1ZGl0GGMgASgLMjAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRCEQoPcHJvdmlkZXJfc3RhdHVzItABChJTbGFja0luc3RhbGxTdGF0dXMSDwoHdGVhbV9pZBgBIAEoCRIRCgl0ZWFtX25hbWUYAiABKAkSEwoLYm90X3VzZXJfaWQYAyABKAkSFgoOZ3JhbnRlZF9zY29wZXMYBCADKAkSHwoXaW5zdGFsbGVyX3NsYWNrX3VzZXJfaWQYBSABKAkSMAoMaW5zdGFsbGVkX2F0GAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIWCg5jaGFubmVsX2FwcF9pZBgHIAEoCSKvAQoVV2hhdHNBcHBJbnN0YWxsU3RhdHVzEhcKD3Bob25lX251bWJlcl9pZBgBIAEoCRIcChRkaXNwbGF5X3Bob25lX251bWJlchgCIAEoCRIVCg12ZXJpZmllZF9uYW1lGAMgASgJEhYKDmNoYW5uZWxfYXBwX2lkGAQgASgJEjAKDGluc3RhbGxlZF9hdBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAqeAoYQWdlbnRDaGFubmVsSW5zdGFsbFN0YXRlEisKJ2FnZW50X2NoYW5uZWxfaW5zdGFsbF9zdGF0ZV91bnNwZWNpZmllZBAAEhMKD3BlbmRpbmdfaW5zdGFsbBABEg0KCWluc3RhbGxlZBACEgsKB3Jldm9rZWQQA2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_status,file_google_protobuf_timestamp]),AgentChannelStatusSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_status,0);var AgentChannelInstallState;(function(AgentChannelInstallState2){AgentChannelInstallState2[AgentChannelInstallState2.agent_channel_install_state_unspecified=0]="agent_channel_install_state_unspecified",AgentChannelInstallState2[AgentChannelInstallState2.pending_install=1]="pending_install",AgentChannelInstallState2[AgentChannelInstallState2.installed=2]="installed",AgentChannelInstallState2[AgentChannelInstallState2.revoked=3]="revoked"})(AgentChannelInstallState||(AgentChannelInstallState={}));var file_ai_stigmer_agentic_agentchannel_v1_api=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2FwaS5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MSK/AgoMQWdlbnRDaGFubmVsEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiEKBGtpbmQYAiABKAlCE7pIEHIOCgxBZ2VudENoYW5uZWwSTQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YUIGukgDyAEBEkIKBHNwZWMYBCABKAsyNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbFNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5BZ2VudENoYW5uZWxTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_agentchannel_v1_spec,file_ai_stigmer_agentic_agentchannel_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),AgentChannelSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_api,0);var agentChannelDeclaration=declareKind({kind:ApiResourceKind.agent_channel,schema:AgentChannelSchema,source:"fga/model/agentic/agent_channel.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["participant",union(direct(objectOf("identity_account")),computed("owner"))],["viewer",union(direct(objectOf("identity_account")),computed("participant"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_participate",computed("participant")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_agentic_agentexecution_v1_approval=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvYXBwcm92YWwucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSLLAwoPUGVuZGluZ0FwcHJvdmFsEhQKDHRvb2xfY2FsbF9pZBgBIAEoCRIRCgl0b29sX25hbWUYAiABKAkSDwoHbWVzc2FnZRgDIAEoCRIUCgxhcmdzX3ByZXZpZXcYBCABKAkSFAoMcmVxdWVzdGVkX2F0GAUgASgJEhYKDmZyb21fc3ViX2FnZW50GAYgASgIEhYKDnN1Yl9hZ2VudF9uYW1lGAcgASgJEhcKD21jcF9zZXJ2ZXJfc2x1ZxgIIAEoCRIZChFzdWJfYWdlbnRfc3ViamVjdBgJIAEoCRIXCg9hZ2VudF9yYXRpb25hbGUYCiABKAkSFgoOYnJhbmNoX2F0X2RlbnkYCyABKAkSGAoQaGVhZF9zaGFfYXRfZGVueRgMIAEoCRJBCgl0b29sX2tpbmQYDSABKA4yLi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVG9vbEtpbmQSWgoWYXBwcm92YWxfcG9saWN5X3NvdXJjZRgPIAEoDjI6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFBvbGljeVNvdXJjZUoECA4QDyKDAQoZQ2hpbGRBcHByb3ZhbE5vdGlmaWNhdGlvbhIUCgxleGVjdXRpb25faWQYASABKAkSUAoRcGVuZGluZ19hcHByb3ZhbHMYAiADKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUGVuZGluZ0FwcHJvdmFsIp0DCg9BcHByb3ZhbFJlcXVlc3QSGwoTYXBwcm92YWxfcmVxdWVzdF9pZBgBIAEoCRIUCgx0b29sX2NhbGxfaWQYAiABKAkSFAoMcmVxdWVzdGVkX2F0GAMgASgJEhEKCXRvb2xfbmFtZRgEIAEoCRIPCgdtZXNzYWdlGAUgASgJEhQKDGFyZ3NfcHJldmlldxgGIAEoCRIWCg5mcm9tX3N1Yl9hZ2VudBgHIAEoCBIWCg5zdWJfYWdlbnRfbmFtZRgIIAEoCRIZChFzdWJfYWdlbnRfc3ViamVjdBgJIAEoCRIXCg9tY3Bfc2VydmVyX3NsdWcYCiABKAkSQQoJdG9vbF9raW5kGAsgASgOMi4uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xLaW5kEloKFmFwcHJvdmFsX3BvbGljeV9zb3VyY2UYDSABKA4yOi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXBwcm92YWxQb2xpY3lTb3VyY2VKBAgMEA0ilwEKEkFwcHJvdmFsUmV0cmFjdGlvbhIbChNhcHByb3ZhbF9yZXF1ZXN0X2lkGAEgASgJEk4KBnJlYXNvbhgCIAEoDjI+LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFJldHJhY3Rpb25SZWFzb24SFAoMcmV0cmFjdGVkX2F0GAMgASgJIq4BChBBcHByb3ZhbERlY2lzaW9uEhsKE2FwcHJvdmFsX3JlcXVlc3RfaWQYASABKAkSRAoGYWN0aW9uGAIgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsQWN0aW9uEhIKCmRlY2lkZWRfYXQYAyABKAkSEgoKZGVjaWRlZF9ieRgEIAEoCRIPCgdjb21tZW50GAUgASgJIp4DCg1BcHByb3ZhbEV2ZW50EhAKCGV2ZW50X2lkGAEgASgJEhsKE2FwcHJvdmFsX3JlcXVlc3RfaWQYAiABKAkSSwoKZXZlbnRfdHlwZRgDIAEoDjI3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbEV2ZW50VHlwZRIRCgl0aW1lc3RhbXAYBCABKAkSDQoFYWN0b3IYBSABKAkSSgoJcmVxdWVzdGVkGAYgASgLMjUuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsUmVxdWVzdEgAEkkKB2RlY2lkZWQYByABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXBwcm92YWxEZWNpc2lvbkgAEk0KCXJldHJhY3RlZBgIIAEoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFJldHJhY3Rpb25IAEIJCgdwYXlsb2FkInAKE0FwcHJvdmFsRXZlbnRTdHJlYW0SFAoMZXhlY3V0aW9uX2lkGAEgASgJEkMKBmV2ZW50cxgCIAMoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbEV2ZW50YgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum]),PendingApprovalSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_approval,0);var ApprovalEventSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_approval,5),ApprovalEventStreamSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_approval,6);var file_ai_stigmer_agentic_agentexecution_v1_artifact=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvYXJ0aWZhY3QucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSKEAgoRRXhlY3V0aW9uQXJ0aWZhY3QSDAoEbmFtZRgBIAEoCRIUCgxzYW5kYm94X3BhdGgYAiABKAkSUwoEa2luZBgDIAEoDjI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25BcnRpZmFjdEtpbmRCCLpIBYIBAhABEhIKCnNpemVfYnl0ZXMYBCABKAMSEwoLc3RvcmFnZV9rZXkYBSABKAkSEgoKY3JlYXRlZF9hdBgHIAEoCRISCgpleHBpcmVzX2F0GAggASgJEg8KB2VudHJpZXMYCSADKAkSFAoMY29udGVudF9oYXNoGAogASgJYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_buf_validate_validate]);var file_ai_stigmer_agentic_agentexecution_v1_context=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvY29udGV4dC5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIoYDChJTdW1tYXJpemF0aW9uRXZlbnQSEQoJdGltZXN0YW1wGAEgASgJEhUKDXRva2Vuc19iZWZvcmUYAiABKAUSFAoMdG9rZW5zX2FmdGVyGAMgASgFEhkKEWNvbXByZXNzaW9uX3JhdGlvGAQgASgCEhMKC2R1cmF0aW9uX21zGAUgASgFEhsKE3N1bW1hcml6YXRpb25fbW9kZWwYBiABKAkSFwoPbWVzc2FnZXNfYmVmb3JlGAcgASgFEhYKDm1lc3NhZ2VzX2FmdGVyGAggASgFEkkKBnNvdXJjZRgJIAEoDjI5LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5TdW1tYXJpemF0aW9uU291cmNlEiIKGnN1bW1hcml6YXRpb25faW5wdXRfdG9rZW5zGAogASgFEiMKG3N1bW1hcml6YXRpb25fb3V0cHV0X3Rva2VucxgLIAEoBRIeChZzdW1tYXJpemF0aW9uX2Nvc3RfdXNkGAwgASgBIqoCCgtDb250ZXh0SW5mbxIbChNjdXJyZW50X3Rva2VuX2NvdW50GAEgASgFEhwKFGNvbnRleHRfd2luZG93X2xpbWl0GAIgASgFEicKH3N1bW1hcml6YXRpb25fdHJpZ2dlcl90aHJlc2hvbGQYAyABKAUSIwobc3VtbWFyaXphdGlvbl90YXJnZXRfdG9rZW5zGAQgASgFEh0KFXN1bW1hcml6YXRpb25fZW5hYmxlZBgFIAEoCBJWChRzdW1tYXJpemF0aW9uX2V2ZW50cxgGIAMoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5TdW1tYXJpemF0aW9uRXZlbnQSGwoTdXRpbGl6YXRpb25fcGVyY2VudBgHIAEoAmIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_enum]);var file_ai_stigmer_agentic_agentexecution_v1_message=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvbWVzc2FnZS5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIoICCgxBZ2VudE1lc3NhZ2USSQoEdHlwZRgBIAEoDjIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5NZXNzYWdlVHlwZUIIukgFggECEAESDwoHY29udGVudBgCIAEoCRIRCgl0aW1lc3RhbXAYAyABKAkSQgoKdG9vbF9jYWxscxgEIAMoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub29sQ2FsbBIpCghtZXRhZGF0YRgFIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSFAoMaXNfc3RyZWFtaW5nGAYgASgIIqUHCghUb29sQ2FsbBIKCgJpZBgBIAEoCRIMCgRuYW1lGAIgASgJEiUKBGFyZ3MYAyABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0Eg4KBnJlc3VsdBgEIAEoCRJOCgZzdGF0dXMYBSABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVG9vbENhbGxTdGF0dXNCCLpIBYIBAhABEhIKCnN0YXJ0ZWRfYXQYByABKAkSFAoMY29tcGxldGVkX2F0GAggASgJEg0KBWVycm9yGAkgASgJEhkKEXJlcXVpcmVzX2FwcHJvdmFsGAogASgIEhgKEGFwcHJvdmFsX21lc3NhZ2UYCyABKAkSHQoVYXBwcm92YWxfcmVxdWVzdGVkX2F0GAwgASgJEhsKE2FwcHJvdmFsX2RlY2lkZWRfYXQYDSABKAkSEwoLYXBwcm92ZWRfYnkYDiABKAkSTQoPYXBwcm92YWxfYWN0aW9uGA8gASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsQWN0aW9uEhQKDGlzX3N0cmVhbWluZxgQIAEoCBJXChBzdHJlYW1pbmdfc291cmNlGBMgASgOMj0uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xDYWxsU3RyZWFtaW5nU291cmNlEhcKD21jcF9zZXJ2ZXJfc2x1ZxgRIAEoCRIUCgxhcmdzX3ByZXZpZXcYEiABKAkSQQoJdG9vbF9raW5kGBQgASgOMi4uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xLaW5kEksKCm91dHB1dF9yZWYYFSABKAsyNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVG9vbENhbGxPdXRwdXRSZWYSWgoWYXBwcm92YWxfcG9saWN5X3NvdXJjZRgXIAEoDjI6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFBvbGljeVNvdXJjZRIdChVwb2xpY3lfZW5naW5lX3ZlcnNpb24YGCABKAkSHwoXYXBwcm92YWxfY29udGVudF9kaWdlc3QYGSABKAkSGgoSZmlsZV9jaGFuZ2Vfc2V0X2lkGBogASgJSgQIFhAXIpIBChFUb29sQ2FsbE91dHB1dFJlZhITCgtzdG9yYWdlX2tleRgBIAEoCRISCgpzaXplX2J5dGVzGAMgASgDEhQKDGNvbnRlbnRfaGFzaBgEIAEoCRIRCgltaW1lX3R5cGUYBSABKAkSEAoIaXNfaW1hZ2UYBiABKAgSGQoRdHJ1bmNhdGVkX3ByZXZpZXcYByABKAkiwQMKCkZpbGVDaGFuZ2USDAoEcGF0aBgBIAEoCRIVCg1hYnNvbHV0ZV9wYXRoGAIgASgJElMKC2NoYW5nZV90eXBlGAMgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVDaGFuZ2VUeXBlQgi6SAWCAQIQARJdCg1jYXB0dXJlX2xldmVsGAQgASgOMjwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVDaGFuZ2VDYXB0dXJlTGV2ZWxCCLpIBYIBAhABEkEKBmJlZm9yZRgFIAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ29udGVudBJACgVhZnRlchgGIAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ29udGVudBIUCgx1bmlmaWVkX2RpZmYYByABKAkSEwoLbGluZXNfYWRkZWQYCCABKAUSFQoNbGluZXNfcmVtb3ZlZBgJIAEoBRITCgtyZW5hbWVfZnJvbRgKIAEoCSKCAQoLRmlsZUNvbnRlbnQSEAoGaW5saW5lGAEgASgJSAASRgoDcmVmGAIgASgLMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xDYWxsT3V0cHV0UmVmSAASEQoJaXNfYmluYXJ5GAMgASgIQgYKBGJvZHliBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_buf_validate_validate,file_google_protobuf_struct]),AgentMessageSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_message,0);var file_ai_stigmer_agentic_agentexecution_v1_filereview=fileDesc("CjVhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvZmlsZXJldmlldy5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIokFCg1GaWxlQ2hhbmdlU2V0EgoKAmlkGAEgASgJEg8KB3R1cm5faWQYAiABKAkSEgoKaGFybmVzc19pZBgDIAEoCRJTCgZzdGF0dXMYBCABKA4yOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNoYW5nZVNldFN0YXR1c0IIukgFggECEAESTAoRYmFzZWxpbmVfc25hcHNob3QYBSABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU25hcHNob3RSZWYSTQoSY2FuZGlkYXRlX3NuYXBzaG90GAYgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmEkwKEWFwcHJvdmVkX3NuYXBzaG90GAcgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmEkkKB2NoYW5nZXMYCCADKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ2FwdHVyZWRGaWxlQ2hhbmdlEhgKEGFnZ3JlZ2F0ZV9kaWdlc3QYCSABKAkSWwoRZGlmZl9jb21wbGV0ZW5lc3MYCiABKA4yNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRGlmZkNvbXBsZXRlbmVzc0IIukgFggECEAESRQoJZGVjaXNpb25zGAsgAygLMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVEZWNpc2lvbiKoBQoSQ2FwdHVyZWRGaWxlQ2hhbmdlEgoKAmlkGAEgASgJEhMKC3BhdGhfYmVmb3JlGAIgASgJEhIKCnBhdGhfYWZ0ZXIYAyABKAkSTAoEa2luZBgEIAEoDjI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ2hhbmdlS2luZEIIukgFggECEAESVwoNY2FwdHVyZV9jbGFzcxgFIAEoDjI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ2FwdHVyZUNsYXNzQgi6SAWCAQIQARJBCgZiZWZvcmUYBiABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNvbnRlbnQSQAoFYWZ0ZXIYByABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNvbnRlbnQSFQoNYmVmb3JlX3NoYTI1NhgIIAEoCRIUCgxhZnRlcl9zaGEyNTYYCSABKAkSTQoMdW5pZmllZF9kaWZmGAogASgLMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xDYWxsT3V0cHV0UmVmEhUKDWRpZmZfY29tcGxldGUYCyABKAgSEwoLZmlsZV9kaWdlc3QYDCABKAkSXQoOYmxvY2tlZF9yZWFzb24YDSABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZVJldmlld0Jsb2NrUmVhc29uQgi6SAWCAQIQARITCgtsaW5lc19hZGRlZBgOIAEoBRIVCg1saW5lc19yZW1vdmVkGA8gASgFItsBCgtTbmFwc2hvdFJlZhJKCgRraW5kGAEgASgOMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90S2luZEIIukgFggECEAESPQoDZ2l0GAIgASgLMjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkdpdFRyZWVSZWYSQQoDY2FzGAMgASgLMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkNhc01hbmlmZXN0UmVmIisKCkdpdFRyZWVSZWYSEAoIdHJlZV9vaWQYASABKAkSCwoDcmVmGAIgASgJIj8KDkNhc01hbmlmZXN0UmVmEhcKD21hbmlmZXN0X2RpZ2VzdBgBIAEoCRIUCgxhcnRpZmFjdF91cmkYAiABKAkitwMKDEZpbGVEZWNpc2lvbhIKCgJpZBgBIAEoCRIVCg1jaGFuZ2Vfc2V0X2lkGAIgASgJElAKBXNjb3BlGAMgASgOMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVEZWNpc2lvblNjb3BlQgi6SAWCAQIQARIWCg5maWxlX2NoYW5nZV9pZBgEIAEoCRJSCgZhY3Rpb24YBSABKA4yOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZURlY2lzaW9uQWN0aW9uQgi6SAWCAQIQARIXCg9leHBlY3RlZF9kaWdlc3QYBiABKAkSEwoLcmV2aWV3ZXJfaWQYByABKAkSEgoKZGVjaWRlZF9hdBgIIAEoCRIOCgZyZWFzb24YCSABKAkSIAoYYWNrbm93bGVkZ2VfdW5yZXZpZXdhYmxlGAogASgIElIKBm9yaWdpbhgLIAEoDjI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlRGVjaXNpb25PcmlnaW5CCLpIBYIBAhABIqYBChpGaWxlUmV2aWV3QmFzZWxpbmVDYXB0dXJlZBIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJEg8KB3R1cm5faWQYAiABKAkSEgoKaGFybmVzc19pZBgDIAEoCRJMChFiYXNlbGluZV9zbmFwc2hvdBgEIAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5TbmFwc2hvdFJlZiJeChVUdXJuQ29tbWFuZFByb3ZlbmFuY2USHQoVY29uc2VudF90b29sX2NhbGxfaWRzGAEgAygJEiYKHmF1dGhvcml6ZWRfYnlfYXV0b19hcHByb3ZlX2FsbBgCIAEoCCKeAwobRmlsZVJldmlld0NhbmRpZGF0ZUNhcHR1cmVkEhUKDWNoYW5nZV9zZXRfaWQYASABKAkSTQoSY2FuZGlkYXRlX3NuYXBzaG90GAIgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmEkkKB2NoYW5nZXMYAyADKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ2FwdHVyZWRGaWxlQ2hhbmdlEhgKEGFnZ3JlZ2F0ZV9kaWdlc3QYBCABKAkSWwoRZGlmZl9jb21wbGV0ZW5lc3MYBSABKA4yNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRGlmZkNvbXBsZXRlbmVzc0IIukgFggECEAESVwoSY29tbWFuZF9wcm92ZW5hbmNlGAYgASgLMjsuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlR1cm5Db21tYW5kUHJvdmVuYW5jZSJ7ChRGaWxlUmV2aWV3UmVjb25jaWxlZBIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJEkwKEWFwcHJvdmVkX3NuYXBzaG90GAIgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmIo8BChFGaWxlUmV2aWV3RmFpbHVyZRIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJElMKBGtpbmQYAiABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZVJldmlld0ZhaWx1cmVLaW5kQgi6SAWCAQIQARIOCgZkZXRhaWwYAyABKAki6QQKD0ZpbGVSZXZpZXdFdmVudBIQCghldmVudF9pZBgBIAEoCRIVCg1jaGFuZ2Vfc2V0X2lkGAIgASgJElcKCmV2ZW50X3R5cGUYAyABKA4yOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZVJldmlld0V2ZW50VHlwZUIIukgFggECEAESEQoJdGltZXN0YW1wGAQgASgJEg0KBWFjdG9yGAUgASgJEl0KEWJhc2VsaW5lX2NhcHR1cmVkGAYgASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdCYXNlbGluZUNhcHR1cmVkSAASXwoSY2FuZGlkYXRlX2NhcHR1cmVkGAcgASgLMkEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdDYW5kaWRhdGVDYXB0dXJlZEgAEkoKDGZpbGVfZGVjaWRlZBgIIAEoCzIyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlRGVjaXNpb25IABJQCgpyZWNvbmNpbGVkGAkgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdSZWNvbmNpbGVkSAASSQoGZmFpbGVkGAogASgLMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdGYWlsdXJlSABCCQoHcGF5bG9hZCJ0ChVGaWxlUmV2aWV3RXZlbnRTdHJlYW0SFAoMZXhlY3V0aW9uX2lkGAEgASgJEkUKBmV2ZW50cxgCIAMoCzI1LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlUmV2aWV3RXZlbnQi0wEKEkZpbGVDaGFuZ2VQcm9ncmVzcxIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJEhUKDWZpbGVzX2NoYW5nZWQYAiABKAUSEwoLbGluZXNfYWRkZWQYAyABKAUSFQoNbGluZXNfcmVtb3ZlZBgEIAEoBRJOCgdlbnRyaWVzGAUgAygLMj0uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVDaGFuZ2VQcm9ncmVzc0VudHJ5EhMKC2NhcHR1cmVkX2F0GAYgASgJIrwBChdGaWxlQ2hhbmdlUHJvZ3Jlc3NFbnRyeRITCgtwYXRoX2JlZm9yZRgBIAEoCRISCgpwYXRoX2FmdGVyGAIgASgJEkwKBGtpbmQYAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNoYW5nZUtpbmRCCLpIBYIBAhABEhMKC2xpbmVzX2FkZGVkGAQgASgFEhUKDWxpbmVzX3JlbW92ZWQYBSABKAViBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_agentexecution_v1_message,file_buf_validate_validate]),FileChangeSetSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,0);var FileDecisionSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,5);var FileReviewEventSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,11),FileReviewEventStreamSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,12);var file_ai_stigmer_agentic_executioncontext_v1_spec=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9zcGVjLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MSLwAQoURXhlY3V0aW9uQ29udGV4dFNwZWMSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABElQKBGRhdGEYAiADKAsyRi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0U3BlYy5EYXRhRW50cnkaYwoJRGF0YUVudHJ5EgsKA2tleRgBIAEoCRJFCgV2YWx1ZRgCIAEoCzI2LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvblZhbHVlOgI4ASIyCg5FeGVjdXRpb25WYWx1ZRINCgV2YWx1ZRgBIAEoCRIRCglpc19zZWNyZXQYAiABKAhiBnByb3RvMw",[file_buf_validate_validate]);var ExecutionValueSchema=messageDesc2(file_ai_stigmer_agentic_executioncontext_v1_spec,1);var file_ai_stigmer_agentic_session_v1_spec=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9zcGVjLnByb3RvEh1haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MSKWBwoLU2Vzc2lvblNwZWMSGQoRYWdlbnRfaW5zdGFuY2VfaWQYASABKAkSDwoHc3ViamVjdBgCIAEoCRIYChBoYXJuZXNzX3N0YXRlX2lkGAMgASgJEiAKGGhhcm5lc3Nfc3RhdGVfaWRfaGlzdG9yeRgNIAMoCRJKCghtZXRhZGF0YRgFIAMoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25TcGVjLk1ldGFkYXRhRW50cnkSSAoRd29ya3NwYWNlX2VudHJpZXMYBiADKAsyLS5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5Xb3Jrc3BhY2VFbnRyeRLZAQoRbWNwX3NlcnZlcl91c2FnZXMYByADKAsyKy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuTWNwU2VydmVyVXNhZ2VCkAG6SIwBkgGIASKFAboBgQEKHnNlc3Npb25fbWNwX3NlcnZlcl91c2FnZXMua2luZBI/bWNwX3NlcnZlcl91c2FnZXMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1tY3Bfc2VydmVyGh50aGlzLm1jcF9zZXJ2ZXJfcmVmLmtpbmQgPT0gNDQSuAEKCnNraWxsX3JlZnMYCCADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCbrpIZ5IBZCJiugFfChdzZXNzaW9uX3NraWxsX3JlZnMua2luZBIzc2tpbGxfcmVmcyBtdXN0IHJlZmVyZW5jZSByZXNvdXJjZXMgd2l0aCBraW5kPXNraWxsGg90aGlzLmtpbmQgPT0gNDPghSwrEjcKB2hhcm5lc3MYCiABKA4yJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5IYXJuZXNzEj4KC2N1cnNvcl9tb2RlGAsgASgOMikuYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuQ3Vyc29yTW9kZRJIChBleGVjdXRpb25fdGFyZ2V0GAwgASgOMi4uYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuRXhlY3V0aW9uVGFyZ2V0Gi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4AWIGcHJvdG8z",[file_ai_stigmer_agentic_agent_v1_spec,file_ai_stigmer_agentic_session_v1_enum,file_ai_stigmer_agentic_session_v1_workspace,file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]),SessionSpecSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_spec,0);var file_ai_stigmer_agentic_agentexecution_v1_spec=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvc3BlYy5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIuEKChJBZ2VudEV4ZWN1dGlvblNwZWMSEgoKc2Vzc2lvbl9pZBgBIAEoCRIQCghhZ2VudF9pZBgCIAEoCRJACgxzZXNzaW9uX3NwZWMYDSABKAsyKi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uU3BlYxIYCgdtZXNzYWdlGAMgASgJQge6SARyAhABEk8KEGV4ZWN1dGlvbl9jb25maWcYBCABKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRXhlY3V0aW9uQ29uZmlnEl0KC3J1bnRpbWVfZW52GAUgAygLMkguYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uU3BlYy5SdW50aW1lRW52RW50cnkSFgoOY2FsbGJhY2tfdG9rZW4YBiABKAwSGAoQYXV0b19hcHByb3ZlX2FsbBgHIAEoCBIaChJwYXJlbnRfd29ya2Zsb3dfaWQYCCABKAkSRQoLYXR0YWNobWVudHMYCSADKAsyMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXR0YWNobWVudBIbChN3b3Jrc3BhY2VfZmlsZV9yZWZzGAogAygJEhsKE2FjdGl2aXR5X3Rhc2tfcXVldWUYCyABKAkSHwoXc3VwZXJzZWRlc19leGVjdXRpb25faWQYDCABKAkSVwoUY29udmVyc2F0aW9uX2NhdGNodXAYDiABKAsyOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29udmVyc2F0aW9uQ2F0Y2h1cBJXChRkZWNsYXJlZF9wcmVmZXJlbmNlcxgPIAEoCzI5LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5EZWNsYXJlZFByZWZlcmVuY2VzElEKEXJlY2FsbGVkX21lbW9yaWVzGBAgASgLMjYuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlJlY2FsbGVkTWVtb3JpZXMaaQoPUnVudGltZUVudkVudHJ5EgsKA2tleRgBIAEoCRJFCgV2YWx1ZRgCIAEoCzI2LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvblZhbHVlOgI4ATq4A7pItAMaywEKIWFnZW50X2V4ZWN1dGlvbi5zZXNzaW9uX2V4Y2x1c2l2ZRJyc2Vzc2lvbl9pZCBhbmQgc2Vzc2lvbl9zcGVjIGFyZSBtdXR1YWxseSBleGNsdXNpdmUg4oCUIHJlZmVyZW5jZSBhbiBleGlzdGluZyBzZXNzaW9uIG9yIGRlZmluZSBhIG5ldyBvbmUsIG5vdCBib3RoGjIhKHRoaXMuc2Vzc2lvbl9pZCAhPSAnJyAmJiBoYXModGhpcy5zZXNzaW9uX3NwZWMpKRrjAQoqYWdlbnRfZXhlY3V0aW9uLnNlc3Npb25fc3BlY19oYXJuZXNzX3N0YXRlEnBzZXNzaW9uX3NwZWMuaGFybmVzc19zdGF0ZV9pZCBtdXN0IGJlIGVtcHR5IOKAlCBoYXJuZXNzIHN0YXRlIGlzIGNyZWF0ZWQgYnkgdGhlIHJ1bm5lciBhZnRlciB0aGUgZmlyc3QgZXhlY3V0aW9uGkMhaGFzKHRoaXMuc2Vzc2lvbl9zcGVjKSB8fCB0aGlzLnNlc3Npb25fc3BlYy5oYXJuZXNzX3N0YXRlX2lkID09ICcnIvoECg9FeGVjdXRpb25Db25maWcSEgoKbW9kZWxfbmFtZRgBIAEoCRJZChJjb250ZXh0X21hbmFnZW1lbnQYAiABKAsyPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29udGV4dE1hbmFnZW1lbnRDb25maWcSFwoPbWF4X3Rvb2xfcm91bmRzGAMgASgFEh0KFW1heF90b29sX3Jlc3VsdF9jaGFycxgEIAEoBRIUCgxtYXhfY29zdF91c2QYBSABKAESWQoQaW50ZXJhY3Rpb25fbW9kZRgGIAEoDjI1LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5JbnRlcmFjdGlvbk1vZGVCCLpIBYIBAhABEjkKGHN0cnVjdHVyZWRfb3V0cHV0X3NjaGVtYRgHIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSFwoPYnVpbGRfZnJvbV9wbGFuGAggASgIElMKDWFwcHJvdmFsX21vZGUYCSABKA4yMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXBwcm92YWxNb2RlQgi6SAWCAQIQARJRCgxzZXJ2aWNlX3RpZXIYCiABKA4yMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU2VydmljZVRpZXJCCLpIBYIBAhABElMKDXRoaW5raW5nX21vZGUYCyABKA4yMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVGhpbmtpbmdNb2RlQgi6SAWCAQIQASKKAQoXQ29udGV4dE1hbmFnZW1lbnRDb25maWcSHQoVZGlzYWJsZV9zdW1tYXJpemF0aW9uGAEgASgIEikKGGN1c3RvbV90cmlnZ2VyX3RocmVzaG9sZBgCIAEoBUIHukgEGgIoABIlChRjdXN0b21fdGFyZ2V0X3Rva2VucxgDIAEoBUIHukgEGgIoACLUAgoKQXR0YWNobWVudBLYAQoIZmlsZW5hbWUYASABKAlCxQG6SMEBugG5AQobYXR0YWNobWVudC5maWxlbmFtZS5ub19wYXRoEk5maWxlbmFtZSBtdXN0IGJlIGEgYmFyZSBmaWxlbmFtZSB3aXRob3V0IHBhdGggc2VwYXJhdG9ycyBvciB0cmF2ZXJzYWwgc2VnbWVudHMaSiF0aGlzLmNvbnRhaW5zKCcvJykgJiYgIXRoaXMuY29udGFpbnMoJ1xcJykgJiYgdGhpcyAhPSAnLicgJiYgdGhpcyAhPSAnLi4ncgIQARIcCgtzdG9yYWdlX2tleRgCIAEoCUIHukgEcgIQARISCgptb3VudF9wYXRoGAMgASgJEhQKDGNvbnRlbnRfdHlwZRgEIAEoCRIPCgdleHRyYWN0GAUgASgIEhIKCmxvY2FsX3BhdGgYBiABKAkiVQoTQ29udmVyc2F0aW9uQ2F0Y2h1cBIOCgZkaWdlc3QYASABKAkSLgoKd2luZG93X2VuZBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiQAoTRGVjbGFyZWRQcmVmZXJlbmNlcxITCgtvcmdfY29udGV4dBgBIAEoCRIUCgx1c2VyX2NvbnRleHQYAiABKAkibAoQUmVjYWxsZWRNZW1vcmllcxIPCgdlbmFibGVkGAEgASgIEkcKBWZhY3RzGAIgAygLMjguYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlJlY2FsbGVkTWVtb3J5RmFjdCI4ChJSZWNhbGxlZE1lbW9yeUZhY3QSEQoJbWVtb3J5X2lkGAEgASgJEg8KB2NvbnRlbnQYAiABKAliBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_executioncontext_v1_spec,file_ai_stigmer_agentic_session_v1_spec,file_buf_validate_validate,file_google_protobuf_struct,file_google_protobuf_timestamp]),AgentExecutionSpecSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,0),ExecutionConfigSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,1);var DeclaredPreferencesSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,5),RecalledMemoriesSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,6),RecalledMemoryFactSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,7);var file_ai_stigmer_agentic_agentexecution_v1_todo=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvdG9kby5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIpEBCghUb2RvSXRlbRIKCgJpZBgBIAEoCRIPCgdjb250ZW50GAIgASgJEkAKBnN0YXR1cxgDIAEoDjIwLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub2RvU3RhdHVzEhIKCmNyZWF0ZWRfYXQYBCABKAkSEgoKdXBkYXRlZF9hdBgFIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_enum]);var file_ai_stigmer_agentic_agentexecution_v1_subagent=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvc3ViYWdlbnQucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSKIBAoRU3ViQWdlbnRFeGVjdXRpb24SCgoCaWQYASABKAkSDAoEbmFtZRgCIAEoCRINCgVpbnB1dBgDIAEoCRIOCgZvdXRwdXQYBCABKAkSTgoGc3RhdHVzGAUgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlN1YkFnZW50U3RhdHVzQgi6SAWCAQIQARISCgpzdGFydGVkX2F0GAYgASgJEhQKDGNvbXBsZXRlZF9hdBgHIAEoCRINCgVlcnJvchgIIAEoCRIpCghtZXRhZGF0YRgJIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSRAoIbWVzc2FnZXMYCyADKAsyMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRNZXNzYWdlEg8KB3N1YmplY3QYDSABKAkSUQoFdG9kb3MYDiADKAsyQi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU3ViQWdlbnRFeGVjdXRpb24uVG9kb3NFbnRyeRpcCgpUb2Rvc0VudHJ5EgsKA2tleRgBIAEoCRI9CgV2YWx1ZRgCIAEoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub2RvSXRlbToCOAFiBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_agentexecution_v1_message,file_ai_stigmer_agentic_agentexecution_v1_todo,file_buf_validate_validate,file_google_protobuf_struct]);var file_ai_stigmer_agentic_agentexecution_v1_usage=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvdXNhZ2UucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSKxAwoKVG9rZW5Vc2FnZRIUCgxpbnB1dF90b2tlbnMYASABKAMSFQoNb3V0cHV0X3Rva2VucxgCIAEoAxIUCgx0b3RhbF90b2tlbnMYAyABKAMSIwobY2FjaGVfY3JlYXRpb25faW5wdXRfdG9rZW5zGAQgASgDEh8KF2NhY2hlX3JlYWRfaW5wdXRfdG9rZW5zGAUgASgDEhgKEHJlYXNvbmluZ190b2tlbnMYBiABKAMSHgoWdG9vbF91c2VfcHJvbXB0X3Rva2VucxgHIAEoAxIaChJhdWRpb19pbnB1dF90b2tlbnMYCCABKAMSGwoTYXVkaW9fb3V0cHV0X3Rva2VucxgJIAEoAxJqChZwcm92aWRlcl90b2tlbl9kZXRhaWxzGBQgAygLMkouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRva2VuVXNhZ2UuUHJvdmlkZXJUb2tlbkRldGFpbHNFbnRyeRo7ChlQcm92aWRlclRva2VuRGV0YWlsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoAzoCOAEiugMKD1ByaWNpbmdTbmFwc2hvdBIgChhwcmljaW5nX3JlZ2lzdHJ5X3ZlcnNpb24YASABKAkSOAoUcHJpY2luZ19lZmZlY3RpdmVfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhAKCGN1cnJlbmN5GAMgASgJEiYKHmlucHV0X3ByaWNlX21pY3Jvc19wZXJfbWlsbGlvbhgKIAEoAxInCh9vdXRwdXRfcHJpY2VfbWljcm9zX3Blcl9taWxsaW9uGAsgASgDEi8KJ2NhY2hlX2NyZWF0aW9uX3ByaWNlX21pY3Jvc19wZXJfbWlsbGlvbhgMIAEoAxIrCiNjYWNoZV9yZWFkX3ByaWNlX21pY3Jvc19wZXJfbWlsbGlvbhgNIAEoAxIqCiJyZWFzb25pbmdfcHJpY2VfbWljcm9zX3Blcl9taWxsaW9uGA4gASgDEiwKJGN1cnNvcl90b2tlbl9yYXRlX21pY3Jvc19wZXJfbWlsbGlvbhgPIAEoAxIdChVtYXJrdXBfcG9saWN5X3ZlcnNpb24YHiABKAkSEQoJY29zdF90aWVyGB8gASgJIqkCCglDb3N0U3RhbXASEAoIY3VycmVuY3kYASABKAkSHAoUcHJvdmlkZXJfY29zdF9taWNyb3MYAiABKAMSJwofY3VzdG9tZXJfYmlsbGFibGVfYW1vdW50X21pY3JvcxgDIAEoAxJXChJjYWxjdWxhdGlvbl9zdGF0dXMYBCABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29zdENhbGN1bGF0aW9uU3RhdHVzEkYKB3ByaWNpbmcYBSABKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUHJpY2luZ1NuYXBzaG90EiIKGmN1cnNvcl9wbGF0Zm9ybV9mZWVfbWljcm9zGAYgASgDItQDCgtQcm94eVRpbWluZxI1ChFwcm94eV9yZWNlaXZlZF9hdBgBIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASPwobdXBzdHJlYW1fcmVxdWVzdF9zdGFydGVkX2F0GAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI6ChZmaXJzdF9yZXNwb25zZV9ieXRlX2F0GAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI5ChVsYXN0X3Jlc3BvbnNlX2J5dGVfYXQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjYKEnByb3h5X2NvbXBsZXRlZF9hdBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGAoQdXBzdHJlYW1fdHRmYl9tcxgKIAEoAxIYChB1cHN0cmVhbV90dGxiX21zGAsgASgDEhoKEnN0cmVhbV9kdXJhdGlvbl9tcxgMIAEoAxIfChdwcm94eV90b3RhbF9kdXJhdGlvbl9tcxgNIAEoAxIVCg1yZXF1ZXN0X2J5dGVzGBQgASgDEhYKDnJlc3BvbnNlX2J5dGVzGBUgASgDIvoBCgtCaWxsaW5nTGluaxJOCgxkZWJpdF9zdGF0dXMYASABKA4yOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQmlsbGluZ0RlYml0U3RhdHVzEhYKDnJlc2VydmF0aW9uX2lkGAIgASgJEhgKEGJpbGxpbmdfZGViaXRfaWQYAyABKAkSLgoKZGViaXRlZF9hdBgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASHQoVYmlsbGluZ19hdHRlbXB0X2NvdW50GAUgASgFEhoKEmxhc3RfYmlsbGluZ19lcnJvchgGIAEoCSL+CgoSTGxtQ2FsbFVzYWdlUmVjb3JkEhcKD3VzYWdlX3JlY29yZF9pZBgBIAEoCRIUCgxleGVjdXRpb25faWQYAiABKAkSGQoRcm9vdF9leGVjdXRpb25faWQYAyABKAkSEAoIc2VxdWVuY2UYBCABKAUSFwoPaWRlbXBvdGVuY3lfa2V5GAUgASgJEh4KFmNhbm9uaWNhbF9wYXlsb2FkX2hhc2gYBiABKAkSDwoHY2FsbF9pZBgJIAEoCRIvCgtvYnNlcnZlZF9hdBgKIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLgoKY3JlYXRlZF9hdBgLIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASUgoPbWV0ZXJpbmdfc291cmNlGBQgASgOMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlVzYWdlTWV0ZXJpbmdTb3VyY2USSgoLdHJ1c3RfbGV2ZWwYFSABKA4yNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVXNhZ2VUcnVzdExldmVsElEKDHVzYWdlX3N0YXR1cxgWIAEoDjI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Vc2FnZUNvbXBsZXRpb25TdGF0dXMSEwoLaXNfYmlsbGFibGUYFyABKAgSEAoIcHJvdmlkZXIYHiABKAkSFwoPcmVxdWVzdGVkX21vZGVsGB8gASgJEhYKDnJlc29sdmVkX21vZGVsGCAgASgJEhAKCGVuZHBvaW50GCEgASgJEhEKCXN0cmVhbWluZxgiIAEoCBIUCgxzZXJ2aWNlX3RpZXIYIyABKAkSGwoTcHJvdmlkZXJfcmVxdWVzdF9pZBgkIAEoCRIPCgdoYXJuZXNzGCUgASgJEhkKEWN1cnNvcl9hY2NvdW50X2lkGCYgASgJEhUKDWN1cnNvcl9rZXlfaWQYJyABKAkSGAoQaHR0cF9zdGF0dXNfY29kZRgoIAEoBRIVCg1maW5pc2hfcmVhc29uGCkgASgJEhIKCmVycm9yX2NvZGUYKiABKAkSUAoRY3Vyc29yX2tleV9zb3VyY2UYKyABKA4yNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ3Vyc29yS2V5U291cmNlEhAKCHRoaW5raW5nGCwgASgJEkAKBnRva2VucxgyIAEoCzIwLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub2tlblVzYWdlEj0KBGNvc3QYMyABKAsyLy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29zdFN0YW1wEkcKDHByb3h5X3RpbWluZxg8IAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Qcm94eVRpbWluZxIbChNwcm92aWRlcl91c2FnZV9qc29uGEYgASgJEkIKB2JpbGxpbmcYUCABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQmlsbGluZ0xpbmsSDgoGb3JnX2lkGAcgASgJEhIKCnNlc3Npb25faWQYCCABKAkSVAoGbGFiZWxzGFogAygLMkQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkxsbUNhbGxVc2FnZVJlY29yZC5MYWJlbHNFbnRyeRotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIr4CChRVc2FnZVJlcG9ydEFnZ3JlZ2F0ZRIUCgxpbnB1dF90b2tlbnMYASABKAMSFQoNb3V0cHV0X3Rva2VucxgCIAEoAxIUCgx0b3RhbF90b2tlbnMYAyABKAMSIwobY2FjaGVfY3JlYXRpb25faW5wdXRfdG9rZW5zGAQgASgDEh8KF2NhY2hlX3JlYWRfaW5wdXRfdG9rZW5zGAUgASgDEhgKEHJlYXNvbmluZ190b2tlbnMYBiABKAMSFgoObGxtX2NhbGxfY291bnQYCiABKAUSHAoUYmlsbGFibGVfY29zdF9taWNyb3MYFCABKAMSHAoUcHJvdmlkZXJfY29zdF9taWNyb3MYFSABKAMSFQoNcHJpbWFyeV9tb2RlbBgeIAEoCRIYChBwcmltYXJ5X3Byb3ZpZGVyGB8gASgJIvABCgpNb2RlbFVzYWdlEg0KBW1vZGVsGAEgASgJEhAKCHByb3ZpZGVyGAIgASgJEhQKDGlucHV0X3Rva2VucxgDIAEoAxIVCg1vdXRwdXRfdG9rZW5zGAQgASgDEiMKG2NhY2hlX2NyZWF0aW9uX2lucHV0X3Rva2VucxgFIAEoAxIfChdjYWNoZV9yZWFkX2lucHV0X3Rva2VucxgGIAEoAxISCgpjYWxsX2NvdW50GAcgASgFEhwKFGJpbGxhYmxlX2Nvc3RfbWljcm9zGAggASgDEhwKFHByb3ZpZGVyX2Nvc3RfbWljcm9zGAkgASgDIq0DChVTdHJlYW1pbmdVc2FnZVN1bW1hcnkSFAoMaW5wdXRfdG9rZW5zGAEgASgDEhUKDW91dHB1dF90b2tlbnMYAiABKAMSGQoRY2FjaGVfcmVhZF90b2tlbnMYAyABKAMSGgoSY2FjaGVfd3JpdGVfdG9rZW5zGAQgASgDEhQKDHRvdGFsX3Rva2VucxgFIAEoAxISCgp0dXJuX2NvdW50GAYgASgFEhoKEmVzdGltYXRlZF9jb3N0X3VzZBgHIAEoARINCgVtb2RlbBgIIAEoCRITCgtvYnNlcnZlZF9hdBgJIAEoCRJRChZyZXF1ZXN0ZWRfc2VydmljZV90aWVyGAogASgOMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNlcnZpY2VUaWVyEh4KFnJlcXVlc3RlZF9tb2RlbF9wYXJhbXMYCyABKAkSUwoXcmVxdWVzdGVkX3RoaW5raW5nX21vZGUYDCABKA4yMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVGhpbmtpbmdNb2RlKq4CChNVc2FnZU1ldGVyaW5nU291cmNlEiUKIVVTQUdFX01FVEVSSU5HX1NPVVJDRV9VTlNQRUNJRklFRBAAEjEKLVVTQUdFX01FVEVSSU5HX1NPVVJDRV9QUk9YWV9QUk9WSURFUl9SRVBPUlRFRBABEjYKMlVTQUdFX01FVEVSSU5HX1NPVVJDRV9SVU5ORVJfUFJPVklERVJfUkVQT1JURURfT1NTEAISIwofVVNBR0VfTUVURVJJTkdfU09VUkNFX0VTVElNQVRFRBADEjMKL1VTQUdFX01FVEVSSU5HX1NPVVJDRV9QUk9WSURFUl9BRE1JTl9SRUNPTkNJTEVEEAQSKwonVVNBR0VfTUVURVJJTkdfU09VUkNFX01BTlVBTF9BREpVU1RNRU5UEAUqqAEKD1VzYWdlVHJ1c3RMZXZlbBIhCh1VU0FHRV9UUlVTVF9MRVZFTF9VTlNQRUNJRklFRBAAEicKI1VTQUdFX1RSVVNUX0xFVkVMX0JJTExJTkdfQVVUSE9SSVRZEAESJQohVVNBR0VfVFJVU1RfTEVWRUxfU0VSVkVSX09CU0VSVkVEEAISIgoeVVNBR0VfVFJVU1RfTEVWRUxfRElTUExBWV9PTkxZEAMq/AIKFVVzYWdlQ29tcGxldGlvblN0YXR1cxInCiNVU0FHRV9DT01QTEVUSU9OX1NUQVRVU19VTlNQRUNJRklFRBAAEiQKIFVTQUdFX0NPTVBMRVRJT05fU1RBVFVTX0NPTVBMRVRFEAESLgoqVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfU1RSRUFNX0lOVEVSUlVQVEVEEAISNQoxVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfUFJPVklERVJfRVJST1JfV0lUSF9VU0FHRRADEjMKL1VTQUdFX0NPTVBMRVRJT05fU1RBVFVTX1BST1ZJREVSX0VSUk9SX05PX1VTQUdFEAQSKgomVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfRVNUSU1BVEVEX09OTFkQBRImCiJVU0FHRV9DT01QTEVUSU9OX1NUQVRVU19SRUNPTkNJTEVEEAYSJAogVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfQ09ORkxJQ1QQByqfAgoSQmlsbGluZ0RlYml0U3RhdHVzEiQKIEJJTExJTkdfREVCSVRfU1RBVFVTX1VOU1BFQ0lGSUVEEAASJwojQklMTElOR19ERUJJVF9TVEFUVVNfTk9UX0FQUExJQ0FCTEUQARIgChxCSUxMSU5HX0RFQklUX1NUQVRVU19QRU5ESU5HEAISIAocQklMTElOR19ERUJJVF9TVEFUVVNfREVCSVRFRBADEikKJUJJTExJTkdfREVCSVRfU1RBVFVTX0ZBSUxFRF9SRVRSWUFCTEUQBBIoCiRCSUxMSU5HX0RFQklUX1NUQVRVU19GQUlMRURfVEVSTUlOQUwQBRIhCh1CSUxMSU5HX0RFQklUX1NUQVRVU19DT05GTElDVBAGKo8CChVDb3N0Q2FsY3VsYXRpb25TdGF0dXMSJwojQ09TVF9DQUxDVUxBVElPTl9TVEFUVVNfVU5TUEVDSUZJRUQQABIkCiBDT1NUX0NBTENVTEFUSU9OX1NUQVRVU19DT01QVVRFRBABEiUKIUNPU1RfQ0FMQ1VMQVRJT05fU1RBVFVTX0VTVElNQVRFRBACEisKJ0NPU1RfQ0FMQ1VMQVRJT05fU1RBVFVTX1BSSUNFX05PVF9GT1VORBADEiYKIkNPU1RfQ0FMQ1VMQVRJT05fU1RBVFVTX1JFQ09OQ0lMRUQQBBIrCidDT1NUX0NBTENVTEFUSU9OX1NUQVRVU19NQU5VQUxfQURKVVNURUQQBSpXCg9DdXJzb3JLZXlTb3VyY2USIQodQ1VSU09SX0tFWV9TT1VSQ0VfVU5TUEVDSUZJRUQQABIhCh1DVVJTT1JfS0VZX1NPVVJDRV9NQU5BR0VEX0tFWRABYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_google_protobuf_timestamp]);var UsageReportAggregateSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_usage,6);var UsageMeteringSource;(function(UsageMeteringSource2){UsageMeteringSource2[UsageMeteringSource2.UNSPECIFIED=0]="UNSPECIFIED",UsageMeteringSource2[UsageMeteringSource2.PROXY_PROVIDER_REPORTED=1]="PROXY_PROVIDER_REPORTED",UsageMeteringSource2[UsageMeteringSource2.RUNNER_PROVIDER_REPORTED_OSS=2]="RUNNER_PROVIDER_REPORTED_OSS",UsageMeteringSource2[UsageMeteringSource2.ESTIMATED=3]="ESTIMATED",UsageMeteringSource2[UsageMeteringSource2.PROVIDER_ADMIN_RECONCILED=4]="PROVIDER_ADMIN_RECONCILED",UsageMeteringSource2[UsageMeteringSource2.MANUAL_ADJUSTMENT=5]="MANUAL_ADJUSTMENT"})(UsageMeteringSource||(UsageMeteringSource={}));var UsageTrustLevel;(function(UsageTrustLevel2){UsageTrustLevel2[UsageTrustLevel2.UNSPECIFIED=0]="UNSPECIFIED",UsageTrustLevel2[UsageTrustLevel2.BILLING_AUTHORITY=1]="BILLING_AUTHORITY",UsageTrustLevel2[UsageTrustLevel2.SERVER_OBSERVED=2]="SERVER_OBSERVED",UsageTrustLevel2[UsageTrustLevel2.DISPLAY_ONLY=3]="DISPLAY_ONLY"})(UsageTrustLevel||(UsageTrustLevel={}));var UsageCompletionStatus;(function(UsageCompletionStatus2){UsageCompletionStatus2[UsageCompletionStatus2.UNSPECIFIED=0]="UNSPECIFIED",UsageCompletionStatus2[UsageCompletionStatus2.COMPLETE=1]="COMPLETE",UsageCompletionStatus2[UsageCompletionStatus2.STREAM_INTERRUPTED=2]="STREAM_INTERRUPTED",UsageCompletionStatus2[UsageCompletionStatus2.PROVIDER_ERROR_WITH_USAGE=3]="PROVIDER_ERROR_WITH_USAGE",UsageCompletionStatus2[UsageCompletionStatus2.PROVIDER_ERROR_NO_USAGE=4]="PROVIDER_ERROR_NO_USAGE",UsageCompletionStatus2[UsageCompletionStatus2.ESTIMATED_ONLY=5]="ESTIMATED_ONLY",UsageCompletionStatus2[UsageCompletionStatus2.RECONCILED=6]="RECONCILED",UsageCompletionStatus2[UsageCompletionStatus2.CONFLICT=7]="CONFLICT"})(UsageCompletionStatus||(UsageCompletionStatus={}));var BillingDebitStatus;(function(BillingDebitStatus2){BillingDebitStatus2[BillingDebitStatus2.UNSPECIFIED=0]="UNSPECIFIED",BillingDebitStatus2[BillingDebitStatus2.NOT_APPLICABLE=1]="NOT_APPLICABLE",BillingDebitStatus2[BillingDebitStatus2.PENDING=2]="PENDING",BillingDebitStatus2[BillingDebitStatus2.DEBITED=3]="DEBITED",BillingDebitStatus2[BillingDebitStatus2.FAILED_RETRYABLE=4]="FAILED_RETRYABLE",BillingDebitStatus2[BillingDebitStatus2.FAILED_TERMINAL=5]="FAILED_TERMINAL",BillingDebitStatus2[BillingDebitStatus2.CONFLICT=6]="CONFLICT"})(BillingDebitStatus||(BillingDebitStatus={}));var CostCalculationStatus;(function(CostCalculationStatus2){CostCalculationStatus2[CostCalculationStatus2.UNSPECIFIED=0]="UNSPECIFIED",CostCalculationStatus2[CostCalculationStatus2.COMPUTED=1]="COMPUTED",CostCalculationStatus2[CostCalculationStatus2.ESTIMATED=2]="ESTIMATED",CostCalculationStatus2[CostCalculationStatus2.PRICE_NOT_FOUND=3]="PRICE_NOT_FOUND",CostCalculationStatus2[CostCalculationStatus2.RECONCILED=4]="RECONCILED",CostCalculationStatus2[CostCalculationStatus2.MANUAL_ADJUSTED=5]="MANUAL_ADJUSTED"})(CostCalculationStatus||(CostCalculationStatus={}));var CursorKeySource;(function(CursorKeySource2){CursorKeySource2[CursorKeySource2.UNSPECIFIED=0]="UNSPECIFIED",CursorKeySource2[CursorKeySource2.MANAGED_KEY=1]="MANAGED_KEY"})(CursorKeySource||(CursorKeySource={}));var file_ai_stigmer_agentic_agentexecution_v1_writeback=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvd3JpdGViYWNrLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEimgIKEldvcmtzcGFjZVdyaXRlQmFjaxIcChR3b3Jrc3BhY2VfZW50cnlfbmFtZRgBIAEoCRITCgticmFuY2hfbmFtZRgCIAEoCRITCgtiYXNlX2JyYW5jaBgDIAEoCRISCgpjb21taXRfc2hhGAQgASgJEhgKEHB1bGxfcmVxdWVzdF91cmwYBSABKAkSGwoTcHVsbF9yZXF1ZXN0X251bWJlchgGIAEoBRIUCgxkaWZmX3N1bW1hcnkYByABKAkSTAoFcGhhc2UYCCABKA4yPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuV29ya3NwYWNlV3JpdGVCYWNrUGhhc2USDQoFZXJyb3IYCSABKAkq0AEKF1dvcmtzcGFjZVdyaXRlQmFja1BoYXNlEioKJldPUktTUEFDRV9XUklURV9CQUNLX1BIQVNFX1VOU1BFQ0lGSUVEEAASIgoeV09SS1NQQUNFX1dSSVRFX0JBQ0tfQ09NTUlUVEVEEAESHwobV09SS1NQQUNFX1dSSVRFX0JBQ0tfUFVTSEVEEAISIwofV09SS1NQQUNFX1dSSVRFX0JBQ0tfUFJfQ1JFQVRFRBADEh8KG1dPUktTUEFDRV9XUklURV9CQUNLX0ZBSUxFRBAEYgZwcm90bzM");var WorkspaceWriteBackPhase;(function(WorkspaceWriteBackPhase2){WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_PHASE_UNSPECIFIED=0]="WORKSPACE_WRITE_BACK_PHASE_UNSPECIFIED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_COMMITTED=1]="WORKSPACE_WRITE_BACK_COMMITTED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_PUSHED=2]="WORKSPACE_WRITE_BACK_PUSHED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_PR_CREATED=3]="WORKSPACE_WRITE_BACK_PR_CREATED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_FAILED=4]="WORKSPACE_WRITE_BACK_FAILED"})(WorkspaceWriteBackPhase||(WorkspaceWriteBackPhase={}));var file_ai_stigmer_agentic_agentexecution_v1_api=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvYXBpLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEiywIKDkFnZW50RXhlY3V0aW9uEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiMKBGtpbmQYAiABKAlCFbpIEnIQCg5BZ2VudEV4ZWN1dGlvbhJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESRgoEc3BlYxgEIAEoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvblNwZWMSSgoGc3RhdHVzGAUgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uU3RhdHVzIrcMChRBZ2VudEV4ZWN1dGlvblN0YXR1cxI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0EkQKCG1lc3NhZ2VzGAEgAygLMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50TWVzc2FnZRJNCgVwaGFzZRgCIAEoDjI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25QaGFzZUIIukgFggECEAESVQoUc3ViX2FnZW50X2V4ZWN1dGlvbnMYBCADKAsyNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU3ViQWdlbnRFeGVjdXRpb24SDQoFZXJyb3IYBiABKAkSEgoKc3RhcnRlZF9hdBgHIAEoCRIUCgxjb21wbGV0ZWRfYXQYCCABKAkSVAoFdG9kb3MYCSADKAsyRS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb25TdGF0dXMuVG9kb3NFbnRyeRIWCg5jYWxsYmFja190b2tlbhgKIAEoDBJQChFwZW5kaW5nX2FwcHJvdmFscxgQIAMoCzI1LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5QZW5kaW5nQXBwcm92YWwSWAoVYXBwcm92YWxfZXZlbnRfc3RyZWFtGBYgASgLMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsRXZlbnRTdHJlYW0SRwoMY29udGV4dF9pbmZvGA4gASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkNvbnRleHRJbmZvEkoKCWFydGlmYWN0cxgPIAMoCzI3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25BcnRpZmFjdBJXChV3b3Jrc3BhY2Vfd3JpdGVfYmFja3MYESADKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuV29ya3NwYWNlV3JpdGVCYWNrEksKDnNldHVwX3Byb2dyZXNzGBIgASgLMjMuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNldHVwUHJvZ3Jlc3MSVAoPc3RyZWFtaW5nX3VzYWdlGBQgASgLMjsuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlN0cmVhbWluZ1VzYWdlU3VtbWFyeRIyChFzdHJ1Y3R1cmVkX291dHB1dBgVIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSTQoQZmlsZV9jaGFuZ2Vfc2V0cxgXIAMoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ2hhbmdlU2V0El0KGGZpbGVfcmV2aWV3X2V2ZW50X3N0cmVhbRgYIAEoCzI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlUmV2aWV3RXZlbnRTdHJlYW0SVgoUZmlsZV9jaGFuZ2VfcHJvZ3Jlc3MYGSABKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNoYW5nZVByb2dyZXNzEl4KGHJlY2FsbGVkX21lbW9yaWVzX3JlcG9ydBgaIAEoCzI8LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5SZWNhbGxlZE1lbW9yaWVzUmVwb3J0GlwKClRvZG9zRW50cnkSCwoDa2V5GAEgASgJEj0KBXZhbHVlGAIgASgLMi4uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvZG9JdGVtOgI4AUoECAwQDVIQcmVzb2x2ZWRfY29udGV4dCImCg1TZXR1cFByb2dyZXNzEhUKDWN1cnJlbnRfcGhhc2UYASABKAkiaAoWUmVjYWxsZWRNZW1vcmllc1JlcG9ydBIYChBzZWxlY3Rpb25fYWN0aXZlGAEgASgIEhsKE2luamVjdGVkX21lbW9yeV9pZHMYAiADKAkSFwoPZW1iZWRkaW5nX21vZGVsGAMgASgJYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_approval,file_ai_stigmer_agentic_agentexecution_v1_artifact,file_ai_stigmer_agentic_agentexecution_v1_context,file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_agentexecution_v1_filereview,file_ai_stigmer_agentic_agentexecution_v1_message,file_ai_stigmer_agentic_agentexecution_v1_spec,file_ai_stigmer_agentic_agentexecution_v1_subagent,file_ai_stigmer_agentic_agentexecution_v1_todo,file_ai_stigmer_agentic_agentexecution_v1_usage,file_ai_stigmer_agentic_agentexecution_v1_writeback,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_struct]),AgentExecutionSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_api,0),AgentExecutionStatusSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_api,1);var agentExecutionDeclaration=declareKind({kind:ApiResourceKind.agent_execution,schema:AgentExecutionSchema,source:"fga/model/agentic/agent_execution.fga",relations:[["session",direct(objectOf("session"))],["owner",from("owner","session")],["viewer",union(from("viewer","session"),computed("owner"))],["can_view",union(computed("viewer"),from("can_view","session"))],["can_edit",computed("owner")]]});var file_ai_stigmer_agentic_agentinstance_v1_spec=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRpbnN0YW5jZS92MS9zcGVjLnByb3RvEiNhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRpbnN0YW5jZS52MSKpAgoRQWdlbnRJbnN0YW5jZVNwZWMSGQoIYWdlbnRfaWQYASABKAlCB7pIBHICEAESEwoLZGVzY3JpcHRpb24YAiABKAkSyAEKEGVudmlyb25tZW50X3JlZnMYAyADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCeLpIcZIBbiJsugFpChVlbnZpcm9ubWVudF9yZWZzLmtpbmQSP2Vudmlyb25tZW50X3JlZnMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1lbnZpcm9ubWVudBoPdGhpcy5raW5kID09IDUz4IUsNUoECAQQBVITZGF0YXN0b3JlX3BhcnRpdGlvbmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]);var file_ai_stigmer_agentic_agentinstance_v1_api=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRpbnN0YW5jZS92MS9hcGkucHJvdG8SI2FpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxIsMCCg1BZ2VudEluc3RhbmNlEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiIKBGtpbmQYAiABKAlCFLpIEXIPCg1BZ2VudEluc3RhbmNlEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJECgRzcGVjGAQgASgLMjYuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuQWdlbnRJbnN0YW5jZVNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_agentinstance_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),AgentInstanceSchema=messageDesc2(file_ai_stigmer_agentic_agentinstance_v1_api,0);function defaultOfBlueprint(blueprint){let blueprintType=kindEnumName(blueprint.kind);return async(object,row,loader2)=>{let blueprintId=parentIdOf(row,blueprintSpecFieldOf(object.type,blueprint.kind));if(blueprintId==="")return[];let loaded=await loader2.load({type:blueprintType,id:blueprintId});return loaded===void 0||!isMessage2(loaded,blueprint.schema)||blueprint.defaultInstanceIdOf(loaded)!==object.id?[]:[{object,relation:"default_of",subject:{form:"object",object:{type:blueprintType,id:blueprintId}}}]}}function blueprintSpecFieldOf(instanceType,blueprintKind){let instanceKind=kindByEnumName(instanceType),entry=getKindMeta(instanceKind).authorization?.additionalParents?.find(parent=>getKindEnum(parent.kind)===blueprintKind);if(entry===void 0)throw new Error(`${instanceType} declares default_of but kind_meta names no ${kindEnumName(blueprintKind)} parent`);return entry.specField}var agentInstanceDeclaration=declareKind({kind:ApiResourceKind.agent_instance,schema:AgentInstanceSchema,source:"fga/model/agentic/agent_instance.fga",relations:[["organization",direct(objectOf("organization"))],["agent",direct(objectOf("agent"))],["default_of",direct(objectOf("agent"))],["owner",direct(objectOf("identity_account"))],["viewer",union(direct(objectOf("identity_account"),publicWith("identity_account","allow_public"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"),from("viewer","default_of"))],["can_view",computed("viewer")],["can_execute",computed("can_view")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]],derived:[["default_of",defaultOfBlueprint({kind:ApiResourceKind.agent,schema:AgentSchema,defaultInstanceIdOf:agent=>agent.status?.defaultInstanceId??""})]]});var file_ai_stigmer_agentic_agentshare_v1_spec=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9zcGVjLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MSLWCQoOQWdlbnRTaGFyZVNwZWMSrAEKCWFnZW50X3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUJjukhcugFWCg5hZ2VudF9yZWYua2luZBIzYWdlbnRfcmVmIG11c3QgcmVmZXJlbmNlIGEgcmVzb3VyY2Ugd2l0aCBraW5kPWFnZW50Gg90aGlzLmtpbmQgPT0gNDDIAQHghSwoEg8KB2VuYWJsZWQYAiABKAgSRgoIYXVkaWVuY2UYAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MS5BZ2VudFNoYXJlQXVkaWVuY2USsAIKD2FsbG93ZWRfb3JpZ2lucxgEIAMoCUKWArpIkgKSAY4CECAiiQK6AYUCChZhbGxvd2VkX29yaWdpbnMuZm9ybWF0Em5hbGxvd2VkX29yaWdpbnMgZW50cmllcyBtdXN0IGJlIGV4YWN0IHdlYiBvcmlnaW5zIGxpa2UgaHR0cHM6Ly9leGFtcGxlLmNvbSAobm8gcGF0aCwgcXVlcnksIG9yIHRyYWlsaW5nIHNsYXNoKRp7dGhpcy5tYXRjaGVzKCdeaHR0cHM/Oi8vW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8oXFwuW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8pKig6WzAtOV17MSw1fSk/JCcpEkYKCG1lc3NhZ2VzGAUgASgLMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZU1lc3NhZ2VzEsgBChBlbnZpcm9ubWVudF9yZWZzGAYgAygLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlQni6SHGSAW4ibLoBaQoVZW52aXJvbm1lbnRfcmVmcy5raW5kEj9lbnZpcm9ubWVudF9yZWZzIG11c3QgcmVmZXJlbmNlIHJlc291cmNlcyB3aXRoIGtpbmQ9ZW52aXJvbm1lbnQaD3RoaXMua2luZCA9PSA1M+CFLDUSQwoKcnVuX2NvbmZpZxgHIAEoCzIvLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5SdW5Db25maWc6sAK6SKwCGp8BCihhZ2VudF9zaGFyZS5lbnZpcm9ubWVudF9yZWZzX3B1YmxpY19vbmx5EjplbnZpcm9ubWVudF9yZWZzIGNhbiBvbmx5IGJlIHNldCBvbiBwdWJsaWMtYXVkaWVuY2Ugc2hhcmVzGjd0aGlzLmF1ZGllbmNlICE9IDIgfHwgdGhpcy5lbnZpcm9ubWVudF9yZWZzLnNpemUoKSA9PSAwGocBCiJhZ2VudF9zaGFyZS5ydW5fY29uZmlnX3B1YmxpY19vbmx5EjRydW5fY29uZmlnIGNhbiBvbmx5IGJlIHNldCBvbiBwdWJsaWMtYXVkaWVuY2Ugc2hhcmVzGit0aGlzLmF1ZGllbmNlICE9IDIgfHwgIWhhcyh0aGlzLnJ1bl9jb25maWcpInkKEkFnZW50U2hhcmVNZXNzYWdlcxIeCgxyYXRlX2xpbWl0ZWQYASABKAlCCLpIBXIDGKwCEh0KC3VuYXZhaWxhYmxlGAIgASgJQgi6SAVyAxisAhIkChJjb252ZXJzYXRpb25fZW5kZWQYAyABKAlCCLpIBXIDGKwCKnkKEkFnZW50U2hhcmVBdWRpZW5jZRIkCiBhZ2VudF9zaGFyZV9hdWRpZW5jZV91bnNwZWNpZmllZBAAEh8KG2FnZW50X3NoYXJlX2F1ZGllbmNlX3B1YmxpYxABEhwKGGFnZW50X3NoYXJlX2F1ZGllbmNlX29yZxACYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_invocation,file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]);var AgentShareAudience;(function(AgentShareAudience2){AgentShareAudience2[AgentShareAudience2.unspecified=0]="unspecified",AgentShareAudience2[AgentShareAudience2.public=1]="public",AgentShareAudience2[AgentShareAudience2.org=2]="org"})(AgentShareAudience||(AgentShareAudience={}));var file_ai_stigmer_agentic_agentshare_v1_status=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9zdGF0dXMucHJvdG8SIGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxIn8KEEFnZW50U2hhcmVTdGF0dXMSPwoFYXVkaXQYYyABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdBIYChBzaGFyZV9saW5rX3Rva2VuGAEgASgJEhAKCGFnZW50X2lkGAIgASgJYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_status]),AgentShareStatusSchema=messageDesc2(file_ai_stigmer_agentic_agentshare_v1_status,0);var file_ai_stigmer_agentic_agentshare_v1_api=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9hcGkucHJvdG8SIGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxIrMCCgpBZ2VudFNoYXJlEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEh8KBGtpbmQYAiABKAlCEbpIDnIMCgpBZ2VudFNoYXJlEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARI+CgRzcGVjGAQgASgLMjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZVNwZWMSQgoGc3RhdHVzGAUgASgLMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZVN0YXR1c2IGcHJvdG8z",[file_ai_stigmer_agentic_agentshare_v1_spec,file_ai_stigmer_agentic_agentshare_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),AgentShareSchema=messageDesc2(file_ai_stigmer_agentic_agentshare_v1_api,0);var agentShareDeclaration=declareKind({kind:ApiResourceKind.agent_share,schema:AgentShareSchema,source:"fga/model/agentic/agent_share.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["viewer",union(direct(objectOf("identity_account")),computed("owner"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_iam_apikey_v1_spec=fileDesc("CiNhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvc3BlYy5wcm90bxIYYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxIoYBCgpBcGlLZXlTcGVjEhYKCGtleV9oYXNoGAEgASgJQgTIhSwBEhkKC2ZpbmdlcnByaW50GAIgASgJQgTIhSwBEi4KCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhUKDW5ldmVyX2V4cGlyZXMYBCABKAhiBnByb3RvMw",[file_ai_stigmer_commons_apiresource_field_options,file_google_protobuf_timestamp]);var file_ai_stigmer_iam_apikey_v1_api=fileDesc("CiJhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvYXBpLnByb3RvEhhhaS5zdGlnbWVyLmlhbS5hcGlrZXkudjEihwIKBkFwaUtleRItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEhsKBGtpbmQYAiABKAlCDbpICnIICgZBcGlLZXkSRQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YRIyCgRzcGVjGAQgASgLMiQuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleVNwZWMSNgoGc3RhdHVzGAUgASgLMiYuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleVN0YXR1cyKBAQoMQXBpS2V5U3RhdHVzEj8KBWF1ZGl0GGMgASgLMjAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXQSMAoMbGFzdF91c2VkX2F0GAEgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_apikey_v1_spec,file_buf_validate_validate,file_google_protobuf_timestamp]),ApiKeySchema=messageDesc2(file_ai_stigmer_iam_apikey_v1_api,0);var apiKeyDeclaration=declareKind({kind:ApiResourceKind.api_key,schema:ApiKeySchema,source:"fga/model/iam/api_key.fga",relations:[["owner",direct(objectOf("identity_account"))],["can_view",computed("owner")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_rotate",computed("owner")],["can_revoke",computed("owner")],["can_use",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("owner")]]});var file_ai_stigmer_agentic_artifact_v1_enum=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvZW51bS5wcm90bxIeYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxKoUBChRBcnRpZmFjdFN0b3JhZ2VTdGF0ZRIdChlzdG9yYWdlX3N0YXRlX3Vuc3BlY2lmaWVkEAASGQoVc3RvcmFnZV9zdGF0ZV9wZW5kaW5nEAESGAoUc3RvcmFnZV9zdGF0ZV9zdG9yZWQQAhIZChVzdG9yYWdlX3N0YXRlX2RlbGV0ZWQQA2IGcHJvdG8z"),ArtifactStorageState;(function(ArtifactStorageState2){ArtifactStorageState2[ArtifactStorageState2.storage_state_unspecified=0]="storage_state_unspecified",ArtifactStorageState2[ArtifactStorageState2.storage_state_pending=1]="storage_state_pending",ArtifactStorageState2[ArtifactStorageState2.storage_state_stored=2]="storage_state_stored",ArtifactStorageState2[ArtifactStorageState2.storage_state_deleted=3]="storage_state_deleted"})(ArtifactStorageState||(ArtifactStorageState={}));var file_ai_stigmer_agentic_artifact_v1_spec=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvc3BlYy5wcm90bxIeYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxIuQBCgxBcnRpZmFjdFNwZWMSIwoMY29udGVudF90eXBlGAEgASgJQg26SArIAQFyBRABGP8BEiMKDGRpc3BsYXlfbmFtZRgCIAEoCUINukgKyAEBcgUQARj/ARJGCgZzb3VyY2UYAyABKAsyLi5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuQXJ0aWZhY3RTb3VyY2VCBrpIA8gBARJCCglyZXRlbnRpb24YBCABKAsyLy5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuUmV0ZW50aW9uUG9saWN5Il4KDkFydGlmYWN0U291cmNlEh0KFXdvcmtmbG93X2V4ZWN1dGlvbl9pZBgBIAEoCRIaChJhZ2VudF9leGVjdXRpb25faWQYAiABKAkSEQoJdGFza19uYW1lGAMgASgJIiMKD1JldGVudGlvblBvbGljeRIQCgh0dGxfZGF5cxgBIAEoBWIGcHJvdG8z",[file_buf_validate_validate]);var file_ai_stigmer_agentic_artifact_v1_api=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvYXBpLnByb3RvEh5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEipwIKCEFydGlmYWN0EjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEh0KBGtpbmQYAiABKAlCD7pIDHIKCghBcnRpZmFjdBJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESOgoEc3BlYxgEIAEoCzIsLmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5BcnRpZmFjdFNwZWMSPgoGc3RhdHVzGAUgASgLMi4uYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxLkFydGlmYWN0U3RhdHVzItwBCg5BcnRpZmFjdFN0YXR1cxI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0EhQKDGNvbnRlbnRfaGFzaBgBIAEoCRISCgpzaXplX2J5dGVzGAIgASgDEksKDXN0b3JhZ2Vfc3RhdGUYAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuQXJ0aWZhY3RTdG9yYWdlU3RhdGUSEgoKZXhwaXJlc19hdBgEIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_artifact_v1_enum,file_ai_stigmer_agentic_artifact_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),ArtifactSchema=messageDesc2(file_ai_stigmer_agentic_artifact_v1_api,0),ArtifactStatusSchema=messageDesc2(file_ai_stigmer_agentic_artifact_v1_api,1);var artifactDeclaration=declareKind({kind:ApiResourceKind.artifact,schema:ArtifactSchema,source:"fga/model/agentic/artifact.fga",relations:[["organization",direct(objectOf("organization"))],["owner",direct(objectOf("identity_account"))],["viewer",union(direct(objectOf("identity_account")),from("viewer","organization"))],["can_view",union(computed("owner"),computed("viewer"))],["can_edit",from("admin","organization")]]});var file_ai_stigmer_agentic_channelapp_v1_spec=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9zcGVjLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MSLEAQoOQ2hhbm5lbEFwcFNwZWMSSAoFc2xhY2sYASABKAsyNy5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5TbGFja0NoYW5uZWxBcHBDb25maWdIABJOCgh3aGF0c2FwcBgCIAEoCzI6LmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLldoYXRzQXBwQ2hhbm5lbEFwcENvbmZpZ0gAQhgKD3Byb3ZpZGVyX2NvbmZpZxIFukgCCAEidAoVU2xhY2tDaGFubmVsQXBwQ29uZmlnEhoKCWNsaWVudF9pZBgBIAEoCUIHukgEcgIQARIeCg1jbGllbnRfc2VjcmV0GAIgASgJQge6SARyAhABEh8KDnNpZ25pbmdfc2VjcmV0GAMgASgJQge6SARyAhABIo4BChhXaGF0c0FwcENoYW5uZWxBcHBDb25maWcSFwoGYXBwX2lkGAEgASgJQge6SARyAhABEhsKCmFwcF9zZWNyZXQYAiABKAlCB7pIBHICEAESHQoMYWNjZXNzX3Rva2VuGAMgASgJQge6SARyAhABEh0KDHZlcmlmeV90b2tlbhgEIAEoCUIHukgEcgIQAWIGcHJvdG8z",[file_buf_validate_validate]);var file_ai_stigmer_agentic_channelapp_v1_api=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9hcGkucHJvdG8SIGFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxIrcCCgpDaGFubmVsQXBwEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEh8KBGtpbmQYAiABKAlCEbpIDnIMCgpDaGFubmVsQXBwEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARI+CgRzcGVjGAQgASgLMjAuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcFNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_channelapp_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),ChannelAppSchema=messageDesc2(file_ai_stigmer_agentic_channelapp_v1_api,0);var channelAppDeclaration=declareKind({kind:ApiResourceKind.channel_app,schema:ChannelAppSchema,source:"fga/model/agentic/channel_app.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["viewer",union(direct(objectOf("identity_account")),computed("owner"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var environmentDeclaration=declareKind({kind:ApiResourceKind.environment,schema:EnvironmentSchema,source:"fga/model/agentic/environment.fga",relations:[["organization",direct(objectOf("organization"))],["creator",direct(objectOf("identity_account"))],["owner",direct(objectOf("identity_account"))],["viewer",union(direct(objectOf("identity_account"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_read_secrets",computed("creator")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_agentic_executioncontext_v1_api=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9hcGkucHJvdG8SJmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxIs8CChBFeGVjdXRpb25Db250ZXh0EjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiUKBGtpbmQYAiABKAlCF7pIFHISChBFeGVjdXRpb25Db250ZXh0Ek0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJKCgRzcGVjGAQgASgLMjwuYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dFNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),ExecutionContextSchema=messageDesc2(file_ai_stigmer_agentic_executioncontext_v1_api,0);var executionContextDeclaration=declareKind({kind:ApiResourceKind.execution_context,schema:ExecutionContextSchema,source:"fga/model/agentic/execution_context.fga",relations:[["owner",direct(objectOf("identity_account"))],["can_view",computed("owner")],["can_edit",computed("owner")]]});var file_ai_stigmer_iam_iampolicy_v1_api=fileDesc("CiVhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvYXBpLnByb3RvEhthaS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEimQIKCUlhbVBvbGljeRItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEh4KBGtpbmQYAiABKAlCELpIDXILCglJYW1Qb2xpY3kSRQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YRI4CgRzcGVjGAQgASgLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMSPAoGc3RhdHVzGAUgASgLMiwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVN0YXR1cyJSCg9JYW1Qb2xpY3lTdGF0dXMSPwoFYXVkaXQYASABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_iampolicy_v1_spec,file_buf_validate_validate]),IamPolicySchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_api,0);var iamPolicyDeclaration=declareKind({kind:ApiResourceKind.iam_policy,schema:IamPolicySchema,source:"fga/model/iam/iam_policy.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["viewer",from("admin","organization")],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var identityAccountDeclaration=declareKind({kind:ApiResourceKind.identity_account,schema:IdentityAccountSchema,source:"fga/model/iam/identity_account.fga",relations:[["owner",direct(objectOf("identity_account"))],["can_view",computed("owner")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("owner")]]});var mcpServerDeclaration=declareKind({kind:ApiResourceKind.mcp_server,schema:McpServerSchema,source:"fga/model/agentic/mcp_server.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["platform_viewer",direct(usersetOf("identity_provider","platform_user"))],["viewer",union(direct(objectOf("identity_account"),publicWith("identity_account","allow_public"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"),computed("platform_viewer"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_use",computed("viewer")],["can_clone",computed("viewer")],["can_connect",computed("viewer")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_agentic_memory_v1_spec=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3NwZWMucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEikgEKCk1lbW9yeVNwZWMSGwoHY29udGVudBgBIAEoCUIKukgHcgUQARj0AxIjChtzdWJqZWN0X2lkZW50aXR5X2FjY291bnRfaWQYAiABKAkSQgoKcHJvdmVuYW5jZRgDIAEoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5UHJvdmVuYW5jZSJqChBNZW1vcnlQcm92ZW5hbmNlEhAKCGFnZW50X2lkGAEgASgJEhIKCnNlc3Npb25faWQYAiABKAkSGgoSYWdlbnRfZXhlY3V0aW9uX2lkGAMgASgJEhQKDHRvb2xfY2FsbF9pZBgEIAEoCWIGcHJvdG8z",[file_buf_validate_validate]);var MemoryProvenanceSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_spec,1);var file_ai_stigmer_agentic_memory_v1_enum=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2VudW0ucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEqkgEKFE1lbW9yeUxpZmVjeWNsZVN0YXRlEh8KG2xpZmVjeWNsZV9zdGF0ZV91bnNwZWNpZmllZBAAEhwKGGxpZmVjeWNsZV9zdGF0ZV9wcm9wb3NlZBABEh0KGWxpZmVjeWNsZV9zdGF0ZV9jb25maXJtZWQQAhIcChhsaWZlY3ljbGVfc3RhdGVfcmVqZWN0ZWQQA2IGcHJvdG8z"),MemoryLifecycleState;(function(MemoryLifecycleState2){MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_unspecified=0]="lifecycle_state_unspecified",MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_proposed=1]="lifecycle_state_proposed",MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_confirmed=2]="lifecycle_state_confirmed",MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_rejected=3]="lifecycle_state_rejected"})(MemoryLifecycleState||(MemoryLifecycleState={}));var file_ai_stigmer_agentic_memory_v1_status=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3N0YXR1cy5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MSLSAQoMTWVtb3J5U3RhdHVzEksKD2xpZmVjeWNsZV9zdGF0ZRgBIAEoDjIyLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5TGlmZWN5Y2xlU3RhdGUSNAoQc3RhdGVfY2hhbmdlZF9hdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASPwoFYXVkaXQYYyABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdGIGcHJvdG8z",[file_ai_stigmer_agentic_memory_v1_enum,file_ai_stigmer_commons_apiresource_status,file_google_protobuf_timestamp]),MemoryStatusSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_status,0);var file_ai_stigmer_agentic_memory_v1_api=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2FwaS5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MSKbAgoGTWVtb3J5EjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEhsKBGtpbmQYAiABKAlCDbpICnIICgZNZW1vcnkSTQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YUIGukgDyAEBEjYKBHNwZWMYBCABKAsyKC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeVNwZWMSOgoGc3RhdHVzGAUgASgLMiouYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_memory_v1_spec,file_ai_stigmer_agentic_memory_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),MemorySchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_api,0);var memoryDeclaration=declareKind({kind:ApiResourceKind.memory,schema:MemorySchema,source:"fga/model/agentic/memory.fga",relations:[["organization",direct(objectOf("organization"))],["subject",direct(objectOf("identity_account"))],["can_view",computed("subject")],["can_edit",computed("subject")],["can_delete",computed("subject")]]});var file_ai_stigmer_iam_oauthapp_v1_api=fileDesc("CiRhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9hcGkucHJvdG8SGmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxIqcCCghPQXV0aEFwcBItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEh0KBGtpbmQYAiABKAlCD7pIDHIKCghPQXV0aEFwcBJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESNgoEc3BlYxgEIAEoCzIoLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwU3BlYxJGCgZzdGF0dXMYBSABKAsyNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdFN0YXR1c2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_oauthapp_v1_spec,file_buf_validate_validate]),OAuthAppSchema=messageDesc2(file_ai_stigmer_iam_oauthapp_v1_api,0);var oauthAppDeclaration=declareKind({kind:ApiResourceKind.oauth_app,schema:OAuthAppSchema,source:"fga/model/iam/oauth_app.fga",relations:[["organization",direct(objectOf("organization"))],["owner",direct(objectOf("identity_account"))],["viewer",union(direct(objectOf("identity_account")),computed("owner"),from("admin","organization"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var organizationDeclaration=declareKind({kind:ApiResourceKind.organization,schema:OrganizationSchema,source:"fga/model/tenancy/organization.fga",relations:[["owner",direct(objectOf("identity_account"))],["admin",union(direct(objectOf("identity_account")),computed("owner"))],["member",union(direct(objectOf("identity_account")),computed("admin"))],["viewer",union(direct(objectOf("identity_account")),computed("member"))],["guest",direct(objectOf("identity_account"))],["can_view",computed("viewer")],["can_edit",computed("admin")],["can_delete",computed("owner")],["can_manage_members",computed("admin")],["can_assign_roles",computed("owner")],["can_create_project",computed("admin")],["can_create_agent",computed("admin")],["can_create_workflow",computed("admin")],["can_create_session",union(computed("member"),computed("guest"))],["can_create_environment",computed("member")],["can_create_skill",computed("admin")],["can_create_plugin",computed("admin")],["can_create_idp",computed("admin")],["can_create_identity_account",computed("admin")],["can_create_oauth_app",computed("admin")],["can_create_platform_client",computed("admin")],["can_create_channel_app",computed("admin")],["can_create_execution_in",union(computed("member"),computed("guest"))],["can_create_agent_share",computed("admin")],["can_grant_access",computed("admin")],["can_view_access",computed("viewer")],["can_view_billing",computed("viewer")],["can_manage_billing",computed("admin")]]});var file_ai_stigmer_agentic_plugin_v1_spec=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3NwZWMucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEigwIKClBsdWdpblNwZWMSDAoEbmFtZRgBIAEoCRIPCgd2ZXJzaW9uGAIgASgJEhMKC2Rlc2NyaXB0aW9uGAMgASgJEjoKBmF1dGhvchgEIAEoCzIqLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luQXV0aG9yEhAKCGhvbWVwYWdlGAUgASgJEhIKCnJlcG9zaXRvcnkYBiABKAkSDwoHbGljZW5zZRgHIAEoCRIQCghrZXl3b3JkcxgIIAMoCRI8CgdkaWFsZWN0GAkgASgOMisuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5EaWFsZWN0IjgKDFBsdWdpbkF1dGhvchIMCgRuYW1lGAEgASgJEg0KBWVtYWlsGAIgASgJEgsKA3VybBgDIAEoCSqhAQoNUGx1Z2luRGlhbGVjdBIeChpQTFVHSU5fRElBTEVDVF9VTlNQRUNJRklFRBAAEiAKHFBMVUdJTl9ESUFMRUNUX0FHRU5UX1BMVUdJTlMQARIZChVQTFVHSU5fRElBTEVDVF9DTEFVREUQAhIZChVQTFVHSU5fRElBTEVDVF9DVVJTT1IQAxIYChRQTFVHSU5fRElBTEVDVF9DT0RFWBAEYgZwcm90bzM"),PluginSpecSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_spec,0),PluginAuthorSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_spec,1),PluginDialect;(function(PluginDialect2){PluginDialect2[PluginDialect2.UNSPECIFIED=0]="UNSPECIFIED",PluginDialect2[PluginDialect2.AGENT_PLUGINS=1]="AGENT_PLUGINS",PluginDialect2[PluginDialect2.CLAUDE=2]="CLAUDE",PluginDialect2[PluginDialect2.CURSOR=3]="CURSOR",PluginDialect2[PluginDialect2.CODEX=4]="CODEX"})(PluginDialect||(PluginDialect={}));var file_ai_stigmer_agentic_plugin_v1_status=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3N0YXR1cy5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MSLqAgoMUGx1Z2luU3RhdHVzEj8KBWF1ZGl0GGMgASgLMjAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXQSKAoGZGlnZXN0GAEgASgJQhi6SBVyEzIRXiR8XlthLWYwLTldezY0fSQSHAoUYXJ0aWZhY3Rfc3RvcmFnZV9rZXkYAiABKAkSOAoFc3RhdGUYAyABKA4yKS5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpblN0YXRlEg0KBWVycm9yGAQgASgJEkkKDG1hdGVyaWFsaXplZBgFIAEoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luTWF0ZXJpYWxpemF0aW9uEj0KCHdhcm5pbmdzGAYgAygLMisuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5XYXJuaW5nIl8KFVBsdWdpbk1hdGVyaWFsaXphdGlvbhIOCgZza2lsbHMYASABKAUSEwoLbWNwX3NlcnZlcnMYAiABKAUSDgoGYWdlbnRzGAMgASgFEhEKCXdvcmtmbG93cxgEIAEoBSI8Cg1QbHVnaW5XYXJuaW5nEgwKBGtpbmQYASABKAkSDwoHbWVzc2FnZRgCIAEoCRIMCgRwYXRoGAMgASgJKnkKC1BsdWdpblN0YXRlEhwKGFBMVUdJTl9TVEFURV9VTlNQRUNJRklFRBAAEhsKF1BMVUdJTl9TVEFURV9JTlNUQUxMSU5HEAESFgoSUExVR0lOX1NUQVRFX1JFQURZEAISFwoTUExVR0lOX1NUQVRFX0ZBSUxFRBADYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),PluginStatusSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_status,0),PluginMaterializationSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_status,1),PluginWarningSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_status,2),PluginState;(function(PluginState2){PluginState2[PluginState2.UNSPECIFIED=0]="UNSPECIFIED",PluginState2[PluginState2.INSTALLING=1]="INSTALLING",PluginState2[PluginState2.READY=2]="READY",PluginState2[PluginState2.FAILED=3]="FAILED"})(PluginState||(PluginState={}));var file_ai_stigmer_agentic_plugin_v1_api=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2FwaS5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MSKbAgoGUGx1Z2luEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEhsKBGtpbmQYAiABKAlCDbpICnIICgZQbHVnaW4STQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YUIGukgDyAEBEjYKBHNwZWMYBCABKAsyKC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpblNwZWMSOgoGc3RhdHVzGAUgASgLMiouYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5TdGF0dXMiZAoKUGx1Z2luTGlzdBITCgthcGlfdmVyc2lvbhgBIAEoCRIMCgRraW5kGAIgASgJEjMKBWl0ZW1zGAMgAygLMiQuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5iBnByb3RvMw",[file_ai_stigmer_agentic_plugin_v1_spec,file_ai_stigmer_agentic_plugin_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),PluginSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_api,0);var pluginDeclaration=declareKind({kind:ApiResourceKind.plugin,schema:PluginSchema,source:"fga/model/agentic/plugin.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["platform_viewer",direct(usersetOf("identity_provider","platform_user"))],["viewer",union(direct(objectOf("identity_account"),publicWith("identity_account","allow_public"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"),computed("platform_viewer"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_use",computed("viewer")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_tenancy_project_v1_spec=fileDesc("CihhaS9zdGlnbWVyL3RlbmFuY3kvcHJvamVjdC92MS9zcGVjLnByb3RvEh1haS5zdGlnbWVyLnRlbmFuY3kucHJvamVjdC52MSJ+CgtQcm9qZWN0U3BlYxITCgtlbnRyeV9wb2ludBgBIAEoCRITCgtkZXNjcmlwdGlvbhgCIAEoCRJFCgdtZW1iZXJzGAMgAygLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io]);var file_ai_stigmer_tenancy_project_v1_status=fileDesc("CiphaS9zdGlnbWVyL3RlbmFuY3kvcHJvamVjdC92MS9zdGF0dXMucHJvdG8SHWFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxIuwBChVSZWNvbmNpbGlhdGlvblN1bW1hcnkSRQoHY3JlYXRlZBgBIAMoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRJFCgd1cGRhdGVkGAIgAygLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlEkUKB2RlbGV0ZWQYAyADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UiowEKDVByb2plY3RTdGF0dXMSUQoTbGFzdF9yZWNvbmNpbGlhdGlvbhgBIAEoCzI0LmFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxLlJlY29uY2lsaWF0aW9uU3VtbWFyeRI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0YgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_status]),ReconciliationSummarySchema=messageDesc2(file_ai_stigmer_tenancy_project_v1_status,0),ProjectStatusSchema=messageDesc2(file_ai_stigmer_tenancy_project_v1_status,1);var file_ai_stigmer_tenancy_project_v1_api=fileDesc("CidhaS9zdGlnbWVyL3RlbmFuY3kvcHJvamVjdC92MS9hcGkucHJvdG8SHWFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxIqkCCgdQcm9qZWN0EjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVdGVuYW5jeS5zdGlnbWVyLmFpL3YxEhwKBGtpbmQYAiABKAlCDrpIC3IJCgdQcm9qZWN0Ek0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJACgRzcGVjGAQgASgLMiouYWkuc3RpZ21lci50ZW5hbmN5LnByb2plY3QudjEuUHJvamVjdFNwZWNCBrpIA8gBARI8CgZzdGF0dXMYBSABKAsyLC5haS5zdGlnbWVyLnRlbmFuY3kucHJvamVjdC52MS5Qcm9qZWN0U3RhdHVzYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_tenancy_project_v1_spec,file_ai_stigmer_tenancy_project_v1_status,file_buf_validate_validate]),ProjectSchema=messageDesc2(file_ai_stigmer_tenancy_project_v1_api,0);var projectDeclaration=declareKind({kind:ApiResourceKind.project,schema:ProjectSchema,source:"fga/model/tenancy/project.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["viewer",union(direct(objectOf("identity_account")),computed("owner"),from("viewer","organization"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var scheduleDeclaration=declareKind({kind:ApiResourceKind.schedule,schema:ScheduleSchema,source:"fga/model/agentic/schedule.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["viewer",union(direct(objectOf("identity_account")),computed("owner"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_agentic_session_v1_api=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9hcGkucHJvdG8SHWFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxIqsCCgdTZXNzaW9uEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEhwKBGtpbmQYAiABKAlCDrpIC3IJCgdTZXNzaW9uEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARI4CgRzcGVjGAQgASgLMiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvblNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_session_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),SessionSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_api,0);var sessionDeclaration=declareKind({kind:ApiResourceKind.session,schema:SessionSchema,source:"fga/model/agentic/session.fga",relations:[["organization",direct(objectOf("organization"))],["agent_instance",direct(objectOf("agent_instance"))],["channel",direct(objectOf("agent_channel"))],["schedule",direct(objectOf("schedule"))],["owner",direct(objectOf("identity_account"))],["viewer",union(direct(objectOf("identity_account")),computed("owner"))],["can_view",union(computed("viewer"),from("viewer","channel"),from("viewer","schedule"))],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_create_execution_in",computed("viewer")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var skillDeclaration=declareKind({kind:ApiResourceKind.skill,schema:SkillSchema,source:"fga/model/agentic/skill.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["platform_viewer",direct(usersetOf("identity_provider","platform_user"))],["viewer",union(direct(objectOf("identity_account"),publicWith("identity_account","allow_public"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"),computed("platform_viewer"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_use",computed("viewer")],["can_clone",computed("viewer")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var workflowDeclaration=declareKind({kind:ApiResourceKind.workflow,schema:WorkflowSchema,source:"fga/model/agentic/workflow.fga",relations:[["organization",direct(objectOf("organization"))],["owner",union(direct(objectOf("identity_account")),from("admin","organization"))],["platform_viewer",direct(usersetOf("identity_provider","platform_user"))],["viewer",union(direct(objectOf("identity_account"),publicWith("identity_account","allow_public"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"),computed("platform_viewer"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_execute",computed("viewer")],["can_clone",computed("viewer")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_agentic_workflowexecution_v1_enum=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvZW51bS5wcm90bxInYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxKtsBCg5FeGVjdXRpb25QaGFzZRIfChtFWEVDVVRJT05fUEhBU0VfVU5TUEVDSUZJRUQQABIVChFFWEVDVVRJT05fUEVORElORxABEhkKFUVYRUNVVElPTl9JTl9QUk9HUkVTUxACEhcKE0VYRUNVVElPTl9DT01QTEVURUQQAxIUChBFWEVDVVRJT05fRkFJTEVEEAQSFwoTRVhFQ1VUSU9OX0NBTkNFTExFRBAFEhgKFEVYRUNVVElPTl9URVJNSU5BVEVEEAYSFAoQRVhFQ1VUSU9OX1BBVVNFRBAHKoQCChBXb3JrZmxvd1Rhc2tUeXBlEiIKHldPUktGTE9XX1RBU0tfVFlQRV9VTlNQRUNJRklFRBAAEiIKHldPUktGTE9XX1RBU0tfQUdFTlRfSU5WT0NBVElPThABEhoKFldPUktGTE9XX1RBU0tfQVBQUk9WQUwQAhIaChZXT1JLRkxPV19UQVNLX0FQSV9DQUxMEAMSHQoZV09SS0ZMT1dfVEFTS19DT05ESVRJT05BTBAEEhoKFldPUktGTE9XX1RBU0tfUEFSQUxMRUwQBRIbChdXT1JLRkxPV19UQVNLX1RSQU5TRk9STRAGEhgKFFdPUktGTE9XX1RBU0tfQ1VTVE9NEAcq6gEKEldvcmtmbG93VGFza1N0YXR1cxIkCiBXT1JLRkxPV19UQVNLX1NUQVRVU19VTlNQRUNJRklFRBAAEhkKFVdPUktGTE9XX1RBU0tfUEVORElORxABEh0KGVdPUktGTE9XX1RBU0tfSU5fUFJPR1JFU1MQAhIbChdXT1JLRkxPV19UQVNLX0NPTVBMRVRFRBADEhgKFFdPUktGTE9XX1RBU0tfRkFJTEVEEAQSGQoVV09SS0ZMT1dfVEFTS19TS0lQUEVEEAUSIgoeV09SS0ZMT1dfVEFTS19XQUlUSU5HX0FQUFJPVkFMEAZiBnByb3RvMw"),ExecutionPhase2;(function(ExecutionPhase3){ExecutionPhase3[ExecutionPhase3.EXECUTION_PHASE_UNSPECIFIED=0]="EXECUTION_PHASE_UNSPECIFIED",ExecutionPhase3[ExecutionPhase3.EXECUTION_PENDING=1]="EXECUTION_PENDING",ExecutionPhase3[ExecutionPhase3.EXECUTION_IN_PROGRESS=2]="EXECUTION_IN_PROGRESS",ExecutionPhase3[ExecutionPhase3.EXECUTION_COMPLETED=3]="EXECUTION_COMPLETED",ExecutionPhase3[ExecutionPhase3.EXECUTION_FAILED=4]="EXECUTION_FAILED",ExecutionPhase3[ExecutionPhase3.EXECUTION_CANCELLED=5]="EXECUTION_CANCELLED",ExecutionPhase3[ExecutionPhase3.EXECUTION_TERMINATED=6]="EXECUTION_TERMINATED",ExecutionPhase3[ExecutionPhase3.EXECUTION_PAUSED=7]="EXECUTION_PAUSED"})(ExecutionPhase2||(ExecutionPhase2={}));var WorkflowTaskType;(function(WorkflowTaskType2){WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_TYPE_UNSPECIFIED=0]="WORKFLOW_TASK_TYPE_UNSPECIFIED",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_AGENT_INVOCATION=1]="WORKFLOW_TASK_AGENT_INVOCATION",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_APPROVAL=2]="WORKFLOW_TASK_APPROVAL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_API_CALL=3]="WORKFLOW_TASK_API_CALL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_CONDITIONAL=4]="WORKFLOW_TASK_CONDITIONAL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_PARALLEL=5]="WORKFLOW_TASK_PARALLEL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_TRANSFORM=6]="WORKFLOW_TASK_TRANSFORM",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_CUSTOM=7]="WORKFLOW_TASK_CUSTOM"})(WorkflowTaskType||(WorkflowTaskType={}));var WorkflowTaskStatus;(function(WorkflowTaskStatus2){WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_STATUS_UNSPECIFIED=0]="WORKFLOW_TASK_STATUS_UNSPECIFIED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_PENDING=1]="WORKFLOW_TASK_PENDING",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_IN_PROGRESS=2]="WORKFLOW_TASK_IN_PROGRESS",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_COMPLETED=3]="WORKFLOW_TASK_COMPLETED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_FAILED=4]="WORKFLOW_TASK_FAILED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_SKIPPED=5]="WORKFLOW_TASK_SKIPPED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_WAITING_APPROVAL=6]="WORKFLOW_TASK_WAITING_APPROVAL"})(WorkflowTaskStatus||(WorkflowTaskStatus={}));var file_ai_stigmer_agentic_workflowexecution_v1_spec=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvc3BlYy5wcm90bxInYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxIrwEChVXb3JrZmxvd0V4ZWN1dGlvblNwZWMSHAoUd29ya2Zsb3dfaW5zdGFuY2VfaWQYASABKAkSEwoLd29ya2Zsb3dfaWQYBiABKAkSFwoPdHJpZ2dlcl9tZXNzYWdlGAMgASgJEm0KEHRyaWdnZXJfbWV0YWRhdGEYBCADKAsyUy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb25TcGVjLlRyaWdnZXJNZXRhZGF0YUVudHJ5EmMKC3J1bnRpbWVfZW52GAUgAygLMk4uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uU3BlYy5SdW50aW1lRW52RW50cnkSFgoOY2FsbGJhY2tfdG9rZW4YByABKAwSSAoQZXhlY3V0aW9uX3RhcmdldBgIIAEoDjIuLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLkV4ZWN1dGlvblRhcmdldBo2ChRUcmlnZ2VyTWV0YWRhdGFFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBGmkKD1J1bnRpbWVFbnZFbnRyeRILCgNrZXkYASABKAkSRQoFdmFsdWUYAiABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25WYWx1ZToCOAFiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_spec,file_ai_stigmer_agentic_session_v1_enum]);var file_ai_stigmer_agentic_workflowexecution_v1_api=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvYXBpLnByb3RvEidhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEi3QIKEVdvcmtmbG93RXhlY3V0aW9uEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiYKBGtpbmQYAiABKAlCGLpIFXITChFXb3JrZmxvd0V4ZWN1dGlvbhJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESTAoEc3BlYxgEIAEoCzI+LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvblNwZWMSUAoGc3RhdHVzGAUgASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uU3RhdHVzIqQFChdXb3JrZmxvd0V4ZWN1dGlvblN0YXR1cxI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0ElAKBXBoYXNlGAEgASgOMjcuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvblBoYXNlQgi6SAWCAQIQARJECgV0YXNrcxgCIAMoCzI1LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd1Rhc2sSJwoGb3V0cHV0GAMgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBINCgVlcnJvchgEIAEoCRISCgpzdGFydGVkX2F0GAUgASgJEhQKDGNvbXBsZXRlZF9hdBgGIAEoCRIcChR0ZW1wb3JhbF93b3JrZmxvd19pZBgHIAEoCRJbChFwZW5kaW5nX2FwcHJvdmFscxgJIAMoCzJALmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd1BlbmRpbmdBcHByb3ZhbBIZChF0b3RhbF9jb3N0X21pY3JvcxgKIAEoAxIaChJ0b3RhbF9pbnB1dF90b2tlbnMYCyABKAMSGwoTdG90YWxfb3V0cHV0X3Rva2VucxgMIAEoAxIdChV3b3JrZmxvd192ZXJzaW9uX2hhc2gYDSABKAkSYAoUcGVuZGluZ19maWxlX3Jldmlld3MYDiADKAsyQi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dQZW5kaW5nRmlsZVJldmlldyKEAQoXV29ya2Zsb3dQZW5kaW5nQXBwcm92YWwSRwoIYXBwcm92YWwYASABKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUGVuZGluZ0FwcHJvdmFsEiAKGGNoaWxkX2FnZW50X2V4ZWN1dGlvbl9pZBgCIAEoCSJUChlXb3JrZmxvd1BlbmRpbmdGaWxlUmV2aWV3EiAKGGNoaWxkX2FnZW50X2V4ZWN1dGlvbl9pZBgBIAEoCRIVCg1jaGFuZ2Vfc2V0X2lkGAIgAygJIv8DCgxXb3JrZmxvd1Rhc2sSDwoHdGFza19pZBgBIAEoCRIRCgl0YXNrX25hbWUYAiABKAkSVgoJdGFza190eXBlGAMgASgOMjkuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93VGFza1R5cGVCCLpIBYIBAhABEiYKBWlucHV0GAQgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBInCgZvdXRwdXQYBSABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0ElUKBnN0YXR1cxgGIAEoDjI7LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd1Rhc2tTdGF0dXNCCLpIBYIBAhABEhIKCnN0YXJ0ZWRfYXQYByABKAkSFAoMY29tcGxldGVkX2F0GAggASgJEg0KBWVycm9yGAkgASgJEikKCG1ldGFkYXRhGAogASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBIUCgxhcnRpZmFjdF9pZHMYCyADKAkSEwoLY29zdF9taWNyb3MYDCABKAMSFAoMaW5wdXRfdG9rZW5zGA0gASgDEhUKDW91dHB1dF90b2tlbnMYDiABKAMSDwoHdWlfaGludBgPIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_approval,file_ai_stigmer_agentic_workflowexecution_v1_enum,file_ai_stigmer_agentic_workflowexecution_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_struct]),WorkflowExecutionSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_api,0),WorkflowExecutionStatusSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_api,1);var workflowExecutionDeclaration=declareKind({kind:ApiResourceKind.workflow_execution,schema:WorkflowExecutionSchema,source:"fga/model/agentic/workflow_execution.fga",relations:[["organization",direct(objectOf("organization"))],["workflow_instance",direct(objectOf("workflow_instance"))],["owner",direct(objectOf("identity_account"))],["viewer",union(direct(objectOf("identity_account")),computed("owner"),from("execution_viewer","workflow_instance"))],["can_view",computed("viewer")],["can_edit",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]]});var file_ai_stigmer_agentic_workflowinstance_v1_spec=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dpbnN0YW5jZS92MS9zcGVjLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MSKBAwoUV29ya2Zsb3dJbnN0YW5jZVNwZWMSHAoLd29ya2Zsb3dfaWQYASABKAlCB7pIBHICEAESEwoLZGVzY3JpcHRpb24YAiABKAkSyAEKEGVudmlyb25tZW50X3JlZnMYAyADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCeLpIcZIBbiJsugFpChVlbnZpcm9ubWVudF9yZWZzLmtpbmQSP2Vudmlyb25tZW50X3JlZnMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1lbnZpcm9ubWVudBoPdGhpcy5raW5kID09IDUz4IUsNRJrChRleGVjdXRpb25fdmlzaWJpbGl0eRgEIAEoDjJDLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93RXhlY3V0aW9uVmlzaWJpbGl0eUIIukgFggECEAEqpwEKG1dvcmtmbG93RXhlY3V0aW9uVmlzaWJpbGl0eRItCil3b3JrZmxvd19leGVjdXRpb25fdmlzaWJpbGl0eV91bnNwZWNpZmllZBAAEikKJXdvcmtmbG93X2V4ZWN1dGlvbl92aXNpYmlsaXR5X3ByaXZhdGUQARIuCip3b3JrZmxvd19leGVjdXRpb25fdmlzaWJpbGl0eV9vcmdhbml6YXRpb24QAmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]),WorkflowInstanceSpecSchema=messageDesc2(file_ai_stigmer_agentic_workflowinstance_v1_spec,0),WorkflowExecutionVisibility;(function(WorkflowExecutionVisibility2){WorkflowExecutionVisibility2[WorkflowExecutionVisibility2.unspecified=0]="unspecified",WorkflowExecutionVisibility2[WorkflowExecutionVisibility2.private=1]="private",WorkflowExecutionVisibility2[WorkflowExecutionVisibility2.organization=2]="organization"})(WorkflowExecutionVisibility||(WorkflowExecutionVisibility={}));var file_ai_stigmer_agentic_workflowinstance_v1_api=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dpbnN0YW5jZS92MS9hcGkucHJvdG8SJmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxIs8CChBXb3JrZmxvd0luc3RhbmNlEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiUKBGtpbmQYAiABKAlCF7pIFHISChBXb3JrZmxvd0luc3RhbmNlEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJKCgRzcGVjGAQgASgLMjwuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEuV29ya2Zsb3dJbnN0YW5jZVNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_workflowinstance_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),WorkflowInstanceSchema=messageDesc2(file_ai_stigmer_agentic_workflowinstance_v1_api,0);var executionViewer=(object,row)=>{if(!isMessage2(row,WorkflowInstanceSchema))return Promise.resolve([]);let level=row.spec?.executionVisibility??WorkflowExecutionVisibility.unspecified;switch(level){case WorkflowExecutionVisibility.organization:{let org=row.metadata?.org??"";return Promise.resolve(org===""?[]:[{object,relation:"execution_viewer",subject:{form:"userset",object:{type:"organization",id:org},relation:"viewer"}}])}case WorkflowExecutionVisibility.private:case WorkflowExecutionVisibility.unspecified:return Promise.resolve([]);default:{let exhaustive=level;throw new Error(`unknown execution visibility: ${String(exhaustive)}`)}}},workflowInstanceDeclaration=declareKind({kind:ApiResourceKind.workflow_instance,schema:WorkflowInstanceSchema,source:"fga/model/agentic/workflow_instance.fga",relations:[["organization",direct(objectOf("organization"))],["workflow",direct(objectOf("workflow"))],["default_of",direct(objectOf("workflow"))],["owner",direct(objectOf("identity_account"))],["viewer",union(direct(objectOf("identity_account"),publicWith("identity_account","allow_public"),usersetOf("organization","member"),usersetOf("organization","viewer")),computed("owner"),from("viewer","default_of"))],["execution_viewer",direct(objectOf("identity_account"),usersetOf("organization","member"),usersetOf("organization","viewer"))],["can_view",computed("viewer")],["can_execute",computed("can_view")],["can_edit",computed("owner")],["can_delete",computed("owner")],["can_grant_access",computed("owner")],["can_view_access",computed("viewer")]],derived:[["default_of",defaultOfBlueprint({kind:ApiResourceKind.workflow,schema:WorkflowSchema,defaultInstanceIdOf:workflow=>workflow.status?.defaultInstanceId??""})],["execution_viewer",executionViewer]]});function newModel(declarations){let byKind=new Map,byType=new Map;for(let declaration of declarations){if(byKind.has(declaration.kind))throw new Error(`${declaration.type} is declared twice in the model`);byKind.set(declaration.kind,declaration),byType.set(declaration.type,declaration)}return{declarations,byKind:kind=>byKind.get(kind),byType:type2=>byType.get(type2)}}var builtInModel=newModel([identityAccountDeclaration,iamPolicyDeclaration,apiKeyDeclaration,oauthAppDeclaration,organizationDeclaration,projectDeclaration,agentDeclaration,agentChannelDeclaration,agentShareDeclaration,channelAppDeclaration,agentInstanceDeclaration,agentExecutionDeclaration,artifactDeclaration,environmentDeclaration,executionContextDeclaration,mcpServerDeclaration,memoryDeclaration,scheduleDeclaration,sessionDeclaration,skillDeclaration,workflowDeclaration,workflowInstanceDeclaration,workflowExecutionDeclaration,pluginDeclaration]);var ACCOUNT_TYPE="identity_account",ALLOW_PUBLIC_CONDITION="allow_public";function formatObjectRef(object){return`${object.type}:${object.id}`}function pairKey(object,relation){return`${formatObjectRef(object)}#${relation}`}var ROW_RECORDED_OWNER_KINDS=new Set([ApiResourceKind.organization]);function account(id){return{form:"object",object:{type:ACCOUNT_TYPE,id}}}function deriveTuples(facts){let object={type:kindEnumName(facts.kind),id:facts.id},config2=getKindMeta(facts.kind).authorization;if(config2===void 0)return[];let tuples=[];for(let link of facts.parentLinks)tuples.push({object,relation:link.relation,subject:{form:"object",object:{type:kindEnumName(link.parentKind),id:link.parentId}}});let stampIsPerson=isPersonStamp(facts.createdBy);switch(config2.ownerType){case OwnerAttributionType.DIRECT:stampIsPerson&&!ROW_RECORDED_OWNER_KINDS.has(facts.kind)&&tuples.push({object,relation:"owner",subject:account(facts.createdBy)});break;case OwnerAttributionType.SELF:tuples.push({object,relation:"owner",subject:account(facts.id)});break;case OwnerAttributionType.INHERITED:case OwnerAttributionType.NONE:case OwnerAttributionType.UNSPECIFIED:break;default:{let exhaustive=config2.ownerType;throw new Error(`unknown owner attribution: ${String(exhaustive)}`)}}config2.requiresCreatorTuple&&stampIsPerson&&tuples.push({object,relation:"creator",subject:account(facts.createdBy)});for(let shape of visibilityShapesFor(facts.kind,facts.visibility)){let subject=visibilitySubject(shape,facts.org);subject!==void 0&&tuples.push({object,relation:"viewer",subject})}return tuples}function visibilitySubject(shape,org){switch(shape){case"org-viewer":return org===""?void 0:{form:"userset",object:{type:"organization",id:org},relation:"viewer"};case"public-viewer":return{form:"wildcard",type:ACCOUNT_TYPE,condition:ALLOW_PUBLIC_CONDITION};case"platform-viewer":return;default:{let exhaustive=shape;throw new Error(`unknown visibility shape: ${String(exhaustive)}`)}}}function newDerivedTupleSource(deps,person,seed){let model=deps.model??builtInModel,rows=new Map,derived=new Map,seeded=new Map;for(let facts of seed?.facts??[])seeded.set(formatObjectRef({type:kindEnumName(facts.kind),id:facts.id}),facts);let personRows,loader2={load(object){let key=formatObjectRef(object),held=rows.get(key);if(held!==void 0)return held;let loading=loadRow(deps,model,object);return rows.set(key,loading),loading}};function derivedTuplesOf(object){let key=formatObjectRef(object),held=derived.get(key);if(held!==void 0)return held;let declaration=model.byType(object.type),known=seeded.get(key),deriving;return declaration===void 0?deriving=Promise.resolve([]):known!==void 0?deriving=Promise.resolve(deriveTuples(known)):deriving=loader2.load(object).then(row=>row===void 0?[]:deriveTuples(rowFactsOf(declaration.kind,row))),derived.set(key,deriving),deriving}function rowTuples(){return personRows===void 0&&(personRows=deps.policies.findByPrincipal(ACCOUNT_TYPE,person.accountId).then(found=>found.map(tupleOfRow))),personRows}return{loader:loader2,personTuples:rowTuples,async tuplesOf(object,relation){let onPair=tuple=>tuple.relation===relation&&tuple.object.type===object.type&&tuple.object.id===object.id,fromRows=(await rowTuples()).filter(onPair),declaration=model.byType(object.type);if(declaration===void 0)return fromRows;let fromRow=(await derivedTuplesOf(object)).filter(onPair),rule=declaration.derived.get(relation);if(rule===void 0)return[...fromRows,...fromRow];let row=await loader2.load(object),fromRule=row===void 0?[]:await rule(object,row,loader2);return[...fromRows,...fromRow,...fromRule]}}}async function loadRow(deps,model,object){let declaration=model.byType(object.type),kind=kindByEnumName(object.type);if(!(declaration===void 0||kind===ApiResourceKind.api_resource_kind_unknown||object.id==="")){if(kind===ApiResourceKind.identity_account)return deps.accounts.findById(object.id);try{return await deps.store.getResource(kind,object.id,declaration.schema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}}function tupleOfRow(row){let spec=row.spec,principal=spec?.principal,resource=spec?.resource,object={type:resource?.kind??"",id:resource?.id??""},principalObject={type:principal?.kind??"",id:principal?.id??""},subject;return principal!==void 0&&principal.relation!==""?subject={form:"userset",object:principalObject,relation:principal.relation}:principalObject.id==="*"?subject={form:"wildcard",type:principalObject.type,condition:void 0}:subject={form:"object",object:principalObject},{object,relation:spec?.relation??"",subject}}var MAX_RESOLUTION_DEPTH=25,AuthorizationEvaluationError=class extends Error{reason;constructor(reason,message6){super(message6),this.name="AuthorizationEvaluationError",this.reason=reason}};async function checkRelation(deps,object,relation,person,context2){if(deps.model.byType(object.type)===void 0)throw new AuthorizationEvaluationError("undeclared-target-kind",`no declaration for kind '${object.type}' (target ${formatObjectRef(object)})`);return new Walk(deps,person,context2).resolve(object,relation,0)}var Walk=class{deps;person;context;memo=new Map;inProgress=new Set;constructor(deps,person,context2){this.deps=deps,this.person=person,this.context=context2}resolve(object,relation,depth){let key=pairKey(object,relation);if(this.inProgress.has(key))throw new AuthorizationEvaluationError("resolution-cycle",`'${key}' re-entered while being resolved \u2014 the declarations cycle`);if(depth>MAX_RESOLUTION_DEPTH)throw new AuthorizationEvaluationError("resolution-depth-exceeded",`resolving '${key}' exceeded ${MAX_RESOLUTION_DEPTH} hops`);let held=this.memo.get(key);if(held!==void 0)return held;let declaration=this.deps.model.byType(object.type),rewrite=declaration?.relations.get(relation);if(declaration===void 0||rewrite===void 0)return Promise.resolve(!1);this.inProgress.add(key);let result=this.evaluate(rewrite,object,relation,depth).finally(()=>this.inProgress.delete(key));return this.memo.set(key,result),result}async evaluate(rewrite,object,relation,depth){switch(rewrite.node){case"this":{let tuples=await this.deps.source.tuplesOf(object,relation);for(let tuple of tuples)if(await this.subjectHolds(tuple.subject,rewrite.subjects,depth))return!0;return!1}case"computed":return this.resolve(object,rewrite.relation,depth+1);case"from":{let linkTypes=this.objectTypesOf(object,rewrite.tupleset),links=await this.deps.source.tuplesOf(object,rewrite.tupleset);for(let link of links)if(link.subject.form==="object"&&linkTypes.has(link.subject.object.type)&&await this.resolve(link.subject.object,rewrite.relation,depth+1))return!0;return!1}case"union":{for(let member2 of rewrite.members)if(await this.evaluate(member2,object,relation,depth))return!0;return!1}default:{let exhaustive=rewrite;throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`)}}}async subjectHolds(subject,restriction,depth){switch(subject.form){case"object":return subject.object.type===ACCOUNT_TYPE&&restriction.some(allowed=>allowed.form==="object"&&allowed.type===ACCOUNT_TYPE)&&this.person.aliases.has(subject.object.id);case"userset":return restriction.some(allowed=>allowed.form==="userset"&&allowed.type===subject.object.type&&allowed.relation===subject.relation)&&await this.resolve(subject.object,subject.relation,depth+1);case"wildcard":return restriction.some(entry=>entry.form==="wildcard"&&entry.type===subject.type&&entry.condition===subject.condition)&&this.conditionHolds(subject.condition);default:{let exhaustive=subject;throw new Error(`unknown subject form: ${JSON.stringify(exhaustive)}`)}}}conditionHolds(condition){if(condition===ALLOW_PUBLIC_CONDITION)return this.context.allow;throw new AuthorizationEvaluationError("unknown-condition",`the model declares no condition '${String(condition)}'`)}objectTypesOf(object,tupleset){let rewrite=this.deps.model.byType(object.type)?.relations.get(tupleset),types3=new Set,collect=node=>{if(node.node==="this")for(let subject of node.subjects)subject.form==="object"&&types3.add(subject.type);else node.node==="union"&&node.members.forEach(collect)};return rewrite!==void 0&&collect(rewrite),types3}};var ACCOUNT_ID_PREFIX="ida";function accountIdFor(idpId){if(idpId==="")throw new Error("idp_id must not be empty");return derivedId(ACCOUNT_ID_PREFIX,idpId)}var LOCAL_IDP_ID_PREFIX="local|";function localIdpIdFor(identityId){return`${LOCAL_IDP_ID_PREFIX}${identityId}`}function idpIdOf(caller){return caller.issuer===""&&caller.rawToken===""?localIdpIdFor(caller.identityId):jwtSubjectOf(caller.rawToken)}function jwtSubjectOf(rawToken){let segments=rawToken.split(".");if(segments.length!==3)return"";try{let payload=JSON.parse(Buffer.from(segments[1]??"","base64url").toString("utf8"));return typeof payload.sub=="string"?payload.sub:""}catch{return""}}var MACHINE_ACCOUNT_SUFFIX="@clients";function isMachineSubject(idpId){return idpId.endsWith(MACHINE_ACCOUNT_SUFFIX)}var ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE="Identity account not found for the authenticated user",NO_IDP_ID_MESSAGE="Cannot provision account: no IDP ID in authentication context",USERINFO_UNAVAILABLE_PREFIX="Failed to fetch user profile from identity provider: ";function accountNotFoundMessage(handle){return`Identity account not found: ${handle}`}var CREATE_IS_INTERNAL_MESSAGE="this RPC is internal to the platform",FEDERATION_UNIMPLEMENTED_REASON="federated identity accounts are served by the Enterprise and Cloud editions";function federationUnimplementedMessage(method){return`${method} is not implemented: ${FEDERATION_UNIMPLEMENTED_REASON}`}function idpIdImmutableMessage(existingIdpId){return`spec.idp_id is immutable (account subject is '${existingIdpId}') \u2014 create a new account for a different subject`}async function identityIdForSubject(accounts,subject){let account2=await accounts.findDirectByIdpId(subject);if(account2===void 0)return subject;let id=account2.metadata?.id??"";if(id==="")throw new Error(`identity account for subject '${subject}' carries no id \u2014 refusing to stamp an empty principal`);return id}async function accountForCaller(accounts,caller){let byId=await accounts.findById(caller.identityId);if(byId!==void 0)return byId;let subject=idpIdOf(caller);if(subject!=="")return accounts.findDirectByIdpId(subject)}async function accountForStamp(accounts,stamp){if(stamp!=="")return await accounts.findById(stamp)??await accounts.findDirectByIdpId(stamp)}function personFor(caller,account2){let accountId=account2?.metadata?.id??caller.identityId;if(!isPersonStamp(accountId))throw new Error(`caller '${accountId}' names no person \u2014 the built-in authorizer evaluates people only`);let aliases=new Set([accountId]),subject=account2?.spec?.idpId??"";return subject!==""&&aliases.add(subject),{accountId,aliases}}async function resolvePerson(accounts,caller){return personFor(caller,await accountForCaller(accounts,caller))}var NOT_FOUND_EXEMPT_KINDS=new Set([ApiResourceKind.identity_account,ApiResourceKind.iam_policy]),UNKNOWN_PERMISSION_DENY_REASON="authorization cannot be performed with unknown permission",EMPTY_IDENTITY_DENY_REASON="authorization cannot be performed on empty identity string",EMPTY_RESOURCE_ID_DENY_REASON="authorization cannot be performed on empty api-resource-id",UNKNOWN_KIND_DENY_REASON="authorization cannot be performed on unknown api-resource-kind",UNSERVED_KIND_DENY_REASON="authorization cannot be performed on a kind this edition does not serve";function newBuiltInAuthorizer(deps){let model=deps.model??builtInModel;return{async authorize(caller,check){if(check.permission===IamPermission.unspecified)return deny(UNKNOWN_PERMISSION_DENY_REASON);if(caller.identityId==="")return deny(EMPTY_IDENTITY_DENY_REASON);if(check.resourceId==="")return deny(EMPTY_RESOURCE_ID_DENY_REASON);if(check.resourceKind===ApiResourceKind.api_resource_kind_unknown)return deny(UNKNOWN_KIND_DENY_REASON);if(!kindServedByEdition(check.resourceKind,deps.edition))return deny(UNSERVED_KIND_DENY_REASON);let object={type:kindEnumName(check.resourceKind),id:check.resourceId},relation=IamPermission[check.permission];try{let person=await resolvePerson(deps.accounts,caller),source=newDerivedTupleSource({store:deps.store,policies:deps.policies,accounts:deps.accounts,model},person);return await source.loader.load(object)===void 0&&!NOT_FOUND_EXEMPT_KINDS.has(check.resourceKind)?(deps.logger.debug("authorization target not found",{account:person.accountId,permission:relation,object:formatObjectRef(object)}),{kind:"not-found"}):await checkRelation({model,source},object,relation,person,{allow:!0})?{kind:"allow"}:(deps.logger.debug("authorization denied",{account:person.accountId,permission:relation,object:formatObjectRef(object)}),deny(""))}catch(error2){return{kind:"unavailable",cause:error2 instanceof Error?error2:new Error(String(error2))}}}}}function deny(reason){return{kind:"deny",reason}}var AUTHORIZATION_UNAVAILABLE_MESSAGE="authorization check could not be completed",AUTHORIZATION_DENIED_FALLBACK_MESSAGE="permission denied";function newPermissiveSingleTeamAuthorizer(){return{authorize(){return Promise.resolve({kind:"allow"})}}}function newAuthorizeStep(method,authorizer){return{name:"Authorize",execute(ctx){return authorizeDirect(method,authorizer,ctx.callerIdentity,ctx.input)}}}async function authorizeDirect(method,authorizer,identity2,input,override){if(identity2.callerClass==="internal"||getOption(method,is_public)||getOption(method,is_skip_authorization)||!hasOption(method,config))return;let config2=getOption(method,config);return authorizeResolvedResource(authorizer,identity2,{permission:config2.permission,resourceKind:override?.resourceKind??resolveResourceKind(input,config2),resourceId:override?.resourceId??resolveResourceId(input,config2)},config2.errorMsg)}async function authorizeResolvedResource(authorizer,identity2,check,errorMsg){if(identity2.callerClass==="internal")return;let decision=await evaluateAuthorizer(authorizer,identity2,check);switch(decision.kind){case"allow":return;case"deny":throw new ConnectError(errorMsg!==""?errorMsg:decision.reason!==""?decision.reason:AUTHORIZATION_DENIED_FALLBACK_MESSAGE,Code.PermissionDenied);case"not-found":throw check.resourceId===""||check.resourceKind===ApiResourceKind.api_resource_kind_unknown?internalError(new Error("authorizer answered not-found for a non-resource-scoped check"),AUTHORIZATION_UNAVAILABLE_MESSAGE):notFoundError(getKindName(check.resourceKind),check.resourceId);case"unavailable":throw internalError(decision.cause,AUTHORIZATION_UNAVAILABLE_MESSAGE);default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),AUTHORIZATION_UNAVAILABLE_MESSAGE)}}}async function evaluateAuthorizer(authorizer,identity2,check){try{return await authorizer.authorize(identity2,check)}catch(error2){return{kind:"unavailable",cause:error2 instanceof Error?error2:new Error(String(error2))}}}function resolveResourceKind(input,config2){if(config2.resourceKindPath==="")return config2.resourceKind;let value=resolveDotPath(input,config2.resourceKindPath);return typeof value=="number"?value:typeof value=="string"?kindByEnumName(value):ApiResourceKind.api_resource_kind_unknown}function resolveResourceId(input,config2){if(config2.resourceId!=="")return config2.resourceId;if(config2.fieldPath==="")return"";let value=resolveDotPath(input,config2.fieldPath);return typeof value=="string"?value:""}function resolveDotPath(input,path14){let current=input;for(let segment of path14.split(".")){if(current===null||typeof current!="object")return;current=current[snakeToCamel(segment)]}return current}function snakeToCamel(segment){return segment.replace(/_([a-z0-9])/g,(_,ch)=>ch.toUpperCase())}var RUN_GATE_CHECKS={agent:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.agent},agentInstance:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.agent_instance},session:{permission:IamPermission.can_create_execution_in,resourceKind:ApiResourceKind.session},workflow:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.workflow},workflowInstance:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.workflow_instance}},RUN_GATE_CHECK_LIST=Object.values(RUN_GATE_CHECKS);function isRunGateCheck(check){return RUN_GATE_CHECK_LIST.some(candidate=>candidate.permission===check.permission&&candidate.resourceKind===check.resourceKind)}function newAuthorizeRunTargetStep(authorizer,resolveRunTarget){return{name:"AuthorizeRunTarget",async execute(ctx){let target=resolveRunTarget(ctx.newState);target!==void 0&&await authorizeResolvedResource(authorizer,ctx.callerIdentity,{permission:target.permission,resourceKind:target.resourceKind,resourceId:target.resourceId},target.deniedMessage)}}}var ADMITTED={kind:"allow"};function newLaneAdmittedAuthorizer(inner,isAdmittedLane){return{authorize(caller,check){return isRunGateCheck(check)&&isAdmittedLane(caller)?Promise.resolve(ADMITTED):inner.authorize(caller,check)}}}var LIST_RELATION="can_view",LISTING={allow:!1};function newBuiltInListReadScope(deps){let model=deps.model??builtInModel;async function visibleAmong(caller,kind,candidates){if(candidates.length===0)return new Set;let started=performance.now(),person=await resolvePerson(deps.accounts,caller),source=newDerivedTupleSource({store:deps.store,policies:deps.policies,accounts:deps.accounts,model},person,{facts:candidates}),type2=kindEnumName(kind),answers=await Promise.all(candidates.map(async facts=>{let object={type:type2,id:facts.id};return await checkRelation({model,source},object,LIST_RELATION,person,LISTING)?facts.id:void 0})),kept=new Set;for(let id of answers)id!==void 0&&kept.add(id);return deps.logger.debug("list scope evaluated candidates",{account:person.accountId,kind:type2,offered:candidates.length,kept:kept.size,elapsedMs:Math.round(performance.now()-started)}),kept}function requireDeclared(kind){let declaration=model.byKind(kind);if(declaration===void 0)throw new AuthorizationEvaluationError("undeclared-target-kind",`no declaration for kind '${kindEnumName(kind)}' \u2014 a list lane asked the scope about a kind the model does not declare`);return declaration}async function everyRowOf(declaration){let kind=declaration.kind,rows=await deps.store.listResources(kind),facts=[];for(let bytes of rows)try{facts.push(rowFactsOf(kind,fromBinary2(declaration.schema,bytes)))}catch(error2){deps.logger.warn("list scope skipped a row that does not decode",{kind:kindEnumName(kind),error:error2 instanceof Error?error2.message:String(error2)})}return facts}return{async restrictListEntries(caller,kind,entries){requireDeclared(kind);let unique2=new Map;for(let entry of entries)unique2.has(entry.id)||unique2.set(entry.id,rowFactsOfEntry(kind,entry));return caller.callerClass==="internal"?new Set(unique2.keys()):visibleAmong(caller,kind,[...unique2.values()])},async authorizedResourceIds(caller,kind){let candidates=await everyRowOf(requireDeclared(kind));return caller.callerClass==="internal"?new Set(candidates.map(facts=>facts.id)):visibleAmong(caller,kind,candidates)}}}var ORGANIZATION2=kindEnumName(ApiResourceKind.organization);function newBuiltInOrganizationDirectory(deps){let model=deps.model??builtInModel;return{refusesEnumeration:!0,async listMyOrganizationIds(caller){if(caller.callerClass==="internal")return"all";let person=await resolvePerson(deps.accounts,caller),source=newDerivedTupleSource({store:deps.store,policies:deps.policies,accounts:deps.accounts,model},person),candidates=new Set;for(let tuple of await source.personTuples())tuple.object.type===ORGANIZATION2&&tuple.object.id!==""&&candidates.add(tuple.object.id);let visible=[];for(let id of candidates)await checkRelation({model,source},{type:ORGANIZATION2,id},"can_view",person,{allow:!1})&&visible.push(id);return visible}}}function authorizationPostureOf(inputs){return inputs.unitAuthorizer?"unit-authorizer":inputs.requireAuthentication?"built-in":"trusted-local"}var ScheduleFireCallerRefusedError=class extends Error{constructor(reason){super(reason),this.name="ScheduleFireCallerRefusedError"}};function scheduleHasNoPersonMessage(scheduleId){return`schedule ${scheduleId} was created by nobody this server recognizes as a person; recreate it while signed in`}function newBuiltInScheduleFireCaller(deps){return{async mintFireCaller(_org,scheduleId){let schedule=await deps.store.getResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema),stamp=auditOf(ScheduleSchema,schedule)?.specAudit?.createdBy?.id??"",account2=await accountForStamp(deps.accounts,stamp);if(account2===void 0)throw new ScheduleFireCallerRefusedError(scheduleHasNoPersonMessage(scheduleId));return accountAsCaller(account2)}}}var ABSENT_LICENSE_STATUS={status:()=>Promise.resolve({state:LicenseState.absent})};var file_ai_stigmer_agentic_agent_v1_io=fileDesc("CiRhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnQvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MSIgCgdBZ2VudElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiLgoWR2V0RGVmYXVsdEFnZW50UmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAFiBnByb3RvMw",[file_buf_validate_validate]),AgentIdSchema=messageDesc2(file_ai_stigmer_agentic_agent_v1_io,0);var file_ai_stigmer_commons_apiresource_rpc_service_options=fileDesc("CjhhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvcnBjX3NlcnZpY2Vfb3B0aW9ucy5wcm90bxIeYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlOo4BChFhcGlfcmVzb3VyY2Vfa2luZBIfLmdvb2dsZS5wcm90b2J1Zi5TZXJ2aWNlT3B0aW9ucxj0vwUgASgOMj8uYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUtpbmRSD2FwaVJlc291cmNlS2luZGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind,file_google_protobuf_descriptor]),api_resource_kind=extDesc(file_ai_stigmer_commons_apiresource_rpc_service_options,0);var file_ai_stigmer_agentic_agent_v1_command=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnQvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxMskFChZBZ2VudENvbW1hbmRDb250cm9sbGVyEk8KBWFwcGx5EiIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50GiIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50EpsBCgZjcmVhdGUSIi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuQWdlbnQaIi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuQWdlbnQiScK4GEUIBhAeIgxtZXRhZGF0YS5vcmcqMXVuYXV0aG9yaXplZCB0byBjcmVhdGUgYWdlbnQgaW4gdGhpcyBvcmdhbml6YXRpb24ShQEKBnVwZGF0ZRIiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudBoiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudCIzwrgYLwgCECgiC21ldGFkYXRhLmlkKhx1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGFnZW50Eq0BChB1cGRhdGVWaXNpYmlsaXR5EjUuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlVwZGF0ZVZpc2liaWxpdHlJbnB1dBoiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudCI+wrgYOggCECgiC3Jlc291cmNlX2lkKid1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGFnZW50IHZpc2liaWxpdHkSgQEKBmRlbGV0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudElkGiIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50Ii3CuBgpCAMQKCIFdmFsdWUqHHVuYXV0aG9yaXplZCB0byBkZWxldGUgYWdlbnQaBKD/KyhiBnByb3RvMw",[file_ai_stigmer_agentic_agent_v1_api,file_ai_stigmer_agentic_agent_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentCommandController=serviceDesc(file_ai_stigmer_agentic_agent_v1_command,0);var file_ai_stigmer_agentic_agent_v1_query=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnQvdjEvcXVlcnkucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MTL4AgoUQWdlbnRRdWVyeUNvbnRyb2xsZXISewoDZ2V0EiQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50SWQaIi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuQWdlbnQiKsK4GCYIARAoIgV2YWx1ZSoZdW5hdXRob3JpemVkIHRvIGdldCBhZ2VudBJwCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRoiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudCIE0LgYARJrCgpnZXREZWZhdWx0EjMuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkdldERlZmF1bHRBZ2VudFJlcXVlc3QaIi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuQWdlbnQiBNC4GAEaBKD/KyhiBnByb3RvMw",[file_ai_stigmer_agentic_agent_v1_api,file_ai_stigmer_agentic_agent_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentQueryController=serviceDesc(file_ai_stigmer_agentic_agent_v1_query,0);var apiResourceKindKey=createContextKey(ApiResourceKind.api_resource_kind_unknown,{description:"api_resource_kind service option of the target service"});function createApiResourceInterceptor(){return next=>request=>{if(!request.stream&&hasOption(request.service,api_resource_kind)){let kind=getOption(request.service,api_resource_kind);kind!==ApiResourceKind.api_resource_kind_unknown&&request.contextValues.set(apiResourceKindKey,kind)}return next(request)}}var INTERNAL_FALLBACK_MESSAGE="internal server error",Pipeline=class{pipelineName;steps;logger;constructor(pipelineName,steps,logger2){this.pipelineName=pipelineName,this.steps=steps,this.logger=logger2}get name(){return this.pipelineName}get stepCount(){return this.steps.length}async execute(ctx){for(let step of this.steps){let startedAt=performance.now();try{await step.execute(ctx)}catch(error2){throw this.logger.warn("pipeline step failed",{pipeline:this.pipelineName,step:step.name,durationMs:Math.round(performance.now()-startedAt),error:error2 instanceof Error?error2.message:String(error2)}),error2 instanceof ConnectError?error2:internalError(error2,INTERNAL_FALLBACK_MESSAGE)}this.logger.debug("pipeline step completed",{pipeline:this.pipelineName,step:step.name,durationMs:Math.round(performance.now()-startedAt)})}}},PipelineBuilder=class{name;logger;steps=[];constructor(name,logger2){this.name=name,this.logger=logger2}addStep(step){return this.steps.push(step),this}build(){return new Pipeline(this.name,this.steps,this.logger)}};function newPipeline(name,logger2){return new PipelineBuilder(name,logger2)}var LOADED_EXECUTION_KEY="loadedExecution",RequestContext=class{input;schema;callerIdentity;apiResourceKind;state;metadata=new Map;constructor(schema2,input,callerIdentity,apiResourceKind=ApiResourceKind.api_resource_kind_unknown){this.schema=schema2,this.input=input,this.state=clone(schema2,input),this.callerIdentity=callerIdentity,this.apiResourceKind=apiResourceKind}get newState(){return this.state}setNewState(state2){this.state=state2}get(key){return this.metadata.get(key)}set(key,value){this.metadata.set(key,value)}};var STAMPED_KEYS_CONTEXT_KEY="serverStampedReservedLabels";function recordServerStampedReservedLabels(ctx,...keys){let existing=ctx.get(STAMPED_KEYS_CONTEXT_KEY),stamped=existing instanceof Set?existing:new Set;for(let key of keys)stamped.add(key);ctx.set(STAMPED_KEYS_CONTEXT_KEY,stamped)}function serverStampedReservedLabels(ctx){let stamped=ctx.get(STAMPED_KEYS_CONTEXT_KEY);return stamped instanceof Set?stamped:new Set}var RESERVED_LABEL_PREFIX="stigmer.ai/",CLIENT_CONTRACT_ALLOWLIST=new Map([[ApiResourceKind.environment,new Set(["stigmer.ai/personal"])]]);function reservedLabelMutations(stored,requested){let mutations=[];for(let[key,value]of Object.entries(requested))key.startsWith(RESERVED_LABEL_PREFIX)&&stored[key]!==value&&mutations.push(key);return mutations.sort()}function newGuardReservedLabelsStep(authorizer,positions={}){let stateOf=positions.stateOf??(ctx=>ctx.newState),existingKey=positions.existingKey??EXISTING_RESOURCE_KEY;return{name:"GuardReservedLabels",async execute(ctx){if(ctx.callerIdentity.callerClass==="internal"||ctx.callerIdentity.origin==="in-process")return;let state2=stateOf(ctx),requested=state2===void 0?{}:metadataOf(state2)?.labels??{},existing=ctx.get(existingKey),stored=existing===void 0?{}:metadataOf(existing)?.labels??{},allowlist=CLIENT_CONTRACT_ALLOWLIST.get(ctx.apiResourceKind)??new Set,stamped=serverStampedReservedLabels(ctx),mutations=reservedLabelMutations(stored,requested).filter(key=>!allowlist.has(key)&&!stamped.has(key));if(mutations.length===0)return;let decision;try{decision=await authorizer.authorize(ctx.callerIdentity,{permission:IamPermission.can_write_reserved_labels,resourceKind:ApiResourceKind.platform,resourceId:"stigmer"})}catch(error2){throw reservedLabelCheckFailure(error2)}switch(decision.kind){case"allow":return;case"deny":case"not-found":throw new ConnectError(`Labels in the reserved '${RESERVED_LABEL_PREFIX}' namespace are platform-managed and cannot be set or changed by this request: ${mutations.join(", ")}. Stored reserved labels may be echoed back unchanged or removed.`,Code.InvalidArgument);case"unavailable":throw reservedLabelCheckFailure(decision.cause);default:{let exhaustive=decision;throw reservedLabelCheckFailure(new Error(`unknown decision ${JSON.stringify(exhaustive)}`))}}}}}function reservedLabelCheckFailure(error2){return internalError(error2 instanceof Error?error2:new Error(String(error2)),"reserved-label validation could not be completed")}var PUBLIC_VISIBILITY_DENY_MESSAGE="Public visibility is granted by the platform team. Ask a platform operator to publish this resource.";function newGuardPublicVisibilityStep(authorizer){return{name:"GuardPublicVisibility",async execute(ctx){ctx.callerIdentity.callerClass!=="internal"&&metadataOf(ctx.newState)?.visibility===ApiResourceVisibility.visibility_public&&await requireOperatorMaySetPublic(authorizer,ctx.callerIdentity)}}}function newAuthorizeVisibilityTransitionStep(targetKey,authorizer){return{name:"AuthorizeVisibilityTransition",async execute(ctx){if(ctx.callerIdentity.callerClass==="internal"||ctx.input.visibility!==ApiResourceVisibility.visibility_public)return;let target=ctx.get(targetKey);if(target===void 0)throw internalError(new Error("AuthorizeVisibilityTransition ran without a loaded target \u2014 step must be placed after the load step"),"visibility authorization requires the loaded resource");metadataOf(target)?.visibility!==ApiResourceVisibility.visibility_public&&await requireOperatorMaySetPublic(authorizer,ctx.callerIdentity)}}}async function requireOperatorMaySetPublic(authorizer,caller){let decision;try{decision=await authorizer.authorize(caller,{permission:IamPermission.can_set_public_visibility,resourceKind:ApiResourceKind.platform,resourceId:"stigmer"})}catch(error2){throw publicVisibilityCheckFailure(error2)}switch(decision.kind){case"allow":return;case"deny":case"not-found":throw new ConnectError(PUBLIC_VISIBILITY_DENY_MESSAGE,Code.PermissionDenied);case"unavailable":throw publicVisibilityCheckFailure(decision.cause);default:{let exhaustive=decision;throw publicVisibilityCheckFailure(new Error(`unknown decision ${JSON.stringify(exhaustive)}`))}}}function publicVisibilityCheckFailure(error2){return internalError(error2 instanceof Error?error2:new Error(String(error2)),"public-visibility authorization could not be completed")}function newBuildUpdateStateStep(){return{name:"BuildUpdateState",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not found in context - LoadExisting must run first"),"build update state");let merged=clone(ctx.schema,ctx.input);preserveImmutableFields(merged,existing),hasStatusField(ctx.schema)&&(clearStatusField(ctx.schema,merged),copyStatusFromExisting(ctx.schema,merged,existing),updateAuditFields(ctx.schema,merged,existing,ctx.callerIdentity)),ctx.setNewState(merged)}}}function preserveImmutableFields(merged,existing){let mergedMeta=metadataOf(merged),existingMeta=metadataOf(existing);if(mergedMeta===void 0||existingMeta===void 0)throw internalError(new Error("metadata is nil"),"preserve immutable fields");mergedMeta.id=existingMeta.id,mergedMeta.slug=existingMeta.slug,mergedMeta.org=existingMeta.org,mergedMeta.visibility=existingMeta.visibility}function copyStatusFromExisting(schema2,merged,existing){let existingRoot=reflect2(schema2,existing),statusField=messageFieldByName(existingRoot,"status");if(statusField===void 0||!existingRoot.isSet(statusField))return;let statusCopy=reflect2(statusField.message,clone(statusField.message,existingRoot.get(statusField).message));reflect2(schema2,merged).set(statusField,statusCopy)}function updateAuditFields(schema2,resource,existing,identity2){let now=timestampNow(),actor=auditActorFor(identity2),{createdBy,createdAt}=creationAuditOf(schema2,existing,"spec_audit");setAuditReflect(schema2,resource,create2(ApiResourceAuditSchema,{specAudit:updatedAuditInfo(createdBy,createdAt,actor,now),statusAudit:create2(ApiResourceAuditInfoSchema,{createdBy:actor,createdAt:now,updatedBy:actor,updatedAt:now,event:"updated"})}))}function newCheckDuplicateStep(store){return{name:"CheckDuplicate",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"duplicate check");if(metadata.slug==="")throw internalError(new Error("resource slug is empty"),"duplicate check");let existing;try{existing=await findResourceBySlug(store,ctx.apiResourceKind,ctx.schema,metadata.slug,metadata.org)}catch(error2){throw internalError(error2,"failed to check for duplicates")}if(existing!==void 0){let existingMetadata=metadataOf(existing);throw alreadyExistsError(getKindName(ctx.apiResourceKind),`slug '${metadata.slug}' in org '${existingMetadata?.org??""}' (id: ${existingMetadata?.id??""})`)}}}}var RESOURCE_ID_KEY="resourceId";function newExtractResourceIdStep(){return{name:"ExtractResourceId",execute(ctx){let id=idValueOf(ctx.input);if(id==="")throw invalidArgumentError("resource id is required");ctx.set(RESOURCE_ID_KEY,id)}}}function newLoadExistingForDeleteStep(store,resourceSchema){return{name:"LoadExistingForDelete",async execute(ctx){let id=requireResourceId(ctx),resource;try{resource=await store.getResource(ctx.apiResourceKind,id,resourceSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError(getKindName(ctx.apiResourceKind),id):error2}ctx.set(EXISTING_RESOURCE_KEY,resource)}}}function newDeleteResourceStep(store){return{name:"DeleteResource",async execute(ctx){let id=requireResourceId(ctx);try{await store.deleteResource(ctx.apiResourceKind,id)}catch(error2){throw internalError(error2,`failed to delete ${getKindName(ctx.apiResourceKind)}`)}}}}function requireResourceId(ctx){let id=ctx.get(RESOURCE_ID_KEY);if(typeof id!="string"||id==="")throw internalError(new Error("resource id not found in context (ExtractResourceId must run first)"),"delete pipeline ordering");return id}function apiResourceKindName(kind){return enumToJson(ApiResourceKindSchema,kind)}function extractFieldValue(schema2,msg,fieldPath){let parts=fieldPath.split("."),current=reflect2(schema2,msg);for(let i6=0;i6<parts.length;i6++){let part=parts[i6],field2=findFieldByProtoName(current,part);if(field2===void 0)return"";if(i6===parts.length-1)return scalarString(current,field2);if(field2.fieldKind!=="message")return"";current=current.get(field2)}return""}function extractLabelValue(schema2,msg,labelKey){let root5=reflect2(schema2,msg),metadataField=root5.fields.find(f5=>f5.name==="metadata");if(metadataField===void 0||metadataField.fieldKind!=="message")return"";let metadata=root5.get(metadataField),labelsField=metadata.fields.find(f5=>f5.name==="labels");if(labelsField===void 0||labelsField.fieldKind!=="map")return"";let value=metadata.get(labelsField).get(labelKey);return typeof value=="string"?value:""}function scanForFieldMatch(rows,schema2,fieldPath,value){for(let data of rows){let msg;try{msg=fromBinary2(schema2,data)}catch{continue}if(extractFieldValue(schema2,msg,fieldPath)===value)return msg}}function filterRowsByLabel(rows,schema2,labelKey,labelValue){let results=[];for(let data of rows){let msg;try{msg=fromBinary2(schema2,data)}catch{continue}extractLabelValue(schema2,msg,labelKey)===labelValue&&results.push(data)}return results}function findFieldByProtoName(message6,part){return message6.fields.find(f5=>f5.name===part)??message6.fields.find(f5=>f5.name===toSnakeCase(part))}function scalarString(message6,field2){if(field2.fieldKind==="list"||field2.fieldKind==="map"||field2.fieldKind==="message")return"";let value=message6.get(field2);return typeof value=="string"?value:typeof value=="number"||typeof value=="bigint"?String(value):typeof value=="boolean"?value?"true":"false":value instanceof Uint8Array?Buffer.from(value).toString("latin1"):""}function toSnakeCase(value){let result="";for(let i6=0;i6<value.length;i6++){let ch=value[i6];i6>0&&ch>="A"&&ch<="Z"&&(result+="_"),result+=ch}return result.toLowerCase()}function newIndexSearchStep(store,extractor,logger2){return{name:"IndexSearch",async execute(ctx){let resource=ctx.newState,metadata=metadataOf(resource);if(metadata===void 0||metadata.id===""){logger2.warn("IndexSearch: resource has no metadata or ID, skipping indexing");return}let entry=extractor.getSearchIndexEntry(resource);if(entry===void 0){logger2.warn("IndexSearch: extractor returned no entry, skipping indexing",{id:metadata.id});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,metadata.id,entry)}catch(error2){logger2.warn("IndexSearch: failed to update search index (best-effort)",{id:metadata.id,kind:apiResourceKindName(ctx.apiResourceKind),error:error2 instanceof Error?error2.message:String(error2)})}}}}function newDeleteSearchIndexStep(store,logger2){return{name:"DeleteSearchIndex",async execute(ctx){let id=ctx.get(RESOURCE_ID_KEY);if(typeof id!="string"||id==="")throw internalError(new Error("resource id not found in context (ExtractResourceId must run first)"),"delete search index ordering");try{await store.deleteSearchIndex(ctx.apiResourceKind,id)}catch(error2){logger2.warn("DeleteSearchIndex: failed to remove search index entry (best-effort)",{id,kind:apiResourceKindName(ctx.apiResourceKind),error:error2 instanceof Error?error2.message:String(error2)})}}}}var RESERVED_LABEL_PREFIX2="stigmer.ai/",DEFAULT_INSTANCE_LABEL=`${RESERVED_LABEL_PREFIX2}default-instance`,SYSTEM_MANAGED_LABEL=`${RESERVED_LABEL_PREFIX2}system-managed`,SYSTEM_LABEL=`${RESERVED_LABEL_PREFIX2}system`,RESERVED_LABEL_TRUE="true",PLUGIN_LABEL=`${RESERVED_LABEL_PREFIX2}plugin`,PLUGIN_VERSION_LABEL=`${RESERVED_LABEL_PREFIX2}plugin-version`;function pluginIdOf(metadata){let value=metadata?.labels[PLUGIN_LABEL];return value===void 0||value===""?void 0:value}function isDefaultInstance(metadata){return metadata?.labels[DEFAULT_INSTANCE_LABEL]===RESERVED_LABEL_TRUE}function isSystemContent(metadata){return metadata?.labels[SYSTEM_LABEL]===RESERVED_LABEL_TRUE}var MANAGED_KIND_NOUNS=new Map([[ApiResourceKind.skill,"skill"],[ApiResourceKind.mcp_server,"MCP server"],[ApiResourceKind.agent,"agent"],[ApiResourceKind.workflow,"workflow"]]);function pluginManagedRefusal(kind,slug,pluginSlug){return`${MANAGED_KIND_NOUNS.get(kind)??ApiResourceKind[kind]??String(kind)} '${slug}' is managed by plugin '${pluginSlug}'; change the plugin and push it again, or compose your own agent over it`}function newGuardPluginManagedStep(store,positions={}){let existingKey=positions.existingKey??EXISTING_RESOURCE_KEY;return{name:"GuardPluginManaged",async execute(ctx){if(ctx.callerIdentity.callerClass==="internal"||ctx.callerIdentity.origin==="in-process")return;let existing=ctx.get(existingKey);if(existing===void 0)return;let metadata=metadataOf(existing),pluginId=pluginIdOf(metadata);if(pluginId===void 0)return;let pluginSlug;try{pluginSlug=(await store.getResource(ApiResourceKind.plugin,pluginId,PluginSchema)).metadata?.slug??pluginId}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw internalError(error2,"plugin ownership could not be checked")}throw new ConnectError(pluginManagedRefusal(ctx.apiResourceKind,metadata?.slug??"",pluginSlug),Code.FailedPrecondition)}}}var EXISTS_IN_DATABASE_KEY="existsInDatabase",SHOULD_CREATE_KEY="shouldCreate";function newLoadForApplyStep(store){return{name:"LoadForApply",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0||metadata.slug===""){ctx.set(EXISTS_IN_DATABASE_KEY,!1),ctx.set(SHOULD_CREATE_KEY,!0);return}let existing=await findResourceBySlug(store,ctx.apiResourceKind,ctx.schema,metadata.slug,metadata.org);if(existing===void 0){ctx.set(EXISTS_IN_DATABASE_KEY,!1),ctx.set(SHOULD_CREATE_KEY,!0);return}ctx.set(EXISTING_RESOURCE_KEY,existing),ctx.set(EXISTS_IN_DATABASE_KEY,!0),ctx.set(SHOULD_CREATE_KEY,!1),metadata.id===""&&(metadata.id=metadataOf(existing)?.id??"")}}}function withResolvedApplyId(schema2,original,resolved){let enriched=clone(schema2,original),metadata=metadataOf(enriched),resolvedId=metadataOf(resolved.newState)?.id??"";return metadata!==void 0&&metadata.id===""&&resolvedId!==""&&(metadata.id=resolvedId),enriched}var TARGET_RESOURCE_KEY="targetResource";function newLoadTargetStep(store,targetSchema){return{name:"LoadTarget",async execute(ctx){let resourceId=idValueOf(ctx.input);if(resourceId==="")throw invalidArgumentError("resource id is required");let target;try{target=await store.getResource(ctx.apiResourceKind,resourceId,targetSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError(getKindName(ctx.apiResourceKind),resourceId):error2}ctx.set(TARGET_RESOURCE_KEY,target)}}}function newLoadByReferenceStep(store,targetSchema){return{name:"LoadByReference",async execute(ctx){let ref=ctx.input;if(ref.slug==="")throw invalidArgumentError("slug is required in reference");let kind=ctx.apiResourceKind;if(ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==kind)throw invalidArgumentError(`kind mismatch: expected ${apiResourceKindName(kind)}, got ${apiResourceKindName(ref.kind)}`);requireOrgForReference(kind,ref.org);let target=await findResourceBySlug(store,kind,targetSchema,ref.slug,ref.org);if(target===void 0)throw notFoundError(getKindName(kind),ref.slug);ctx.set(TARGET_RESOURCE_KEY,target)}}}var API_RESOURCE_REFERENCE_TYPE="ai.stigmer.commons.apiresource.ApiResourceReference";function newNormalizeReferencesStep(){return{name:"NormalizeReferences",execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"normalize references");metadata.org!==""&&forEachSpecReference(ctx.schema,ctx.newState,ref=>{let orgField=ref.fields.find(f5=>f5.name==="org");orgField!==void 0&&ref.get(orgField)===""&&ref.set(orgField,metadata.org)})}}}function newValidateReferencesStep(store){return{name:"ValidateReferences",async execute(ctx){let refs=[];forEachSpecReference(ctx.schema,ctx.newState,ref=>{refs.push({kind:numberField(ref,"kind"),slug:stringField(ref,"slug"),org:stringField(ref,"org")})});let missingMcpServers=[];for(let ref of refs)ref.slug!==""&&ref.kind===ApiResourceKind.mcp_server&&await findResourceBySlug(store,ApiResourceKind.mcp_server,McpServerSchema,ref.slug,ref.org)===void 0&&missingMcpServers.push(`'${ref.slug}' (org: ${ref.org})`);if(missingMcpServers.length>0)throw failedPreconditionError(`referenced MCP server(s) not found: ${missingMcpServers.join(", ")}. Verify the slug and org are correct. Use 'stigmer get mcp-servers' to list available MCP servers.`)}}}function collectSpecReferences(schema2,msg){let refs=[];return forEachSpecReference(schema2,msg,ref=>{refs.push({kind:numberField(ref,"kind"),slug:stringField(ref,"slug"),org:stringField(ref,"org")})}),refs}function forEachSpecReference(schema2,msg,fn){let root5=reflect2(schema2,msg),specField=messageFieldByName(root5,"spec");specField===void 0||!root5.isSet(specField)||walk(root5.get(specField),fn)}function walk(msg,fn){for(let field2 of msg.fields)if(field2.fieldKind==="list"){if(field2.listKind!=="message")continue;for(let item of msg.get(field2))visit(item,fn)}else if(field2.fieldKind==="map"){if(field2.mapKind!=="message")continue;let map5=msg.get(field2);for(let[,value]of map5)visit(value,fn)}else if(field2.fieldKind==="message"){if(!msg.isSet(field2))continue;visit(msg.get(field2),fn)}}function visit(sub,fn){sub.desc.typeName===API_RESOURCE_REFERENCE_TYPE?fn(sub):walk(sub,fn)}function stringField(msg,name){let field2=msg.fields.find(f5=>f5.name===name);if(field2===void 0)return"";let value=msg.get(field2);return typeof value=="string"?value:""}function numberField(msg,name){let field2=msg.fields.find(f5=>f5.name===name);if(field2===void 0)return 0;let value=msg.get(field2);return typeof value=="number"?value:0}function newPersistStep(store){return{name:"Persist",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"persist");if(metadata.id==="")throw internalError(new Error("resource ID is empty, cannot persist"),"persist");try{await store.saveResource(ctx.apiResourceKind,metadata.id,ctx.schema,ctx.newState)}catch(error2){throw internalError(error2,"failed to save resource to store")}}}}function newResolveSlugStep(){return{name:"ResolveSlug",execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"slug resolution");if(metadata.slug===""){if(metadata.name==="")throw invalidArgumentError("resource name is required");metadata.slug=generateSlug(metadata.name)}}}}function generateSlug(name){let slug=name.toLowerCase();return slug=slug.replaceAll(" ","-").replaceAll(".","-"),slug=slug.replace(/[^a-z0-9\- ]/g,""),slug=slug.replace(/-{2,}/g,"-"),slug.replace(/^-+|-+$/g,"")}var file_buf_validate_validate2=fileDesc2("ChtidWYvdmFsaWRhdGUvdmFsaWRhdGUucHJvdG8SDGJ1Zi52YWxpZGF0ZSI3CgRSdWxlEgoKAmlkGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEgoKZXhwcmVzc2lvbhgDIAEoCSKGAQoMTWVzc2FnZVJ1bGVzEhYKDmNlbF9leHByZXNzaW9uGAUgAygJEh8KA2NlbBgDIAMoCzISLmJ1Zi52YWxpZGF0ZS5SdWxlEi0KBW9uZW9mGAQgAygLMh4uYnVmLnZhbGlkYXRlLk1lc3NhZ2VPbmVvZlJ1bGVKBAgBEAJSCGRpc2FibGVkIjQKEE1lc3NhZ2VPbmVvZlJ1bGUSDgoGZmllbGRzGAEgAygJEhAKCHJlcXVpcmVkGAIgASgIIh4KCk9uZW9mUnVsZXMSEAoIcmVxdWlyZWQYASABKAgiiwkKCkZpZWxkUnVsZXMSFgoOY2VsX2V4cHJlc3Npb24YHSADKAkSHwoDY2VsGBcgAygLMhIuYnVmLnZhbGlkYXRlLlJ1bGUSEAoIcmVxdWlyZWQYGSABKAgSJAoGaWdub3JlGBsgASgOMhQuYnVmLnZhbGlkYXRlLklnbm9yZRIpCgVmbG9hdBgBIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GbG9hdFJ1bGVzSAASKwoGZG91YmxlGAIgASgLMhkuYnVmLnZhbGlkYXRlLkRvdWJsZVJ1bGVzSAASKQoFaW50MzIYAyABKAsyGC5idWYudmFsaWRhdGUuSW50MzJSdWxlc0gAEikKBWludDY0GAQgASgLMhguYnVmLnZhbGlkYXRlLkludDY0UnVsZXNIABIrCgZ1aW50MzIYBSABKAsyGS5idWYudmFsaWRhdGUuVUludDMyUnVsZXNIABIrCgZ1aW50NjQYBiABKAsyGS5idWYudmFsaWRhdGUuVUludDY0UnVsZXNIABIrCgZzaW50MzIYByABKAsyGS5idWYudmFsaWRhdGUuU0ludDMyUnVsZXNIABIrCgZzaW50NjQYCCABKAsyGS5idWYudmFsaWRhdGUuU0ludDY0UnVsZXNIABItCgdmaXhlZDMyGAkgASgLMhouYnVmLnZhbGlkYXRlLkZpeGVkMzJSdWxlc0gAEi0KB2ZpeGVkNjQYCiABKAsyGi5idWYudmFsaWRhdGUuRml4ZWQ2NFJ1bGVzSAASLwoIc2ZpeGVkMzIYCyABKAsyGy5idWYudmFsaWRhdGUuU0ZpeGVkMzJSdWxlc0gAEi8KCHNmaXhlZDY0GAwgASgLMhsuYnVmLnZhbGlkYXRlLlNGaXhlZDY0UnVsZXNIABInCgRib29sGA0gASgLMhcuYnVmLnZhbGlkYXRlLkJvb2xSdWxlc0gAEisKBnN0cmluZxgOIAEoCzIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlc0gAEikKBWJ5dGVzGA8gASgLMhguYnVmLnZhbGlkYXRlLkJ5dGVzUnVsZXNIABInCgRlbnVtGBAgASgLMhcuYnVmLnZhbGlkYXRlLkVudW1SdWxlc0gAEi8KCHJlcGVhdGVkGBIgASgLMhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXNIABIlCgNtYXAYEyABKAsyFi5idWYudmFsaWRhdGUuTWFwUnVsZXNIABIlCgNhbnkYFCABKAsyFi5idWYudmFsaWRhdGUuQW55UnVsZXNIABIvCghkdXJhdGlvbhgVIAEoCzIbLmJ1Zi52YWxpZGF0ZS5EdXJhdGlvblJ1bGVzSAASMgoKZmllbGRfbWFzaxgcIAEoCzIcLmJ1Zi52YWxpZGF0ZS5GaWVsZE1hc2tSdWxlc0gAEjEKCXRpbWVzdGFtcBgWIAEoCzIcLmJ1Zi52YWxpZGF0ZS5UaW1lc3RhbXBSdWxlc0gAQgYKBHR5cGVKBAgYEBlKBAgaEBtSB3NraXBwZWRSDGlnbm9yZV9lbXB0eSJVCg9QcmVkZWZpbmVkUnVsZXMSHwoDY2VsGAEgAygLMhIuYnVmLnZhbGlkYXRlLlJ1bGVKBAgYEBlKBAgaEBtSB3NraXBwZWRSDGlnbm9yZV9lbXB0eSL4FgoKRmxvYXRSdWxlcxJ9CgVjb25zdBgBIAEoAkJuwkhrCmkKC2Zsb2F0LmNvbnN0Glp0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICdtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSmQEKAmx0GAIgASgCQooBwkiGAQqDAQoIZmxvYXQubHQadyFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPj0gcnVsZXMubHQpPyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASqQEKA2x0ZRgDIAEoAkKZAcJIlQEKkgEKCWZsb2F0Lmx0ZRqEASFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUpPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEtAHCgJndBgEIAEoAkLBB8JIvQcKhgEKCGZsb2F0Lmd0GnohaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwq9AQoLZmxvYXQuZ3RfbHQarQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrHAQoVZmxvYXQuZ3RfbHRfZXhjbHVzaXZlGq0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKzQEKDGZsb2F0Lmd0X2x0ZRq8AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCtcBChZmbG9hdC5ndF9sdGVfZXhjbHVzaXZlGrwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARKcCAoDZ3RlGAUgASgCQowIwkiICAqVAQoJZmxvYXQuZ3RlGocBIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCswBCgxmbG9hdC5ndGVfbHQauwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCtYBChZmbG9hdC5ndGVfbHRfZXhjbHVzaXZlGrsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrcAQoNZmxvYXQuZ3RlX2x0ZRrKAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK5gEKF2Zsb2F0Lmd0ZV9sdGVfZXhjbHVzaXZlGsoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEnkKAmluGAYgAygCQm3CSGoKaAoIZmxvYXQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnAKBm5vdF9pbhgHIAMoAkJgwkhdClsKDGZsb2F0Lm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEm8KBmZpbml0ZRgIIAEoCEJfwkhcCloKDGZsb2F0LmZpbml0ZRpKcnVsZXMuZmluaXRlID8gKHRoaXMuaXNOYW4oKSB8fCB0aGlzLmlzSW5mKCkgPyAnbXVzdCBiZSBmaW5pdGUnIDogJycpIDogJycSKwoHZXhhbXBsZRgJIAMoAkIawkgXChUKDWZsb2F0LmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIooXCgtEb3VibGVSdWxlcxJ+CgVjb25zdBgBIAEoAUJvwkhsCmoKDGRvdWJsZS5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEpoBCgJsdBgCIAEoAUKLAcJIhwEKhAEKCWRvdWJsZS5sdBp3IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+PSBydWxlcy5sdCk/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKqAQoDbHRlGAMgASgBQpoBwkiWAQqTAQoKZG91YmxlLmx0ZRqEASFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUpPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEtUHCgJndBgEIAEoAULGB8JIwgcKhwEKCWRvdWJsZS5ndBp6IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKvgEKDGRvdWJsZS5ndF9sdBqtAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCsgBChZkb3VibGUuZ3RfbHRfZXhjbHVzaXZlGq0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKzgEKDWRvdWJsZS5ndF9sdGUavAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrYAQoXZG91YmxlLmd0X2x0ZV9leGNsdXNpdmUavAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEqEICgNndGUYBSABKAFCkQjCSI0ICpYBCgpkb3VibGUuZ3RlGocBIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCs0BCg1kb3VibGUuZ3RlX2x0GrsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrXAQoXZG91YmxlLmd0ZV9sdF9leGNsdXNpdmUauwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCt0BCg5kb3VibGUuZ3RlX2x0ZRrKAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK5wEKGGRvdWJsZS5ndGVfbHRlX2V4Y2x1c2l2ZRrKAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ6CgJpbhgGIAMoAUJuwkhrCmkKCWRvdWJsZS5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAcgAygBQmHCSF4KXAoNZG91YmxlLm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEnAKBmZpbml0ZRgIIAEoCEJgwkhdClsKDWRvdWJsZS5maW5pdGUaSnJ1bGVzLmZpbml0ZSA/ICh0aGlzLmlzTmFuKCkgfHwgdGhpcy5pc0luZigpID8gJ211c3QgYmUgZmluaXRlJyA6ICcnKSA6ICcnEiwKB2V4YW1wbGUYCSADKAFCG8JIGAoWCg5kb3VibGUuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4isBQKCkludDMyUnVsZXMSfQoFY29uc3QYASABKAVCbsJIawppCgtpbnQzMi5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEoQBCgJsdBgCIAEoBUJ2wkhzCnEKCGludDMyLmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpUBCgNsdGUYAyABKAVChQHCSIEBCn8KCWludDMyLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAAS+QYKAmd0GAQgASgFQuoGwkjmBgp0CghpbnQzMi5ndBpoIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKrQEKC2ludDMyLmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq1AQoVaW50MzIuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvQEKDGludDMyLmd0X2x0ZRqsAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKxQEKFmludDMyLmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEsUHCgNndGUYBSABKAVCtQfCSLEHCoIBCglpbnQzMi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq8AQoMaW50MzIuZ3RlX2x0GqsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCsQBChZpbnQzMi5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrMAQoNaW50MzIuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrUAQoXaW50MzIuZ3RlX2x0ZV9leGNsdXNpdmUauAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESeQoCaW4YBiADKAVCbcJIagpoCghpbnQzMi5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScAoGbm90X2luGAcgAygFQmDCSF0KWwoMaW50MzIubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSKwoHZXhhbXBsZRgIIAMoBUIawkgXChUKDWludDMyLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIrAUCgpJbnQ2NFJ1bGVzEn0KBWNvbnN0GAEgASgDQm7CSGsKaQoLaW50NjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKEAQoCbHQYAiABKANCdsJIcwpxCghpbnQ2NC5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKVAQoDbHRlGAMgASgDQoUBwkiBAQp/CglpbnQ2NC5sdGUaciFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEvkGCgJndBgEIAEoA0LqBsJI5gYKdAoIaW50NjQuZ3QaaCFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCq0BCgtpbnQ2NC5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtQEKFWludDY0Lmd0X2x0X2V4Y2x1c2l2ZRqbAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr0BCgxpbnQ2NC5ndF9sdGUarAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCsUBChZpbnQ2NC5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLFBwoDZ3RlGAUgASgDQrUHwkixBwqCAQoJaW50NjQuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKvAEKDGludDY0Lmd0ZV9sdBqrAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrEAQoWaW50NjQuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzAEKDWludDY0Lmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK1AEKF2ludDY0Lmd0ZV9sdGVfZXhjbHVzaXZlGrgBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEnkKAmluGAYgAygDQm3CSGoKaAoIaW50NjQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnAKBm5vdF9pbhgHIAMoA0JgwkhdClsKDGludDY0Lm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEisKB2V4YW1wbGUYCSADKANCGsJIFwoVCg1pbnQ2NC5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiLCFAoLVUludDMyUnVsZXMSfgoFY29uc3QYASABKA1Cb8JIbApqCgx1aW50MzIuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKFAQoCbHQYAiABKA1Cd8JIdApyCgl1aW50MzIubHQaZSFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASlwEKA2x0ZRgDIAEoDUKHAcJIgwEKgAEKCnVpbnQzMi5sdGUaciFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEv4GCgJndBgEIAEoDULvBsJI6wYKdQoJdWludDMyLmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwquAQoMdWludDMyLmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq2AQoWdWludDMyLmd0X2x0X2V4Y2x1c2l2ZRqbAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr4BCg11aW50MzIuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrGAQoXdWludDMyLmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEsoHCgNndGUYBSABKA1CugfCSLYHCoMBCgp1aW50MzIuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKvQEKDXVpbnQzMi5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxQEKF3VpbnQzMi5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrNAQoOdWludDMyLmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK1QEKGHVpbnQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ6CgJpbhgGIAMoDUJuwkhrCmkKCXVpbnQzMi5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAcgAygNQmHCSF4KXAoNdWludDMyLm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEiwKB2V4YW1wbGUYCCADKA1CG8JIGAoWCg51aW50MzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4iwhQKC1VJbnQ2NFJ1bGVzEn4KBWNvbnN0GAEgASgEQm/CSGwKagoMdWludDY0LmNvbnN0Glp0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICdtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycShQEKAmx0GAIgASgEQnfCSHQKcgoJdWludDY0Lmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpcBCgNsdGUYAyABKARChwHCSIMBCoABCgp1aW50NjQubHRlGnIhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ211c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABL+BgoCZ3QYBCABKARC7wbCSOsGCnUKCXVpbnQ2NC5ndBpoIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKrgEKDHVpbnQ2NC5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtgEKFnVpbnQ2NC5ndF9sdF9leGNsdXNpdmUamwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq+AQoNdWludDY0Lmd0X2x0ZRqsAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKxgEKF3VpbnQ2NC5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLKBwoDZ3RlGAUgASgEQroHwki2BwqDAQoKdWludDY0Lmd0ZRp1IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCr0BCg11aW50NjQuZ3RlX2x0GqsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCsUBChd1aW50NjQuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzQEKDnVpbnQ2NC5ndGVfbHRlGroBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtUBChh1aW50NjQuZ3RlX2x0ZV9leGNsdXNpdmUauAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESegoCaW4YBiADKARCbsJIawppCgl1aW50NjQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnEKBm5vdF9pbhgHIAMoBEJhwkheClwKDXVpbnQ2NC5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIsCgdleGFtcGxlGAggAygEQhvCSBgKFgoOdWludDY0LmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIsIUCgtTSW50MzJSdWxlcxJ+CgVjb25zdBgBIAEoEUJvwkhsCmoKDHNpbnQzMi5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEoUBCgJsdBgCIAEoEUJ3wkh0CnIKCXNpbnQzMi5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKXAQoDbHRlGAMgASgRQocBwkiDAQqAAQoKc2ludDMyLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAAS/gYKAmd0GAQgASgRQu8GwkjrBgp1CglzaW50MzIuZ3QaaCFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCq4BCgxzaW50MzIuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrYBChZzaW50MzIuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvgEKDXNpbnQzMi5ndF9sdGUarAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCsYBChdzaW50MzIuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAESygcKA2d0ZRgFIAEoEUK6B8JItgcKgwEKCnNpbnQzMi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq9AQoNc2ludDMyLmd0ZV9sdBqrAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrFAQoXc2ludDMyLmd0ZV9sdF9leGNsdXNpdmUaqQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs0BCg5zaW50MzIuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrVAQoYc2ludDMyLmd0ZV9sdGVfZXhjbHVzaXZlGrgBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEnoKAmluGAYgAygRQm7CSGsKaQoJc2ludDMyLmluGlwhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJxCgZub3RfaW4YByADKBFCYcJIXgpcCg1zaW50MzIubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLAoHZXhhbXBsZRgIIAMoEUIbwkgYChYKDnNpbnQzMi5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiLCFAoLU0ludDY0UnVsZXMSfgoFY29uc3QYASABKBJCb8JIbApqCgxzaW50NjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKFAQoCbHQYAiABKBJCd8JIdApyCglzaW50NjQubHQaZSFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASlwEKA2x0ZRgDIAEoEkKHAcJIgwEKgAEKCnNpbnQ2NC5sdGUaciFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEv4GCgJndBgEIAEoEkLvBsJI6wYKdQoJc2ludDY0Lmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwquAQoMc2ludDY0Lmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq2AQoWc2ludDY0Lmd0X2x0X2V4Y2x1c2l2ZRqbAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr4BCg1zaW50NjQuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrGAQoXc2ludDY0Lmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEsoHCgNndGUYBSABKBJCugfCSLYHCoMBCgpzaW50NjQuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKvQEKDXNpbnQ2NC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxQEKF3NpbnQ2NC5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrNAQoOc2ludDY0Lmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK1QEKGHNpbnQ2NC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ6CgJpbhgGIAMoEkJuwkhrCmkKCXNpbnQ2NC5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAcgAygSQmHCSF4KXAoNc2ludDY0Lm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEiwKB2V4YW1wbGUYCCADKBJCG8JIGAoWCg5zaW50NjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i0xQKDEZpeGVkMzJSdWxlcxJ/CgVjb25zdBgBIAEoB0JwwkhtCmsKDWZpeGVkMzIuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKGAQoCbHQYAiABKAdCeMJIdQpzCgpmaXhlZDMyLmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpgBCgNsdGUYAyABKAdCiAHCSIQBCoEBCgtmaXhlZDMyLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASgwcKAmd0GAQgASgHQvQGwkjwBgp2CgpmaXhlZDMyLmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqvAQoNZml4ZWQzMi5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtwEKF2ZpeGVkMzIuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvwEKDmZpeGVkMzIuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrHAQoYZml4ZWQzMi5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLPBwoDZ3RlGAUgASgHQr8Hwki7BwqEAQoLZml4ZWQzMi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq+AQoOZml4ZWQzMi5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxgEKGGZpeGVkMzIuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzgEKD2ZpeGVkMzIuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrWAQoZZml4ZWQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ7CgJpbhgGIAMoB0JvwkhsCmoKCmZpeGVkMzIuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnIKBm5vdF9pbhgHIAMoB0JiwkhfCl0KDmZpeGVkMzIubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLQoHZXhhbXBsZRgIIAMoB0IcwkgZChcKD2ZpeGVkMzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i0xQKDEZpeGVkNjRSdWxlcxJ/CgVjb25zdBgBIAEoBkJwwkhtCmsKDWZpeGVkNjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKGAQoCbHQYAiABKAZCeMJIdQpzCgpmaXhlZDY0Lmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpgBCgNsdGUYAyABKAZCiAHCSIQBCoEBCgtmaXhlZDY0Lmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASgwcKAmd0GAQgASgGQvQGwkjwBgp2CgpmaXhlZDY0Lmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqvAQoNZml4ZWQ2NC5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtwEKF2ZpeGVkNjQuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvwEKDmZpeGVkNjQuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrHAQoYZml4ZWQ2NC5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLPBwoDZ3RlGAUgASgGQr8Hwki7BwqEAQoLZml4ZWQ2NC5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq+AQoOZml4ZWQ2NC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxgEKGGZpeGVkNjQuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzgEKD2ZpeGVkNjQuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrWAQoZZml4ZWQ2NC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ7CgJpbhgGIAMoBkJvwkhsCmoKCmZpeGVkNjQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnIKBm5vdF9pbhgHIAMoBkJiwkhfCl0KDmZpeGVkNjQubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLQoHZXhhbXBsZRgIIAMoBkIcwkgZChcKD2ZpeGVkNjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i5RQKDVNGaXhlZDMyUnVsZXMSgAEKBWNvbnN0GAEgASgPQnHCSG4KbAoOc2ZpeGVkMzIuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKHAQoCbHQYAiABKA9CecJIdgp0CgtzZml4ZWQzMi5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKZAQoDbHRlGAMgASgPQokBwkiFAQqCAQoMc2ZpeGVkMzIubHRlGnIhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ211c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKIBwoCZ3QYBCABKA9C+QbCSPUGCncKC3NmaXhlZDMyLmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqwAQoOc2ZpeGVkMzIuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrgBChhzZml4ZWQzMi5ndF9sdF9leGNsdXNpdmUamwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrAAQoPc2ZpeGVkMzIuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrIAQoZc2ZpeGVkMzIuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES1AcKA2d0ZRgFIAEoD0LEB8JIwAcKhQEKDHNmaXhlZDMyLmd0ZRp1IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCr8BCg9zZml4ZWQzMi5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxwEKGXNmaXhlZDMyLmd0ZV9sdF9leGNsdXNpdmUaqQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs8BChBzZml4ZWQzMi5ndGVfbHRlGroBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtcBChpzZml4ZWQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ8CgJpbhgGIAMoD0JwwkhtCmsKC3NmaXhlZDMyLmluGlwhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJzCgZub3RfaW4YByADKA9CY8JIYApeCg9zZml4ZWQzMi5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIuCgdleGFtcGxlGAggAygPQh3CSBoKGAoQc2ZpeGVkMzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i5RQKDVNGaXhlZDY0UnVsZXMSgAEKBWNvbnN0GAEgASgQQnHCSG4KbAoOc2ZpeGVkNjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKHAQoCbHQYAiABKBBCecJIdgp0CgtzZml4ZWQ2NC5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKZAQoDbHRlGAMgASgQQokBwkiFAQqCAQoMc2ZpeGVkNjQubHRlGnIhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ211c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKIBwoCZ3QYBCABKBBC+QbCSPUGCncKC3NmaXhlZDY0Lmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqwAQoOc2ZpeGVkNjQuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrgBChhzZml4ZWQ2NC5ndF9sdF9leGNsdXNpdmUamwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrAAQoPc2ZpeGVkNjQuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrIAQoZc2ZpeGVkNjQuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES1AcKA2d0ZRgFIAEoEELEB8JIwAcKhQEKDHNmaXhlZDY0Lmd0ZRp1IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCr8BCg9zZml4ZWQ2NC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxwEKGXNmaXhlZDY0Lmd0ZV9sdF9leGNsdXNpdmUaqQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs8BChBzZml4ZWQ2NC5ndGVfbHRlGroBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtcBChpzZml4ZWQ2NC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ8CgJpbhgGIAMoEEJwwkhtCmsKC3NmaXhlZDY0LmluGlwhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJzCgZub3RfaW4YByADKBBCY8JIYApeCg9zZml4ZWQ2NC5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIuCgdleGFtcGxlGAggAygQQh3CSBoKGAoQc2ZpeGVkNjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4iwAEKCUJvb2xSdWxlcxJ8CgVjb25zdBgBIAEoCEJtwkhqCmgKCmJvb2wuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxIqCgdleGFtcGxlGAIgAygIQhnCSBYKFAoMYm9vbC5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAIi6jwKC1N0cmluZ1J1bGVzEoABCgVjb25zdBgBIAEoCUJxwkhuCmwKDHN0cmluZy5jb25zdBpcdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCBgJXNgJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycScQoDbGVuGBMgASgEQmTCSGEKXwoKc3RyaW5nLmxlbhpRdWludCh0aGlzLnNpemUoKSkgIT0gcnVsZXMubGVuID8gJ211c3QgYmUgJXMgY2hhcmFjdGVycycuZm9ybWF0KFtydWxlcy5sZW5dKSA6ICcnEokBCgdtaW5fbGVuGAIgASgEQnjCSHUKcwoOc3RyaW5nLm1pbl9sZW4aYXVpbnQodGhpcy5zaXplKCkpIDwgcnVsZXMubWluX2xlbiA/ICdtdXN0IGJlIGF0IGxlYXN0ICVzIGNoYXJhY3RlcnMnLmZvcm1hdChbcnVsZXMubWluX2xlbl0pIDogJycSiAEKB21heF9sZW4YAyABKARCd8JIdApyCg5zdHJpbmcubWF4X2xlbhpgdWludCh0aGlzLnNpemUoKSkgPiBydWxlcy5tYXhfbGVuID8gJ211c3QgYmUgYXQgbW9zdCAlcyBjaGFyYWN0ZXJzJy5mb3JtYXQoW3J1bGVzLm1heF9sZW5dKSA6ICcnEosBCglsZW5fYnl0ZXMYFCABKARCeMJIdQpzChBzdHJpbmcubGVuX2J5dGVzGl91aW50KGJ5dGVzKHRoaXMpLnNpemUoKSkgIT0gcnVsZXMubGVuX2J5dGVzID8gJ211c3QgYmUgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubGVuX2J5dGVzXSkgOiAnJxKUAQoJbWluX2J5dGVzGAQgASgEQoABwkh9CnsKEHN0cmluZy5taW5fYnl0ZXMaZ3VpbnQoYnl0ZXModGhpcykuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9ieXRlcyA/ICdtdXN0IGJlIGF0IGxlYXN0ICVzIGJ5dGVzJy5mb3JtYXQoW3J1bGVzLm1pbl9ieXRlc10pIDogJycSkgEKCW1heF9ieXRlcxgFIAEoBEJ/wkh8CnoKEHN0cmluZy5tYXhfYnl0ZXMaZnVpbnQoYnl0ZXModGhpcykuc2l6ZSgpKSA+IHJ1bGVzLm1heF9ieXRlcyA/ICdtdXN0IGJlIGF0IG1vc3QgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubWF4X2J5dGVzXSkgOiAnJxKHAQoHcGF0dGVybhgGIAEoCUJ2wkhzCnEKDnN0cmluZy5wYXR0ZXJuGl8hdGhpcy5tYXRjaGVzKHJ1bGVzLnBhdHRlcm4pID8gJ2RvZXMgbm90IG1hdGNoIHJlZ2V4IHBhdHRlcm4gYCVzYCcuZm9ybWF0KFtydWxlcy5wYXR0ZXJuXSkgOiAnJxJ+CgZwcmVmaXgYByABKAlCbsJIawppCg1zdHJpbmcucHJlZml4GlghdGhpcy5zdGFydHNXaXRoKHJ1bGVzLnByZWZpeCkgPyAnZG9lcyBub3QgaGF2ZSBwcmVmaXggYCVzYCcuZm9ybWF0KFtydWxlcy5wcmVmaXhdKSA6ICcnEnwKBnN1ZmZpeBgIIAEoCUJswkhpCmcKDXN0cmluZy5zdWZmaXgaViF0aGlzLmVuZHNXaXRoKHJ1bGVzLnN1ZmZpeCkgPyAnZG9lcyBub3QgaGF2ZSBzdWZmaXggYCVzYCcuZm9ybWF0KFtydWxlcy5zdWZmaXhdKSA6ICcnEooBCghjb250YWlucxgJIAEoCUJ4wkh1CnMKD3N0cmluZy5jb250YWlucxpgIXRoaXMuY29udGFpbnMocnVsZXMuY29udGFpbnMpID8gJ2RvZXMgbm90IGNvbnRhaW4gc3Vic3RyaW5nIGAlc2AnLmZvcm1hdChbcnVsZXMuY29udGFpbnNdKSA6ICcnEpEBCgxub3RfY29udGFpbnMYFyABKAlCe8JIeAp2ChNzdHJpbmcubm90X2NvbnRhaW5zGl90aGlzLmNvbnRhaW5zKHJ1bGVzLm5vdF9jb250YWlucykgPyAnY29udGFpbnMgc3Vic3RyaW5nIGAlc2AnLmZvcm1hdChbcnVsZXMubm90X2NvbnRhaW5zXSkgOiAnJxJ6CgJpbhgKIAMoCUJuwkhrCmkKCXN0cmluZy5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAsgAygJQmHCSF4KXAoNc3RyaW5nLm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEtkBCgVlbWFpbBgMIAEoCELHAcJIwwEKWwoMc3RyaW5nLmVtYWlsEh1tdXN0IGJlIGEgdmFsaWQgZW1haWwgYWRkcmVzcxosIXJ1bGVzLmVtYWlsIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc0VtYWlsKCkKZAoSc3RyaW5nLmVtYWlsX2VtcHR5EjJ2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgZW1haWwgYWRkcmVzcxoaIXJ1bGVzLmVtYWlsIHx8IHRoaXMgIT0gJydIABLhAQoIaG9zdG5hbWUYDSABKAhCzAHCSMgBCl8KD3N0cmluZy5ob3N0bmFtZRIYbXVzdCBiZSBhIHZhbGlkIGhvc3RuYW1lGjIhcnVsZXMuaG9zdG5hbWUgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSG9zdG5hbWUoKQplChVzdHJpbmcuaG9zdG5hbWVfZW1wdHkSLXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBob3N0bmFtZRodIXJ1bGVzLmhvc3RuYW1lIHx8IHRoaXMgIT0gJydIABLBAQoCaXAYDiABKAhCsgHCSK4BCk8KCXN0cmluZy5pcBIabXVzdCBiZSBhIHZhbGlkIElQIGFkZHJlc3MaJiFydWxlcy5pcCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcCgpClsKD3N0cmluZy5pcF9lbXB0eRIvdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIGFkZHJlc3MaFyFydWxlcy5pcCB8fCB0aGlzICE9ICcnSAAS0AEKBGlwdjQYDyABKAhCvwHCSLsBClYKC3N0cmluZy5pcHY0EhxtdXN0IGJlIGEgdmFsaWQgSVB2NCBhZGRyZXNzGikhcnVsZXMuaXB2NCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcCg0KQphChFzdHJpbmcuaXB2NF9lbXB0eRIxdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjQgYWRkcmVzcxoZIXJ1bGVzLmlwdjQgfHwgdGhpcyAhPSAnJ0gAEtABCgRpcHY2GBAgASgIQr8Bwki7AQpWCgtzdHJpbmcuaXB2NhIcbXVzdCBiZSBhIHZhbGlkIElQdjYgYWRkcmVzcxopIXJ1bGVzLmlwdjYgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXAoNikKYQoRc3RyaW5nLmlwdjZfZW1wdHkSMXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBJUHY2IGFkZHJlc3MaGSFydWxlcy5pcHY2IHx8IHRoaXMgIT0gJydIABK5AQoDdXJpGBEgASgIQqkBwkilAQpLCgpzdHJpbmcudXJpEhNtdXN0IGJlIGEgdmFsaWQgVVJJGighcnVsZXMudXJpIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc1VyaSgpClYKEHN0cmluZy51cmlfZW1wdHkSKHZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBVUkkaGCFydWxlcy51cmkgfHwgdGhpcyAhPSAnJ0gAEmoKB3VyaV9yZWYYEiABKAhCV8JIVApSCg5zdHJpbmcudXJpX3JlZhIdbXVzdCBiZSBhIHZhbGlkIFVSSSBSZWZlcmVuY2UaISFydWxlcy51cmlfcmVmIHx8IHRoaXMuaXNVcmlSZWYoKUgAEokCCgdhZGRyZXNzGBUgASgIQvUBwkjxAQp7Cg5zdHJpbmcuYWRkcmVzcxInbXVzdCBiZSBhIHZhbGlkIGhvc3RuYW1lLCBvciBpcCBhZGRyZXNzGkAhcnVsZXMuYWRkcmVzcyB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNIb3N0bmFtZSgpIHx8IHRoaXMuaXNJcCgpCnIKFHN0cmluZy5hZGRyZXNzX2VtcHR5Ejx2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgaG9zdG5hbWUsIG9yIGlwIGFkZHJlc3MaHCFydWxlcy5hZGRyZXNzIHx8IHRoaXMgIT0gJydIABKSAgoEdXVpZBgWIAEoCEKBAsJI/QEKnwEKC3N0cmluZy51dWlkEhRtdXN0IGJlIGEgdmFsaWQgVVVJRBp6IXJ1bGVzLnV1aWQgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykKWQoRc3RyaW5nLnV1aWRfZW1wdHkSKXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBVVUlEGhkhcnVsZXMudXVpZCB8fCB0aGlzICE9ICcnSAAS6gEKBXR1dWlkGCEgASgIQtgBwkjUAQptCgxzdHJpbmcudHV1aWQSHG11c3QgYmUgYSB2YWxpZCB0cmltbWVkIFVVSUQaPyFydWxlcy50dXVpZCB8fCB0aGlzID09ICcnIHx8IHRoaXMubWF0Y2hlcygnXlswLTlhLWZBLUZdezMyfSQnKQpjChJzdHJpbmcudHV1aWRfZW1wdHkSMXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCB0cmltbWVkIFVVSUQaGiFydWxlcy50dXVpZCB8fCB0aGlzICE9ICcnSAASkAIKEWlwX3dpdGhfcHJlZml4bGVuGBogASgIQvIBwkjuAQpyChhzdHJpbmcuaXBfd2l0aF9wcmVmaXhsZW4SGW11c3QgYmUgYSB2YWxpZCBJUCBwcmVmaXgaOyFydWxlcy5pcF93aXRoX3ByZWZpeGxlbiB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCgpCngKHnN0cmluZy5pcF93aXRoX3ByZWZpeGxlbl9lbXB0eRIudmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIHByZWZpeBomIXJ1bGVzLmlwX3dpdGhfcHJlZml4bGVuIHx8IHRoaXMgIT0gJydIABLJAgoTaXB2NF93aXRoX3ByZWZpeGxlbhgbIAEoCEKpAsJIpQIKjQEKGnN0cmluZy5pcHY0X3dpdGhfcHJlZml4bGVuEi9tdXN0IGJlIGEgdmFsaWQgSVB2NCBhZGRyZXNzIHdpdGggcHJlZml4IGxlbmd0aBo+IXJ1bGVzLmlwdjRfd2l0aF9wcmVmaXhsZW4gfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXBQcmVmaXgoNCkKkgEKIHN0cmluZy5pcHY0X3dpdGhfcHJlZml4bGVuX2VtcHR5EkR2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBhZGRyZXNzIHdpdGggcHJlZml4IGxlbmd0aBooIXJ1bGVzLmlwdjRfd2l0aF9wcmVmaXhsZW4gfHwgdGhpcyAhPSAnJ0gAEskCChNpcHY2X3dpdGhfcHJlZml4bGVuGBwgASgIQqkCwkilAgqNAQoac3RyaW5nLmlwdjZfd2l0aF9wcmVmaXhsZW4SL211c3QgYmUgYSB2YWxpZCBJUHY2IGFkZHJlc3Mgd2l0aCBwcmVmaXggbGVuZ3RoGj4hcnVsZXMuaXB2Nl93aXRoX3ByZWZpeGxlbiB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCg2KQqSAQogc3RyaW5nLmlwdjZfd2l0aF9wcmVmaXhsZW5fZW1wdHkSRHZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBJUHY2IGFkZHJlc3Mgd2l0aCBwcmVmaXggbGVuZ3RoGighcnVsZXMuaXB2Nl93aXRoX3ByZWZpeGxlbiB8fCB0aGlzICE9ICcnSAAS7AEKCWlwX3ByZWZpeBgdIAEoCELWAcJI0gEKZgoQc3RyaW5nLmlwX3ByZWZpeBIZbXVzdCBiZSBhIHZhbGlkIElQIHByZWZpeBo3IXJ1bGVzLmlwX3ByZWZpeCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCh0cnVlKQpoChZzdHJpbmcuaXBfcHJlZml4X2VtcHR5Ei52YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVAgcHJlZml4Gh4hcnVsZXMuaXBfcHJlZml4IHx8IHRoaXMgIT0gJydIABL9AQoLaXB2NF9wcmVmaXgYHiABKAhC5QHCSOEBCm8KEnN0cmluZy5pcHY0X3ByZWZpeBIbbXVzdCBiZSBhIHZhbGlkIElQdjQgcHJlZml4GjwhcnVsZXMuaXB2NF9wcmVmaXggfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXBQcmVmaXgoNCwgdHJ1ZSkKbgoYc3RyaW5nLmlwdjRfcHJlZml4X2VtcHR5EjB2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBwcmVmaXgaICFydWxlcy5pcHY0X3ByZWZpeCB8fCB0aGlzICE9ICcnSAAS/QEKC2lwdjZfcHJlZml4GB8gASgIQuUBwkjhAQpvChJzdHJpbmcuaXB2Nl9wcmVmaXgSG211c3QgYmUgYSB2YWxpZCBJUHY2IHByZWZpeBo8IXJ1bGVzLmlwdjZfcHJlZml4IHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc0lwUHJlZml4KDYsIHRydWUpCm4KGHN0cmluZy5pcHY2X3ByZWZpeF9lbXB0eRIwdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjYgcHJlZml4GiAhcnVsZXMuaXB2Nl9wcmVmaXggfHwgdGhpcyAhPSAnJ0gAEq8CCg1ob3N0X2FuZF9wb3J0GCAgASgIQpUCwkiRAgqTAQoUc3RyaW5nLmhvc3RfYW5kX3BvcnQSO211c3QgYmUgYSB2YWxpZCBob3N0IChob3N0bmFtZSBvciBJUCBhZGRyZXNzKSBhbmQgcG9ydCBwYWlyGj4hcnVsZXMuaG9zdF9hbmRfcG9ydCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNIb3N0QW5kUG9ydCh0cnVlKQp5ChpzdHJpbmcuaG9zdF9hbmRfcG9ydF9lbXB0eRI3dmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIGhvc3QgYW5kIHBvcnQgcGFpchoiIXJ1bGVzLmhvc3RfYW5kX3BvcnQgfHwgdGhpcyAhPSAnJ0gAEu4BCgR1bGlkGCMgASgIQt0BwkjZAQp8CgtzdHJpbmcudWxpZBIUbXVzdCBiZSBhIHZhbGlkIFVMSUQaVyFydWxlcy51bGlkIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5tYXRjaGVzKCdeWzAtN11bMC05QS1ISktNTlAtVFYtWmEtaGprbW5wLXR2LXpdezI1fSQnKQpZChFzdHJpbmcudWxpZF9lbXB0eRIpdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIFVMSUQaGSFydWxlcy51bGlkIHx8IHRoaXMgIT0gJydIABLUAgoMcHJvdG9idWZfZnFuGCUgASgIQrsCwki3AgqvAQoTc3RyaW5nLnByb3RvYnVmX2ZxbhItbXVzdCBiZSBhIHZhbGlkIGZ1bGx5LXF1YWxpZmllZCBQcm90b2J1ZiBuYW1lGmkhcnVsZXMucHJvdG9idWZfZnFuIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5tYXRjaGVzKCdeW0EtWmEtel9dW0EtWmEtel8wLTldKihcXC5bQS1aYS16X11bQS1aYS16XzAtOV0qKSokJykKggEKGXN0cmluZy5wcm90b2J1Zl9mcW5fZW1wdHkSQnZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBmdWxseS1xdWFsaWZpZWQgUHJvdG9idWYgbmFtZRohIXJ1bGVzLnByb3RvYnVmX2ZxbiB8fCB0aGlzICE9ICcnSAASkQMKEHByb3RvYnVmX2RvdF9mcW4YJiABKAhC9ALCSPACCs0BChdzdHJpbmcucHJvdG9idWZfZG90X2ZxbhJAbXVzdCBiZSBhIHZhbGlkIGZ1bGx5LXF1YWxpZmllZCBQcm90b2J1ZiBuYW1lIHdpdGggYSBsZWFkaW5nIGRvdBpwIXJ1bGVzLnByb3RvYnVmX2RvdF9mcW4gfHwgdGhpcyA9PSAnJyB8fCB0aGlzLm1hdGNoZXMoJ15cXC5bQS1aYS16X11bQS1aYS16XzAtOV0qKFxcLltBLVphLXpfXVtBLVphLXpfMC05XSopKiQnKQqdAQodc3RyaW5nLnByb3RvYnVmX2RvdF9mcW5fZW1wdHkSVXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBmdWxseS1xdWFsaWZpZWQgUHJvdG9idWYgbmFtZSB3aXRoIGEgbGVhZGluZyBkb3QaJSFydWxlcy5wcm90b2J1Zl9kb3RfZnFuIHx8IHRoaXMgIT0gJydIABKcBQoQd2VsbF9rbm93bl9yZWdleBgYIAEoDjIYLmJ1Zi52YWxpZGF0ZS5Lbm93blJlZ2V4QuUEwkjhBArqAQojc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX25hbWUSIG11c3QgYmUgYSB2YWxpZCBIVFRQIGhlYWRlciBuYW1lGqABcnVsZXMud2VsbF9rbm93bl9yZWdleCAhPSAxIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5tYXRjaGVzKCFoYXMocnVsZXMuc3RyaWN0KSB8fCBydWxlcy5zdHJpY3QgPydeOj9bMC05YS16QS1aISMkJSZcJyorLS5eX3x+XHg2MF0rJCcgOideW15cdTAwMDBcdTAwMEFcdTAwMERdKyQnKQqNAQopc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX25hbWVfZW1wdHkSNXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBIVFRQIGhlYWRlciBuYW1lGilydWxlcy53ZWxsX2tub3duX3JlZ2V4ICE9IDEgfHwgdGhpcyAhPSAnJwrhAQokc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX3ZhbHVlEiFtdXN0IGJlIGEgdmFsaWQgSFRUUCBoZWFkZXIgdmFsdWUalQFydWxlcy53ZWxsX2tub3duX3JlZ2V4ICE9IDIgfHwgdGhpcy5tYXRjaGVzKCFoYXMocnVsZXMuc3RyaWN0KSB8fCBydWxlcy5zdHJpY3QgPydeW15cdTAwMDAtXHUwMDA4XHUwMDBBLVx1MDAxRlx1MDA3Rl0qJCcgOideW15cdTAwMDBcdTAwMEFcdTAwMERdKiQnKUgAEg4KBnN0cmljdBgZIAEoCBIsCgdleGFtcGxlGCIgAygJQhvCSBgKFgoOc3RyaW5nLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkIMCgp3ZWxsX2tub3duIt0RCgpCeXRlc1J1bGVzEnoKBWNvbnN0GAEgASgMQmvCSGgKZgoLYnl0ZXMuY29uc3QaV3RoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgYmUgJXgnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxJrCgNsZW4YDSABKARCXsJIWwpZCglieXRlcy5sZW4aTHVpbnQodGhpcy5zaXplKCkpICE9IHJ1bGVzLmxlbiA/ICdtdXN0IGJlICVzIGJ5dGVzJy5mb3JtYXQoW3J1bGVzLmxlbl0pIDogJycSgwEKB21pbl9sZW4YAiABKARCcsJIbwptCg1ieXRlcy5taW5fbGVuGlx1aW50KHRoaXMuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9sZW4gPyAnbXVzdCBiZSBhdCBsZWFzdCAlcyBieXRlcycuZm9ybWF0KFtydWxlcy5taW5fbGVuXSkgOiAnJxKCAQoHbWF4X2xlbhgDIAEoBEJxwkhuCmwKDWJ5dGVzLm1heF9sZW4aW3VpbnQodGhpcy5zaXplKCkpID4gcnVsZXMubWF4X2xlbiA/ICdtdXN0IGJlIGF0IG1vc3QgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubWF4X2xlbl0pIDogJycSigEKB3BhdHRlcm4YBCABKAlCecJIdgp0Cg1ieXRlcy5wYXR0ZXJuGmMhc3RyaW5nKHRoaXMpLm1hdGNoZXMocnVsZXMucGF0dGVybikgPyAnbXVzdCBtYXRjaCByZWdleCBwYXR0ZXJuIGAlc2AnLmZvcm1hdChbcnVsZXMucGF0dGVybl0pIDogJycSewoGcHJlZml4GAUgASgMQmvCSGgKZgoMYnl0ZXMucHJlZml4GlYhdGhpcy5zdGFydHNXaXRoKHJ1bGVzLnByZWZpeCkgPyAnZG9lcyBub3QgaGF2ZSBwcmVmaXggJXgnLmZvcm1hdChbcnVsZXMucHJlZml4XSkgOiAnJxJ5CgZzdWZmaXgYBiABKAxCacJIZgpkCgxieXRlcy5zdWZmaXgaVCF0aGlzLmVuZHNXaXRoKHJ1bGVzLnN1ZmZpeCkgPyAnZG9lcyBub3QgaGF2ZSBzdWZmaXggJXgnLmZvcm1hdChbcnVsZXMuc3VmZml4XSkgOiAnJxJ9Cghjb250YWlucxgHIAEoDEJrwkhoCmYKDmJ5dGVzLmNvbnRhaW5zGlQhdGhpcy5jb250YWlucyhydWxlcy5jb250YWlucykgPyAnZG9lcyBub3QgY29udGFpbiAleCcuZm9ybWF0KFtydWxlcy5jb250YWluc10pIDogJycSoQEKAmluGAggAygMQpQBwkiQAQqNAQoIYnl0ZXMuaW4agAFnZXRGaWVsZChydWxlcywgJ2luJykuc2l6ZSgpID4gMCAmJiAhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJwCgZub3RfaW4YCSADKAxCYMJIXQpbCgxieXRlcy5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxLlAQoCaXAYCiABKAhC1gHCSNIBCm4KCGJ5dGVzLmlwEhptdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcxpGIXJ1bGVzLmlwIHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gNCB8fCB0aGlzLnNpemUoKSA9PSAxNgpgCg5ieXRlcy5pcF9lbXB0eRIvdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIGFkZHJlc3MaHSFydWxlcy5pcCB8fCB0aGlzLnNpemUoKSAhPSAwSAAS3gEKBGlwdjQYCyABKAhCzQHCSMkBCl8KCmJ5dGVzLmlwdjQSHG11c3QgYmUgYSB2YWxpZCBJUHY0IGFkZHJlc3MaMyFydWxlcy5pcHY0IHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gNApmChBieXRlcy5pcHY0X2VtcHR5EjF2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBhZGRyZXNzGh8hcnVsZXMuaXB2NCB8fCB0aGlzLnNpemUoKSAhPSAwSAAS3wEKBGlwdjYYDCABKAhCzgHCSMoBCmAKCmJ5dGVzLmlwdjYSHG11c3QgYmUgYSB2YWxpZCBJUHY2IGFkZHJlc3MaNCFydWxlcy5pcHY2IHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gMTYKZgoQYnl0ZXMuaXB2Nl9lbXB0eRIxdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjYgYWRkcmVzcxofIXJ1bGVzLmlwdjYgfHwgdGhpcy5zaXplKCkgIT0gMEgAEs8BCgR1dWlkGA8gASgIQr4Bwki6AQpYCgpieXRlcy51dWlkEhRtdXN0IGJlIGEgdmFsaWQgVVVJRBo0IXJ1bGVzLnV1aWQgfHwgdGhpcy5zaXplKCkgPT0gMCB8fCB0aGlzLnNpemUoKSA9PSAxNgpeChBieXRlcy51dWlkX2VtcHR5Eil2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgVVVJRBofIXJ1bGVzLnV1aWQgfHwgdGhpcy5zaXplKCkgIT0gMEgAEisKB2V4YW1wbGUYDiADKAxCGsJIFwoVCg1ieXRlcy5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCDAoKd2VsbF9rbm93biLBAwoJRW51bVJ1bGVzEnwKBWNvbnN0GAEgASgFQm3CSGoKaAoKZW51bS5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEhQKDGRlZmluZWRfb25seRgCIAEoCBJ4CgJpbhgDIAMoBUJswkhpCmcKB2VudW0uaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEm8KBm5vdF9pbhgEIAMoBUJfwkhcCloKC2VudW0ubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSKgoHZXhhbXBsZRgFIAMoBUIZwkgWChQKDGVudW0uZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACIu0DCg1SZXBlYXRlZFJ1bGVzEpYBCgltaW5faXRlbXMYASABKARCggHCSH8KfQoScmVwZWF0ZWQubWluX2l0ZW1zGmd1aW50KHRoaXMuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9pdGVtcyA/ICdtdXN0IGNvbnRhaW4gYXQgbGVhc3QgJWQgaXRlbShzKScuZm9ybWF0KFtydWxlcy5taW5faXRlbXNdKSA6ICcnEpwBCgltYXhfaXRlbXMYAiABKARCiAHCSIQBCoEBChJyZXBlYXRlZC5tYXhfaXRlbXMaa3VpbnQodGhpcy5zaXplKCkpID4gcnVsZXMubWF4X2l0ZW1zID8gJ211c3QgY29udGFpbiBubyBtb3JlIHRoYW4gJXMgaXRlbShzKScuZm9ybWF0KFtydWxlcy5tYXhfaXRlbXNdKSA6ICcnEnAKBnVuaXF1ZRgDIAEoCEJgwkhdClsKD3JlcGVhdGVkLnVuaXF1ZRIocmVwZWF0ZWQgdmFsdWUgbXVzdCBjb250YWluIHVuaXF1ZSBpdGVtcxoeIXJ1bGVzLnVuaXF1ZSB8fCB0aGlzLnVuaXF1ZSgpEicKBWl0ZW1zGAQgASgLMhguYnVmLnZhbGlkYXRlLkZpZWxkUnVsZXMqCQjoBxCAgICAAiKKAwoITWFwUnVsZXMSjwEKCW1pbl9wYWlycxgBIAEoBEJ8wkh5CncKDW1hcC5taW5fcGFpcnMaZnVpbnQodGhpcy5zaXplKCkpIDwgcnVsZXMubWluX3BhaXJzID8gJ21hcCBtdXN0IGJlIGF0IGxlYXN0ICVkIGVudHJpZXMnLmZvcm1hdChbcnVsZXMubWluX3BhaXJzXSkgOiAnJxKOAQoJbWF4X3BhaXJzGAIgASgEQnvCSHgKdgoNbWFwLm1heF9wYWlycxpldWludCh0aGlzLnNpemUoKSkgPiBydWxlcy5tYXhfcGFpcnMgPyAnbWFwIG11c3QgYmUgYXQgbW9zdCAlZCBlbnRyaWVzJy5mb3JtYXQoW3J1bGVzLm1heF9wYWlyc10pIDogJycSJgoEa2V5cxgEIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GaWVsZFJ1bGVzEigKBnZhbHVlcxgFIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GaWVsZFJ1bGVzKgkI6AcQgICAgAIiJgoIQW55UnVsZXMSCgoCaW4YAiADKAkSDgoGbm90X2luGAMgAygJIr8WCg1EdXJhdGlvblJ1bGVzEpsBCgVjb25zdBgCIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkJxwkhuCmwKDmR1cmF0aW9uLmNvbnN0Glp0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICdtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSogEKAmx0GAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQnnCSHYKdAoLZHVyYXRpb24ubHQaZSFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAAStAEKA2x0ZRgEIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkKJAcJIhQEKggEKDGR1cmF0aW9uLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASowcKAmd0GAUgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQvkGwkj1Bgp3CgtkdXJhdGlvbi5ndBpoIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKsAEKDmR1cmF0aW9uLmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq4AQoYZHVyYXRpb24uZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKwAEKD2R1cmF0aW9uLmd0X2x0ZRqsAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKyAEKGWR1cmF0aW9uLmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEu8HCgNndGUYBiABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CxAfCSMAHCoUBCgxkdXJhdGlvbi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq/AQoPZHVyYXRpb24uZ3RlX2x0GqsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCscBChlkdXJhdGlvbi5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrPAQoQZHVyYXRpb24uZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrXAQoaZHVyYXRpb24uZ3RlX2x0ZV9leGNsdXNpdmUauAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESlwEKAmluGAcgAygLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQnDCSG0KawoLZHVyYXRpb24uaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEo4BCgZub3RfaW4YCCADKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CY8JIYApeCg9kdXJhdGlvbi5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxJJCgdleGFtcGxlGAkgAygLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQh3CSBoKGAoQZHVyYXRpb24uZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i6wUKDkZpZWxkTWFza1J1bGVzErkBCgVjb25zdBgBIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCjQHCSIkBCoYBChBmaWVsZF9tYXNrLmNvbnN0GnJ0aGlzLnBhdGhzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKS5wYXRocyA/ICdtdXN0IGVxdWFsIHBhdGhzICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKS5wYXRoc10pIDogJycS0wEKAmluGAIgAygJQsYBwkjCAQq/AQoNZmllbGRfbWFzay5pbhqtASF0aGlzLnBhdGhzLmFsbChwLCBwIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSB8fCBnZXRGaWVsZChydWxlcywgJ2luJykuZXhpc3RzKGYsIHAuc3RhcnRzV2l0aChmKycuJykpKSA/ICdtdXN0IG9ubHkgY29udGFpbiBwYXRocyBpbiAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEu0BCgZub3RfaW4YAyADKAlC3AHCSNgBCtUBChFmaWVsZF9tYXNrLm5vdF9pbhq/ASF0aGlzLnBhdGhzLmFsbChwLCAhKHAgaW4gZ2V0RmllbGQocnVsZXMsICdub3RfaW4nKSB8fCBnZXRGaWVsZChydWxlcywgJ25vdF9pbicpLmV4aXN0cyhmLCBwLnN0YXJ0c1dpdGgoZisnLicpKSkpID8gJ211c3Qgbm90IGNvbnRhaW4gYW55IHBhdGhzIGluICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnbm90X2luJyldKSA6ICcnEkwKB2V4YW1wbGUYBCADKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQh/CSBwKGgoSZmllbGRfbWFzay5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAIisBcKDlRpbWVzdGFtcFJ1bGVzEp0BCgVjb25zdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCcsJIbwptCg90aW1lc3RhbXAuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKkAQoCbHQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQnrCSHcKdQoMdGltZXN0YW1wLmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAErYBCgNsdGUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQooBwkiGAQqDAQoNdGltZXN0YW1wLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASZgoGbHRfbm93GAcgASgIQlTCSFEKTwoQdGltZXN0YW1wLmx0X25vdxo7KHJ1bGVzLmx0X25vdyAmJiB0aGlzID4gbm93KSA/ICdtdXN0IGJlIGxlc3MgdGhhbiBub3cnIDogJydIABKpBwoCZ3QYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQv4Gwkj6Bgp4Cgx0aW1lc3RhbXAuZ3QaaCFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCrEBCg90aW1lc3RhbXAuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrkBChl0aW1lc3RhbXAuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKwQEKEHRpbWVzdGFtcC5ndF9sdGUarAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCskBChp0aW1lc3RhbXAuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES9QcKA2d0ZRgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCyQfCSMUHCoYBCg10aW1lc3RhbXAuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKwAEKEHRpbWVzdGFtcC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKyAEKGnRpbWVzdGFtcC5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrQAQoRdGltZXN0YW1wLmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK2AEKG3RpbWVzdGFtcC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJpCgZndF9ub3cYCCABKAhCV8JIVApSChB0aW1lc3RhbXAuZ3Rfbm93Gj4ocnVsZXMuZ3Rfbm93ICYmIHRoaXMgPCBub3cpID8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG5vdycgOiAnJ0gBErEBCgZ3aXRoaW4YCSABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25ChQHCSIEBCn8KEHRpbWVzdGFtcC53aXRoaW4aa3RoaXMgPCBub3ctcnVsZXMud2l0aGluIHx8IHRoaXMgPiBub3crcnVsZXMud2l0aGluID8gJ211c3QgYmUgd2l0aGluICVzIG9mIG5vdycuZm9ybWF0KFtydWxlcy53aXRoaW5dKSA6ICcnEksKB2V4YW1wbGUYCiADKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQh7CSBsKGQoRdGltZXN0YW1wLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIjkKClZpb2xhdGlvbnMSKwoKdmlvbGF0aW9ucxgBIAMoCzIXLmJ1Zi52YWxpZGF0ZS5WaW9sYXRpb24inwEKCVZpb2xhdGlvbhImCgVmaWVsZBgFIAEoCzIXLmJ1Zi52YWxpZGF0ZS5GaWVsZFBhdGgSJQoEcnVsZRgGIAEoCzIXLmJ1Zi52YWxpZGF0ZS5GaWVsZFBhdGgSDwoHcnVsZV9pZBgCIAEoCRIPCgdtZXNzYWdlGAMgASgJEg8KB2Zvcl9rZXkYBCABKAhKBAgBEAJSCmZpZWxkX3BhdGgiPQoJRmllbGRQYXRoEjAKCGVsZW1lbnRzGAEgAygLMh4uYnVmLnZhbGlkYXRlLkZpZWxkUGF0aEVsZW1lbnQi6QIKEEZpZWxkUGF0aEVsZW1lbnQSFAoMZmllbGRfbnVtYmVyGAEgASgFEhIKCmZpZWxkX25hbWUYAiABKAkSPgoKZmllbGRfdHlwZRgDIAEoDjIqLmdvb2dsZS5wcm90b2J1Zi5GaWVsZERlc2NyaXB0b3JQcm90by5UeXBlEjwKCGtleV90eXBlGAQgASgOMiouZ29vZ2xlLnByb3RvYnVmLkZpZWxkRGVzY3JpcHRvclByb3RvLlR5cGUSPgoKdmFsdWVfdHlwZRgFIAEoDjIqLmdvb2dsZS5wcm90b2J1Zi5GaWVsZERlc2NyaXB0b3JQcm90by5UeXBlEg8KBWluZGV4GAYgASgESAASEgoIYm9vbF9rZXkYByABKAhIABIRCgdpbnRfa2V5GAggASgDSAASEgoIdWludF9rZXkYCSABKARIABIUCgpzdHJpbmdfa2V5GAogASgJSABCCwoJc3Vic2NyaXB0KqEBCgZJZ25vcmUSFgoSSUdOT1JFX1VOU1BFQ0lGSUVEEAASGAoUSUdOT1JFX0lGX1pFUk9fVkFMVUUQARIRCg1JR05PUkVfQUxXQVlTEAMiBAgCEAIqDElHTk9SRV9FTVBUWSoOSUdOT1JFX0RFRkFVTFQqF0lHTk9SRV9JRl9ERUZBVUxUX1ZBTFVFKhVJR05PUkVfSUZfVU5QT1BVTEFURUQqbgoKS25vd25SZWdleBIbChdLTk9XTl9SRUdFWF9VTlNQRUNJRklFRBAAEiAKHEtOT1dOX1JFR0VYX0hUVFBfSEVBREVSX05BTUUQARIhCh1LTk9XTl9SRUdFWF9IVFRQX0hFQURFUl9WQUxVRRACOlYKB21lc3NhZ2USHy5nb29nbGUucHJvdG9idWYuTWVzc2FnZU9wdGlvbnMYhwkgASgLMhouYnVmLnZhbGlkYXRlLk1lc3NhZ2VSdWxlc1IHbWVzc2FnZTpOCgVvbmVvZhIdLmdvb2dsZS5wcm90b2J1Zi5PbmVvZk9wdGlvbnMYhwkgASgLMhguYnVmLnZhbGlkYXRlLk9uZW9mUnVsZXNSBW9uZW9mOk4KBWZpZWxkEh0uZ29vZ2xlLnByb3RvYnVmLkZpZWxkT3B0aW9ucxiHCSABKAsyGC5idWYudmFsaWRhdGUuRmllbGRSdWxlc1IFZmllbGQ6XQoKcHJlZGVmaW5lZBIdLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE9wdGlvbnMYiAkgASgLMh0uYnVmLnZhbGlkYXRlLlByZWRlZmluZWRSdWxlc1IKcHJlZGVmaW5lZEJuChJidWlsZC5idWYudmFsaWRhdGVCDVZhbGlkYXRlUHJvdG9QAVpHYnVmLmJ1aWxkL2dlbi9nby9idWZidWlsZC9wcm90b3ZhbGlkYXRlL3Byb3RvY29sYnVmZmVycy9nby9idWYvdmFsaWRhdGU",[file_google_protobuf_descriptor2,file_google_protobuf_duration2,file_google_protobuf_field_mask2,file_google_protobuf_timestamp2]),RuleSchema=messageDesc3(file_buf_validate_validate2,0);var FieldRulesSchema=messageDesc3(file_buf_validate_validate2,4);var FloatRulesSchema=messageDesc3(file_buf_validate_validate2,6),DoubleRulesSchema=messageDesc3(file_buf_validate_validate2,7),Int32RulesSchema=messageDesc3(file_buf_validate_validate2,8),Int64RulesSchema=messageDesc3(file_buf_validate_validate2,9),UInt32RulesSchema=messageDesc3(file_buf_validate_validate2,10),UInt64RulesSchema=messageDesc3(file_buf_validate_validate2,11),SInt32RulesSchema=messageDesc3(file_buf_validate_validate2,12),SInt64RulesSchema=messageDesc3(file_buf_validate_validate2,13),Fixed32RulesSchema=messageDesc3(file_buf_validate_validate2,14),Fixed64RulesSchema=messageDesc3(file_buf_validate_validate2,15),SFixed32RulesSchema=messageDesc3(file_buf_validate_validate2,16),SFixed64RulesSchema=messageDesc3(file_buf_validate_validate2,17),BoolRulesSchema=messageDesc3(file_buf_validate_validate2,18),StringRulesSchema=messageDesc3(file_buf_validate_validate2,19),BytesRulesSchema=messageDesc3(file_buf_validate_validate2,20),EnumRulesSchema=messageDesc3(file_buf_validate_validate2,21),RepeatedRulesSchema=messageDesc3(file_buf_validate_validate2,22),MapRulesSchema=messageDesc3(file_buf_validate_validate2,23),AnyRulesSchema=messageDesc3(file_buf_validate_validate2,24),DurationRulesSchema=messageDesc3(file_buf_validate_validate2,25),FieldMaskRulesSchema=messageDesc3(file_buf_validate_validate2,26),TimestampRulesSchema=messageDesc3(file_buf_validate_validate2,27);var ViolationSchema=messageDesc3(file_buf_validate_validate2,29),FieldPathSchema=messageDesc3(file_buf_validate_validate2,30),FieldPathElementSchema=messageDesc3(file_buf_validate_validate2,31),Ignore2;(function(Ignore3){Ignore3[Ignore3.UNSPECIFIED=0]="UNSPECIFIED",Ignore3[Ignore3.IF_ZERO_VALUE=1]="IF_ZERO_VALUE",Ignore3[Ignore3.ALWAYS=3]="ALWAYS"})(Ignore2||(Ignore2={}));var KnownRegex2;(function(KnownRegex3){KnownRegex3[KnownRegex3.UNSPECIFIED=0]="UNSPECIFIED",KnownRegex3[KnownRegex3.HTTP_HEADER_NAME=1]="HTTP_HEADER_NAME",KnownRegex3[KnownRegex3.HTTP_HEADER_VALUE=2]="HTTP_HEADER_VALUE"})(KnownRegex2||(KnownRegex2={}));var message=extDesc2(file_buf_validate_validate2,0),oneof=extDesc2(file_buf_validate_validate2,1),field=extDesc2(file_buf_validate_validate2,2),predefined=extDesc2(file_buf_validate_validate2,3);var CompilationError=class extends Error{constructor(message6,options){super(message6,options),this.name="CompilationError",Object.setPrototypeOf(this,new.target.prototype)}},RuntimeError=class extends Error{constructor(message6,options){super(message6,options),this.name="RuntimeError",Object.setPrototypeOf(this,new.target.prototype)}},ValidationError=class extends Error{constructor(violations){super(validationErrorMessage(violations)),this.name="ValidationError",Object.setPrototypeOf(this,new.target.prototype),this.violations=violations}};function validationErrorMessage(violations){return violations.length==0?"validation failed":violations.length==1?violations[0].toString():violations[0].toString()+`, and ${violations.length-1} more violation${violations.length>2?"s":""}`}var Violation=class{constructor(message6,ruleId,field2,rule,forKey){this.message=message6,this.ruleId=ruleId,this.field=field2,this.rule=rule,this.forKey=forKey}toString(){let path14=pathToString(this.field);return path14.length>0&&(path14+=": "),path14+`${this.message} [${this.ruleId}]`}};function violationToProto(violation){return[create2(ViolationSchema,{field:violation.field.length>0?pathToProto(violation.field):void 0,rule:violation.rule.length>0?pathToProto(violation.rule):void 0,ruleId:violation.ruleId,message:violation.message.length>0?violation.message:void 0,forKey:violation.forKey}),ViolationSchema]}function pathToProto(path14){let elements=[];for(let[i6,e6]of path14.entries())switch(e6.kind){case"field":elements.push(create2(FieldPathElementSchema,{fieldName:e6.name,fieldNumber:e6.number,fieldType:fieldType(e6)}));break;case"extension":elements.push(create2(FieldPathElementSchema,{fieldName:"["+e6.typeName+"]",fieldNumber:e6.number,fieldType:e6.proto.type}));break;case"oneof":elements.push(create2(FieldPathElementSchema,{fieldName:e6.name}));break;case"list_sub":{let prevProto=elements[elements.length-1];if(prevProto){let prevPath=path14[i6-1];prevProto.subscript=getListSub(e6.index,prevPath)}break}case"map_sub":{let prevProto=elements[elements.length-1];if(prevProto){let prevPath=path14[i6-1];setMapSub(prevProto,e6.key,prevPath)}break}}return create2(FieldPathSchema,{elements})}function fieldType(field2){return field2.fieldKind=="message"&&field2.delimitedEncoding?FieldDescriptorProto_Type2.GROUP:field2.proto.type}function getListSub(index2,prevPath){return prevPath?.kind=="field"&&prevPath.fieldKind=="list"?{case:"index",value:BigInt(index2)}:{case:void 0}}function setMapSub(proto2,key,prevPath){if(!(prevPath?.kind!="field"||prevPath.fieldKind!="map")){switch(proto2.keyType=prevPath.mapKey,prevPath.mapKind){case"scalar":proto2.valueType=prevPath.scalar;break;case"enum":proto2.valueType=FieldDescriptorProto_Type2.ENUM;break;case"message":proto2.valueType=FieldDescriptorProto_Type2.MESSAGE;break}switch(typeof key){case"boolean":prevPath.mapKey===ScalarType2.BOOL&&(proto2.subscript={case:"boolKey",value:key});break;case"string":prevPath.mapKey===ScalarType2.STRING&&(proto2.subscript={case:"stringKey",value:key});break;case"number":case"bigint":switch(prevPath.mapKey){case ScalarType2.INT32:case ScalarType2.SINT32:case ScalarType2.SFIXED32:case ScalarType2.INT64:case ScalarType2.SINT64:case ScalarType2.SFIXED64:proto2.subscript={case:"intKey",value:BigInt(key)};break;case ScalarType2.UINT32:case ScalarType2.FIXED32:case ScalarType2.UINT64:case ScalarType2.FIXED64:proto2.subscript={case:"uintKey",value:BigInt(key)};break}break}}}var Cursor=class _Cursor{static create(root5,failFast){return new _Cursor(root5,failFast,[],buildPath(root5))}constructor(root5,failFast,violations,builder2){this.root=root5,this.failFast=failFast,this.violations=violations,this.builder=builder2}get violated(){return this.violations.length>0}violate(message6,ruleId,rulePath,forMapKey=!1){this.violations.push(new Violation(message6,ruleId,this.builder.toPath(),rulePath,forMapKey)),this.failFast&&this.throwIfViolated()}throwIfViolated(){if(this.violated)throw new ValidationError(this.violations)}getPath(){return this.builder.toPath()}add(path14){return this.cloneWith(this.builder.clone().add(path14))}field(field2){return this.cloneWith(this.builder.clone().field(field2))}oneof(oneof2){return this.cloneWith(this.builder.clone().oneof(oneof2))}extension(ext){return this.cloneWith(this.builder.clone().extension(ext))}list(index2){return this.cloneWith(this.builder.clone().list(index2))}mapKey(key){return this.cloneWith(this.builder.clone().map(key))}cloneWith(path14){return new _Cursor(this.root,this.failFast,this.violations,path14)}};var EvalNoop=class _EvalNoop{static get(){return _EvalNoop.instance}eval(){}prune(){return!0}};EvalNoop.instance=new EvalNoop;var EvalMany=class{constructor(...evals){this.many=evals.flat()}add(...evals){return this.many.push(...evals),this}eval(val,cursor){for(let e6 of this.many)e6.eval(val,cursor)}prune(){return this.many=this.many.filter(e6=>!e6.prune()),this.many.length==0}},EvalListItems=class{constructor(condition,pass2){this.condition=condition,this.pass=pass2}eval(val,cursor){for(let i6=0;i6<val.size;i6++){let t=val.get(i6);this.condition.check(t)&&this.pass.eval(t,cursor.list(i6))}}prune(){return this.pass.prune()||this.condition.never}},EvalMapEntries=class{constructor(keyCondition,key,valueCondition,value){this.keyCondition=keyCondition,this.key=key,this.valueCondition=valueCondition,this.value=value}eval(val,cursor){if(!(this.keyCondition.never&&this.valueCondition.never))for(let[key,value]of val){let c5=cursor.mapKey(key);this.keyCondition.check(key)&&this.key.eval(key,c5),this.valueCondition.check(value)&&this.value.eval(value,c5)}}prune(){let key=this.key.prune()||this.keyCondition.never,value=this.value.prune()||this.valueCondition.never;return key&&value}},EvalField=class{constructor(field2,required,legacyRequired,condition,pass2){this.field=field2,this.required=required,this.legacyRequired=legacyRequired,this.condition=condition,this.pass=pass2}eval(val,cursor){if((this.required||this.legacyRequired)&&!val.isSet(this.field)){this.required?cursor.field(this.field).violate("value is required","required",[FieldRulesSchema.field.required]):cursor.field(this.field).violate("value is required","legacy_required",[]);return}if(this.condition.check(val)){let fieldVal=val.get(this.field);this.pass.eval(fieldVal,cursor.field(this.field))}}prune(){return this.condition.never&&!this.required&&!this.legacyRequired}},EvalOneofRequired=class{constructor(oneof2){this.oneof=oneof2}eval(val,cursor){this.oneof.fields.some(f5=>val.isSet(f5))||cursor.oneof(this.oneof).violate("exactly one field is required in oneof","required",[])}prune(){return!1}},EvalEnumDefinedOnly=class{constructor(descEnum,rulePath,rules){this.rulePath=rulePath,this.definedOnly=rules.definedOnly?new Set(descEnum.values.map(v=>v.number)):void 0}eval(val,cursor){this.definedOnly!==void 0&&!this.definedOnly.has(val)&&cursor.violate("value must be one of the defined enum values","enum.defined_only",this.rulePath.clone().field(EnumRulesSchema.field.definedOnly).toPath())}prune(){return this.definedOnly==null}},EvalAnyRules=class{constructor(rulePath,rules){this.rulePath=rulePath,this.in=rules.in,this.notIn=rules.notIn}eval(val,cursor){let any=val.message;this.in.length>0&&!this.in.includes(any.typeUrl)&&cursor.violate("type URL must be in the allow list","any.in",this.rulePath.clone().field(AnyRulesSchema.field.in).toPath()),this.notIn.length>0&&this.notIn.includes(any.typeUrl)&&cursor.violate("type URL must not be in the block list","any.not_in",this.rulePath.clone().field(AnyRulesSchema.field.notIn).toPath())}prune(){return this.in.length+this.notIn.length==0}},EvalMessageOneofRule=class{constructor(fields2,required){this.fields=fields2,this.required=required}eval(val,cursor){let setFields=this.fields.filter(field2=>val.isSet(field2));if(setFields.length>1){let oneofNames=this.fields.map(f5=>f5.name).join(", ");cursor.violate(`only one of ${oneofNames} can be set`,"message.oneof",[])}if(this.required&&setFields.length==0){let oneofNames=this.fields.map(f5=>f5.name).join(", ");cursor.violate(`one of ${oneofNames} must be set`,"message.oneof",[])}}prune(){return this.fields.length==0}};var messageToRuleType=new Map([[AnySchema.typeName,"any"],[DurationSchema.typeName,"duration"],[TimestampSchema.typeName,"timestamp"],[FloatValueSchema.typeName,"float"],[DoubleValueSchema.typeName,"double"],[Int32ValueSchema.typeName,"int32"],[Int64ValueSchema.typeName,"int64"],[UInt32ValueSchema.typeName,"uint32"],[UInt64ValueSchema.typeName,"uint64"],[BoolValueSchema.typeName,"bool"],[StringValueSchema.typeName,"string"],[FieldMaskSchema.typeName,"fieldMask"],[BytesValueSchema.typeName,"bytes"]]),scalarToRuleType=new Map([[ScalarType2.FLOAT,"float"],[ScalarType2.DOUBLE,"double"],[ScalarType2.INT32,"int32"],[ScalarType2.INT64,"int64"],[ScalarType2.UINT32,"uint32"],[ScalarType2.UINT64,"uint64"],[ScalarType2.SINT32,"sint32"],[ScalarType2.SINT64,"sint64"],[ScalarType2.FIXED32,"fixed32"],[ScalarType2.FIXED64,"fixed64"],[ScalarType2.SFIXED32,"sfixed32"],[ScalarType2.SFIXED64,"sfixed64"],[ScalarType2.BOOL,"bool"],[ScalarType2.STRING,"string"],[ScalarType2.BYTES,"bytes"]]),ruleMessageTypeToScalarType=new Map([[DoubleRulesSchema.typeName,ScalarType2.DOUBLE],[FloatRulesSchema.typeName,ScalarType2.FLOAT],[Int64RulesSchema.typeName,ScalarType2.INT64],[UInt64RulesSchema.typeName,ScalarType2.UINT64],[Int32RulesSchema.typeName,ScalarType2.INT32],[Fixed64RulesSchema.typeName,ScalarType2.FIXED64],[Fixed32RulesSchema.typeName,ScalarType2.FIXED32],[BoolRulesSchema.typeName,ScalarType2.BOOL],[BytesRulesSchema.typeName,ScalarType2.BYTES],[UInt32RulesSchema.typeName,ScalarType2.UINT32],[SFixed32RulesSchema.typeName,ScalarType2.SFIXED32],[SFixed64RulesSchema.typeName,ScalarType2.SFIXED64],[SInt32RulesSchema.typeName,ScalarType2.SINT32],[SInt64RulesSchema.typeName,ScalarType2.SINT64]]);function getRuleScalarType(rule){return ruleMessageTypeToScalarType.get(rule.$typeName)}function getRuleDescriptor(typeName){for(let d5 of[FloatRulesSchema,DoubleRulesSchema,Int32RulesSchema,Int64RulesSchema,UInt32RulesSchema,UInt64RulesSchema,SInt32RulesSchema,SInt64RulesSchema,Fixed32RulesSchema,Fixed64RulesSchema,SFixed32RulesSchema,SFixed64RulesSchema,BoolRulesSchema,StringRulesSchema,BytesRulesSchema,EnumRulesSchema,RepeatedRulesSchema,MapRulesSchema,AnyRulesSchema,DurationRulesSchema,FieldMaskRulesSchema,TimestampRulesSchema])if(typeName==d5.typeName)return d5;throw new Error(`unable to find descriptor for ${typeName}`)}function getListRules(rulePath,fieldRules,fieldContext){let listRules=getRulePath(rulePath,"repeated");return[getRules(fieldRules,"repeated",fieldContext),listRules,listRules.clone().field(RepeatedRulesSchema.field.items)]}function getMapRules(rulePath,fieldRules,fieldContext){let mapRules=getRulePath(rulePath,"map");return[getRules(fieldRules,"map",fieldContext),mapRules,mapRules.clone().field(MapRulesSchema.field.keys),mapRules.clone().field(MapRulesSchema.field.values)]}function getEnumRules(rulePath,fieldRules,fieldContext){return[getRules(fieldRules,"enum",fieldContext),getRulePath(rulePath,"enum")]}function getMessageRules(descMessage,rulePath,fieldRules,fieldContext){let type2=messageToRuleType.get(descMessage.typeName);return[getRules(fieldRules,type2,fieldContext),getRulePath(rulePath,type2)]}function getScalarRules(scalar,rulePath,fieldRules,fieldContext){let type2=scalarToRuleType.get(scalar);return[getRules(fieldRules,type2,fieldContext),getRulePath(rulePath,type2)]}function getRulePath(base,type2){if(type2==null)return base;let field2=FieldRulesSchema.field[type2];if(field2==null)throw new CompilationError(`cannot find rule "${type2}"`);return base.clone().field(field2)}function getRules(fieldRules,want,context2){let got=fieldRules?.type.case;if(!(fieldRules==null||got==null)){if(got!=want)throw new CompilationError(want==null?`rule "${got}" cannot be used on ${context2.toString()}`:`expected rule "${want}", got "${got}" on ${context2.toString()}`);return fieldRules.type.value}}var always={check(){return!0},always:!0,never:!1},never={check(){return!1},always:!1,never:!0};function ignoreListOrMapField(field2,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new FieldIsSet(field2);case Ignore2.ALWAYS:return never}}function ignoreMessageField(field2,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:case Ignore2.IF_ZERO_VALUE:return new FieldIsSet(field2);case Ignore2.ALWAYS:return never}}function ignoreScalarOrEnumField(field2,ignore){if(ignore==Ignore2.ALWAYS)return never;if(field2.presence==FeatureSet_FieldPresence2.IMPLICIT)switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new FieldIsSet(field2)}return new FieldIsSet(field2)}function ignoreEnumValue(enu,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new ScalarNot(ScalarType2.INT32,enu.values[0].number);case Ignore2.ALWAYS:return never}}function ignoreScalarValue(scalar,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new ScalarNot(scalar,scalarZeroValue2(scalar,!1));case Ignore2.ALWAYS:return never}}function ignoreMessageValue(ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:case Ignore2.IF_ZERO_VALUE:return always;case Ignore2.ALWAYS:return never}}var ScalarNot=class{constructor(scalar,not2){this.scalar=scalar,this.not=not2,this.always=!1,this.never=!1}check(val){return!scalarEquals(this.scalar,this.not,val)}},FieldIsSet=class{constructor(field2){this.field=field2,this.always=!1,this.never=!1}check(val){return val.isSet(this.field)}};var privateSymbol=Symbol.for("@bufbuild/cel/error");function celError(value,exprId){return isCelError(value)?value:(typeof exprId=="number"&&(exprId=BigInt(exprId)),value instanceof Error?new _CelError(value.message,value,exprId):typeof value=="string"?new _CelError(value,void 0,exprId):new _CelError(`${value}`,value,exprId))}function celErrorMerge(first,...rest){return new _CelError(first.message,rest,first.exprId)}function isCelError(v){return typeof v=="object"&&v!==null&&privateSymbol in v}var _CelError=class extends Error{_cause;_exprId;[privateSymbol]={};constructor(message6,_cause,_exprId){super(message6),this._cause=_cause,this._exprId=_exprId}get exprId(){return this._exprId}get cause(){return this._cause}};var privateSymbol2=Symbol.for("@bufbuild/cel/uint");function celUint(v){return new Uint(v)}function isCelUint(v){return typeof v=="object"&&v!==null&&privateSymbol2 in v}var Uint=class{_value;[privateSymbol2]={};constructor(_value){this._value=_value}get value(){return this._value}};function celFromScalar(type2,v){switch(type2){case ScalarType2.UINT32:case ScalarType2.UINT64:case ScalarType2.FIXED32:case ScalarType2.FIXED64:return celUint(BigInt(v));case ScalarType2.INT32:case ScalarType2.SINT32:case ScalarType2.SFIXED32:return BigInt(v);default:return v}}var privateSymbol3=Symbol.for("@bufbuild/cel/list");function celList(arrayOrReflectList){return isReflectList2(arrayOrReflectList)?new RepeatedFieldList(arrayOrReflectList):new ArrayList(arrayOrReflectList)}function celListConcat(...lists){return new ConcatList(lists)}function isCelList(v){return typeof v=="object"&&v!==null&&privateSymbol3 in v}var ArrayList=class{_array;[privateSymbol3]={};constructor(_array){this._array=_array}get size(){return this._array.length}get(index2){if(!(index2<0||index2>=this.size))return toCel(this._array[index2])}*values(){for(let element of this._array.values())yield toCel(element)}[Symbol.iterator](){return this.values()}},RepeatedFieldList=class{_list;[privateSymbol3]={};constructor(_list){this._list=_list}get size(){return this._list.size}get(index2){let val=this._list.get(index2);if(val!==void 0)return celFromListElem(this._list.field(),val)}*values(){for(let val of this._list)yield celFromListElem(this._list.field(),val)}[Symbol.iterator](){return this.values()}},ConcatList=class{_lists;[privateSymbol3]={};_size;constructor(_lists){this._lists=_lists;let size=0;for(let list11 of _lists)size+=list11.size;this._size=size}get size(){return this._size}get(index2){if(!(index2<0||index2>=this.size))for(let list11 of this._lists){if(index2<list11.size)return list11.get(index2);index2=index2-list11.size}}*values(){for(let list11 of this._lists)yield*list11.values()}[Symbol.iterator](){return this.values()}};function celFromListElem(desc,v){switch(desc.listKind){case"enum":return BigInt(v);case"message":return reflectMsgToCel(v);case"scalar":return celFromScalar(desc.scalar,v)}}var EMPTY_LIST=celList([]);var contextStack=[];function setEvalContext(context2){return contextStack.push(context2),()=>contextStack.pop()}function getEvalContext(){if(contextStack.length===0)throw new Error("cannot use `getEvalContext` outside of an evaluation");return contextStack[contextStack.length-1]}function withEvalContext(context2,next){return{id:next.id,eval(ctx){let unset=setEvalContext(context2);try{return next.eval(ctx)}finally{unset()}}}}function getMsgDesc(typeName){let schema2=getEvalContext().registry.getMessage(typeName);if(!schema2)throw new Error(`Message ${typeName} not found in registry`);return schema2}var privateSymbol4=Symbol.for("@bufbuild/cel/type"),CelScalar={INT:celScalarType("int"),UINT:celScalarType("uint"),BOOL:celScalarType("bool"),STRING:celScalarType("string"),BYTES:celScalarType("bytes"),DOUBLE:celScalarType("double"),NULL:celScalarType("null_type"),DYN:celScalarType("dyn"),TYPE:celScalarType("type")},TIMESTAMP=objectType(TimestampSchema),DURATION=objectType(DurationSchema);function mapType(key,value){return{[privateSymbol4]:{},kind:"map",key,value,name:"map",toString(){return`map(${key}, ${value})`}}}function listType(element){return{[privateSymbol4]:{},kind:"list",element,name:"list",toString(){return`list(${element})`}}}function objectType(descOrTypeName){let name,desc;return typeof descOrTypeName=="string"?(name=descOrTypeName,desc=void 0):(name=descOrTypeName.typeName,desc=descOrTypeName),{[privateSymbol4]:{},kind:"object",desc,name,toString(){return name}}}function celScalarType(scalar){return{[privateSymbol4]:{},kind:"scalar",scalar,name:scalar,toString(){return scalar}}}function celType(v){switch(typeof v){case"bigint":return CelScalar.INT;case"boolean":return CelScalar.BOOL;case"number":return CelScalar.DOUBLE;case"string":return CelScalar.STRING;case"object":switch(!0){case v===null:return CelScalar.NULL;case v instanceof Uint8Array:return CelScalar.BYTES;case isReflectMessage2(v):return celTypeOfMessage(v);case isCelList(v):return listType(CelScalar.DYN);case isCelMap(v):return mapType(CelScalar.DYN,CelScalar.DYN);case isCelUint(v):return CelScalar.UINT;default:if(isObjectCelType(v))return CelScalar.TYPE}}throw new Error(`Not a CEL value: ${v}`)}function isCelType(v){return typeof v=="object"&&v!==null&&isObjectCelType(v)}function isObjectCelType(v){return privateSymbol4 in v}function celTypeOfMessage(v){let typeName=v.desc.typeName;if(isReflectMessageAny(v)&&(typeName=typeUrlToName2(v.message.typeUrl),typeName===ValueSchema.typeName)){let value=anyUnpack(v.message,ValueSchema);return value?valueToType(value):CelScalar.NULL}switch(typeName){case FloatValueSchema.typeName:case DoubleValueSchema.typeName:return CelScalar.DOUBLE;case UInt64ValueSchema.typeName:case UInt32ValueSchema.typeName:return CelScalar.UINT;case Int32ValueSchema.typeName:case Int64ValueSchema.typeName:return CelScalar.INT;case StringValueSchema.typeName:return CelScalar.STRING;case BytesValueSchema.typeName:return CelScalar.BYTES;case BoolValueSchema.typeName:return CelScalar.BOOL;case StructSchema.typeName:return mapType(CelScalar.STRING,CelScalar.DYN);case ListValueSchema.typeName:return listType(CelScalar.DYN);case ValueSchema.typeName:return valueToType(v.message)}return typeName===v.desc.typeName?objectType(v.desc):objectType(typeName)}function valueToType(v){switch(v.kind.case){case"boolValue":return CelScalar.BOOL;case"listValue":return listType(CelScalar.DYN);case"nullValue":case void 0:return CelScalar.NULL;case"numberValue":return CelScalar.DOUBLE;case"stringValue":return CelScalar.STRING;case"structValue":return mapType(CelScalar.STRING,CelScalar.DYN)}}function isReflectMessageAny(v){return v.desc.typeName===AnySchema.typeName}function typeUrlToName2(url){let slash=url.lastIndexOf("/"),name=slash>=0?url.substring(slash+1):url;if(!name.length)throw new Error(`invalid type url: ${url}`);return name}function toCel(v){switch(typeof v){case"bigint":case"boolean":case"number":case"string":return v;case"object":break;default:throw new Error(`unsupported input ${typeof v}`)}switch(!0){case v===null:case v instanceof Uint8Array:case isCelList(v):case isCelMap(v):case isCelUint(v):case isCelType(v):return v}if(isArray(v)||isReflectList2(v))return celList(v);if(isMap(v)||isReflectMap2(v))return celMap(v);if(isMessage2(v)){let value=wktToCel(v);return value!==void 0?value:reflect2(getMsgDesc(v.$typeName),v)}if(isReflectMessage2(v))return reflectMsgToCel(v);if(v.constructor.name==="Object")return celMap(new Map(Object.entries(v)));throw new Error(`Unsupported input ${v}`)}function unwrapAny(v){if(!isReflectAny(v))return v;let unpacked=anyUnpack(v.message,getEvalContext().registry);if(unpacked===void 0)throw new Error(`invalid Any or ${v.message.typeUrl} not found in registry`);let value=wktToCel(unpacked);return value!==void 0?value:reflect2(getMsgDesc(unpacked.$typeName),unpacked)}function reflectMsgToCel(v){let value=wktToCel(v.message);return value!==void 0?value:v}function isReflectAny(v){return isReflectMessage2(v,AnySchema)}function isArray(v){return Array.isArray(v)}function isMap(v){return v instanceof Map}function wktToCel(msg){return isWrapper2(msg)?unwrapWrapper(msg):jsonWrapperToCel(msg)}function unwrapWrapper(v){switch(v.$typeName){case Int32ValueSchema.typeName:return BigInt(v.value);case UInt32ValueSchema.typeName:return celUint(BigInt(v.value));case UInt64ValueSchema.typeName:return celUint(v.value)}return v.value}function jsonWrapperToCel(msg){switch(!0){case isMessage2(msg,StructSchema):return structToCel(msg);case isMessage2(msg,ValueSchema):return valueToCel(msg);case isMessage2(msg,ListValueSchema):return listValueToCel(msg)}}function structToCel(s2){let map5=new Map;for(let[k5,v]of Object.entries(s2.fields))map5.set(k5,valueToCel(v));return celMap(map5)}function valueToCel(v){switch(v.kind.case){case"boolValue":case"numberValue":case"stringValue":return v.kind.value;case"nullValue":case void 0:return null;case"structValue":return structToCel(v.kind.value);case"listValue":return listValueToCel(v.kind.value)}}function listValueToCel(l3){return celList(l3.values)}var privateSymbol5=Symbol.for("@bufbuild/cel/map");function celMap(mapOrReflectMap){return isReflectMap2(mapOrReflectMap)?new ProtoMap(mapOrReflectMap):new NativeMap(mapOrReflectMap)}function isCelMap(v){return typeof v=="object"&&v!==null&&privateSymbol5 in v}var NativeMap=class{_map;[privateSymbol5]={};constructor(_map){this._map=_map}get size(){return this._map.size}get(key){if(isCelUint(key)&&(key=key.value),typeof key=="number"){if(!Number.isInteger(key))return;key=BigInt(key)}let value=this._map.get(key);if(value!==void 0)return toCel(value);if(typeof key=="bigint"){for(let mapKey of this._map.keys())if(isCelUint(mapKey)&&mapKey.value===key)return toCel(this._map.get(mapKey))}}has(key){return this.get(key)!=null}forEach(callback,thisArg){this._map.forEach((value,key,_)=>callback.call(thisArg,toCel(value),key,this))}*entries(){for(let[key,value]of this._map.entries())yield[key,toCel(value)]}keys(){return this._map.keys()}*values(){for(let value of this._map.values())yield toCel(value)}[Symbol.iterator](){return this.entries()}},ProtoMap=class{_map;[privateSymbol5]={};constructor(_map){this._map=_map}get size(){return this._map.size}get(key){let value=this._map.get(mapKeyFromCel(this._map.field(),key));if(value!==void 0)return celFromMapValue(this._map.field(),value)}has(key){return this._map.has(mapKeyFromCel(this._map.field(),key))}forEach(callback,thisArg){this._map.forEach((value,key,_)=>callback.call(thisArg,celFromMapValue(this._map.field(),value),celFromMapKey(this._map.field(),key),this))}*entries(){for(let[key,value]of this._map.entries())yield[celFromMapKey(this._map.field(),key),celFromMapValue(this._map.field(),value)]}*keys(){for(let key of this._map.keys())yield celFromMapKey(this._map.field(),key)}*values(){for(let value of this._map.keys())yield celFromMapValue(this._map.field(),value)}[Symbol.iterator](){return this.entries()}};function mapKeyFromCel(desc,v){switch(isCelUint(v)&&(v=v.value),desc.mapKey){case ScalarType2.SINT32:case ScalarType2.INT32:case ScalarType2.FIXED32:case ScalarType2.UINT32:case ScalarType2.SFIXED32:return typeof v=="bigint"?Number(v):v;case ScalarType2.SINT64:case ScalarType2.INT64:case ScalarType2.FIXED64:case ScalarType2.UINT64:case ScalarType2.SFIXED64:return v==="number"&&Number.isInteger(v)?BigInt(v):v;default:return v}}function celFromMapKey(desc,v){return celFromScalar(desc.mapKey,v)}function celFromMapValue(desc,v){switch(desc.mapKind){case"enum":return BigInt(v);case"message":return reflectMsgToCel(v);case"scalar":return celFromScalar(desc.scalar,v)}}var EMPTY_MAP=celMap(new Map);var wktRegistry=createRegistry(TimestampSchema,DurationSchema,AnySchema,file_google_protobuf_wrappers,file_google_protobuf_struct2);function createRegistryWithWKT(...inputs){return createRegistry(wktRegistry,...inputs)}var Namespace=class _Namespace{_name;_aliases;constructor(name=""){this._name=name,this._aliases=new Map}static ROOT=new _Namespace;name(){return this._name}aliases(){return this._aliases}resolveCandidateNames(name){if(name.startsWith(".")){let qn=name.substring(1),alias2=this.findAlias(qn);return alias2!==void 0?[alias2]:[qn]}let alias=this.findAlias(name);if(alias!==void 0)return[alias];if(this.name()==="")return[name];let nextCont=this.name(),candidates=[nextCont+"."+name];for(let i6=nextCont.lastIndexOf(".");i6>=0;i6=nextCont.lastIndexOf("."))nextCont=nextCont.substring(0,i6),candidates.push(nextCont+"."+name);return candidates.push(name),candidates}findAlias(name){let simple=name,qualifier="",dot=name.indexOf(".");dot>=0&&(simple=name.substring(0,dot),qualifier=name.substring(dot));let alias=this._aliases.get(simple);if(alias!==void 0)return alias+qualifier}};var privateSymbol6=Symbol.for("@bufbuild/cel/resolver");function createResolver(...inputs){let groups=new Map;for(let input of inputs){let funcs=isFuncResolver(input)||Array.isArray(input)?input:[input];for(let func of funcs){let group4=groups.get(func.name);group4===void 0&&(group4=[],groups.set(func.name,group4)),group4.push(func)}}return new Resolver(new Map(new Array(...groups.entries()).map(([name,funcs])=>[name,createFuncGroup(name,funcs)])))}function isFuncResolver(v){return typeof v=="object"&&v!==null&&privateSymbol6 in v}var Resolver=class{_groups;[privateSymbol6]={};constructor(_groups){this._groups=_groups}*[Symbol.iterator](){for(let group4 of this._groups.values())yield*group4}find(name){return this._groups.get(name)}};function createFuncGroup(name,funcs){let set2=[];for(let func of funcs){for(let i6=0;i6<set2.length;i6++)if(func.id===set2[i6].id){set2.splice(i6,1);break}set2.push(func)}return new Group(name,set2)}var Group=class{_name;_funcs;constructor(_name,_funcs){this._name=_name,this._funcs=_funcs}*[Symbol.iterator](){yield*this._funcs}get name(){return this._name}call(id,target,args){args=args.map(arg=>unwrapAny(arg));for(let func of this._funcs){let result=func.call(id,target,args);if(result!==void 0)return result}}};var CONDITIONAL="_?_:_";var EQUALS="_==_";var GREATER_EQUALS="_>=_";var INDEX="_[_]";var LESS_EQUALS="_<=_",LOGICAL_AND="_&&_";var LOGICAL_OR="_||_";var NOT_EQUALS="_!=_",NOT_STRICTLY_FALSE="@not_strictly_false";var OLD_NOT_STRICTLY_FALSE="__not_strictly_false__",OPT_INDEX="_[?_]",OPT_SELECT="_?._";var ONE_SECOND=1000000000n,MAX_DURATION_NANOS=9223372036854775807n,MIN_DURATION_NANOS=-9223372036854775808n;function createDuration(seconds=0n,ns=0n){let fullNanos=seconds*ONE_SECOND+BigInt(ns);if(fullNanos>MAX_DURATION_NANOS||fullNanos<MIN_DURATION_NANOS)throw new Error("duration out of range");return create2(DurationSchema,{seconds:fullNanos/ONE_SECOND,nanos:Number(fullNanos%ONE_SECOND)})}var DURATION_STRING_LENGTH_LIMIT=128,UNITS=Object.freeze({ns:1n,us:1000n,\u00B5s:1000n,ms:1000n*1000n,s:1000n*1000n*1000n,m:1000n*1000n*1000n*60n,h:1000n*1000n*1000n*60n*60n}),INT_REGEXP=/^\d+/,UNIT_REGEXP=new RegExp(`^(${Object.keys(UNITS).join("|")})`);function parseDuration(str2){if(str2.length>DURATION_STRING_LENGTH_LIMIT)throw badDurationStr(`duration string exceeds ${DURATION_STRING_LENGTH_LIMIT} characters`);if(/^[-+]?0$/.test(str2))return createDuration();let[sign3,values]=/^[+-]/.test(str2)?[str2[0]==="+"?1n:-1n,str2.slice(1)]:[1n,str2],fullNanos=0n,remainder=values;for(;remainder.length>0;){let int3=INT_REGEXP.exec(remainder)?.[0];remainder=remainder.slice(int3?.length??0),remainder[0]==="."&&(remainder=remainder.slice(1));let fraction=INT_REGEXP.exec(remainder)?.[0];remainder=remainder.slice(fraction?.length??0);let unit=UNIT_REGEXP.exec(remainder)?.[0];if(remainder=remainder.slice(unit?.length??0),(int3??fraction)===void 0||unit===void 0)throw badDurationStr("invalid syntax");let factor=UNITS[unit];fullNanos+=BigInt(int3??0)*factor,fullNanos+=BigInt(fraction??0)*factor/10n**BigInt(fraction?.length??0)}return createDuration(0n,sign3*fullNanos)}function badDurationStr(e6){return new Error(`Failed to parse duration: ${e6}`)}var MAX_TIMESTAMP_SECONDS=253402300799n,MIN_TIMESTAMP_SECONDS=-62135596800n,ONE_SECOND2=1000000000n;function createTimestamp(s2=0n,ns=0n){let fullNanos=s2*ONE_SECOND2+BigInt(ns),shift=fullNanos%ONE_SECOND2<0n?1n:0n,seconds=fullNanos/ONE_SECOND2-shift,nanos=Number(fullNanos%ONE_SECOND2+shift*ONE_SECOND2);if(seconds>MAX_TIMESTAMP_SECONDS||seconds<MIN_TIMESTAMP_SECONDS)throw new Error("timestamp out of range");return create2(TimestampSchema,{seconds,nanos})}function equals2(lhs,rhs){if(lhs===rhs)return!0;if(isCelUint(lhs)&&(lhs=lhs.value),isCelUint(rhs)&&(rhs=rhs.value),(typeof lhs=="number"||typeof lhs=="bigint")&&(typeof rhs=="number"||typeof rhs=="bigint"))return lhs==rhs;switch(!0){case lhs instanceof Uint8Array:return rhs instanceof Uint8Array&&equalsBytes(lhs,rhs);case isCelList(lhs):return isCelList(rhs)&&equalsList(lhs,rhs);case isCelMap(lhs):return isCelMap(rhs)&&equalsMap(lhs,rhs);case isCelType(lhs):return isCelType(rhs)&&equalsType(lhs,rhs)}return isReflectMessage2(lhs)?!isReflectMessage2(rhs)||lhs.desc.typeName!==rhs.desc.typeName?!1:equals(lhs.desc,lhs.message,rhs.message,{registry:getEvalContext().registry,unpackAny:!0,unknown:!0,extensions:!0}):!1}function equalsType(lhs,rhs){return lhs.kind===rhs.kind&&lhs.name===rhs.name}function equalsList(lhs,rhs){if(lhs.size!==rhs.size)return!1;for(let i6=0;i6<lhs.size;i6++)if(!equals2(lhs.get(i6),rhs.get(i6)))return!1;return!0}function equalsMap(lhs,rhs){if(lhs.size!==rhs.size)return!1;for(let[k5,v]of lhs){let rv=rhs.get(k5);if(rv===void 0||!equals2(v,rv))return!1}return!0}function equalsBytes(lhs,rhs){if(lhs.length!==rhs.length)return!1;for(let i6=0;i6<lhs.length;i6++)if(lhs[i6]!==rhs[i6])return!1;return!0}var privateSymbol7=Symbol.for("@bufbuild/cel/func");function celFunc(name,args,result,impl){return new Func(name,void 0,args,result,impl)}function celMethod(name,target,args,result,impl){return new Method(name,target,args,result,impl)}var Callable=class{_name;_target;_args;_result;_impl;_id;[privateSymbol7]={};constructor(_name,_target,_args,_result,_impl,_id=""){this._name=_name,this._target=_target,this._args=_args,this._result=_result,this._impl=_impl,this._id=_id}get id(){if(this._id===""){let qualifier=this.target?`${this.target.name}.`:"";this._id=`${qualifier}${this.name}(${this.arguments.map(p3=>p3.name).join(",")})`}return this._id}get name(){return this._name}get target(){return this._target}get arguments(){return this._args}get result(){return this._result}call(id,target,args){if(args.length==this.arguments.length){for(let i6=0;i6<args.length;i6++)if(!isSubtypeOf(args[i6],this.arguments[i6]))return;try{return toCel(this._impl.apply(target,args))}catch(ex){return celError(ex,id)}}}},Func=class extends Callable{call(id,target,args){if(target===void 0)return super.call(id,void 0,args)}},Method=class extends Callable{call(id,target,args){if(!(target===void 0||!isSubtypeOf(target,this.target)))return super.call(id,target,args)}};function isSubtypeOf(val,typ){return typ===CelScalar.DYN||equalsType(celType(val),typ)}var MAX_INT=9223372036854775807n,MIN_INT=-9223372036854775808n,MAX_UINT=18446744073709551615n;function safeInt(value,op2="type conversion"){let numeric=typeof value=="string"?BigInt(value):value;if(typeof numeric=="bigint"){if(numeric>=MIN_INT&&numeric<=MAX_INT)return numeric}else if(Number.isFinite(numeric)&&numeric>Number(MIN_INT)&&numeric<Number(MAX_INT))return BigInt(Math.trunc(numeric));throw celError(`int overflow during ${op2}`)}function safeUint(value,op2="type conversion"){let numeric=typeof value=="string"?BigInt(value):value;if(typeof numeric=="bigint"||Number.isFinite(numeric)){let int3=typeof numeric=="number"?BigInt(Math.trunc(numeric)):numeric;if(numeric>=0&&int3<=MAX_UINT)return celUint(int3)}throw celError(`uint overflow during ${op2}`)}function bytesConcat(l3,r5){let val=new Uint8Array(l3.length+r5.length);return val.set(l3),val.set(r5,l3.length),val}function timestampSum(l3,r5){return createTimestamp(l3.message.seconds+r5.message.seconds,l3.message.nanos+r5.message.nanos)}function durationSum(l3,r5){return createDuration(l3.message.seconds+r5.message.seconds,l3.message.nanos+r5.message.nanos)}function durationDifference(l3,r5){return createDuration(l3.message.seconds-r5.message.seconds,l3.message.nanos-r5.message.nanos)}function timestampDifference(l3,r5){return createTimestamp(l3.message.seconds-r5.message.seconds,l3.message.nanos-r5.message.nanos)}function safeDivide(type2,l3,r5){if(r5===0n)throw celError(`${type2.name} divide by zero`);return safeInt(l3/r5,`divide by ${r5}`)}function safeModulo(type2,l3,r5){if(r5===0n)throw celError(`${type2.name} modulus by zero`);return l3%r5}var LIST=listType(CelScalar.DYN),{BYTES,DOUBLE,INT,STRING,UINT}=CelScalar,math_default=[celFunc("_+_",[INT,INT],INT,(l3,r5)=>safeInt(l3+r5,"_+_")),celFunc("_+_",[UINT,UINT],UINT,(l3,r5)=>safeUint(l3.value+r5.value,"_+_")),celFunc("_+_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3+r5),celFunc("_+_",[DURATION,DURATION],DURATION,durationSum),celFunc("_+_",[TIMESTAMP,DURATION],TIMESTAMP,timestampSum),celFunc("_+_",[DURATION,TIMESTAMP],TIMESTAMP,timestampSum),celFunc("_+_",[STRING,STRING],STRING,(l3,r5)=>l3+r5),celFunc("_+_",[BYTES,BYTES],BYTES,bytesConcat),celFunc("_+_",[LIST,LIST],LIST,celListConcat),celFunc("_-_",[INT,INT],INT,(l3,r5)=>safeInt(l3-r5,"_-_")),celFunc("_-_",[UINT,UINT],UINT,(l3,r5)=>safeUint(l3.value-r5.value,"_-_")),celFunc("_-_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3-r5),celFunc("_-_",[TIMESTAMP,TIMESTAMP],DURATION,durationDifference),celFunc("_-_",[DURATION,DURATION],DURATION,durationDifference),celFunc("_-_",[TIMESTAMP,DURATION],TIMESTAMP,timestampDifference),celFunc("_*_",[INT,INT],INT,(l3,r5)=>safeInt(l3*r5,"_*_")),celFunc("_*_",[UINT,UINT],UINT,(l3,r5)=>safeUint(l3.value*r5.value,"_*_")),celFunc("_*_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3*r5),celFunc("_/_",[INT,INT],INT,(l3,r5)=>safeDivide(INT,l3,r5)),celFunc("_/_",[UINT,UINT],UINT,(l3,r5)=>celUint(safeDivide(UINT,l3.value,r5.value))),celFunc("_/_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3/r5),celFunc("_%_",[INT,INT],INT,(l3,r5)=>safeModulo(INT,l3,r5)),celFunc("_%_",[UINT,UINT],UINT,(l3,r5)=>celUint(safeModulo(UINT,l3.value,r5.value))),celFunc("-_",[INT],INT,x2=>safeInt(-x2)),celFunc("-_",[DOUBLE],DOUBLE,x2=>-x2)];var encoder=new TextEncoder,decoder=new TextDecoder(void 0,{fatal:!0});function stringToBool(x2){switch(x2){case"true":case"True":case"TRUE":case"t":case"1":return!0;case"false":case"False":case"FALSE":case"f":case"0":return!1}throw new Error(`Unable to convert string '${x2}' to bool`)}function bytesToString(x2){try{return decoder.decode(x2)}catch(e6){throw new Error(`Failed to decode bytes as string: ${e6}`)}}function stringToTimestamp(x2){try{return fromJson(TimestampSchema,x2)}catch(e6){throw new Error(`Failed to parse timestamp: ${e6}`)}}function toType(x2){return isMessage2(x2)?objectType(getMsgDesc(x2.$typeName)):celType(x2)}function identity(x2){return x2}var{BOOL,BYTES:BYTES2,DOUBLE:DOUBLE2,DYN,INT:INT2,STRING:STRING2,TYPE,UINT:UINT2}=CelScalar,cast_default=[celFunc("int",[INT2],INT2,identity),celFunc("int",[UINT2],INT2,x2=>safeInt(x2.value)),celFunc("int",[DOUBLE2],INT2,safeInt),celFunc("int",[STRING2],INT2,safeInt),celFunc("int",[TIMESTAMP],INT2,x2=>safeInt(x2.message.seconds)),celFunc("int",[DURATION],INT2,x2=>safeInt(x2.message.seconds)),celFunc("uint",[UINT2],UINT2,identity),celFunc("uint",[INT2],UINT2,safeUint),celFunc("uint",[DOUBLE2],UINT2,safeUint),celFunc("uint",[STRING2],UINT2,safeUint),celFunc("double",[DOUBLE2],DOUBLE2,identity),celFunc("double",[INT2],DOUBLE2,x2=>Number(x2)),celFunc("double",[UINT2],DOUBLE2,x2=>Number(x2.value)),celFunc("double",[STRING2],DOUBLE2,x2=>Number(x2)),celFunc("bool",[BOOL],BOOL,identity),celFunc("bool",[STRING2],BOOL,stringToBool),celFunc("bytes",[BYTES2],BYTES2,identity),celFunc("bytes",[STRING2],BYTES2,x2=>encoder.encode(x2)),celFunc("string",[STRING2],STRING2,identity),celFunc("string",[BOOL],STRING2,x2=>x2.toString()),celFunc("string",[INT2],STRING2,x2=>x2.toString()),celFunc("string",[UINT2],STRING2,x2=>x2.value.toString()),celFunc("string",[DOUBLE2],STRING2,x2=>x2.toString()),celFunc("string",[BYTES2],STRING2,bytesToString),celFunc("string",[TIMESTAMP],STRING2,x2=>toJson(TimestampSchema,x2.message)),celFunc("string",[DURATION],STRING2,x2=>toJson(DurationSchema,x2.message)),celFunc("timestamp",[TIMESTAMP],TIMESTAMP,identity),celFunc("timestamp",[STRING2],TIMESTAMP,stringToTimestamp),celFunc("timestamp",[INT2],TIMESTAMP,x2=>timestampFromMs(Number(x2))),celFunc("duration",[DURATION],DURATION,identity),celFunc("duration",[STRING2],DURATION,parseDuration),celFunc("duration",[INT2],DURATION,x2=>create2(DurationSchema,{seconds:x2})),celFunc("type",[DYN],TYPE,toType),celFunc("dyn",[DYN],DYN,identity)];var CONTAINS="contains";var ENDS_WITH="endsWith";var MATCHES="matches";var SIZE="size";var STARTS_WITH="startsWith";var TIME_GET_DATE="getDate",TIME_GET_DAY_OF_MONTH="getDayOfMonth",TIME_GET_DAY_OF_WEEK="getDayOfWeek",TIME_GET_DAY_OF_YEAR="getDayOfYear",TIME_GET_FULL_YEAR="getFullYear",TIME_GET_HOURS="getHours",TIME_GET_MILLISECONDS="getMilliseconds",TIME_GET_MINUTES="getMinutes",TIME_GET_MONTH="getMonth",TIME_GET_SECONDS="getSeconds";var invalidPatterns=[/\\[1-9]/,/\\k<.>/,/\(\?\=/,/\(\?\!/,/\(\?\<\=/,/\(\?\<\!/,/\\c[A-Z]/,/\\u[0-9a-fA-F]{4}/,/\\0(?!\d)/,/\[\\b.*\]/],flagPattern=new RegExp(/^\(\?(?<flags>[ims\-]+)\)/);function matches(pattern){for(let invalidPattern of invalidPatterns)if(invalidPattern.test(pattern))throw new Error(`Error evaluating pattern ${pattern}, invalid RE2 syntax`);let flags="",flagMatches=pattern.match(flagPattern);if(flagMatches){for(let flag of flagMatches?.groups?.flags??""){if(flag=="-")break;flags+=flag}pattern=pattern.substring(flagMatches[0].length)}return new RegExp(pattern,flags).test(this)}function compareDuration(lhs,rhs){let cmp=lhs.message.seconds-rhs.message.seconds;return cmp==0n?lhs.message.nanos-rhs.message.nanos:cmp<0n?-1:1}function compareTimestamp(lhs,rhs){let cmp=lhs.message.seconds-rhs.message.seconds;return cmp==0n?lhs.message.nanos-rhs.message.nanos:cmp<0n?-1:1}function compareBytes(lhs,rhs){let minLen=Math.min(lhs.length,rhs.length);for(let i6=0;i6<minLen;i6++){if(lhs[i6]<rhs[i6])return-1;if(lhs[i6]>rhs[i6])return 1}return lhs.length-rhs.length}function inList(value,list11){for(let v of list11)if(equals2(v,value))return!0;return!1}function inMap(value,map5){return map5.has(value)}var{BOOL:BOOL2,BYTES:BYTES3,DOUBLE:DOUBLE3,DYN:DYN2,INT:INT3,STRING:STRING3,UINT:UINT3}=CelScalar,LIST2=listType(CelScalar.DYN),MAP=mapType(CelScalar.DYN,CelScalar.DYN),logic_default=[celFunc("!_",[BOOL2],BOOL2,x2=>!x2),celFunc(EQUALS,[DYN2,DYN2],BOOL2,equals2),celFunc(NOT_EQUALS,[DYN2,DYN2],BOOL2,(l3,r5)=>!equals2(l3,r5)),celFunc("_<_",[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)<0),celFunc("_<_",[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[STRING3,STRING3],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[INT3,INT3],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[INT3,UINT3],BOOL2,(l3,r5)=>l3<r5.value),celFunc("_<_",[UINT3,INT3],BOOL2,(l3,r5)=>l3.value<r5),celFunc("_<_",[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value<r5.value),celFunc("_<_",[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)<r5),celFunc("_<_",[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3<Number(r5)),celFunc("_<_",[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3<Number(r5.value)),celFunc("_<_",[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)<r5),celFunc("_<_",[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)<0),celFunc("_<_",[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)<0),celFunc(LESS_EQUALS,[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)<=0),celFunc(LESS_EQUALS,[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[STRING3,STRING3],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[INT3,INT3],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[INT3,UINT3],BOOL2,(l3,r5)=>l3<=r5.value),celFunc(LESS_EQUALS,[UINT3,INT3],BOOL2,(l3,r5)=>l3.value<=r5),celFunc(LESS_EQUALS,[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value<=r5.value),celFunc(LESS_EQUALS,[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)<=r5),celFunc(LESS_EQUALS,[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3<=Number(r5)),celFunc(LESS_EQUALS,[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3<=Number(r5.value)),celFunc(LESS_EQUALS,[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)<=r5),celFunc(LESS_EQUALS,[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)<=0),celFunc(LESS_EQUALS,[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)<=0),celFunc("_>_",[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)>0),celFunc("_>_",[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[STRING3,STRING3],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[INT3,INT3],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[INT3,UINT3],BOOL2,(l3,r5)=>l3>r5.value),celFunc("_>_",[UINT3,INT3],BOOL2,(l3,r5)=>l3.value>r5),celFunc("_>_",[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value>r5.value),celFunc("_>_",[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)>r5),celFunc("_>_",[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3>Number(r5)),celFunc("_>_",[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3>Number(r5.value)),celFunc("_>_",[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)>r5),celFunc("_>_",[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)>0),celFunc("_>_",[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)>0),celFunc(GREATER_EQUALS,[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)>=0),celFunc(GREATER_EQUALS,[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[STRING3,STRING3],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[INT3,INT3],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[INT3,UINT3],BOOL2,(l3,r5)=>l3>=r5.value),celFunc(GREATER_EQUALS,[UINT3,INT3],BOOL2,(l3,r5)=>l3.value>=r5),celFunc(GREATER_EQUALS,[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value>=r5.value),celFunc(GREATER_EQUALS,[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)>=r5),celFunc(GREATER_EQUALS,[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3>=Number(r5)),celFunc(GREATER_EQUALS,[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3>=Number(r5.value)),celFunc(GREATER_EQUALS,[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)>=r5),celFunc(GREATER_EQUALS,[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)>=0),celFunc(GREATER_EQUALS,[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)>=0),celFunc(SIZE,[BYTES3],INT3,x2=>BigInt(x2.length)),celFunc(SIZE,[LIST2],INT3,x2=>BigInt(x2.size)),celFunc(SIZE,[STRING3],INT3,x2=>BigInt([...x2].length)),celFunc(SIZE,[MAP],INT3,x2=>BigInt(x2.size)),celMethod(SIZE,BYTES3,[],INT3,function(){return BigInt(this.length)}),celMethod(SIZE,LIST2,[],INT3,function(){return BigInt(this.size)}),celMethod(SIZE,STRING3,[],INT3,function(){return BigInt([...this].length)}),celMethod(SIZE,MAP,[],INT3,function(){return BigInt(this.size)}),celFunc("@in",[DYN2,LIST2],BOOL2,inList),celFunc("@in",[STRING3,MAP],BOOL2,inMap),celFunc("@in",[DOUBLE3,MAP],BOOL2,inMap),celFunc("@in",[INT3,MAP],BOOL2,inMap),celFunc("@in",[BOOL2,MAP],BOOL2,inMap),celFunc("@in",[UINT3,MAP],BOOL2,inMap),celMethod(CONTAINS,STRING3,[STRING3],BOOL2,String.prototype.includes),celMethod(ENDS_WITH,STRING3,[STRING3],BOOL2,String.prototype.endsWith),celMethod(STARTS_WITH,STRING3,[STRING3],BOOL2,String.prototype.startsWith),celMethod(MATCHES,STRING3,[STRING3],BOOL2,matches)];function getDayOfYear(date2){let start=new Date(0,0,1);start.setFullYear(date2.getFullYear());let diff=date2.getTime()-start.getTime(),oneDay=1e3*60*60*24;return Math.floor(diff/oneDay)}function convertToDate(msg,tz){let ts=msg.message,val=timestampDate(ts);if(tz===void 0)return new Date(val.getUTCFullYear(),val.getUTCMonth(),val.getUTCDate(),val.getUTCHours(),val.getUTCMinutes(),val.getUTCSeconds(),val.getUTCMilliseconds());let timeOffset=tz.match(/^(?<sign>[+-]?)(?<hours>\d\d):(?<minutes>\d\d)$/);if(timeOffset?.groups){let sign3=timeOffset.groups.sign=="-"?1:-1,hours=parseInt(timeOffset.groups.hours),minutes=parseInt(timeOffset.groups.minutes),offset=sign3*(hours*60*60*1e3+minutes*60*1e3);return val=new Date(val.getTime()-offset),new Date(val.getUTCFullYear(),val.getUTCMonth(),val.getUTCDate(),val.getUTCHours(),val.getUTCMinutes(),val.getUTCSeconds(),val.getUTCMilliseconds())}let format3=new Intl.DateTimeFormat("en-US",{hourCycle:"h23",hour12:!1,timeZone:tz,year:"numeric",month:"numeric",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit"}),year2,month,day,hour,minute,second;for(let part of format3.formatToParts(val))switch(part.type){case"year":year2=parseInt(part.value);break;case"month":month=parseInt(part.value)-1;break;case"day":day=parseInt(part.value);break;case"hour":hour=parseInt(part.value);break;case"minute":minute=parseInt(part.value);break;case"second":second=parseInt(part.value);break}if(year2===void 0||month===void 0||day===void 0||hour===void 0||minute===void 0||second===void 0)throw new Error(`Error converting ${toJson(TimestampSchema,ts)} to IANA timezone ${tz}`);return new Date(year2,month,day,hour,minute,second,val.getUTCMilliseconds())}var{STRING:STRING4,INT:INT4}=CelScalar;function celTimeMethods(name,func){function method(tz){let date2=convertToDate(this,tz),result=func(date2);try{return BigInt(result)}catch{throw new Error(`Error converting ${result} of ${String(date2)} of ${toJson(TimestampSchema,this.message)} to BigInt`)}}return[celMethod(name,TIMESTAMP,[],INT4,method),celMethod(name,TIMESTAMP,[STRING4],INT4,method)]}var time_default=[celMethod(TIME_GET_SECONDS,DURATION,[],INT4,function(){return this.message.seconds}),celMethod(TIME_GET_MINUTES,DURATION,[],INT4,function(){return this.message.seconds/60n}),celMethod(TIME_GET_HOURS,DURATION,[],INT4,function(){return this.message.seconds/3600n}),celMethod(TIME_GET_MILLISECONDS,DURATION,[],INT4,function(){return BigInt(this.message.nanos)/1000000n}),...celTimeMethods(TIME_GET_FULL_YEAR,x2=>x2.getFullYear()),...celTimeMethods(TIME_GET_MONTH,x2=>x2.getMonth()),...celTimeMethods(TIME_GET_DATE,x2=>x2.getDate()),...celTimeMethods(TIME_GET_DAY_OF_MONTH,x2=>x2.getDate()-1),...celTimeMethods(TIME_GET_DAY_OF_WEEK,x2=>x2.getDay()),...celTimeMethods(TIME_GET_DAY_OF_YEAR,x2=>getDayOfYear(x2)),...celTimeMethods(TIME_GET_SECONDS,x2=>x2.getSeconds()),...celTimeMethods(TIME_GET_MINUTES,x2=>x2.getMinutes()),...celTimeMethods(TIME_GET_HOURS,x2=>x2.getHours()),...celTimeMethods(TIME_GET_MILLISECONDS,x2=>x2.getMilliseconds())];var privateSymbol8=Symbol.for("@bufbuild/cel/env");function celEnv(options){return new _CelEnv(options?.namespace?new Namespace(options?.namespace):void 0,options?.registry?createRegistryWithWKT(options.registry):createRegistryWithWKT(),createResolver(math_default,cast_default,time_default,logic_default,options?.funcs??[]))}var _CelEnv=class{_namespace;_registry;_funcs;[privateSymbol8]={};constructor(_namespace,_registry,_funcs){this._namespace=_namespace,this._registry=_registry,this._funcs=_funcs}get namespace(){return this._namespace}get registry(){return this._registry}get funcs(){return this._funcs}};var file_cel_expr_syntax=fileDesc2("ChVjZWwvZXhwci9zeW50YXgucHJvdG8SCGNlbC5leHByIlUKClBhcnNlZEV4cHISHAoEZXhwchgCIAEoCzIOLmNlbC5leHByLkV4cHISKQoLc291cmNlX2luZm8YAyABKAsyFC5jZWwuZXhwci5Tb3VyY2VJbmZvItoICgRFeHByEgoKAmlkGAIgASgDEigKCmNvbnN0X2V4cHIYAyABKAsyEi5jZWwuZXhwci5Db25zdGFudEgAEioKCmlkZW50X2V4cHIYBCABKAsyFC5jZWwuZXhwci5FeHByLklkZW50SAASLAoLc2VsZWN0X2V4cHIYBSABKAsyFS5jZWwuZXhwci5FeHByLlNlbGVjdEgAEigKCWNhbGxfZXhwchgGIAEoCzITLmNlbC5leHByLkV4cHIuQ2FsbEgAEi4KCWxpc3RfZXhwchgHIAEoCzIZLmNlbC5leHByLkV4cHIuQ3JlYXRlTGlzdEgAEjIKC3N0cnVjdF9leHByGAggASgLMhsuY2VsLmV4cHIuRXhwci5DcmVhdGVTdHJ1Y3RIABI6ChJjb21wcmVoZW5zaW9uX2V4cHIYCSABKAsyHC5jZWwuZXhwci5FeHByLkNvbXByZWhlbnNpb25IABoVCgVJZGVudBIMCgRuYW1lGAEgASgJGksKBlNlbGVjdBIfCgdvcGVyYW5kGAEgASgLMg4uY2VsLmV4cHIuRXhwchINCgVmaWVsZBgCIAEoCRIRCgl0ZXN0X29ubHkYAyABKAgaVgoEQ2FsbBIeCgZ0YXJnZXQYASABKAsyDi5jZWwuZXhwci5FeHByEhAKCGZ1bmN0aW9uGAIgASgJEhwKBGFyZ3MYAyADKAsyDi5jZWwuZXhwci5FeHByGkgKCkNyZWF0ZUxpc3QSIAoIZWxlbWVudHMYASADKAsyDi5jZWwuZXhwci5FeHByEhgKEG9wdGlvbmFsX2luZGljZXMYAiADKAUa6QEKDENyZWF0ZVN0cnVjdBIUCgxtZXNzYWdlX25hbWUYASABKAkSMgoHZW50cmllcxgCIAMoCzIhLmNlbC5leHByLkV4cHIuQ3JlYXRlU3RydWN0LkVudHJ5Go4BCgVFbnRyeRIKCgJpZBgBIAEoAxITCglmaWVsZF9rZXkYAiABKAlIABIhCgdtYXBfa2V5GAMgASgLMg4uY2VsLmV4cHIuRXhwckgAEh0KBXZhbHVlGAQgASgLMg4uY2VsLmV4cHIuRXhwchIWCg5vcHRpb25hbF9lbnRyeRgFIAEoCEIKCghrZXlfa2luZBr4AQoNQ29tcHJlaGVuc2lvbhIQCghpdGVyX3ZhchgBIAEoCRIRCglpdGVyX3ZhcjIYCCABKAkSIgoKaXRlcl9yYW5nZRgCIAEoCzIOLmNlbC5leHByLkV4cHISEAoIYWNjdV92YXIYAyABKAkSIQoJYWNjdV9pbml0GAQgASgLMg4uY2VsLmV4cHIuRXhwchImCg5sb29wX2NvbmRpdGlvbhgFIAEoCzIOLmNlbC5leHByLkV4cHISIQoJbG9vcF9zdGVwGAYgASgLMg4uY2VsLmV4cHIuRXhwchIeCgZyZXN1bHQYByABKAsyDi5jZWwuZXhwci5FeHByQgsKCWV4cHJfa2luZCLNAgoIQ29uc3RhbnQSMAoKbnVsbF92YWx1ZRgBIAEoDjIaLmdvb2dsZS5wcm90b2J1Zi5OdWxsVmFsdWVIABIUCgpib29sX3ZhbHVlGAIgASgISAASFQoLaW50NjRfdmFsdWUYAyABKANIABIWCgx1aW50NjRfdmFsdWUYBCABKARIABIWCgxkb3VibGVfdmFsdWUYBSABKAFIABIWCgxzdHJpbmdfdmFsdWUYBiABKAlIABIVCgtieXRlc192YWx1ZRgHIAEoDEgAEjcKDmR1cmF0aW9uX3ZhbHVlGAggASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQgIYAUgAEjkKD3RpbWVzdGFtcF92YWx1ZRgJIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCAhgBSABCDwoNY29uc3RhbnRfa2luZCKcBQoKU291cmNlSW5mbxIWCg5zeW50YXhfdmVyc2lvbhgBIAEoCRIQCghsb2NhdGlvbhgCIAEoCRIUCgxsaW5lX29mZnNldHMYAyADKAUSNgoJcG9zaXRpb25zGAQgAygLMiMuY2VsLmV4cHIuU291cmNlSW5mby5Qb3NpdGlvbnNFbnRyeRI5CgttYWNyb19jYWxscxgFIAMoCzIkLmNlbC5leHByLlNvdXJjZUluZm8uTWFjcm9DYWxsc0VudHJ5EjIKCmV4dGVuc2lvbnMYBiADKAsyHi5jZWwuZXhwci5Tb3VyY2VJbmZvLkV4dGVuc2lvbhowCg5Qb3NpdGlvbnNFbnRyeRILCgNrZXkYASABKAMSDQoFdmFsdWUYAiABKAU6AjgBGkEKD01hY3JvQ2FsbHNFbnRyeRILCgNrZXkYASABKAMSHQoFdmFsdWUYAiABKAsyDi5jZWwuZXhwci5FeHByOgI4ARqxAgoJRXh0ZW5zaW9uEgoKAmlkGAEgASgJEkUKE2FmZmVjdGVkX2NvbXBvbmVudHMYAiADKA4yKC5jZWwuZXhwci5Tb3VyY2VJbmZvLkV4dGVuc2lvbi5Db21wb25lbnQSNwoHdmVyc2lvbhgDIAEoCzImLmNlbC5leHByLlNvdXJjZUluZm8uRXh0ZW5zaW9uLlZlcnNpb24aJwoHVmVyc2lvbhINCgVtYWpvchgBIAEoAxINCgVtaW5vchgCIAEoAyJvCglDb21wb25lbnQSGQoVQ09NUE9ORU5UX1VOU1BFQ0lGSUVEEAASFAoQQ09NUE9ORU5UX1BBUlNFUhABEhoKFkNPTVBPTkVOVF9UWVBFX0NIRUNLRVIQAhIVChFDT01QT05FTlRfUlVOVElNRRADQi4KDGRldi5jZWwuZXhwckILU3ludGF4UHJvdG9QAVoMY2VsLmRldi9leHBy+AEBYgZwcm90bzM",[file_google_protobuf_duration2,file_google_protobuf_struct2,file_google_protobuf_timestamp2]),ParsedExprSchema=messageDesc3(file_cel_expr_syntax,0),ExprSchema=messageDesc3(file_cel_expr_syntax,1);var SourceInfo_Extension_Component;(function(SourceInfo_Extension_Component2){SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.UNSPECIFIED=0]="UNSPECIFIED",SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.PARSER=1]="PARSER",SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.TYPE_CHECKER=2]="TYPE_CHECKER",SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.RUNTIME=3]="RUNTIME"})(SourceInfo_Extension_Component||(SourceInfo_Extension_Component={}));var LogicManager=class _LogicManager{builder;function;terms;ops;variadicASTs;constructor(builder2,functionName,term,variadicASTs){this.builder=builder2,this.function=functionName,this.terms=[term],this.ops=[],this.variadicASTs=variadicASTs}static newVariadicLogicManager(builder2,functionName,term){return new _LogicManager(builder2,functionName,term,!0)}static newBalancingLogicManager(builder2,functionName,term){return new _LogicManager(builder2,functionName,term,!1)}addTerm(op2,term){this.terms.push(term),this.ops.push(op2)}toExpr(){return this.terms.length===1?this.terms[0]:this.variadicASTs?this.builder.nextExpr(this.ops[0],{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:this.function,args:this.terms}}):this.balancedTree(0,this.ops.length-1)}balancedTree(lo,hi){let mid=Math.floor((lo+hi+1)/2),left;mid===lo?left=this.terms[mid]:left=this.balancedTree(lo,mid-1);let right;return mid===hi?right=this.terms[mid+1]:right=this.balancedTree(mid+1,hi),this.builder.nextExpr(this.ops[mid],{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:this.function,args:[left,right]}})}};var encoder2=new TextEncoder,accuVarName="@result",Builder=class{#prevId=0n;sourceInfo={$typeName:"cel.expr.SourceInfo",syntaxVersion:"",location:"",lineOffsets:[],positions:{},macroCalls:{},extensions:[]};nextExpr(offset,exprKind){return this.sourceInfo.positions[(++this.#prevId).toString()]=offset,{$typeName:"cel.expr.Expr",id:this.#prevId,exprKind}}nextEntry(offset,keyKind,value){return this.sourceInfo.positions[(++this.#prevId).toString()]=offset,{$typeName:"cel.expr.Expr.CreateStruct.Entry",id:this.#prevId,keyKind,value,optionalEntry:!1}}newConstExpr(offset,constantKind){return this.nextExpr(offset,{case:"constExpr",value:{$typeName:"cel.expr.Constant",constantKind}})}newCallExpr(offset,functionName,args){if(functionName==="has"&&args.length===1&&args[0].exprKind?.case==="selectExpr")return this.expandHasMacro(offset,args[0]);if((functionName==="_||_"||functionName==="_&&_")&&args.length>1){let logicManager=LogicManager.newBalancingLogicManager(this,functionName,args[0]);for(let i6=1;i6<args.length;i6+=1)logicManager.addTerm(offset,args[i6]);return logicManager.toExpr()}return this.nextExpr(offset,{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:functionName,args}})}newMemberCallExpr(offset,target,functionName,args){return this.maybeExpand(offset,this.nextExpr(offset,{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:functionName,target,args}}))}newStringExpr(offset,sequence){return this.newConstExpr(offset,{case:"stringValue",value:sequence.reduce((string,chunk)=>{if(typeof chunk!="string"){if(chunk.some(cp=>cp>=55296&&cp<57344))throw new Error("surrogate code points are not allowed");return string+String.fromCodePoint(...chunk)}return string+chunk},"")})}newBytesExpr(offset,sequence){let chunks=[],totalSize=0;for(let rawChunk of sequence){let chunk=typeof rawChunk=="string"?encoder2.encode(rawChunk):rawChunk;chunks.push(chunk),totalSize+=chunk.length}let value=new Uint8Array(totalSize),chunkOffset=0;for(let chunk of chunks)value.set(chunk,chunkOffset),chunkOffset+=chunk.length;return this.newConstExpr(offset,{case:"bytesValue",value})}newBoolExpr(offset,keyword){return this.newConstExpr(offset,{case:"boolValue",value:keyword==="true"})}newInt64Expr(offset,digits){return this.newConstExpr(offset,{case:"int64Value",value:digits[0]==="-"?-BigInt(digits.slice(1)):BigInt(digits)})}newUnsignedInt64Expr(offset,digits){return this.newConstExpr(offset,{case:"uint64Value",value:BigInt(digits)})}newDoubleExpr(offset,digits){return this.newConstExpr(offset,{case:"doubleValue",value:parseFloat(digits)})}newNullExpr(offset){return this.newConstExpr(offset,{case:"nullValue",value:0})}newIdentExpr(offset,name){return this.nextExpr(offset,{case:"identExpr",value:{$typeName:"cel.expr.Expr.Ident",name}})}newInfixExpr(offset,op2,args){return this.newCallExpr(offset,op2==="in"?"@in":`_${op2}_`,args)}newSelectExpr(offset,operand,field2){return this.nextExpr(offset,{case:"selectExpr",value:{$typeName:"cel.expr.Expr.Select",operand,field:field2,testOnly:!1}})}newIndexExpr(offset,operand,index2){return this.newCallExpr(offset,"_[_]",[operand,index2])}expandHasMacro(offset,target){return target.exprKind.case!=="selectExpr"?this.newCallExpr(offset,"has",[target]):(target.exprKind.value.testOnly=!0,target)}newListExpr(offset,elements){return this.nextExpr(offset,{case:"listExpr",value:{$typeName:"cel.expr.Expr.CreateList",elements,optionalIndices:[]}})}newBoolMacro(offset,iterRange,iterVar,init,loopStep,loopCondition){return this.nextExpr(offset,{case:"comprehensionExpr",value:{$typeName:"cel.expr.Expr.Comprehension",accuVar:accuVarName,accuInit:this.newConstExpr(offset,{case:"boolValue",value:init}),iterVar,iterVar2:"",iterRange,loopStep,loopCondition,result:this.newIdentExpr(offset,accuVarName)}})}newListMacro(offset,iterRange,iterVar,loopStep){return this.nextExpr(offset,{case:"comprehensionExpr",value:{$typeName:"cel.expr.Expr.Comprehension",accuVar:accuVarName,accuInit:this.newListExpr(offset,[]),iterVar,iterVar2:"",iterRange,loopCondition:this.newConstExpr(offset,{case:"boolValue",value:!0}),loopStep,result:this.newIdentExpr(offset,accuVarName)}})}expandExistsMacro(offset,target,x2,test){return this.newBoolMacro(offset,target,x2,!1,this.newCallExpr(offset,"_||_",[this.newIdentExpr(offset,accuVarName),test]),this.newCallExpr(offset,"@not_strictly_false",[this.newCallExpr(offset,"!_",[this.newIdentExpr(offset,accuVarName)])]))}expandAllMacro(offset,target,x2,test){return this.newBoolMacro(offset,target,x2,!0,this.newCallExpr(offset,"_&&_",[this.newIdentExpr(offset,accuVarName),test]),this.newCallExpr(offset,"@not_strictly_false",[this.newIdentExpr(offset,accuVarName)]))}expandMapMacro(offset,target,x2,step){return this.newListMacro(offset,target,x2,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newListExpr(offset,[step])]))}expandMapFilterMacro(offset,target,x2,test,step){return this.newListMacro(offset,target,x2,this.newCallExpr(offset,"_?_:_",[test,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newListExpr(offset,[step])]),this.newIdentExpr(offset,accuVarName)]))}expandFilterMacro(offset,target,x2,step){return this.newListMacro(offset,target,x2,this.newCallExpr(offset,"_?_:_",[step,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newListExpr(offset,[this.newIdentExpr(offset,x2)])]),this.newIdentExpr(offset,accuVarName)]))}expandExistsOne(offset,iterRange,iterVar,step){return this.nextExpr(offset,{case:"comprehensionExpr",value:{$typeName:"cel.expr.Expr.Comprehension",accuVar:accuVarName,accuInit:this.newConstExpr(offset,{case:"int64Value",value:BigInt(0)}),iterVar,iterVar2:"",iterRange,loopCondition:this.newConstExpr(offset,{case:"boolValue",value:!0}),loopStep:this.newCallExpr(offset,"_?_:_",[step,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newConstExpr(offset,{case:"int64Value",value:BigInt(1)})]),this.newIdentExpr(offset,accuVarName)]),result:this.newCallExpr(offset,"_==_",[this.newIdentExpr(offset,accuVarName),this.newConstExpr(offset,{case:"int64Value",value:BigInt(1)})])}})}maybeExpand(offset,call){if(call.exprKind.case==="callExpr"){let callExpr=call.exprKind.value,varName=callExpr.args[0];if(varName!==void 0&&call.exprKind.value.target!==void 0&&varName.exprKind?.case==="identExpr"){if(callExpr.args.length===2)switch(callExpr.function){case"exists":return this.expandExistsMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"all":return this.expandAllMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"map":return this.expandMapMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"filter":return this.expandFilterMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"exists_one":case"existsOne":return this.expandExistsOne(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1])}if(callExpr.args.length===3&&callExpr.function=="map")return this.expandMapFilterMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1],call.exprKind.value.args[2])}}return call}newMapEntry(offset,key,value){return this.nextEntry(offset,{case:"mapKey",value:key},value)}newStructExpr(offset,entries,messageName=""){return this.nextExpr(offset,{case:"structExpr",value:{$typeName:"cel.expr.Expr.CreateStruct",entries,messageName}})}newStructEntry(offset,field2,value){return this.nextEntry(offset,{case:"fieldKey",value:field2},value)}};var runtime;(function(runtime2){class GrammarLocation{source;start;constructor(source,start){this.source=source,this.start=start}toString(){return String(this.source)}offset(loc){return{line:loc.line+this.start.line-1,column:loc.line===1?loc.column+this.start.column-1:loc.column,offset:loc.offset+this.start.offset}}static offsetStart(range2){return range2.source instanceof GrammarLocation?range2.source.offset(range2.start):range2.start}static offsetEnd(range2){return range2.source instanceof GrammarLocation?range2.source.offset(range2.end):range2.end}}runtime2.GrammarLocation=GrammarLocation;function padEnd(str2,targetLength,padString){return padString=padString||" ",str2.length>targetLength?str2:(targetLength-=str2.length,padString+=padString.repeat(targetLength),str2+padString.slice(0,targetLength))}runtime2.padEnd=padEnd;class ParseFailure{}runtime2.ParseFailure=ParseFailure;function isFailure(r5){return!r5.success}runtime2.isFailure=isFailure;function getLine2(input,offset){let line=1;for(let i6=0;i6<offset;i6++)input[i6]==="\r"?(input[i6+1]===`
 `&&i6++,line++):input[i6]===`
 `&&line++;return line}function getColumn(input,offset){let column=1;for(let i6=offset;i6>0&&![`
 `,"\r"].includes(input[i6-1]);i6--)column++;return column}function getLocation(source,input,start,remainder){return{source,start:{offset:input.length-start.length,line:getLine2(input,input.length-start.length),column:getColumn(input,input.length-start.length)},end:{offset:input.length-remainder.length,line:getLine2(input,input.length-remainder.length),column:getColumn(input,input.length-remainder.length)}}}runtime2.getLocation=getLocation;function getRange(source,input,start,remainder){return{source,start:input.length-start.length,end:input.length-remainder.length}}runtime2.getRange=getRange;function getText(start,remainder){return start.slice(0,remainder.length>0?-remainder.length:void 0)}runtime2.getText=getText})(runtime||(runtime={}));var ParseError=class _ParseError extends Error{rawMessage;location;constructor(message6,location,name="parse error"){super(_ParseError.#formatMessage(message6,location)),this.name=name,this.rawMessage=message6,this.location=location}static#formatMessage(message6,location){return`${location.source!==void 0?String(location.source):"<input>"}:${location.start.line}:${location.start.column}: `+message6}},ParseSyntaxError=class _ParseSyntaxError extends ParseError{expected;found;constructor(expected,found,location,name="syntax error"){super(_ParseSyntaxError.#formatMessage(expected,found),location,name),this.expected=expected,this.found=found}static#formatMessage(expected,found){function encode2(s2){return"'"+s2.replace(/[\\\x07\b\f\n\r\t\v']/g,match=>{switch(match){case"\\":return"\\\\";case"\x07":return"\\x07";case"\b":return"\\b";case"\f":return"\\f";case`
@@ -485,11 +485,11 @@ caused by: ${_Layerr.fullStack(cause)}`:err2.stack??""}static info(err2){assertE
 `);return}let root5=import_node_path10.default.resolve(basePath),filePath=import_node_path10.default.resolve(root5,key);if(filePath!==root5&&!filePath.startsWith(root5+import_node_path10.default.sep)){res.writeHead(404),res.end(`404 page not found
 `);return}let info;try{info=await(0,import_promises4.stat)(filePath)}catch{res.writeHead(404),res.end(`404 page not found
 `);return}if(!info.isFile()){res.writeHead(404),res.end(`404 page not found
-`);return}let headers2={"Content-Length":String(info.size)},downloadName=url.searchParams.get(LOCAL_DOWNLOAD_QUERY_PARAM)??"";if(downloadName!==""&&(headers2["Content-Disposition"]=contentDispositionAttachment(downloadName)),res.writeHead(200,headers2),req.method==="HEAD"){res.end();return}let stream=(0,import_node_fs6.createReadStream)(filePath);stream.on("error",error2=>{logger2.error("artifact file stream failed",{key,error:error2.message}),res.destroy()}),stream.pipe(res)}catch(error2){logger2.error("artifact file server request failed",{error:error2 instanceof Error?error2.message:String(error2)}),res.headersSent||res.writeHead(500),res.end()}}async function warnOnLegacyArtifactLayout(basePath,logger2){for(let sub of["attachments","artifacts"]){let legacy=import_node_path10.default.join(basePath,"artifacts",sub);try{if((await(0,import_promises4.stat)(legacy)).isDirectory()){logger2.warn("Detected artifacts under a pre-#285 layout at <base>/artifacts/*. The artifact root is now <base> itself. Move <base>/artifacts/* up into <base> (or set ARTIFACT_LOCAL_BASE_PATH to the old <base>/artifacts) so existing artifacts remain reachable.",{legacyDir:import_node_path10.default.join(basePath,"artifacts"),artifactRoot:basePath});return}}catch{}}}var file_ai_stigmer_agentic_channelapp_v1_command=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9jb21tYW5kLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MTKOBQobQ2hhbm5lbEFwcENvbW1hbmRDb250cm9sbGVyEmMKBWFwcGx5EiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcBosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAStQEKBmNyZWF0ZRIsLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAaLC5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwIk/CuBhLCB8QHiIMbWV0YWRhdGEub3JnKjd1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIGNoYW5uZWwgYXBwIGluIHRoaXMgb3JnYW5pemF0aW9uEp8BCgZ1cGRhdGUSLC5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwGiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcCI5wrgYNQgCEDAiC21ldGFkYXRhLmlkKiJ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGNoYW5uZWwgYXBwEqkBCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiOcK4GDUIAxAwIgtyZXNvdXJjZV9pZCoidW5hdXRob3JpemVkIHRvIGRlbGV0ZSBjaGFubmVsIGFwcBoEoP8rMGIGcHJvdG8z",[file_ai_stigmer_agentic_channelapp_v1_api,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelAppCommandController=serviceDesc(file_ai_stigmer_agentic_channelapp_v1_command,0);var file_ai_stigmer_agentic_channelapp_v1_io=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9pby5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEiTAoLQ2hhbm5lbEFwcHMSPQoHZW50cmllcxgBIAMoCzIsLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiMQoZTGlzdENoYW5uZWxBcHBzQnlPcmdJbnB1dBIUCgNvcmcYASABKAlCB7pIBHICEAFiBnByb3RvMw",[file_ai_stigmer_agentic_channelapp_v1_api,file_buf_validate_validate]),ChannelAppsSchema=messageDesc2(file_ai_stigmer_agentic_channelapp_v1_io,0);var file_ai_stigmer_agentic_channelapp_v1_query=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9xdWVyeS5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEy9gMKGUNoYW5uZWxBcHBRdWVyeUNvbnRyb2xsZXISlQEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcCIxwrgYLQgBEDAiBXZhbHVlKiB1bmF1dGhvcml6ZWQgdG8gdmlldyBjaGFubmVsIGFwcBJ6Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiBNC4GAESvgEKCWxpc3RCeU9yZxI7LmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkxpc3RDaGFubmVsQXBwc0J5T3JnSW5wdXQaLS5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwcyJFwrgYQQgBEB4iA29yZyo2dW5hdXRob3JpemVkIHRvIGxpc3QgY2hhbm5lbCBhcHBzIGluIHRoaXMgb3JnYW5pemF0aW9uGgSg/yswYgZwcm90bzM",[file_ai_stigmer_agentic_channelapp_v1_api,file_ai_stigmer_agentic_channelapp_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelAppQueryController=serviceDesc(file_ai_stigmer_agentic_channelapp_v1_query,0);async function destroySecretBackingState(secretService,logger2,fields2,storedValues){for(let storedValue of storedValues)if(storedValue!=="")try{await secretService.delete(storedValue)}catch(error2){logger2.error("secret backing-state destruction failed after persist \u2014 external state may be orphaned",{...fields2,error:error2 instanceof Error?error2.message:String(error2)})}}function newDestroySecretBackingStateStep(secretService,logger2,extractSecretValues){return{name:"DestroySecretBackingState",async execute(ctx){let deleted=ctx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)return;let metadata=deleted.metadata;await destroySecretBackingState(secretService,logger2,{kind:getKindName(ctx.apiResourceKind),resourceId:metadata?.id??""},extractSecretValues(deleted))}}}var REDACTED_MARKER2="***REDACTED***";function plaintextRequiredMessage(fieldName){return`${fieldName} must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients`}function markerOnCreateMessage(fieldName){return`cannot use the redaction marker as ${fieldName} on create`}function noExistingSecretMessage(fieldName){return`cannot preserve ${fieldName}: no existing secret value found`}var PROVIDER_IMMUTABLE_MESSAGE="the provider of a channel app cannot be changed";function deleteBlockedByChannelMessage(org,slug,channelName){return`cannot delete ChannelApp '${org}/${slug}': referenced by agent channel '${channelName}'`}function redactChannelApp(app){let provider=app.spec?.providerConfig;switch(provider?.case){case"slack":redactSlack(provider.value);return;case"whatsapp":redactWhatsApp(provider.value);return;case void 0:return;default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}function redactSlack(slack){slack.clientSecret!==""&&(slack.clientSecret=REDACTED_MARKER2),slack.signingSecret!==""&&(slack.signingSecret=REDACTED_MARKER2)}function redactWhatsApp(whatsapp){whatsapp.appSecret!==""&&(whatsapp.appSecret=REDACTED_MARKER2),whatsapp.accessToken!==""&&(whatsapp.accessToken=REDACTED_MARKER2),whatsapp.verifyToken!==""&&(whatsapp.verifyToken=REDACTED_MARKER2)}function secretValuesOfChannelApp(app){let provider=app.spec?.providerConfig;switch(provider?.case){case"slack":return[provider.value.clientSecret,provider.value.signingSecret];case"whatsapp":return[provider.value.appSecret,provider.value.accessToken,provider.value.verifyToken];case void 0:return[];default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}function newEncryptChannelAppSecretsForCreateStep(secretService,logger2){return newEncryptChannelAppSecretsStep(secretService,logger2,!0)}function newEncryptChannelAppSecretsForUpdateStep(secretService,logger2){return newEncryptChannelAppSecretsStep(secretService,logger2,!1)}function newEncryptChannelAppSecretsStep(secretService,logger2,isCreate){async function resolveSecret(ctx,fieldName,requestValue,readExisting){if(requestValue==="")return requestValue;if(requestValue===REDACTED_MARKER2)return preserveExistingSecret2(ctx,fieldName,readExisting);if(isCiphertextShaped(requestValue))throw invalidArgumentError(plaintextRequiredMessage(fieldName));if(!secretService.isEnabled())return logger2.warn(`Encryption disabled: ${fieldName} will be stored in plaintext`),requestValue;try{return await secretService.encrypt(requestValue,EncryptionScope.forOrganization(ctx.newState.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt ${fieldName}`)}}function preserveExistingSecret2(ctx,fieldName,readExisting){if(isCreate)throw invalidArgumentError(markerOnCreateMessage(fieldName));let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not loaded"),`cannot preserve ${fieldName}: existing resource not loaded`);let existingSecret=readExisting(existing);if(existingSecret==="")throw invalidArgumentError(noExistingSecretMessage(fieldName));return existingSecret}return{name:"EncryptChannelAppSecrets",async execute(ctx){let provider=ctx.newState.spec?.providerConfig;switch(provider?.case){case"slack":{let slack=provider.value;slack.clientSecret=await resolveSecret(ctx,"client_secret",slack.clientSecret,existing=>existing.spec?.providerConfig.case==="slack"?existing.spec.providerConfig.value.clientSecret:""),slack.signingSecret=await resolveSecret(ctx,"signing_secret",slack.signingSecret,existing=>existing.spec?.providerConfig.case==="slack"?existing.spec.providerConfig.value.signingSecret:"");return}case"whatsapp":{let whatsapp=provider.value;whatsapp.appSecret=await resolveSecret(ctx,"app_secret",whatsapp.appSecret,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.appSecret:""),whatsapp.accessToken=await resolveSecret(ctx,"access_token",whatsapp.accessToken,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.accessToken:""),whatsapp.verifyToken=await resolveSecret(ctx,"verify_token",whatsapp.verifyToken,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.verifyToken:"");return}case void 0:return;default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}}}function newValidateProviderImmutableStep(){return{name:"ValidateProviderImmutable",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing channel app not found in context"),"existing channel app not found in context");let existingCase=existing.spec?.providerConfig.case,inputCase=ctx.input.spec?.providerConfig.case;if(existingCase!==inputCase)throw invalidArgumentError(PROVIDER_IMMUTABLE_MESSAGE)}}}function newCheckNoReferencingChannelsStep(store,logger2){return{name:"CheckNoReferencingChannels",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing ChannelApp not loaded in delete pipeline"),"existing ChannelApp not loaded in delete pipeline");let org=existing.metadata?.org??"",slug=existing.metadata?.slug??"",rows;try{rows=await store.listResources(ApiResourceKind.agent_channel)}catch(error2){throw internalError(error2,"failed to list agent channels for referential integrity check")}for(let bytes of rows){let channel;try{channel=fromBinary2(AgentChannelSchema,bytes)}catch{logger2.warn("Failed to unmarshal agent channel during referential integrity check, skipping");continue}let ref=channel.spec?.appRef;if(ref===void 0||ref.slug==="")continue;if((ref.org!==""?ref.org:channel.metadata?.org??"")===org&&ref.slug===slug)throw failedPreconditionError(deleteBlockedByChannelMessage(org,slug,channel.metadata?.name??""))}}}}function registerChannelAppServices(router,deps){router.service(ChannelAppCommandController,{apply:(app,ctx)=>apply6(deps,app,ctx),create:(app,ctx)=>createChannelApp(deps,app,ctx),update:(app,ctx)=>update9(deps,app,ctx),delete:(input,ctx)=>deleteChannelApp(deps,input,ctx)}),router.service(ChannelAppQueryController,{get:(id,ctx)=>get12(deps,id,ctx),getByReference:(ref,ctx)=>getByReference6(deps,ref,ctx),listByOrg:(req,ctx)=>listByOrg(deps,req,ctx)})}function kindOf11(ctx){return ctx.values.get(apiResourceKindKey)}async function createChannelApp(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));return await newPipeline("channelapp-create",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEncryptChannelAppSecretsForCreateStep(deps.secretService,deps.logger)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),redactChannelApp(reqCtx.newState),reqCtx.newState}async function update9(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));return await newPipeline("channelapp-update",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateProviderImmutableStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newEncryptChannelAppSecretsForUpdateStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).build().execute(reqCtx),redactChannelApp(reqCtx.newState),reqCtx.newState}async function apply6(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-apply",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createChannelApp(deps,app,ctx):update9(deps,withResolvedApplyId(ChannelAppSchema,app,reqCtx),ctx)}async function deleteChannelApp(deps,input,ctx){let reqCtx=new RequestContext(ChannelAppCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf11(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("channelapp-delete",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,ChannelAppSchema)).addStep(newCheckNoReferencingChannelsStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,secretValuesOfChannelApp)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted ChannelApp not found in context"),"deleted ChannelApp not found in context");let app=deleted;return redactChannelApp(app),app}async function get12(deps,id,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-get",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ChannelAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactChannelApp(app),app}async function getByReference6(deps,ref,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-get-by-reference",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ChannelAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactChannelApp(app),app}var LIST_RESULT_KEY4="listResult";async function listByOrg(deps,req,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.listByOrg.input,req,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-list-by-org",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgStep(deps.store,deps.logger)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY4);if(result===void 0)throw internalError(new Error("ChannelApp list not found in context"),"ChannelApp list not found in context");return result}function newListByOrgStep(store,logger2){return{name:"ListByOrg",async execute(ctx){let org=ctx.input.org,rows;try{rows=await store.listResources(ApiResourceKind.channel_app)}catch(error2){throw internalError(error2,"failed to list ChannelApps")}let apps=[];for(let bytes of rows){let app;try{app=fromBinary2(ChannelAppSchema,bytes)}catch{logger2.warn("Failed to unmarshal ChannelApp, skipping");continue}(app.metadata?.org??"")===org&&(redactChannelApp(app),apps.push(app))}apps.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY4,create2(ChannelAppsSchema,{entries:apps}))}}}var file_ai_stigmer_agentic_environment_v1_command=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvZW52aXJvbm1lbnQvdjEvY29tbWFuZC5wcm90bxIhYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxMoMKChxFbnZpcm9ubWVudENvbW1hbmRDb250cm9sbGVyEmcKBWFwcGx5Ei4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50Gi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50ErkBCgZjcmVhdGUSLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiT8K4GEsIDBAeIgxtZXRhZGF0YS5vcmcqN3VuYXV0aG9yaXplZCB0byBjcmVhdGUgZW52aXJvbm1lbnQgaW4gdGhpcyBvcmdhbml6YXRpb24SowEKBnVwZGF0ZRIuLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudBouLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudCI5wrgYNQgCEDUiC21ldGFkYXRhLmlkKiJ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGVudmlyb25tZW50Er8BChB1cGRhdGVWaXNpYmlsaXR5EjUuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlVwZGF0ZVZpc2liaWxpdHlJbnB1dBouLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudCJEwrgYQAgCEDUiC3Jlc291cmNlX2lkKi11bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGVudmlyb25tZW50IHZpc2liaWxpdHkSqwEKBmRlbGV0ZRI2LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZURlbGV0ZUlucHV0Gi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50IjnCuBg1CAIQNSILcmVzb3VyY2VfaWQqInVuYXV0aG9yaXplZCB0byBkZWxldGUgZW52aXJvbm1lbnQSzwEKD3VwZGF0ZVZhcmlhYmxlcxJELmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5VcGRhdGVFbnZpcm9ubWVudFZhcmlhYmxlc1JlcXVlc3QaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiRsK4GEIIAhA1Ig5lbnZpcm9ubWVudF9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBlbnZpcm9ubWVudCB2YXJpYWJsZXMSzwEKD3JlbW92ZVZhcmlhYmxlcxJELmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5SZW1vdmVFbnZpcm9ubWVudFZhcmlhYmxlc1JlcXVlc3QaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiRsK4GEIIAhA1Ig5lbnZpcm9ubWVudF9pZCosdW5hdXRob3JpemVkIHRvIHJlbW92ZSBlbnZpcm9ubWVudCB2YXJpYWJsZXMaBKD/KzViBnByb3RvMw",[file_ai_stigmer_agentic_environment_v1_api,file_ai_stigmer_agentic_environment_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EnvironmentCommandController=serviceDesc(file_ai_stigmer_agentic_environment_v1_command,0);var file_ai_stigmer_agentic_environment_v1_query=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvZW52aXJvbm1lbnQvdjEvcXVlcnkucHJvdG8SIWFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MTKMBQoaRW52aXJvbm1lbnRRdWVyeUNvbnRyb2xsZXISlgEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50IjDCuBgsCAEQNSIFdmFsdWUqH3VuYXV0aG9yaXplZCB0byBnZXQgZW52aXJvbm1lbnQSfAoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiBNC4GAES0gEKDmdldFNlY3JldFZhbHVlEj4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50U2VjcmV0VmFsdWVJbnB1dBozLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudFZhbHVlIkvCuBhHCBAQNSIOZW52aXJvbm1lbnRfaWQqMXVuYXV0aG9yaXplZCB0byByZWFkIHNlY3JldCB2YWx1ZXMgKGNyZWF0b3Itb25seSkSfAoEbGlzdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5MaXN0RW52aXJvbm1lbnRzUmVxdWVzdBoyLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudExpc3QiBNC4GAEaBKD/KzViBnByb3RvMw",[file_ai_stigmer_agentic_environment_v1_api,file_ai_stigmer_agentic_environment_v1_io,file_ai_stigmer_agentic_environment_v1_spec,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EnvironmentQueryController=serviceDesc(file_ai_stigmer_agentic_environment_v1_query,0);var PERSONAL_LABEL_KEY="stigmer.ai/personal",PERSONAL_LABEL_VALUE="true",MANAGED_LABEL_KEY="stigmer.ai/managed",MANAGED_LABEL_VALUE="true";function markerRejectionMessage(key){return`variable '${key}': cannot use the redaction marker as a secret value`}function forgedCiphertextMessage(key){return`variable '${key}' must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients`}function personalEnvironmentExistsMessage(existingId){return`a personal environment already exists for this organization: ${existingId}`}var PERSONAL_SHARE_RESTRICTION="personal environments cannot be shared with the organization - create a dedicated environment with only the credentials the agent needs",MANAGED_SHARE_RESTRICTION="OAuth-managed environments cannot be shared with the organization - OAuth tokens are per-user credentials";function redactEnvironmentSecrets(env2){let data=env2?.spec?.data;if(data!==void 0)for(let value of Object.values(data))value.isSecret&&value.value!==""&&(value.value=REDACTED_MARKER)}function shareRestrictionReason(metadata){let labels=metadata?.labels??{};return labels[PERSONAL_LABEL_KEY]===PERSONAL_LABEL_VALUE?PERSONAL_SHARE_RESTRICTION:labels[MANAGED_LABEL_KEY]===MANAGED_LABEL_VALUE?MANAGED_SHARE_RESTRICTION:""}var environmentSearchExtractor={kind:ApiResourceKind.environment,schema:EnvironmentSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let env2=resource;return buildSearchResult({kind:ApiResourceKind.environment,metadata:env2.metadata,summary:env2.spec?.description??"",score,createdAt:env2.status?.audit?.specAudit?.createdAt,updatedAt:env2.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let env2=resource,metadata=env2.metadata;if(metadata!==void 0)return{name:metadata.name,description:env2.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(env2.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var SECRET_VALUE_KEY="secretValue",UPDATED_ENVIRONMENT_KEY="updatedEnvironment";function newPreserveRedactedSecretsStep(){return{name:"PreserveRedactedSecrets",execute(ctx){let data=ctx.newState.spec?.data;if(data===void 0||Object.keys(data).length===0)return;let existingData=ctx.get(EXISTING_RESOURCE_KEY)?.spec?.data??{};for(let[key,value]of Object.entries(data))if(value.isSecret){if(value.value===REDACTED_MARKER){let existingEntry=existingData[key];if(existingEntry!==void 0&&existingEntry.isSecret){data[key]=existingEntry;continue}throw invalidArgumentError(markerRejectionMessage(key))}if(isCiphertextShaped(value.value))throw invalidArgumentError(forgedCiphertextMessage(key))}}}}function newEncryptSecretValuesStep(secretService,logger2){return{name:"EncryptSecretValues",async execute(ctx){let env2=ctx.newState,data=env2.spec?.data;if(!(data===void 0||Object.keys(data).length===0)){if(!secretService.isEnabled()){hasNonEmptySecret(data)&&logger2.warn("Encryption disabled: environment secret values will be stored in plaintext",{environmentId:env2.metadata?.id??""});return}for(let[key,value]of Object.entries(data))if(!(!value.isSecret||value.value===""))try{value.value=await secretService.encrypt(value.value,EncryptionScope.forOrganization(env2.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt secret value for variable '${key}'`)}}}}}function hasNonEmptySecret(data){return Object.values(data).some(v=>v.isSecret&&v.value!=="")}function newEnforcePersonalUniquenessStep(store){return{name:"EnforcePersonalEnvUniqueness",async execute(ctx){let metadata=ctx.newState.metadata;if(metadata===void 0||metadata.labels[PERSONAL_LABEL_KEY]!==PERSONAL_LABEL_VALUE)return;let existing;try{existing=await findResourceByLabelAndOrg(store,ctx.apiResourceKind,EnvironmentSchema,PERSONAL_LABEL_KEY,PERSONAL_LABEL_VALUE,metadata.org)}catch(error2){throw internalError(error2,"failed to check personal environment uniqueness")}if(existing!==void 0)throw new ConnectError(personalEnvironmentExistsMessage(existing.metadata?.id??""),Code.AlreadyExists)}}}function newLoadEnvironmentByIdStep(store){return{name:"LoadEnvironmentByID",async execute(ctx){let environmentId=ctx.input.environmentId;if(typeof environmentId!="string"||environmentId==="")throw invalidArgumentError("environment_id is required");let env2;try{env2=await store.getResource(ctx.apiResourceKind,environmentId,EnvironmentSchema)}catch{throw notFoundError("environment",environmentId)}ctx.set(TARGET_RESOURCE_KEY,env2)}}}function newExtractAndDecryptSingleKeyStep(secretService,logger2){return{name:"ExtractAndDecryptSingleKey",async execute(ctx){let key=ctx.input.key,env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");let envValue=env2.spec?.data[key];if(envValue===void 0)throw notFoundError("environment key",key);if(envValue.isSecret&&envValue.value!==""){let decrypted;try{decrypted=await secretService.decrypt(envValue.value)}catch(error2){throw logger2.error("Failed to decrypt secret value",{key,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to decrypt secret value")}ctx.set(SECRET_VALUE_KEY,create2(EnvironmentValueSchema,{value:decrypted,isSecret:!0,description:envValue.description}));return}ctx.set(SECRET_VALUE_KEY,envValue)}}}function newMergeVariablesAndPersistStep(store,secretService,logger2){return{name:"MergeVariablesAndPersist",async execute(ctx){let env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");env2.spec===void 0&&(env2.spec=create2(EnvironmentSpecSchema,{}));let incoming=ctx.input.variables;for(let[key,incomingValue]of Object.entries(incoming)){let value=incomingValue;if(value.isSecret&&value.value===REDACTED_MARKER){let existing=env2.spec.data[key];if(existing!==void 0&&existing.isSecret)continue;throw invalidArgumentError(markerRejectionMessage(key))}if(value.isSecret&&isCiphertextShaped(value.value))throw invalidArgumentError(forgedCiphertextMessage(key));if(value.isSecret&&value.value!=="")if(!secretService.isEnabled())logger2.warn("Encryption disabled: environment secret value will be stored in plaintext",{key});else{let encrypted;try{encrypted=await secretService.encrypt(value.value,EncryptionScope.forOrganization(env2.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt secret value for variable '${key}'`)}value=create2(EnvironmentValueSchema,{value:encrypted,isSecret:!0,description:value.description})}env2.spec.data[key]=value}try{setAuditFieldsForUpdate(EnvironmentSchema,env2,"spec_audit",ctx.callerIdentity)}catch(error2){throw internalError(error2,"failed to set audit fields")}try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to persist environment after merging variables")}ctx.set(UPDATED_ENVIRONMENT_KEY,env2)}}}function newRemoveVariableKeysAndPersistStep(store,secretService,logger2){return{name:"RemoveVariableKeysAndPersist",async execute(ctx){let env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");let keys=ctx.input.keys,removedSecretValues=[];if(env2.spec?.data!==void 0)for(let key of keys){let removed=env2.spec.data[key];removed!==void 0&&removed.isSecret&&removedSecretValues.push(removed.value),delete env2.spec.data[key]}try{setAuditFieldsForUpdate(EnvironmentSchema,env2,"spec_audit",ctx.callerIdentity)}catch(error2){throw internalError(error2,"failed to set audit fields")}try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to persist environment after removing variables")}await destroySecretBackingState(secretService,logger2,{kind:"environment",resourceId:env2.metadata?.id??"",operation:"removeVariables"},removedSecretValues),ctx.set(UPDATED_ENVIRONMENT_KEY,env2)}}}function newDestroyDroppedEnvironmentSecretsStep(secretService,logger2){return{name:"DestroyDroppedEnvironmentSecrets",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY),oldData=existing?.spec?.data;if(oldData===void 0)return;let newData=ctx.newState.spec?.data??{},droppedSecretValues=Object.entries(oldData).filter(([key,value])=>value.isSecret&&newData[key]===void 0).map(([,value])=>value.value);await destroySecretBackingState(secretService,logger2,{kind:"environment",resourceId:existing?.metadata?.id??"",operation:"update"},droppedSecretValues)}}}function secretValuesOfEnvironment(env2){return Object.values(env2.spec?.data??{}).filter(value=>value.isSecret).map(value=>value.value)}function registerEnvironmentServices(router,deps){router.service(EnvironmentCommandController,{apply:(env2,ctx)=>apply7(deps,env2,ctx),create:(env2,ctx)=>createEnvironment(deps,env2,ctx),update:(env2,ctx)=>update10(deps,env2,ctx),updateVisibility:(input,ctx)=>updateVisibility3(deps,input,ctx),delete:(input,ctx)=>deleteEnvironment(deps,input,ctx),updateVariables:(req,ctx)=>updateVariables(deps,req,ctx),removeVariables:(req,ctx)=>removeVariables(deps,req,ctx)}),router.service(EnvironmentQueryController,{get:(id,ctx)=>get13(deps,id,ctx),getByReference:(ref,ctx)=>getByReference7(deps,ref,ctx),getSecretValue:(input,ctx)=>getSecretValue(deps,input,ctx),list:(req,ctx)=>list7(deps,req,ctx)})}function kindOf12(ctx){return ctx.values.get(apiResourceKindKey)}async function createEnvironment(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-create",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEnforcePersonalUniquenessStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPreserveRedactedSecretsStep()).addStep(newEncryptSecretValuesStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,environmentSearchExtractor,deps.logger)).build().execute(reqCtx),redactEnvironmentSecrets(reqCtx.newState),reqCtx.newState}async function update10(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-update",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPreserveRedactedSecretsStep()).addStep(newEncryptSecretValuesStep(deps.secretService,deps.logger)).addStep(newNormalizeReferencesStep()).addStep(newPersistStep(deps.store)).addStep(newDestroyDroppedEnvironmentSecretsStep(deps.secretService,deps.logger)).addStep(newIndexSearchStep(deps.store,environmentSearchExtractor,deps.logger)).build().execute(reqCtx),redactEnvironmentSecrets(reqCtx.newState),reqCtx.newState}async function apply7(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-apply",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createEnvironment(deps,env2,ctx):update10(deps,withResolvedApplyId(EnvironmentSchema,env2,reqCtx),ctx)}async function deleteEnvironment(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf12(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("environment-delete",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,EnvironmentSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,secretValuesOfEnvironment)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted environment not found in context"),"deleted environment not found in context");let env2=deleted;return redactEnvironmentSecrets(env2),env2}var UPDATE_VISIBILITY_ENVIRONMENT_KEY="updateVisibilityEnvironment";async function updateVisibility3(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-update-visibility",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentForVisibilityUpdateStep(deps.store)).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_ENVIRONMENT_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newAuthorizeVisibilityTransitionStep(UPDATE_VISIBILITY_ENVIRONMENT_KEY,deps.authorizer)).addStep(newValidateEnvironmentShareRestrictionStep()).addStep(newSetEnvironmentVisibilityStep()).addStep(newPersistEnvironmentForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_ENVIRONMENT_KEY)).addStep(newIndexEnvironmentAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx);let env2=reqCtx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);return redactEnvironmentSecrets(env2),env2}function newLoadEnvironmentForVisibilityUpdateStep(store){return{name:"LoadEnvironmentForVisibilityUpdate",async execute(ctx){let input=ctx.input,env2;try{env2=await store.getResource(ctx.apiResourceKind,input.resourceId,EnvironmentSchema)}catch{throw notFoundError("environment",input.resourceId)}ctx.set(UPDATE_VISIBILITY_ENVIRONMENT_KEY,env2)}}}function newValidateEnvironmentShareRestrictionStep(){return{name:"ValidateEnvironmentShareRestriction",execute(ctx){if(ctx.input.visibility!==ApiResourceVisibility.visibility_org)return;let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY),reason=shareRestrictionReason(env2.metadata);if(reason!=="")throw failedPreconditionError(reason)}}}function newSetEnvironmentVisibilityStep(){return{name:"SetVisibility",execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);env2.metadata!==void 0&&(env2.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(EnvironmentSchema,env2,"status_audit",ctx.callerIdentity)}}}function newPersistEnvironmentForVisibilityUpdateStep(store){return{name:"PersistEnvironmentForVisibilityUpdate",async execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to save environment")}}}}function newIndexEnvironmentAfterVisibilityUpdateStep(store,logger2){return{name:"IndexEnvironmentAfterVisibilityUpdate",async execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY),entry=environmentSearchExtractor.getSearchIndexEntry(env2);if(entry===void 0){logger2.warn("IndexEnvironmentAfterVisibilityUpdate: extractor returned nil, skipping",{id:env2.metadata?.id??""});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,env2.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexEnvironmentAfterVisibilityUpdate: failed (best-effort)",{id:env2.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function updateVariables(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.updateVariables.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-update-variables",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.updateVariables,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newMergeVariablesAndPersistStep(deps.store,deps.secretService,deps.logger)).build().execute(reqCtx);let updated=reqCtx.get(UPDATED_ENVIRONMENT_KEY);return redactEnvironmentSecrets(updated),updated}async function removeVariables(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.removeVariables.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-remove-variables",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.removeVariables,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newRemoveVariableKeysAndPersistStep(deps.store,deps.secretService,deps.logger)).build().execute(reqCtx);let updated=reqCtx.get(UPDATED_ENVIRONMENT_KEY);return redactEnvironmentSecrets(updated),updated}async function get13(deps,id,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-get",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,EnvironmentSchema)).build().execute(reqCtx);let env2=reqCtx.get(TARGET_RESOURCE_KEY);return redactEnvironmentSecrets(env2),env2}async function getByReference7(deps,ref,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-get-by-reference",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,EnvironmentSchema)).build().execute(reqCtx);let env2=reqCtx.get(TARGET_RESOURCE_KEY);return redactEnvironmentSecrets(env2),env2}async function getSecretValue(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.getSecretValue.input,input,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-get-secret-value",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.getSecretValue,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newExtractAndDecryptSingleKeyStep(deps.secretService,deps.logger)).build().execute(reqCtx),reqCtx.get(SECRET_VALUE_KEY)}var LIST_RESULT_KEY5="listResult";async function list7(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-list",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgAndLabelsStep5(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY5);if(result===void 0)throw internalError(new Error("environment list not found in context"),"environment list not found in context");return result}function newListByOrgAndLabelsStep5(store,listReadScope){return{name:"ListByOrgAndLabels",async execute(ctx){let{org,labels:filterLabels}=ctx.input,rows;try{rows=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list environments")}let decoded=[];for(let bytes of rows)try{decoded.push(fromBinary2(EnvironmentSchema,bytes))}catch{continue}let requested=decoded.filter(env2=>(env2.metadata?.org??"")===org&&matchesAllLabels(env2.metadata?.labels??{},filterLabels)),environments=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.environment,requested,"");for(let env2 of environments)redactEnvironmentSecrets(env2);environments.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY5,create2(EnvironmentListSchema,{totalCount:environments.length,items:environments}))}}}var file_ai_stigmer_agentic_executioncontext_v1_command=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9jb21tYW5kLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MTKuAwohRXhlY3V0aW9uQ29udGV4dENvbW1hbmRDb250cm9sbGVyEnsKBWFwcGx5EjguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQSggEKBmNyZWF0ZRI4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQaOC5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0IgTQuBgBEoABCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQiBNC4GAEaBKD/KzZiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_api,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ExecutionContextCommandController=serviceDesc(file_ai_stigmer_agentic_executioncontext_v1_command,0);var file_ai_stigmer_agentic_executioncontext_v1_io=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9pby5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEiKwoSRXhlY3V0aW9uQ29udGV4dElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiQQogRXhlY3V0aW9uQ29udGV4dEV4ZWN1dGlvbklkSW5wdXQSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABYgZwcm90bzM",[file_buf_validate_validate]);var file_ai_stigmer_agentic_executioncontext_v1_query=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9xdWVyeS5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEy0wMKH0V4ZWN1dGlvbkNvbnRleHRRdWVyeUNvbnRyb2xsZXISgQEKA2dldBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHRJZBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQiBNC4GAEShgEKDmdldEJ5UmVmZXJlbmNlEjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlGjguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dCIE0LgYARKcAQoQZ2V0QnlFeGVjdXRpb25JZBJILmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHRFeGVjdXRpb25JZElucHV0GjguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dCIE0LgYARoEoP8rNmIGcHJvdG8z",[file_ai_stigmer_agentic_executioncontext_v1_api,file_ai_stigmer_agentic_executioncontext_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ExecutionContextQueryController=serviceDesc(file_ai_stigmer_agentic_executioncontext_v1_query,0);function redactExecutionContextSecrets(ec2){let data=ec2?.spec?.data;if(data!==void 0)for(let value of Object.values(data))value.isSecret&&value.value!==""&&(value.value=REDACTED_MARKER)}var import_node_crypto18=require("node:crypto"),CONNECT_EXECUTION_ID_PREFIX="connect-";function newConnectExecutionId(mcpServerId){return`${CONNECT_EXECUTION_ID_PREFIX}${mcpServerId}-${(0,import_node_crypto18.randomUUID)().slice(0,8)}`}function isConnectExecutionId(executionId){return executionId.startsWith(CONNECT_EXECUTION_ID_PREFIX)}function isTerminalWorkflowExecutionPhase(phase){switch(phase){case ExecutionPhase2.EXECUTION_COMPLETED:case ExecutionPhase2.EXECUTION_FAILED:case ExecutionPhase2.EXECUTION_CANCELLED:case ExecutionPhase2.EXECUTION_TERMINATED:return!0;default:return!1}}var RUNNER_VERIFIER_NAME="runner",RUNNER_CREDENTIAL_INVALID_MESSAGE="runner credential is not valid on this server",RUNNER_CREDENTIAL_NOT_LIVE_MESSAGE="runner credential names a run that is over or belongs to nobody this server recognizes",RUN_CREDENTIAL_NOT_RUNS_PERSON_MESSAGE="a run credential is minted only for the person whose run it is",WORKFLOW_LINEAGE_BINDING_MISMATCH_MESSAGE="workflow lineage label names a workflow execution this runner credential is not bound to",MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE="memory capture is scoped to the session's organization";function boundExecutionKindOf(executionId){switch(kindByIdPrefix(executionId)){case ApiResourceKind.agent_execution:return"agent-execution";case ApiResourceKind.workflow_execution:return"workflow-execution";default:return isConnectExecutionId(executionId)?"mcp-connect":void 0}}function bindsARun(kind){switch(kind){case"agent-execution":case"workflow-execution":return!0;case"mcp-connect":return!1;default:{let exhaustive=kind;throw new Error(`unknown bound execution kind ${String(exhaustive)}`)}}}async function loadBoundExecution(store,executionId,now=Date.now()){let kind=boundExecutionKindOf(executionId);if(kind!==void 0)switch(kind){case"agent-execution":{let row=await getRow(store,ApiResourceKind.agent_execution,executionId,AgentExecutionSchema);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(AgentExecutionSchema,row),sessionId:row.spec?.sessionId??"",live:isLive(row.status!==void 0&&isTerminalExecutionPhase(row.status.phase),row.status?.completedAt??"",now)}}case"workflow-execution":{let row=await getRow(store,ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(WorkflowExecutionSchema,row),sessionId:"",live:isLive(row.status!==void 0&&isTerminalWorkflowExecutionPhase(row.status.phase),row.status?.completedAt??"",now)}}case"mcp-connect":{let row=await getExecutionContextRow(store,executionId);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(ExecutionContextSchema,row),sessionId:"",live:!0}}default:{let exhaustive=kind;throw new Error(`unknown bound execution kind ${String(exhaustive)}`)}}}function isLive(terminal,completedAt,now){if(!terminal)return!0;let finishedAt=Date.parse(completedAt);return Number.isNaN(finishedAt)?!1:now-finishedAt<6e5}function creatorStampOf(schema2,row){return auditOf(schema2,row)?.specAudit?.createdBy?.id??""}async function getRow(store,kind,id,schema2){try{return await store.getResource(kind,id,schema2)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function getExecutionContextRow(store,executionId){try{return await store.findByField(ApiResourceKind.execution_context,"spec.executionId",executionId,ExecutionContextSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}function ciphertextShapedMessage(key){return`value for '${key}' looks like stored ciphertext (enc:v<N>: prefix); supply the plaintext value`}var ENCRYPT_BATCH_FAILURE_MESSAGE="failed to encrypt secret values";function encryptionKeyMissingMessage(executionId,key){return`execution context for ${executionId} holds encrypted secret '${key}' but no encryption key is configured`}async function resolveValuesForCaller(deps,ctx,ec2){if(await runnerMayDecrypt(deps,ctx,ec2)){await decryptSecretValues(deps,ec2);return}redactExecutionContextSecrets(ec2)}async function runnerMayDecrypt(deps,ctx,ec2){let authorizeRead=deps.runnerAuthService.authorizeExecutionContextRead?.bind(deps.runnerAuthService);if(authorizeRead!==void 0){let token2=bearerToken(ctx);if(token2==="")return!1;try{return await authorizeRead(token2,ec2.spec?.executionId??"")}catch(error2){return deps.logger.warn("ExecutionContext read authorization failed \u2014 redacting secrets",{error:error2 instanceof Error?error2.message:String(error2)}),!1}}let token=bearerToken(ctx),executionId=verifyRunnerToken(deps,token,ec2);return executionId===void 0?!1:!isClockedToken(token)&&!await runIsLive(deps,executionId)?(deps.logger.debug("Run credential presented for a run that is over - redacting execution context secrets",{executionId}),!1):(deps.logger.debug("Scope-bound runner token presented - decrypting execution context secrets",{executionId}),!0)}function verifyRunnerToken(deps,token,ec2){if(token==="")return;let tokenExecutionId;try{tokenExecutionId=deps.runnerAuthService.verify(TOKEN_TYPE_EXECUTION_SCOPED,token)}catch{deps.logger.debug("Presented runner token failed verification - redacting execution context secrets");return}if(tokenExecutionId!==(ec2.spec?.executionId??"")){deps.logger.warn("Runner token is not scope-bound to this execution context - redacting secrets",{tokenExecutionId,executionId:ec2.spec?.executionId??""});return}return tokenExecutionId}async function runIsLive(deps,executionId){try{let execution=await loadBoundExecution(deps.store,executionId);return execution!==void 0&&bindsARun(execution.kind)&&execution.live}catch(error2){throw internalError(error2,"failed to load the run credential's execution")}}function bearerToken(ctx){return parseBearerToken(ctx.requestHeader.get("authorization")??"")}async function decryptSecretValues(deps,ec2){let executionId=ec2.spec?.executionId??"",data=ec2.spec?.data??{};for(let[key,value]of Object.entries(data))if(!(!value.isSecret||!deps.secretService.isEncrypted(value.value)))try{value.value=await deps.secretService.decrypt(value.value)}catch(error2){if(error2 instanceof EncryptionUnavailableError)throw internalError(error2,encryptionKeyMissingMessage(executionId,key));deps.logger.warn("Undecryptable ciphertext in execution context \u2014 dropping this value from the runner read",{key,executionId,error:error2 instanceof Error?error2.message:String(error2)}),delete data[key]}}var executionContextSearchExtractor={kind:ApiResourceKind.execution_context,schema:ExecutionContextSchema,getSearchSummary(){return""},toSearchResult(resource,score){let ec2=resource;return buildSearchResult({kind:ApiResourceKind.execution_context,metadata:ec2.metadata,summary:"",score,createdAt:ec2.status?.audit?.specAudit?.createdAt,updatedAt:ec2.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let ec2=resource,metadata=ec2.metadata;if(metadata!==void 0)return{name:metadata.name,description:"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(ec2.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function newRejectCiphertextShapedStep(){return{name:"RejectCiphertextShapedValues",execute(ctx){let data=ctx.input.spec?.data??{};for(let[key,value]of Object.entries(data))if(isCiphertextShaped(value.value))throw invalidArgumentError(ciphertextShapedMessage(key))}}}function newEncryptSecretValuesStep2(secretService,logger2){return{name:"EncryptSecretValues",async execute(ctx){let ec2=ctx.newState,data=ec2.spec?.data;if(data===void 0||Object.keys(data).length===0)return;if(!secretService.isEnabled()){hasNonEmptySecret2(data)&&logger2.warn("Encryption disabled: execution context secret values will be stored in plaintext",{executionId:ec2.spec?.executionId??""});return}let toSeal=new Map;for(let[key,value]of Object.entries(data))!value.isSecret||value.value===""||toSeal.set(key,value.value);if(toSeal.size===0)return;let sealed;try{sealed=await secretService.encryptAllAtMostV2(toSeal,EncryptionScope.forOrganization(ec2.metadata?.org??""))}catch(error2){throw internalError(error2,ENCRYPT_BATCH_FAILURE_MESSAGE)}for(let[key,value]of Object.entries(data)){let sealedValue=sealed.get(key);sealedValue!==void 0&&(value.value=sealedValue)}}}}function hasNonEmptySecret2(data){return Object.values(data).some(v=>v.isSecret&&v.value!=="")}function newLoadByExecutionIdStep(store){return{name:"LoadByExecutionId",async execute(ctx){let input=ctx.input;if(input.executionId==="")throw invalidArgumentError("execution_id is required");let executionContext;try{executionContext=await store.findByField(ctx.apiResourceKind,"spec.executionId",input.executionId,ExecutionContextSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("execution_context",`execution_id=${input.executionId}`):internalError(error2,"failed to query execution context")}ctx.set(TARGET_RESOURCE_KEY,executionContext)}}}function newAuthorizeExecutionContextCreateStep(authorizer){return{name:"AuthorizeCreate",async execute(ctx){let caller=ctx.callerIdentity;if(caller.callerClass==="internal"||caller.origin==="in-process")return;let decision;try{decision=await authorizer.authorize(caller,{permission:IamPermission.can_create_execution_in,resourceKind:ApiResourceKind.organization,resourceId:ctx.newState.metadata?.org??""})}catch(error2){throw internalError(error2 instanceof Error?error2:new Error(String(error2)),"execution-context create authorization could not be completed")}switch(decision.kind){case"allow":return;case"deny":case"not-found":throw new ConnectError("unauthorized to create execution context in this organization",Code.PermissionDenied);case"unavailable":throw internalError(decision.cause,"execution-context create authorization could not be completed");default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),"execution-context create authorization could not be completed")}}}}}function registerExecutionContextServices(router,deps){router.service(ExecutionContextCommandController,{apply:(ec2,ctx)=>apply8(deps,ec2,ctx),create:(ec2,ctx)=>createExecutionContext(deps,ec2,ctx),delete:(input,ctx)=>deleteExecutionContext(deps,input,ctx)}),router.service(ExecutionContextQueryController,{get:(id,ctx)=>get14(deps,id,ctx),getByReference:(ref,ctx)=>getByReference8(deps,ref,ctx),getByExecutionId:(input,ctx)=>getByExecutionId(deps,input,ctx)})}function kindOf13(ctx){return ctx.values.get(apiResourceKindKey)}async function createExecutionContext(deps,ec2,ctx){let reqCtx=new RequestContext(ExecutionContextSchema,ec2,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("execution-context-create",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeExecutionContextCreateStep(deps.authorizer)).addStep(newValidateVisibilityStep()).addStep(newRejectCiphertextShapedStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newEncryptSecretValuesStep2(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,executionContextSearchExtractor,deps.logger)).build().execute(reqCtx),redactExecutionContextSecrets(reqCtx.newState),reqCtx.newState}async function apply8(deps,ec2,ctx){let reqCtx=new RequestContext(ExecutionContextSchema,ec2,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-apply",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");if(shouldCreate)return createExecutionContext(deps,ec2,ctx);throw deps.logger.warn("ExecutionContext already exists - UPDATE not supported",{slug:ec2.metadata?.name??"",id:ec2.metadata?.id??""}),alreadyExistsError("ExecutionContext",ec2.metadata?.name??"")}async function deleteExecutionContext(deps,input,ctx){let reqCtx=new RequestContext(ExecutionContextCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf13(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("execution-context-delete",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,ExecutionContextSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted execution context not found in context"),"deleted execution context not found in context");let ec2=deleted;return redactExecutionContextSecrets(ec2),ec2}async function get14(deps,id,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ExecutionContextSchema)).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return redactExecutionContextSecrets(ec2),ec2}async function getByReference8(deps,ref,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get-by-reference",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ExecutionContextSchema)).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return redactExecutionContextSecrets(ec2),ec2}async function getByExecutionId(deps,input,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.getByExecutionId.input,input,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get-by-execution-id",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.getByExecutionId,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByExecutionIdStep(deps.store)).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return await resolveValuesForCaller(deps,ctx,ec2),ec2}var import_node_crypto19=require("node:crypto");var file_ai_stigmer_platform_github_v1_service=fileDesc("CithaS9zdGlnbWVyL3BsYXRmb3JtL2dpdGh1Yi92MS9zZXJ2aWNlLnByb3RvEh1haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MSI8ChtHZXRPQXV0aEF1dGhvcml6ZVVybFJlcXVlc3QSHQoMcmVkaXJlY3RfdXJpGAEgASgJQge6SARyAhABIkQKHEdldE9BdXRoQXV0aG9yaXplVXJsUmVzcG9uc2USFQoNYXV0aG9yaXplX3VybBgBIAEoCRINCgVzdGF0ZRgCIAEoCSJoChhFeGNoYW5nZU9BdXRoQ29kZVJlcXVlc3QSFQoEY29kZRgBIAEoCUIHukgEcgIQARIWCgVzdGF0ZRgCIAEoCUIHukgEcgIQARIdCgxyZWRpcmVjdF91cmkYAyABKAlCB7pIBHICEAEiVAoZRXhjaGFuZ2VPQXV0aENvZGVSZXNwb25zZRIUCgxhY2Nlc3NfdG9rZW4YASABKAkSEgoKdG9rZW5fdHlwZRgCIAEoCRINCgVzY29wZRgDIAEoCTK2AgoNR2l0SHViU2VydmljZRKVAQoUZ2V0T0F1dGhBdXRob3JpemVVcmwSOi5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HZXRPQXV0aEF1dGhvcml6ZVVybFJlcXVlc3QaOy5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HZXRPQXV0aEF1dGhvcml6ZVVybFJlc3BvbnNlIgTQuBgBEowBChFleGNoYW5nZU9BdXRoQ29kZRI3LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkV4Y2hhbmdlT0F1dGhDb2RlUmVxdWVzdBo4LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkV4Y2hhbmdlT0F1dGhDb2RlUmVzcG9uc2UiBNC4GAFiBnByb3RvMw",[file_ai_stigmer_commons_rpc_method_options,file_buf_validate_validate]);var GetOAuthAuthorizeUrlResponseSchema=messageDesc2(file_ai_stigmer_platform_github_v1_service,1);var ExchangeOAuthCodeResponseSchema=messageDesc2(file_ai_stigmer_platform_github_v1_service,3),GitHubService=serviceDesc(file_ai_stigmer_platform_github_v1_service,0);var GITHUB_AUTHORIZE_URL="https://github.com/login/oauth/authorize",GITHUB_TOKEN_URL="https://github.com/login/oauth/access_token",OAUTH_SCOPES="repo,read:user",HTTP_TIMEOUT_MS=1e4;function registerGitHubServices(router,deps){router.service(GitHubService,{getOAuthAuthorizeUrl:req=>getOAuthAuthorizeUrl(deps,req),exchangeOAuthCode:req=>exchangeOAuthCode(deps,req)})}function getOAuthAuthorizeUrl(deps,req){if(deps.clientId==="")throw failedPreconditionError("GitHub OAuth is not configured (STIGMER_GITHUB_CLIENT_ID not set)");let state2;try{state2=(0,import_node_crypto19.randomBytes)(16).toString("hex")}catch(error2){throw deps.logger.error("failed to generate OAuth state",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to generate OAuth state")}let authorizeUrl=GITHUB_AUTHORIZE_URL+"?"+goUrlValuesEncode({client_id:deps.clientId,redirect_uri:req.redirectUri,scope:OAUTH_SCOPES,state:state2});return create2(GetOAuthAuthorizeUrlResponseSchema,{authorizeUrl,state:state2})}async function exchangeOAuthCode(deps,req){if(deps.clientId===""||deps.clientSecret==="")throw failedPreconditionError("GitHub OAuth is not configured");let body=goUrlValuesEncode({client_id:deps.clientId,client_secret:deps.clientSecret,code:req.code,redirect_uri:req.redirectUri}),fetchImpl=deps.fetchImpl??fetch,response;try{response=await fetchImpl(GITHUB_TOKEN_URL,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body,signal:AbortSignal.timeout(HTTP_TIMEOUT_MS)})}catch(error2){throw deps.logger.error("GitHub token exchange failed",{error:error2 instanceof Error?error2.message:String(error2)}),unavailableError("failed to reach GitHub for token exchange")}let raw;try{raw=await response.text()}catch(error2){throw deps.logger.error("failed to read GitHub token response",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to read GitHub response")}let tokenResponse;try{tokenResponse=JSON.parse(raw)}catch(error2){throw deps.logger.error("failed to parse GitHub token response",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to parse GitHub response")}if(tokenResponse.error!==void 0&&tokenResponse.error!=="")throw deps.logger.warn("GitHub OAuth error",{error:tokenResponse.error,description:tokenResponse.error_description??""}),invalidArgumentError(`GitHub OAuth error: ${tokenResponse.error_description??""}`);return create2(ExchangeOAuthCodeResponseSchema,{accessToken:tokenResponse.access_token??"",tokenType:tokenResponse.token_type??"",scope:tokenResponse.scope??""})}var file_ai_stigmer_agentic_memory_v1_io=fileDesc("CiVhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2lvLnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxIiEKCE1lbW9yeUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiYAoTTGlzdE1lbW9yaWVzUmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESMwoJcGFnZV9pbmZvGAIgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbyJWCgpNZW1vcnlMaXN0EhMKC3RvdGFsX2NvdW50GAEgASgFEjMKBWl0ZW1zGAIgAygLMiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnliBnByb3RvMw",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]),MemoryIdSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,0);var MemoryListSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,2);var file_ai_stigmer_agentic_memory_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEypQUKF01lbW9yeUNvbW1hbmRDb250cm9sbGVyEloKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5GiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnkiBNC4GAESigEKBnVwZGF0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5GiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnkiNMK4GDAIAhA5IgttZXRhZGF0YS5pZCoddW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtZW1vcnkShgEKBmRlbGV0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIuwrgYKggDEDkiBXZhbHVlKh11bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1lbW9yeRKIAQoHY29uZmlybRImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIvwrgYKwgCEDkiBXZhbHVlKh51bmF1dGhvcml6ZWQgdG8gY29uZmlybSBtZW1vcnkShgEKBnJlamVjdBImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIuwrgYKggCEDkiBXZhbHVlKh11bmF1dGhvcml6ZWQgdG8gcmVqZWN0IG1lbW9yeRoEoP8rOWIGcHJvdG8z",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryCommandController=serviceDesc(file_ai_stigmer_agentic_memory_v1_command,0);var file_ai_stigmer_agentic_memory_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxMosCChVNZW1vcnlRdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIrwrgYJwgBEDkiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IG1lbW9yeRJpCgRsaXN0EjEuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5MaXN0TWVtb3JpZXNSZXF1ZXN0GiguYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlMaXN0IgTQuBgBGgSg/ys5YgZwcm90bzM",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryQueryController=serviceDesc(file_ai_stigmer_agentic_memory_v1_query,0);var MEMORY_CAPTURE_CALLER_MESSAGE="memory can only be captured for a first-party human operator",MEMORY_CAPTURE_CREDENTIAL_KEY="memoryCaptureCredential";function newGuardMemoryCaptureStep(provider){return{name:"GuardMemoryCapture",async execute(ctx){let caller=ctx.callerIdentity;if(caller.callerClass==="internal"||caller.origin==="in-process")return;let decide=provider?.authorizeMemoryCapture;if(decide!==void 0){let org=metadataOf(ctx.newState)?.org??"",decision=await decide.call(provider,caller,org);switch(decision.verdict){case"admit":ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY,{subjectIdentityAccountId:decision.subjectIdentityAccountId,provedSessionId:decision.provedSessionId});return;case"refuse":throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied);case"no-opinion":break;default:{let exhaustive=decision;throw new Error(`unknown memory capture decision ${JSON.stringify(exhaustive)}`)}}}if(caller.callerClass==="machine"||carriesPlatformClientClaim(caller.rawToken))throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied)}}}function memoryCaptureCredentialOf(ctx){let payload=ctx.get(MEMORY_CAPTURE_CREDENTIAL_KEY);if(typeof payload=="object"&&payload!==null&&"subjectIdentityAccountId"in payload&&"provedSessionId"in payload)return payload}function carriesPlatformClientClaim(rawToken){let segments=rawToken.split(".");if(segments.length!==3)return!1;try{let payload=JSON.parse(Buffer.from(segments[1],"base64url").toString("utf8"));return typeof payload.platform_client_id=="string"&&payload.platform_client_id!==""}catch{return!1}}var MEMORY_FULL_MESSAGE="memory is full \u2014 review and delete existing memories";function memoryDisabledMessage(org){return`memory is not enabled for organization ${org} \u2014 an organization admin can enable it in organization preferences`}var MEMORY_CONFIRM_REJECTED_MESSAGE="memory was rejected \u2014 delete it and let the agent propose it again",MEMORY_REJECT_CONFIRMED_MESSAGE="memory was confirmed \u2014 delete it to stop it from being recalled",MEMORY_SUBJECT_IMMUTABLE_MESSAGE="spec.subject_identity_account_id is immutable \u2014 it is derived from the capturing credential at create",MEMORY_PROVENANCE_IMMUTABLE_MESSAGE="spec.provenance is immutable \u2014 it records where the fact came from";var LIST_RESULT_KEY6="listResult";function newResolveMemoryDefaultsStep(){return{name:"ResolveMemoryDefaults",execute(ctx){let memory=ctx.newState,metadata=memory.metadata;if((metadata?.org??"")==="")throw invalidArgumentError("metadata.org is required for a memory");if(metadata===void 0)throw internalError(new Error("metadata is nil"),"metadata is nil");metadata.id===""&&(metadata.id=generateId("mem")),metadata.name===""&&metadata.slug===""&&(metadata.name=metadata.id);let spec=memory.spec;if(spec===void 0)throw internalError(new Error("memory spec is nil"),"memory spec is nil");let captureCredential=memoryCaptureCredentialOf(ctx);spec.subjectIdentityAccountId=captureCredential?.subjectIdentityAccountId??"",spec.provenance!==void 0&&(spec.provenance.toolCallId=""),captureCredential!==void 0&&(spec.provenance===void 0&&(spec.provenance=create2(MemoryProvenanceSchema,{})),spec.provenance.sessionId=captureCredential.provedSessionId)}}}function newCheckMemoryEnablementStep(store){return{name:"CheckMemoryEnablement",async execute(ctx){let orgID=ctx.newState.metadata?.org??"",org;try{org=await store.getResource(ApiResourceKind.organization,orgID,OrganizationSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Organization",orgID):internalError(error2,"failed to load organization for memory enablement check")}if(org.spec?.preferences?.memoryEnabled!==!0)throw failedPreconditionError(memoryDisabledMessage(orgID))}}}function newCheckMemoryCapStep(store){return{name:"CheckMemoryCap",async execute(ctx){let newState=ctx.newState,org=newState.metadata?.org??"",subject=newState.spec?.subjectIdentityAccountId??"",rows;try{rows=await store.listResources(ApiResourceKind.memory)}catch(error2){throw internalError(error2,"failed to count memories for cap check")}let count=0;for(let bytes of rows){let existing=unmarshalMemory(bytes);existing!==void 0&&(existing.metadata?.org??"")===org&&(existing.spec?.subjectIdentityAccountId??"")===subject&&count++}if(count>=100)throw failedPreconditionError(MEMORY_FULL_MESSAGE)}}}function newInitializeMemoryLifecycleStep(){return{name:"InitializeMemoryLifecycle",execute(ctx){let memory=ctx.newState;memory.status===void 0&&(memory.status=create2(MemoryStatusSchema,{})),memory.status.lifecycleState=MemoryLifecycleState.lifecycle_state_proposed,memory.status.stateChangedAt=timestampNow()}}}function newValidateMemoryUpdateStep(){return{name:"ValidateMemoryUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing memory not found in context"),"existing memory not found in context");let newState=ctx.newState;if((newState.spec?.subjectIdentityAccountId??"")!==(existing.spec?.subjectIdentityAccountId??""))throw failedPreconditionError(MEMORY_SUBJECT_IMMUTABLE_MESSAGE);let newProvenance=newState.spec?.provenance,existingProvenance=existing.spec?.provenance;if(!(newProvenance===void 0||existingProvenance===void 0?newProvenance===existingProvenance:equals(MemoryProvenanceSchema,newProvenance,existingProvenance)))throw failedPreconditionError(MEMORY_PROVENANCE_IMMUTABLE_MESSAGE)}}}function newPersistMemoryUpdateStep(store){return{name:"PersistMemoryUpdate",async execute(ctx){let newState=ctx.newState,memoryId=newState.metadata?.id??"",live;try{live=await store.updateResource(ApiResourceKind.memory,memoryId,MemorySchema,row=>{row.apiVersion=newState.apiVersion,row.kind=newState.kind,row.metadata=newState.metadata,row.spec=newState.spec,newState.status?.audit!==void 0&&(row.status===void 0&&(row.status=create2(MemoryStatusSchema,{})),row.status.audit=newState.status.audit)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Memory",memoryId):internalError(error2,"failed to persist memory update")}ctx.setNewState(live)}}}function newTransitionMemoryLifecycleStep(store,target,blockedMessage){return{name:"TransitionMemoryLifecycle",async execute(ctx){let memoryId=ctx.get(EXISTING_RESOURCE_KEY).metadata?.id??"",transitionNoOp=new Error("memory already in target state"),blocked,live;try{live=await store.updateResource(ApiResourceKind.memory,memoryId,MemorySchema,row=>{live=row;let current=row.status?.lifecycleState??MemoryLifecycleState.lifecycle_state_unspecified;if(current===target)throw transitionNoOp;if(current!==MemoryLifecycleState.lifecycle_state_proposed&&current!==MemoryLifecycleState.lifecycle_state_unspecified)throw blocked=failedPreconditionError(blockedMessage),blocked;row.status===void 0&&(row.status=create2(MemoryStatusSchema,{})),row.status.lifecycleState=target,row.status.stateChangedAt=timestampNow(),setAuditFieldsForUpdate(MemorySchema,row,"status_audit",ctx.callerIdentity)})}catch(error2){if(error2!==transitionNoOp)throw blocked!==void 0&&error2===blocked?blocked:error2 instanceof ResourceNotFoundError?notFoundError("Memory",memoryId):internalError(error2,"failed to transition memory lifecycle")}if(live===void 0)throw internalError(new Error("transition closure did not observe the row"),"failed to transition memory lifecycle");ctx.set(EXISTING_RESOURCE_KEY,live)}}}function newListMemoriesByOrgStep(store,listReadScope){return{name:"ListMemoriesByOrg",async execute(ctx){let org=ctx.input.org,rows;try{rows=await store.listResources(ApiResourceKind.memory)}catch(error2){throw internalError(error2,"failed to list memories")}let decoded=[];for(let bytes of rows){let memory=unmarshalMemory(bytes);memory!==void 0&&decoded.push(memory)}let memories=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.memory,decoded.filter(memory=>(memory.metadata?.org??"")===org),"");memories.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY6,create2(MemoryListSchema,{totalCount:memories.length,items:memories}))}}}function unmarshalMemory(data){try{return fromBinary2(MemorySchema,data)}catch{return}}function registerMemoryServices(router,deps){router.service(MemoryCommandController,{create:(memory,ctx)=>createMemory(deps,memory,ctx),update:(memory,ctx)=>update11(deps,memory,ctx),delete:(id,ctx)=>deleteMemory(deps,id,ctx),confirm:(id,ctx)=>confirm(deps,id,ctx),reject:(id,ctx)=>reject(deps,id,ctx)}),router.service(MemoryQueryController,{get:(id,ctx)=>get15(deps,id,ctx),list:(req,ctx)=>list8(deps,req,ctx)})}function kindOf14(ctx){return ctx.values.get(apiResourceKindKey)}async function createMemory(deps,memory,ctx){let reqCtx=new RequestContext(MemorySchema,memory,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("memory-create",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider)).addStep(newValidateVisibilityStep()).addStep(newResolveMemoryDefaultsStep()).addStep(newCheckMemoryEnablementStep(deps.store)).addStep(newCheckMemoryCapStep(deps.store)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newInitializeMemoryLifecycleStep()).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update11(deps,memory,ctx){let reqCtx=new RequestContext(MemorySchema,memory,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("memory-update",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateMemoryUpdateStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistMemoryUpdateStep(deps.store)).build().execute(reqCtx),reqCtx.newState}async function confirm(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-confirm",MemoryCommandController.method.confirm,MemoryLifecycleState.lifecycle_state_confirmed,MEMORY_CONFIRM_REJECTED_MESSAGE)}async function reject(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-reject",MemoryCommandController.method.reject,MemoryLifecycleState.lifecycle_state_rejected,MEMORY_REJECT_CONFIRMED_MESSAGE)}async function runTransition(deps,memoryId,ctx,name,method,target,blockedMessage){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline(name,deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newTransitionMemoryLifecycleStep(deps.store,target,blockedMessage)).build().execute(reqCtx);let transitioned=reqCtx.get(EXISTING_RESOURCE_KEY);if(transitioned===void 0)throw internalError(new Error("transitioned memory not found in context"),"transitioned memory not found in context");return transitioned}async function deleteMemory(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-delete",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted memory not found in context"),"deleted memory not found in context");return deleted}async function get15(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-get",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,MemorySchema)).build().execute(reqCtx);let target=reqCtx.get(TARGET_RESOURCE_KEY);if(target===void 0)throw internalError(new Error("target memory not found in context"),"target memory not found in context");return target}async function list8(deps,req,ctx){let reqCtx=new RequestContext(MemoryQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-list",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListMemoriesByOrgStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY6);if(result===void 0)throw internalError(new Error("memory list not found in context"),"memory list not found in context");return result}var file_ai_stigmer_iam_oauthapp_v1_command=fileDesc("CihhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9jb21tYW5kLnByb3RvEhphaS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MTLOBAoZT0F1dGhBcHBDb21tYW5kQ29udHJvbGxlchJTCgVhcHBseRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHASowEKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiTcK4GEkIFxAeIgxtZXRhZGF0YS5vcmcqNXVuYXV0aG9yaXplZCB0byBjcmVhdGUgb2F1dGggYXBwIGluIHRoaXMgb3JnYW5pemF0aW9uEo0BCgZ1cGRhdGUSJC5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5PQXV0aEFwcBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAIQFiILbWV0YWRhdGEuaWQqIHVuYXV0aG9yaXplZCB0byB1cGRhdGUgb2F1dGggYXBwEp8BCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAMQFiILcmVzb3VyY2VfaWQqIHVuYXV0aG9yaXplZCB0byBkZWxldGUgb2F1dGggYXBwGgSg/ysWYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api]),OAuthAppCommandController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_command,0);var file_ai_stigmer_iam_oauthapp_v1_io=fileDesc("CiNhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9pby5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEiJgoKT0F1dGhBcHBJZBIYCgV2YWx1ZRgBIAEoCUIJukgGcgQQARhAIkIKCU9BdXRoQXBwcxI1CgdlbnRyaWVzGAEgAygLMiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiLwoXTGlzdE9BdXRoQXBwc0J5T3JnSW5wdXQSFAoDb3JnGAEgASgJQge6SARyAhABYgZwcm90bzM",[file_ai_stigmer_iam_oauthapp_v1_api,file_buf_validate_validate]);var OAuthAppsSchema=messageDesc2(file_ai_stigmer_iam_oauthapp_v1_io,1);var file_ai_stigmer_iam_oauthapp_v1_query=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9xdWVyeS5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEy0AMKF09BdXRoQXBwUXVlcnlDb250cm9sbGVyEosBCgNnZXQSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIi/CuBgrCAEQFiIFdmFsdWUqHnVuYXV0aG9yaXplZCB0byB2aWV3IG9hdXRoIGFwcBJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIgTQuBgBEqwBCglsaXN0QnlPcmcSMy5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5MaXN0T0F1dGhBcHBzQnlPcmdJbnB1dBolLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwcyJDwrgYPwgBEB4iA29yZyo0dW5hdXRob3JpemVkIHRvIGxpc3Qgb2F1dGggYXBwcyBpbiB0aGlzIG9yZ2FuaXphdGlvbhoEoP8rFmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api,file_ai_stigmer_iam_oauthapp_v1_io]),OAuthAppQueryController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_query,0);var REDACTED_MARKER3="***REDACTED***",MARKER_ON_CREATE_MESSAGE="cannot use the redaction marker as client_secret on create",PRESERVE_NO_EXISTING_SECRET_MESSAGE="cannot preserve client_secret: no existing secret value found",CIPHERTEXT_SHAPED_SECRET_MESSAGE="client_secret must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients";function deleteBlockedByMcpServerMessage(org,slug,mcpServerName){return`cannot delete OAuthApp '${org}/${slug}': referenced by MCP server '${mcpServerName}'`}async function resolveOAuthAppRef(store,ref,logger2){if(ref.slug==="")return;let rows=await store.listResources(ApiResourceKind.oauth_app),slugMatches=[];for(let data of rows){let app;try{app=fromBinary2(OAuthAppSchema,data)}catch{continue}if((app.metadata?.slug??"")===ref.slug){if(ref.org!==""&&app.metadata?.org===ref.org)return app;slugMatches.push(app)}}if(slugMatches.length!==0){if(slugMatches.length===1)return slugMatches[0];logger2.warn("oauth_app_ref is ambiguous (slug exists in several orgs, none matching the ref); refusing to pick \u2014 pin the ref's org to resolve",{oauthAppSlug:ref.slug,refOrg:ref.org,candidateOrgs:slugMatches.map(app=>app.metadata?.org??"")})}}function redactOAuthApp(app){app.spec!==void 0&&app.spec.clientSecret!==""&&(app.spec.clientSecret=REDACTED_MARKER3)}function newEncryptClientSecretForCreateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!0)}function newEncryptClientSecretForUpdateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!1)}function newEncryptClientSecretStep(secretService,logger2,isCreate){return{name:"EncryptClientSecret",async execute(ctx){let app=ctx.newState;if(app.spec===void 0)return;let clientSecret=app.spec.clientSecret;if(clientSecret!==""){if(clientSecret===REDACTED_MARKER3){preserveExistingSecret(ctx,app,isCreate,logger2);return}if(isCiphertextShaped(clientSecret))throw invalidArgumentError(CIPHERTEXT_SHAPED_SECRET_MESSAGE);if(!secretService.isEnabled()){logger2.warn("encryption disabled: client_secret will be stored in plaintext");return}try{app.spec.clientSecret=await secretService.encrypt(clientSecret,EncryptionScope.forOrganization(app.metadata?.org??""))}catch(error2){throw internalError(error2,"failed to encrypt client_secret")}}}}}function preserveExistingSecret(ctx,app,isCreate,logger2){if(isCreate)throw invalidArgumentError(MARKER_ON_CREATE_MESSAGE);let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not loaded"),"cannot preserve client_secret: existing resource not loaded");let existingSecret=existing.spec?.clientSecret??"";if(existingSecret==="")throw invalidArgumentError(PRESERVE_NO_EXISTING_SECRET_MESSAGE);app.spec!==void 0&&(app.spec.clientSecret=existingSecret),logger2.debug("preserved existing encrypted client_secret",{oauthAppId:app.metadata?.id??""})}function newCheckNoReferencingMcpServersStep(store,logger2){return{name:"CheckNoReferencingMcpServers",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing OAuthApp missing from pipeline context"),"existing OAuthApp not loaded in delete pipeline");let resources;try{resources=await store.listResources(ApiResourceKind.mcp_server)}catch(error2){throw internalError(error2,"failed to list MCP servers for referential integrity check")}for(let data of resources){let mcp;try{mcp=fromBinary2(McpServerSchema,data)}catch(error2){logger2.warn("failed to unmarshal MCP server during referential integrity check, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}let ref=mcp.spec?.auth?.oauthAppRef;if(ref===void 0)continue;let resolved;try{resolved=await resolveOAuthAppRef(store,ref,logger2)}catch(error2){throw internalError(error2,"failed to resolve oauth_app_ref during referential integrity check")}if(resolved!==void 0&&(resolved.metadata?.id??"")===(existing.metadata?.id??""))throw failedPreconditionError(deleteBlockedByMcpServerMessage(existing.metadata?.org??"",existing.metadata?.slug??"",mcp.metadata?.name??""))}}}}function registerOAuthAppServices(router,deps){router.service(OAuthAppCommandController,{apply:(app,ctx)=>apply9(deps,app,ctx),create:(app,ctx)=>createOAuthApp(deps,app,ctx),update:(app,ctx)=>update12(deps,app,ctx),delete:(input,ctx)=>deleteOAuthApp(deps,input,ctx)}),router.service(OAuthAppQueryController,{get:(id,ctx)=>get16(deps,id,ctx),getByReference:(ref,ctx)=>getByReference9(deps,ref,ctx),listByOrg:(req,ctx)=>listByOrg2(deps,req,ctx)})}function kindOf15(ctx){return ctx.values.get(apiResourceKindKey)}async function createOAuthApp(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-create",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEncryptClientSecretForCreateStep(deps.secretService,deps.logger)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let result=reqCtx.newState;return redactOAuthApp(result),result}async function update12(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-update",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newEncryptClientSecretForUpdateStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).build().execute(reqCtx);let result=reqCtx.newState;return redactOAuthApp(result),result}async function apply9(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-apply",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOAuthApp(deps,app,ctx):update12(deps,withResolvedApplyId(OAuthAppSchema,app,reqCtx),ctx)}async function deleteOAuthApp(deps,input,ctx){let reqCtx=new RequestContext(OAuthAppCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf15(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("oauthapp-delete",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,OAuthAppSchema)).addStep(newCheckNoReferencingMcpServersStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,app=>app.spec===void 0?[]:[app.spec.clientSecret])).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted OAuthApp not found in context"),"deleted OAuthApp not found in context");return deleted}async function get16(deps,id,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-get",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OAuthAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}async function getByReference9(deps,ref,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-get-by-reference",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,OAuthAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}var LIST_RESULT_KEY7="listResult";async function listByOrg2(deps,req,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.listByOrg.input,req,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-list-by-org",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgStep2(deps.store,deps.logger)).build().execute(reqCtx);let list11=reqCtx.get(LIST_RESULT_KEY7);if(list11===void 0)throw internalError(new Error("list result missing from pipeline context"),"OAuthApp list not found in context");return list11}function newListByOrgStep2(store,logger2){return{name:"ListByOrg",async execute(ctx){let org=ctx.input.org,resources;try{resources=await store.listResources(ApiResourceKind.oauth_app)}catch(error2){throw internalError(error2,"failed to list OAuthApps")}let apps=[];for(let data of resources){let app;try{app=fromBinary2(OAuthAppSchema,data)}catch(error2){logger2.warn("failed to unmarshal OAuthApp, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}(app.metadata?.org??"")===org&&(redactOAuthApp(app),apps.push(app))}apps.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),logger2.info("listed OAuthApps by organization",{org,matchCount:apps.length}),ctx.set(LIST_RESULT_KEY7,create2(OAuthAppsSchema,{entries:apps}))}}}var file_ai_stigmer_tenancy_organization_v1_io=fileDesc("CithaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2lvLnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxIlIKDU9yZ2FuaXphdGlvbnMSQQoHZW50cmllcxgBIAMoCzIwLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uImoKEE9yZ2FuaXphdGlvbkxpc3QSEwoLdG90YWxfcGFnZXMYASABKAUSQQoHZW50cmllcxgCIAMoCzIwLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIioKDk9yZ2FuaXphdGlvbklkEhgKBXZhbHVlGAEgASgJQgm6SAZyBBABGEAimwEKGk9yZ2FuaXphdGlvbkV4dGVybmFsTG9va3VwElsKFWlkZW50aXR5X3Byb3ZpZGVyX3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUIGukgDyAEBEiAKD2V4dGVybmFsX29yZ19pZBgCIAEoCUIHukgEcgIQAWIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_tenancy_organization_v1_api,file_buf_validate_validate]),OrganizationsSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,0),OrganizationListSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,1);var file_ai_stigmer_tenancy_organization_v1_command=fileDesc("CjBhaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2NvbW1hbmQucHJvdG8SImFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEy2AQKHU9yZ2FuaXphdGlvbkNvbW1hbmRDb250cm9sbGVyEmsKBWFwcGx5EjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24aMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhJyCgZjcmVhdGUSMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhowLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIgTQuBgBEqgBCgZ1cGRhdGUSMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhowLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIjrCuBg2CAIQHiILbWV0YWRhdGEuaWQqI3VuYXV0aG9yaXplZCB0byB1cGRhdGUgb3JnYW5pemF0aW9uEqQBCgZkZWxldGUSMi5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbklkGjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iNMK4GDAIAxAeIgV2YWx1ZSojdW5hdXRob3JpemVkIHRvIGRlbGV0ZSBvcmdhbml6YXRpb24aBKD/Kx5iBnByb3RvMw",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io]),OrganizationCommandController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_command,0);var file_ai_stigmer_tenancy_organization_v1_query=fileDesc("Ci5haS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL3F1ZXJ5LnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxMrkEChtPcmdhbml6YXRpb25RdWVyeUNvbnRyb2xsZXISnwEKA2dldBIyLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uSWQaMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbiIywrgYLggBEB4iBXZhbHVlKiF1bmF1dGhvcml6ZWQgdG8gdmlldyBvcmdhbml6YXRpb24SewoEZmluZBI3LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5GaW5kQXBpUmVzb3VyY2VzUmVxdWVzdBo0LmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uTGlzdCIE0LgYARJmChNmaW5kTXlPcmdhbml6YXRpb25zEhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5GjEuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb25zIgTQuBgBEowBChJnZXRCeUV4dGVybmFsT3JnSWQSPi5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbkV4dGVybmFsTG9va3VwGjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iBNC4GAEaBKD/Kx5iBnByb3RvMw",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io,file_google_protobuf_empty]),OrganizationQueryController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_query,0);var organizationSearchExtractor={kind:ApiResourceKind.organization,schema:OrganizationSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let org=resource;return buildSearchResult({kind:ApiResourceKind.organization,metadata:org.metadata,summary:org.spec?.description??"",score,createdAt:org.status?.audit?.specAudit?.createdAt,updatedAt:org.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let org=resource,metadata=org.metadata;if(metadata!==void 0)return{name:metadata.name,description:org.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(org.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function newCheckOrgDuplicateStep(store){return{name:"CheckDuplicate",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("organization metadata is nil"),"duplicate check");if(metadata.slug==="")throw internalError(new Error("organization slug is empty"),"duplicate check");try{await store.getResource(ctx.apiResourceKind,metadata.slug,OrganizationSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw internalError(error2,"failed to check for duplicate organization")}throw alreadyExistsError("Organization",`slug '${metadata.slug}'`)}}}function newCopySlugToIdStep(){return{name:"CopySlugToId",execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("organization metadata is nil"),"copy slug to id");if(metadata.slug==="")throw internalError(new Error("organization slug is empty"),"copy slug to id");metadata.id=metadata.slug}}}function registerOrganizationServices(router,deps){router.service(OrganizationCommandController,{apply:(org,ctx)=>apply10(deps,org,ctx),create:(org,ctx)=>createOrganization(deps,org,ctx),update:(org,ctx)=>update13(deps,org,ctx),delete:(orgId,ctx)=>deleteOrganization(deps,orgId,ctx)});let externalLookup=deps.organizationDirectory?.getOrganizationIdByExternalOrgId?.bind(deps.organizationDirectory);router.service(OrganizationQueryController,{get:(orgId,ctx)=>get17(deps,orgId,ctx),find:(req,ctx)=>find(deps,req,ctx),findMyOrganizations:(_,ctx)=>findMyOrganizations(deps,ctx),...externalLookup===void 0?{}:{getByExternalOrgId:(lookup2,ctx)=>getByExternalOrgId(deps,externalLookup,lookup2,ctx)}})}function kindOf16(ctx){return ctx.values.get(apiResourceKindKey)}async function createOrganization(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf16(ctx)),builder2=newPipeline("organization-create",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckOrgDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newCopySlugToIdStep()).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger));for(let step of stepsForSlot(deps.gateSteps,"org-create:post-persist"))builder2.addStep(step);return await builder2.addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update13(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("organization-update",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply10(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("organization-apply",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOrganization(deps,org,ctx):update13(deps,withResolvedApplyId(OrganizationSchema,org,reqCtx),ctx)}async function deleteOrganization(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationCommandController.method.delete.input,orgId,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("organization-delete",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,OrganizationSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted organization not found in context"),"delete operation lost its loaded resource");return deleted}async function get17(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.get.input,orgId,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("organization-get",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OrganizationSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var FIND_RESULT_KEY="findResult";async function find(deps,req,ctx){if(deps.organizationDirectory?.refusesEnumeration===!0)throw new ConnectError("ai.stigmer.tenancy.organization.v1.OrganizationQueryController.find is not implemented",Code.Unimplemented);let reqCtx=new RequestContext(OrganizationQueryController.method.find.input,req,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("organization-find",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.find,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListAllOrganizationsStep(deps.store)).build().execute(reqCtx),reqCtx.get(FIND_RESULT_KEY)}function newListAllOrganizationsStep(store){return{name:"ListAllOrganizations",async execute(ctx){let data;try{data=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list organizations")}let orgs=[];for(let bytes of data)try{orgs.push(fromBinary2(OrganizationSchema,bytes))}catch{continue}let req=ctx.input,pageSize=req.pageSize,pageNumber=req.pageNumber;req.page!==void 0&&(req.page.size>0&&(pageSize=req.page.size),req.page.num>0&&(pageNumber=req.page.num)),pageSize<=0&&(pageSize=20),pageSize>100&&(pageSize=100),pageNumber<=0&&(pageNumber=1);let totalPages=Math.ceil(orgs.length/pageSize),start=(pageNumber-1)*pageSize,entries=start>=orgs.length?[]:orgs.slice(start,start+pageSize);ctx.set(FIND_RESULT_KEY,create2(OrganizationListSchema,{totalPages,entries}))}}}async function findMyOrganizations(deps,ctx){let directory=deps.organizationDirectory;if(directory!==void 0){let authorized=await directory.listMyOrganizationIds(callerIdentityOf(ctx));if(authorized!=="all"){let entries2=[];for(let id of authorized)try{entries2.push(await deps.store.getResource(ApiResourceKind.organization,id,OrganizationSchema))}catch(error2){if(error2 instanceof ResourceNotFoundError)continue;throw internalError(error2,"failed to list organizations")}return create2(OrganizationsSchema,{entries:entries2})}}let data;try{data=await deps.store.listResources(ApiResourceKind.organization)}catch(error2){throw internalError(error2,"failed to list organizations")}let entries=[];for(let bytes of data)try{entries.push(fromBinary2(OrganizationSchema,bytes))}catch{continue}return create2(OrganizationsSchema,{entries})}async function getByExternalOrgId(deps,lookup2,input,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.getByExternalOrgId.input,input,callerIdentityOf(ctx),kindOf16(ctx));if(await newPipeline("organization-get-by-external-org-id",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.getByExternalOrgId,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx),input.externalOrgId==="")throw invalidArgumentError("external_org_id is required");let orgId=await lookup2(input.externalOrgId);if(orgId===void 0)throw notFoundError("Organization",input.externalOrgId);try{return await deps.store.getResource(ApiResourceKind.organization,orgId,OrganizationSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Organization",input.externalOrgId):internalError(error2,"failed to load organization")}}var file_ai_stigmer_agentic_mcpserver_v1_io=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2lvLnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxIiQKC01jcFNlcnZlcklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiggIKDENvbm5lY3RJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESUgoLcnVudGltZV9lbnYYAiADKAsyPS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dC5SdW50aW1lRW52RW50cnkSFAoDb3JnGAMgASgJQge6SARyAhABGmkKD1J1bnRpbWVFbnZFbnRyeRILCgNrZXkYASABKAkSRQoFdmFsdWUYAiABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25WYWx1ZToCOAEiUAoZSW5pdGlhdGVPQXV0aENvbm5lY3RJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESFAoDb3JnGAIgASgJQge6SARyAhABIm0KGkluaXRpYXRlT0F1dGhDb25uZWN0T3V0cHV0EhkKEWF1dGhvcml6YXRpb25fdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEg4KBnNjb3BlcxgDIAMoCRIVCg1wcm92aWRlcl9uYW1lGAQgASgJIncKGUNvbXBsZXRlT0F1dGhDb25uZWN0SW5wdXQSHQoNbWNwX3NlcnZlcl9pZBgBIAEoCUIGukgDyAEBEiMKEmF1dGhvcml6YXRpb25fY29kZRgCIAEoCUIHukgEcgIQARIWCgVzdGF0ZRgDIAEoCUIHukgEcgIQASJkChpDb21wbGV0ZU9BdXRoQ29ubmVjdE91dHB1dBIRCgljb25uZWN0ZWQYASABKAgSFgoOdGFyZ2V0X2Vudl92YXIYAiABKAkSGwoTdG9rZW5fbGlmZXRpbWVfaGludBgDIAEoCSJNChhHZXRPQXV0aEdyYW50U3RhdHVzSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBARIUCgNvcmcYAiABKAlCB7pIBHICEAEizwEKGUdldE9BdXRoR3JhbnRTdGF0dXNPdXRwdXQSEQoJY29ubmVjdGVkGAEgASgIEh8KF2FjY2Vzc190b2tlbl9leHBpcmVzX2F0GAIgASgDEhYKDnRhcmdldF9lbnZfdmFyGAMgASgJEhMKC2F1dGhfbWV0aG9kGAQgASgJElEKEWNvbm5lY3Rpb25faGVhbHRoGAUgASgOMjYuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5PQXV0aENvbm5lY3Rpb25IZWFsdGgiSQoURGlzY29ubmVjdE9BdXRoSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBARIUCgNvcmcYAiABKAlCB7pIBHICEAEiLQoVRGlzY29ubmVjdE9BdXRoT3V0cHV0EhQKDGRpc2Nvbm5lY3RlZBgBIAEoCCKEAQoTU2V0T3JnT0F1dGhBcHBJbnB1dBIbCgtyZXNvdXJjZV9pZBgBIAEoCUIGukgDyAEBEhQKA29yZxgCIAEoCUIHukgEcgIQARIaCgljbGllbnRfaWQYAyABKAlCB7pIBHICEAESHgoNY2xpZW50X3NlY3JldBgEIAEoCUIHukgEcgIQASIsChRTZXRPcmdPQXV0aEFwcE91dHB1dBIUCgxvYXV0aF9hcHBfaWQYASABKAkiSAoTR2V0T3JnT0F1dGhBcHBJbnB1dBIbCgtyZXNvdXJjZV9pZBgBIAEoCUIGukgDyAEBEhQKA29yZxgCIAEoCUIHukgEcgIQASJVChRHZXRPcmdPQXV0aEFwcE91dHB1dBIUCgxoYXNfb3ZlcnJpZGUYASABKAgSFAoMb2F1dGhfYXBwX2lkGAIgASgJEhEKCWNsaWVudF9pZBgDIAEoCSJLChZEZWxldGVPcmdPQXV0aEFwcElucHV0EhsKC3Jlc291cmNlX2lkGAEgASgJQga6SAPIAQESFAoDb3JnGAIgASgJQge6SARyAhABIioKF0RlbGV0ZU9yZ09BdXRoQXBwT3V0cHV0Eg8KB2RlbGV0ZWQYASABKAgq7QEKFU9BdXRoQ29ubmVjdGlvbkhlYWx0aBInCiNPQVVUSF9DT05ORUNUSU9OX0hFQUxUSF9VTlNQRUNJRklFRBAAEiMKH09BVVRIX0NPTk5FQ1RJT05fSEVBTFRIX0hFQUxUSFkQARIpCiVPQVVUSF9DT05ORUNUSU9OX0hFQUxUSF9UT0tFTl9FWFBJUkVEEAISNQoxT0FVVEhfQ09OTkVDVElPTl9IRUFMVEhfVE9LRU5fRVhQSVJFRF9SRUZSRVNIQUJMRRADEiQKIE9BVVRIX0NPTk5FQ1RJT05fSEVBTFRIX05PX0dSQU5UEARiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_spec,file_buf_validate_validate]);var InitiateOAuthConnectOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,3);var CompleteOAuthConnectOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,5);var GetOAuthGrantStatusOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,7);var DisconnectOAuthOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,9);var OAuthConnectionHealth;(function(OAuthConnectionHealth2){OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_UNSPECIFIED=0]="OAUTH_CONNECTION_HEALTH_UNSPECIFIED",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_HEALTHY=1]="OAUTH_CONNECTION_HEALTH_HEALTHY",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED=2]="OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE=3]="OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_NO_GRANT=4]="OAUTH_CONNECTION_HEALTH_NO_GRANT"})(OAuthConnectionHealth||(OAuthConnectionHealth={}));var file_ai_stigmer_agentic_mcpserver_v1_command=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2NvbW1hbmQucHJvdG8SH2FpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEy0hAKGk1jcFNlcnZlckNvbW1hbmRDb250cm9sbGVyEl8KBWFwcGx5EiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchJmCgZjcmVhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBEpoBCgZ1cGRhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIjjCuBg0CAIQLCILbWV0YWRhdGEuaWQqIXVuYXV0aG9yaXplZCB0byB1cGRhdGUgbWNwIHNlcnZlchKmAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI4wrgYNAgDECwiC3Jlc291cmNlX2lkKiF1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1jcCBzZXJ2ZXISugEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiQ8K4GD8IAhAsIgtyZXNvdXJjZV9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtY3Agc2VydmVyIHZpc2liaWxpdHkSpAEKB2Nvbm5lY3QSLS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dBoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIj7CuBg6CBYQLCINbWNwX3NlcnZlcl9pZColdW5hdXRob3JpemVkIHRvIGNvbm5lY3QgdG8gbWNwIHNlcnZlchKpAQoMc3RhcnRDb25uZWN0Ei0uYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Db25uZWN0SW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI+wrgYOggWECwiDW1jcF9zZXJ2ZXJfaWQqJXVuYXV0aG9yaXplZCB0byBjb25uZWN0IHRvIG1jcCBzZXJ2ZXIS3wEKFGluaXRpYXRlT0F1dGhDb25uZWN0EjouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Jbml0aWF0ZU9BdXRoQ29ubmVjdElucHV0GjsuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Jbml0aWF0ZU9BdXRoQ29ubmVjdE91dHB1dCJOwrgYSggWECwiDW1jcF9zZXJ2ZXJfaWQqNXVuYXV0aG9yaXplZCB0byBpbml0aWF0ZSBvYXV0aCBjb25uZWN0IGZvciBtY3Agc2VydmVyEt8BChRjb21wbGV0ZU9BdXRoQ29ubmVjdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuQ29tcGxldGVPQXV0aENvbm5lY3RJbnB1dBo7LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuQ29tcGxldGVPQXV0aENvbm5lY3RPdXRwdXQiTsK4GEoIFhAsIg1tY3Bfc2VydmVyX2lkKjV1bmF1dGhvcml6ZWQgdG8gY29tcGxldGUgb2F1dGggY29ubmVjdCBmb3IgbWNwIHNlcnZlchLIAQoPZGlzY29ubmVjdE9BdXRoEjUuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5EaXNjb25uZWN0T0F1dGhJbnB1dBo2LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuRGlzY29ubmVjdE9BdXRoT3V0cHV0IkbCuBhCCBYQLCILcmVzb3VyY2VfaWQqL3VuYXV0aG9yaXplZCB0byBkaXNjb25uZWN0IG9hdXRoIGZvciBtY3Agc2VydmVyErgBCg5zZXRPcmdPQXV0aEFwcBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU2V0T3JnT0F1dGhBcHBJbnB1dBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU2V0T3JnT0F1dGhBcHBPdXRwdXQiOcK4GDUIFxAeIgNvcmcqKnVuYXV0aG9yaXplZCB0byBzZXQgb3JnIG9hdXRoIGFwcCBvdmVycmlkZRLEAQoRZGVsZXRlT3JnT0F1dGhBcHASNy5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRlbGV0ZU9yZ09BdXRoQXBwSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRlbGV0ZU9yZ09BdXRoQXBwT3V0cHV0IjzCuBg4CBcQHiIDb3JnKi11bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG9yZyBvYXV0aCBhcHAgb3ZlcnJpZGUaBKD/KyxiBnByb3RvMw",[file_ai_stigmer_agentic_mcpserver_v1_api,file_ai_stigmer_agentic_mcpserver_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),McpServerCommandController=serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_command,0);var file_ai_stigmer_agentic_mcpserver_v1_query=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL3F1ZXJ5LnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxMssFChhNY3BTZXJ2ZXJRdWVyeUNvbnRyb2xsZXISkgEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiMMK4GCwIARAsIgV2YWx1ZSofdW5hdXRob3JpemVkIHRvIHZpZXcgbWNwIHNlcnZlchJ4Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBEtUBChNnZXRPQXV0aEdyYW50U3RhdHVzEjkuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5HZXRPQXV0aEdyYW50U3RhdHVzSW5wdXQaOi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkdldE9BdXRoR3JhbnRTdGF0dXNPdXRwdXQiR8K4GEMIARAsIgtyZXNvdXJjZV9pZCowdW5hdXRob3JpemVkIHRvIHZpZXcgb2F1dGggc3RhdHVzIGZvciBtY3Agc2VydmVyEsEBCg5nZXRPcmdPQXV0aEFwcBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuR2V0T3JnT0F1dGhBcHBJbnB1dBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuR2V0T3JnT0F1dGhBcHBPdXRwdXQiQsK4GD4IARAsIgtyZXNvdXJjZV9pZCordW5hdXRob3JpemVkIHRvIHZpZXcgb3JnIG9hdXRoIGFwcCBvdmVycmlkZRoEoP8rLGIGcHJvdG8z",[file_ai_stigmer_agentic_mcpserver_v1_api,file_ai_stigmer_agentic_mcpserver_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),McpServerQueryController=serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_query,0);async function completeOAuthConnect(deps,input,identity2){let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");let stateParam=input.state;if(stateParam==="")throw invalidArgumentError("state is required");let code=input.authorizationCode;if(code==="")throw invalidArgumentError("authorization_code is required");let pendingState;try{pendingState=await deps.pendingOAuthStates.getAndDelete(stateParam)}catch(error2){throw internalError(error2,"failed to load pending OAuth state")}if(pendingState===void 0)throw failedPreconditionError("no pending OAuth state found for the given state parameter (expired or already used)");if(pendingState.mcpServerId!==mcpServerId)throw failedPreconditionError("state parameter does not match the requested mcp_server_id");await authorizeDirect(McpServerCommandController.method.completeOAuthConnect,deps.authorizer,identity2,input,{resourceId:pendingState.mcpServerId});try{pendingState=await unsealPendingOAuthState(deps.secretService,pendingState)}catch(error2){throw deps.logger.error("Failed to decrypt pending OAuth state secrets",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to decrypt OAuth handshake secrets \u2014 please retry the connect flow")}let tokenResponse;try{tokenResponse=await exchangeCode(pendingState.tokenEndpoint,code,pendingState.redirectUri,pendingState.codeVerifier,pendingState.clientId,pendingState.clientSecret,pendingState.tokenAuthMethod)}catch(error2){throw unavailableError(`token exchange failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}let org=pendingState.org;org===""&&(org=mcpServer.metadata?.org??"");let managedEnvId=await resolveOrCreateManagedEnvironment(deps,pendingState.identityAccountId,mcpServerId,org,mcpServer.metadata?.name??"",identity2),tokenVars={[pendingState.targetEnvVar]:create2(EnvironmentValueSchema,{value:tokenResponse.accessToken,isSecret:!0})},refreshTokenEnvVar=`${pendingState.targetEnvVar}_REFRESH_TOKEN`;tokenResponse.refreshToken!==""&&(tokenVars[refreshTokenEnvVar]=create2(EnvironmentValueSchema,{value:tokenResponse.refreshToken,isSecret:!0}));try{await deps.managedEnv.updateSecrets(managedEnvId,tokenVars)}catch(error2){throw internalError(error2,"failed to store OAuth tokens in managed environment")}let expiresAt=0;tokenResponse.expiresIn>0&&(expiresAt=Math.floor(Date.now()/1e3)+tokenResponse.expiresIn);try{await deps.oauthGrants.upsert({identityAccountId:pendingState.identityAccountId,resourceId:mcpServerId,resourceKind:"mcp_server",orgId:org,accessTokenExpiresAt:expiresAt,clientId:pendingState.clientId,authMethod:pendingState.authMethod,tokenEndpoint:pendingState.tokenEndpoint,accessTokenEnvVar:pendingState.targetEnvVar,refreshTokenEnvVar,environmentId:managedEnvId,createdAt:0,updatedAt:0})}catch(error2){throw internalError(error2,"failed to create OAuth grant record")}let auth=mcpServer.spec?.auth;return deps.logger.info("OAuth Connect completed: tokens stored in managed environment",{mcp_server_id:mcpServerId,auth_method:pendingState.authMethod,target_env_var:pendingState.targetEnvVar,managed_env_id:managedEnvId,expires_at:expiresAt,has_refresh_token:tokenResponse.refreshToken!==""}),create2(CompleteOAuthConnectOutputSchema,{connected:!0,targetEnvVar:pendingState.targetEnvVar,tokenLifetimeHint:auth?.tokenLifetimeHint??""})}async function unsealPendingOAuthState(secretService,state2){let verifier;try{verifier=await secretService.decrypt(state2.codeVerifier)}catch(error2){throw new Error(`failed to decrypt code_verifier: ${error2 instanceof Error?error2.message:String(error2)}`)}let secret;try{secret=await secretService.decrypt(state2.clientSecret)}catch(error2){throw new Error(`failed to decrypt client_secret: ${error2 instanceof Error?error2.message:String(error2)}`)}return{...state2,codeVerifier:verifier,clientSecret:secret}}async function resolveOrCreateManagedEnvironment(deps,identityAccountId,mcpServerId,org,mcpServerName,caller){let existingGrant;try{existingGrant=await deps.oauthGrants.find(identityAccountId,mcpServerId,org)}catch(error2){deps.logger.warn("Failed to look up existing OAuth grant (non-fatal, will create new managed env)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}if(existingGrant!==void 0&&existingGrant.environmentId!=="")return deps.logger.info("Reusing existing managed environment for OAuth re-connect",{mcp_server_id:mcpServerId,environment_id:existingGrant.environmentId}),existingGrant.environmentId;let envName=`OAuth: ${mcpServerName}`;try{return await deps.managedEnv.createManagedEnvironment(envName,org,caller)}catch(error2){throw internalError(error2,"failed to create managed environment for OAuth tokens")}}async function resolveOAuthAppRef2(store,ref,logger2){let slug=ref?.slug??"";if(slug==="")return;let rows=await store.listResources(ApiResourceKind.oauth_app),slugMatches=[];for(let data of rows){let app;try{app=fromBinary2(OAuthAppSchema,data)}catch{continue}if((app.metadata?.slug??"")!==slug)continue;let refOrg=ref?.org??"";if(refOrg!==""&&app.metadata?.org===refOrg)return app;slugMatches.push(app)}if(slugMatches.length!==0){if(slugMatches.length===1)return slugMatches[0];logger2.warn("oauth_app_ref is ambiguous (slug exists in several orgs, none matching the ref); refusing to pick \u2014 pin the ref's org to resolve",{oauthAppSlug:slug,refOrg:ref?.org??"",candidateOrgs:slugMatches.map(app=>app.metadata?.org??"")})}}function convertToDiscoveredCapabilities(output){let capabilities=create2(DiscoveredCapabilitiesSchema,{lastDiscoveredAt:timestampNow()});for(let t of output.tools??[]){let tool=create2(DiscoveredToolSchema,{name:t.name??"",description:t.description??""});t.input_schema!==void 0&&(tool.inputSchema=t.input_schema),capabilities.tools.push(tool)}for(let rt of output.resource_templates??[])capabilities.resourceTemplates.push(create2(DiscoveredResourceTemplateSchema,{uriTemplate:rt.uri_template??"",name:rt.name??"",description:rt.description??"",mimeType:rt.mime_type??""}));return capabilities}function convertToToolApprovals(output){let approvals=[];for(let a5 of output.tool_approvals??[])a5.requires_approval!==!0||(a5.tool_name??"")===""||approvals.push(create2(ToolApprovalPolicySchema,{toolName:a5.tool_name,message:a5.message??"",fromDestructiveHint:a5.from_destructive_hint??!1}));return approvals}function setToolApprovalsFromConnect(status,output){let approvals=convertToToolApprovals(output);return approvals.length>0&&(status.toolApprovals=approvals),approvals.length}function settleConnectStatus(mcpStatus,workflowId,failure){let cs=mcpStatus.connectStatus;if(cs===void 0&&(cs=create2(ConnectStatusSchema),mcpStatus.connectStatus=cs),cs.workflowId=workflowId,cs.finishedAt=timestampNow(),cs.warning="",failure===void 0){cs.phase=ConnectPhase.succeeded,cs.failureCode="",cs.failureMessage="";return}cs.phase=ConnectPhase.failed,cs.failureCode=grpcCodeName(failure.code),cs.failureMessage=failure.rawMessage}async function persistConnectResult(store,mcpServerId,workflowId,output){let toolApprovalCount=0;return{persisted:await store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),mcpServer.status.discoveredCapabilities=convertToDiscoveredCapabilities(output),toolApprovalCount=setToolApprovalsFromConnect(mcpServer.status,output),settleConnectStatus(mcpServer.status,workflowId,void 0)}),toolApprovalCount}}async function persistConnectStarting(store,mcpServerId,workflowId,warning2){return store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),mcpServer.status.connectStatus=create2(ConnectStatusSchema,{phase:ConnectPhase.connecting,workflowId,startedAt:timestampNow(),warning:warning2})})}async function persistConnectFailure(store,logger2,mcpServerId,failure){try{await store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),settleConnectStatus(mcpServer.status,mcpServer.status.connectStatus?.workflowId??"",failure)})}catch(error2){if(error2 instanceof ResourceNotFoundError){logger2.info("Skipping connect failure persistence: MCP server deleted before connect settled",{mcp_server_id:mcpServerId});return}logger2.warn("Failed to record connect failure on connect_status (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}}var CONNECT_TIMEOUT={ms:42e4,goLabel:"7m0s"},ASYNC_CONNECT_TIMEOUT={ms:3600*1e3,goLabel:"1h0m0s"},BEST_EFFORT_CONNECT_GET_BUFFER_MS=15e3,PERSONAL_ENV_LABEL2="stigmer.ai/personal";async function connect(deps,input,identity2){let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError("connect is not available: Temporal not configured");let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");if(input.org==="")throw invalidArgumentError("org is required for connect");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.connect,deps.authorizer,identity2,input);let prepared=await prepareConnect(deps,mcpServer,input,identity2);try{let run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,prepared.workflowInput,CONNECT_TIMEOUT.ms)}catch(error2){throw deps.logger.error("Failed to start MCP connect workflow",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to start connect workflow")}if(!run.attached)try{await persistConnectStarting(deps.store,mcpServerId,run.workflowId,"")}catch(error2){deps.logger.warn("Failed to record CONNECTING on connect_status (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let outcome=await run.result(CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,CONNECT_TIMEOUT);throw await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure),failure}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){throw internalError(error2,"failed to save mcp server after connect")}return deps.logger.info("MCP server connect completed and stored",{mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount}),persisted}finally{prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId)}}async function prepareConnect(deps,mcpServer,input,identity2){let mcpServerId=mcpServer.metadata?.id??"",callerOrg=input.org;Object.keys(input.runtimeEnv).length===0&&await refreshOAuthTokenIfNeeded(deps,mcpServer,callerOrg);let executionId=newConnectExecutionId(mcpServerId),ecResourceId=await createConnectExecutionContext(deps,mcpServer,executionId,callerOrg,input.runtimeEnv,identity2),workflowInput={mcp_server_id:mcpServerId,...ecResourceId!==""?{execution_context_id:executionId}:{}};if(ecResourceId!==""&&deps.runnerAuth.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))try{let minted=deps.runnerAuth.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return{workflowInput:{...workflowInput,execution_context_token:minted.token},ecResourceId,executionId}}catch(error2){deps.logger.warn("Failed to mint connect EC token \u2014 discovery will read redacted credentials",{execution_id:executionId,error:error2 instanceof Error?error2.message:String(error2)})}return{workflowInput,ecResourceId,executionId}}async function createConnectExecutionContext(deps,mcpServer,executionId,callerOrg,runtimeEnv,caller){let ecData;if(Object.keys(runtimeEnv).length>0)ecData=runtimeEnv,deps.logger.info("Using runtime_env for connect ExecutionContext (one-time use)",{execution_id:executionId,runtime_env_count:Object.keys(runtimeEnv).length});else{let envDecls=mcpServer.spec?.env??{};if(Object.keys(envDecls).length===0)return deps.logger.debug("MCP server has no env declarations \u2014 skipping ExecutionContext creation",{execution_id:executionId}),"";let mcpServerId=mcpServer.metadata?.id??"",{oauthVars,remainingDecls}=await resolveOAuthVarsFromManagedEnv(deps,mcpServerId,callerOrg,envDecls),personalVars={};Object.keys(remainingDecls).length>0&&(personalVars=await resolveFromPersonalEnvironment(deps,callerOrg,remainingDecls)),ecData={...personalVars,...oauthVars},deps.logger.info("Resolved env vars for connect ExecutionContext",{execution_id:executionId,oauth_count:Object.keys(oauthVars).length,personal_count:Object.keys(personalVars).length})}if(Object.keys(ecData).length===0)return"";let created;try{created=await deps.executionContext.create(create2(ExecutionContextSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"ExecutionContext",metadata:{name:`exec-ctx-${executionId}`,org:callerOrg},spec:{executionId,data:ecData}}),caller)}catch(error2){throw internalError(error2,"failed to create connect ExecutionContext")}let resourceId=created.metadata?.id??"";return deps.logger.info("Created ephemeral ExecutionContext for MCP connect",{execution_context_id:resourceId,execution_id:executionId,data_entries:Object.keys(ecData).length}),resourceId}async function resolveOAuthVarsFromManagedEnv(deps,mcpServerId,org,envDecls){let grant;try{grant=await deps.oauthGrants.find("",mcpServerId,org)}catch{return{oauthVars:{},remainingDecls:envDecls}}if(grant===void 0||grant.environmentId==="")return{oauthVars:{},remainingDecls:envDecls};let oauthKey=grant.accessTokenEnvVar;if(!(oauthKey in envDecls))return{oauthVars:{},remainingDecls:envDecls};let tokenValue="";try{tokenValue=await deps.managedEnv.readSecretValue(grant.environmentId,oauthKey)}catch(error2){return deps.logger.warn("Failed to read OAuth token from managed environment \u2014 falling back to personal env",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId,error:error2 instanceof Error?error2.message:String(error2)}),{oauthVars:{},remainingDecls:envDecls}}if(tokenValue==="")return deps.logger.warn("Failed to read OAuth token from managed environment \u2014 falling back to personal env",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId}),{oauthVars:{},remainingDecls:envDecls};let remainingDecls={};for(let[k5,v]of Object.entries(envDecls))k5!==oauthKey&&(remainingDecls[k5]=v);return deps.logger.debug("Resolved OAuth token from managed environment",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId}),{oauthVars:{[oauthKey]:create2(ExecutionValueSchema,{value:tokenValue,isSecret:!0})},remainingDecls}}async function resolveFromPersonalEnvironment(deps,org,envDecls){let requiredKeys=[];for(let[k5,decl]of Object.entries(envDecls))decl.optional||requiredKeys.push(k5);let listResponse;try{listResponse=await deps.environmentReader.list({org,labels:{[PERSONAL_ENV_LABEL2]:"true"}})}catch(error2){throw internalError(error2,"failed to list personal environments")}if(listResponse.totalCount===0||listResponse.items.length===0){if(requiredKeys.length===0)return{};throw failedPreconditionError(`personal environment not found for org '${org}'; save required credentials first: [${requiredKeys.join(" ")}]`)}let personalEnv=listResponse.items[0],personalEnvId=personalEnv?.metadata?.id??"",storedKeys=new Set(Object.keys(personalEnv?.spec?.data??{})),result={},missing=[];for(let[key,decl]of Object.entries(envDecls)){if(!storedKeys.has(key)){if(decl.optional){deps.logger.debug("Optional env var not in personal environment \u2014 skipping",{key});continue}missing.push(key);continue}let secretValue;try{secretValue=await deps.environmentReader.getSecretValue({environmentId:personalEnvId,key})}catch(error2){if(deps.logger.warn("Failed to get secret value from personal environment",{key,personal_env_id:personalEnvId,error:error2 instanceof Error?error2.message:String(error2)}),decl.optional)continue;missing.push(key);continue}if(secretValue.value===""){if(decl.optional)continue;missing.push(key);continue}result[key]=create2(ExecutionValueSchema,{value:secretValue.value,isSecret:decl.isSecret})}if(missing.length>0)throw failedPreconditionError(`missing required credentials in personal environment: [${missing.join(" ")}]`);return result}async function deleteConnectExecutionContext(deps,resourceId,executionId){try{await deps.executionContext.delete({resourceId})}catch(error2){deps.logger.warn("Failed to delete connect ExecutionContext (non-fatal)",{resource_id:resourceId,execution_id:executionId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.debug("Deleted ephemeral connect ExecutionContext",{resource_id:resourceId,execution_id:executionId})}function mapConnectFailure(logger2,mcpServer,workflowId,failure,budget){let mcpServerId=mcpServer.metadata?.id??"";switch(logger2.error("MCP connect workflow failed",{workflow_id:workflowId,mcp_server_id:mcpServerId,failure_kind:failure.kind}),failure.kind){case"application":return failedPreconditionError(buildConnectFailureMessage(mcpServer,failure.message));case"timeout":return new ConnectError(`connect did not complete within the ${budget.goLabel} budget for MCP server '${mcpServerId}' \u2014 if this repeats, check that your runner is running and healthy`,Code.DeadlineExceeded);case"service-not-found":return unavailableError(`connect service temporarily unavailable for MCP server '${mcpServerId}'`);case"other":return new ConnectError(buildConnectFailureMessage(mcpServer,failure.message),Code.Internal);default:{let exhaustive=failure;throw new Error(`unhandled connect failure ${String(exhaustive)}`)}}}function buildConnectFailureMessage(mcpServer,cause){let name=mcpServer.metadata?.name??"";if(cause.includes("requires OAuth"))return cause;if(mcpServer.spec?.serverType.case==="stdio"){let slug=mcpServer.metadata?.slug??"";return`connect failed for MCP server '${name}': ${cause}. This is a stdio server launched by your local runner \u2014 verify the command is installed and its arguments and environment variables are correct. Preview discovery locally with: stigmer connect mcp-server ${slug} --dry-run`}return`connect failed for MCP server '${name}': ${cause}. Check that the server URL is reachable and your credentials are valid.`}async function refreshOAuthTokenIfNeeded(deps,mcpServer,callerOrg){if(mcpServer.spec?.auth===void 0)return;let mcpServerId=mcpServer.metadata?.id??"",grant;try{grant=await deps.oauthGrants.find("",mcpServerId,callerOrg)}catch(error2){deps.logger.warn("Failed to load OAuth grant for pre-flight check (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}if(grant===void 0)return;if(grant.environmentId===""){deps.logger.warn("OAuth grant has no managed environment ID \u2014 user must re-authenticate via OAuth Connect",{mcp_server_id:mcpServerId});return}let refreshTokenValue;try{refreshTokenValue=await deps.managedEnv.readSecretValue(grant.environmentId,grant.refreshTokenEnvVar)}catch(error2){deps.logger.debug("No refresh token found in managed environment (may not be OAuth-connected)",{mcp_server_id:mcpServerId,refresh_token_var:grant.refreshTokenEnvVar,managed_env_id:grant.environmentId,error:error2 instanceof Error?error2.message:String(error2)});return}let clientSecret="",tokenAuthMethod="";if(grant.authMethod==="vendor_oauth")try{({clientSecret,tokenAuthMethod}=await loadOAuthAppClientCredentials(deps,mcpServer))}catch(error2){deps.logger.warn("Failed to load OAuthApp client secret for refresh",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let result;try{result=await refreshTokenIfExpired(grant,refreshTokenValue,clientSecret,tokenAuthMethod,deps.logger)}catch(error2){throw failedPreconditionError(error2 instanceof Error?error2.message:String(error2))}if(!result.refreshed)return;let tokenVars={[grant.accessTokenEnvVar]:create2(EnvironmentValueSchema,{value:result.newAccessToken,isSecret:!0})};result.newRefreshToken!==refreshTokenValue&&(tokenVars[grant.refreshTokenEnvVar]=create2(EnvironmentValueSchema,{value:result.newRefreshToken,isSecret:!0}));try{await deps.managedEnv.updateSecrets(grant.environmentId,tokenVars)}catch(error2){throw internalError(error2,"failed to update refreshed tokens in managed environment")}try{await deps.oauthGrants.upsert({...grant,accessTokenExpiresAt:result.newExpiresAt})}catch(error2){deps.logger.warn("Failed to update OAuth grant after refresh (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}}async function loadOAuthAppClientCredentials(deps,mcpServer){let ref=mcpServer.spec?.auth?.oauthAppRef;if(ref===void 0||ref.slug==="")return{clientSecret:"",tokenAuthMethod:""};let app;try{app=await resolveOAuthAppRef2(deps.store,ref,deps.logger)}catch(error2){throw new Error(`failed to list oauth apps: ${error2 instanceof Error?error2.message:String(error2)}`)}if(app===void 0)throw new Error(`OAuthApp '${ref.slug}' not found`);let tokenAuthMethod=tokenAuthMethodFromSpec(app.spec?.tokenEndpointAuthMethod??TokenEndpointAuthMethod.UNSPECIFIED),secret=app.spec?.clientSecret??"";return deps.secretService.isEncrypted(secret)&&(secret=await deps.secretService.decrypt(secret)),{clientSecret:secret,tokenAuthMethod}}function tokenAuthMethodFromSpec(method){return method===TokenEndpointAuthMethod.CLIENT_SECRET_POST?TOKEN_AUTH_METHOD_POST:TOKEN_AUTH_METHOD_BASIC}async function startBestEffortConnect(deps,mcpServer){let engineState=deps.engineState();if(!engineState.connected)return;let envKeys=Object.keys(mcpServer.spec?.env??{}).length;if(envKeys>0){deps.logger.debug("Skipping best-effort auto-connect: MCP server has env declarations (requires manual connect)",{mcp_server_id:mcpServer.metadata?.id??"",env_keys:envKeys});return}let mcpServerId=mcpServer.metadata?.id??"",run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,{mcp_server_id:mcpServerId},CONNECT_TIMEOUT.ms)}catch(error2){deps.logger.warn("Failed to start best-effort connect workflow (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}if(!run.attached)try{await persistConnectStarting(deps.store,mcpServerId,run.workflowId,"")}catch(error2){deps.logger.warn("Failed to record CONNECTING for best-effort connect (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let outcome=await run.result(CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){deps.logger.warn("Best-effort connect workflow did not complete (non-fatal)",{workflow_id:run.workflowId,mcp_server_id:mcpServerId,failure_kind:outcome.failure.kind}),await persistConnectFailure(deps.store,deps.logger,mcpServerId,internalError(new Error(`connect run failed: ${outcome.failure.kind}`),"best-effort connect did not complete"));return}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){if(error2 instanceof ResourceNotFoundError){deps.logger.info("Skipping best-effort connect persistence: MCP server deleted before connect completed",{mcp_server_id:mcpServerId});return}deps.logger.warn("Failed to persist best-effort connect result (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.info("Best-effort auto-connect completed and stored",{workflow_id:run.workflowId,mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount})}async function disconnectOAuth(deps,input,identity2){let resourceId=input.resourceId;if(resourceId==="")throw invalidArgumentError("resource_id is required");let org=input.org;if(org==="")throw invalidArgumentError("org is required");await authorizeDirect(McpServerCommandController.method.disconnectOAuth,deps.authorizer,identity2,input);let grant;try{grant=await deps.oauthGrants.find("",resourceId,org)}catch(error2){throw internalError(error2,"failed to look up OAuth grant")}if(grant===void 0)return deps.logger.debug("No OAuth grant to disconnect",{resource_id:resourceId,org}),create2(DisconnectOAuthOutputSchema,{disconnected:!1});let envId=grant.environmentId;if(envId!=="")try{await deps.managedEnv.deleteManagedEnvironment(envId)}catch(error2){deps.logger.warn("Failed to delete managed environment \u2014 may already be deleted",{resource_id:resourceId,environment_id:envId,error:error2 instanceof Error?error2.message:String(error2)})}try{await deps.oauthGrants.delete("",resourceId,org)}catch(error2){throw internalError(error2,"failed to delete OAuth grant")}return deps.logger.info("OAuth connection disconnected",{resource_id:resourceId,org,env_deleted:envId!==""}),create2(DisconnectOAuthOutputSchema,{disconnected:!0})}async function getOAuthGrantStatus(deps,input,identity2){if(input.resourceId==="")throw invalidArgumentError("resource_id is required");if(input.org==="")throw invalidArgumentError("org is required");await authorizeDirect(McpServerQueryController.method.getOAuthGrantStatus,deps.authorizer,identity2,input);let grant;try{grant=await deps.oauthGrants.find("",input.resourceId,input.org)}catch(error2){throw internalError(error2,"failed to look up OAuth grant")}return grant===void 0?create2(GetOAuthGrantStatusOutputSchema,{connected:!1,connectionHealth:OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_NO_GRANT}):create2(GetOAuthGrantStatusOutputSchema,{connected:!0,accessTokenExpiresAt:BigInt(grant.accessTokenExpiresAt),targetEnvVar:grant.accessTokenEnvVar,authMethod:grant.authMethod,connectionHealth:evaluateHealth(grant)})}function evaluateHealth(grant){return grant.accessTokenExpiresAt===0?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY:Math.floor(Date.now()/1e3)<grant.accessTokenExpiresAt-REFRESH_EXPIRY_BUFFER_SECONDS?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY:grant.refreshTokenEnvVar!==""?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE:OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED}var import_node_crypto21=require("node:crypto");var import_node_crypto20=require("node:crypto");function generatePkce(){let verifier=(0,import_node_crypto20.randomBytes)(32).toString("base64url"),challenge=(0,import_node_crypto20.createHash)("sha256").update(verifier).digest().toString("base64url");return{codeVerifier:verifier,codeChallenge:challenge}}async function discoverAuthorizationServer(serverUrl,fetchImpl=fetch){let wellKnownUrl=buildWellKnownUrl(serverUrl),response;try{response=await fetchImpl(wellKnownUrl,{method:"GET",headers:{Accept:"application/json"},signal:AbortSignal.timeout(1e4)})}catch(error2){throw new Error(`discovery request to ${wellKnownUrl} failed: ${error2 instanceof Error?error2.message:String(error2)}`)}if(response.status!==200)throw await response.text(),new Error(`authorization server discovery failed: ${wellKnownUrl} returned HTTP ${response.status} (expected 200). This MCP server may not support the MCP Authorization specification`);let raw;try{raw=await response.json()}catch(error2){throw new Error(`failed to parse authorization server metadata: ${error2 instanceof Error?error2.message:String(error2)}`)}let metadata={issuer:raw.issuer??"",authorizationEndpoint:raw.authorization_endpoint??"",tokenEndpoint:raw.token_endpoint??"",registrationEndpoint:raw.registration_endpoint??"",scopesSupported:raw.scopes_supported??[],codeChallengeMethodsSupported:raw.code_challenge_methods_supported??[]};return validateMetadata(metadata,wellKnownUrl),metadata}function buildWellKnownUrl(serverUrl){let parsed;try{parsed=new URL(serverUrl)}catch(error2){throw new Error(`invalid server URL for discovery: ${error2 instanceof Error?error2.message:String(error2)}`)}let scheme=parsed.protocol.replace(/:$/,"");if(scheme!=="http"&&scheme!=="https")throw new Error(`invalid server URL for discovery: unsupported scheme "${scheme}": only http and https are supported`);if(parsed.host==="")throw new Error("invalid server URL for discovery: server URL has no host");return`${`${scheme}://${parsed.host}`.replace(/\/+$/,"")}/.well-known/oauth-authorization-server`}function validateMetadata(m3,sourceUrl){if(m3.authorizationEndpoint==="")throw new Error(`authorization server at ${sourceUrl} is missing authorization_endpoint`);if(m3.tokenEndpoint==="")throw new Error(`authorization server at ${sourceUrl} is missing token_endpoint`);if(m3.codeChallengeMethodsSupported.length>0&&!m3.codeChallengeMethodsSupported.includes("S256"))throw new Error(`authorization server at ${sourceUrl} does not support S256 PKCE (supports: [${m3.codeChallengeMethodsSupported.join(" ")}]). S256 is required by the MCP Authorization specification`)}var DCR_REQUEST_TIMEOUT_MS=15e3;async function registerClient(registrationEndpoint,redirectUri,clientName,fetchImpl=fetch){let requestBody=JSON.stringify({redirect_uris:[redirectUri],client_name:clientName,grant_types:["authorization_code"],response_types:["code"],token_endpoint_auth_method:"none"}),response;try{response=await fetchImpl(registrationEndpoint,{method:"POST",headers:{"Content-Type":"application/json",Accept:"application/json"},body:requestBody,signal:AbortSignal.timeout(DCR_REQUEST_TIMEOUT_MS)})}catch(error2){throw new Error(`DCR request to ${registrationEndpoint} failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let body=await response.text();if(response.status!==201&&response.status!==200)throw new Error(`DCR at ${registrationEndpoint} returned HTTP ${response.status}: ${truncateBody(body)}`);let raw;try{raw=JSON.parse(body)}catch(error2){throw new Error(`failed to parse DCR response: ${error2 instanceof Error?error2.message:String(error2)}`)}if((raw.client_id??"")==="")throw new Error(`DCR response from ${registrationEndpoint} is missing client_id`);return{clientId:raw.client_id,clientSecret:raw.client_secret??"",clientName:raw.client_name??"",tokenEndpointAuthMethod:raw.token_endpoint_auth_method??""}}var PREFLIGHT_REQUEST_TIMEOUT_MS=4e3,PREFLIGHT_BODY_READ_CAP=4096;async function preflightAuthorize(authorizationUrl,fetchImpl=fetch){let response=await fetchImpl(authorizationUrl,{method:"GET",redirect:"manual",signal:AbortSignal.timeout(PREFLIGHT_REQUEST_TIMEOUT_MS)});if(response.status!==400){await response.text().catch(()=>"");return}let body=(await response.text()).slice(0,PREFLIGHT_BODY_READ_CAP);return{statusCode:response.status,vendorDetail:extractVendorDetail(body),bodySnippet:truncateBody(body)}}function extractVendorDetail(body){let parsed;try{parsed=JSON.parse(body)}catch{return""}return(parsed.error_description??"")!==""?parsed.error_description:parsed.error??""}async function initiateOAuthConnect(deps,input,identity2){if(deps.oauthRedirectUri==="")throw failedPreconditionError("OAuth Connect is not configured: STIGMER_OAUTH_REDIRECT_URI is not set");let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.initiateOAuthConnect,deps.authorizer,identity2,input);let auth=mcpServer.spec?.auth;if(auth===void 0)throw failedPreconditionError(`MCP server '${mcpServerId}' does not have an auth block configured`);let pkcePair=generatePkce(),stateParam=generateState(),oauthAppRef=auth.oauthAppRef,isDcr=oauthAppRef===void 0||oauthAppRef.slug==="",result=isDcr?await initiateDcr(deps,mcpServer,pkcePair,stateParam):await initiateVendorOAuth(deps,mcpServer,pkcePair,stateParam),authMethod=isDcr?"mcp_oauth":"vendor_oauth",pendingState={state:stateParam,codeVerifier:pkcePair.codeVerifier,clientId:result.clientId,clientSecret:result.clientSecret,tokenEndpoint:result.tokenEndpoint,mcpServerId,identityAccountId:"",targetEnvVar:auth.targetEnvVar,authMethod,tokenAuthMethod:result.tokenAuthMethod,redirectUri:deps.oauthRedirectUri,org:input.org,createdAt:0},sealed;try{sealed=await sealPendingOAuthState(deps.secretService,deps.logger,pendingState)}catch(error2){throw internalError(error2,"failed to encrypt OAuth handshake secrets")}try{await deps.pendingOAuthStates.save(sealed)}catch(error2){throw internalError(error2,"failed to save pending OAuth state")}return deps.logger.info("Initiated OAuth Connect flow",{mcp_server_id:mcpServerId,auth_method:authMethod,provider:result.providerName}),create2(InitiateOAuthConnectOutputSchema,{authorizationUrl:result.authorizationUrl,state:stateParam,scopes:result.scopes,providerName:result.providerName})}async function initiateDcr(deps,mcpServer,pkcePair,stateParam){let serverUrl=mcpServer.spec?.auth?.discoveryUrl??"";if(serverUrl===""){let serverType=mcpServer.spec?.serverType;serverType?.case==="http"&&(serverUrl=serverType.value.url)}if(serverUrl==="")throw failedPreconditionError(`DCR requires a discoverable URL. MCP server '${mcpServer.metadata?.id??""}' has no http.url and no auth.discovery_url. Set auth.discovery_url for stdio servers, oauth_app_ref for vendor OAuth, or switch to HTTP transport`);let metadata;try{metadata=await discoverAuthorizationServer(serverUrl)}catch(error2){throw failedPreconditionError(`OAuth authorization server discovery failed for ${serverUrl}: ${error2 instanceof Error?error2.message:String(error2)}`)}if(metadata.registrationEndpoint==="")throw failedPreconditionError(`MCP server at ${serverUrl} does not advertise a registration_endpoint for DCR`);let clientName=`Stigmer (${mcpServer.metadata?.name??""})`,dcrResponse;try{dcrResponse=await registerClient(metadata.registrationEndpoint,deps.oauthRedirectUri,clientName)}catch(error2){throw failedPreconditionError(`DCR registration failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let scopes=mcpServer.spec?.auth?.scopeHints??[];scopes.length===0&&metadata.scopesSupported.length>0&&(scopes=metadata.scopesSupported);let authUrl=buildAuthorizationUrl(metadata.authorizationEndpoint,dcrResponse.clientId,deps.oauthRedirectUri,pkcePair.codeChallenge,stateParam,scopes,"scope"),rejection;try{rejection=await preflightAuthorize(authUrl)}catch(probeError){deps.logger.debug("authorize pre-flight probe inconclusive; proceeding",{mcp_server_id:mcpServer.metadata?.id??"",error:probeError instanceof Error?probeError.message:String(probeError)})}if(rejection!==void 0)throw deps.logger.warn("authorization endpoint rejected the sign-in request pre-flight",{status_code:rejection.statusCode,mcp_server_id:mcpServer.metadata?.id??"",body_snippet:rejection.bodySnippet}),failedPreconditionError(dcrRejectionMessage(mcpServer.metadata?.name??"",deps.oauthRedirectUri,rejection));return{authorizationUrl:authUrl,providerName:mcpServer.metadata?.name??"",scopes,clientId:dcrResponse.clientId,clientSecret:"",tokenEndpoint:metadata.tokenEndpoint,tokenAuthMethod:""}}async function initiateVendorOAuth(deps,mcpServer,pkcePair,stateParam){let ref=mcpServer.spec?.auth?.oauthAppRef,oauthApp;try{oauthApp=await resolveOAuthAppRef2(deps.store,ref,deps.logger)}catch(error2){throw internalError(error2,"failed to list oauth apps")}if(oauthApp===void 0)throw notFoundError("oauth_app",ref?.slug??"");let approvalStatus=oauthApp.spec?.vendorApprovalStatus;if(approvalStatus===VendorApprovalStatus.PENDING||approvalStatus===VendorApprovalStatus.REJECTED){let statusLabel=approvalStatus===VendorApprovalStatus.REJECTED?"rejected":"pending approval",alternative=mcpServer.spec?.auth?.oauthOnly?"This server only accepts OAuth sign-in; an org admin can configure your own OAuth app instead.":"Please enter a token manually instead.";throw failedPreconditionError(`OAuth sign-in is unavailable: the platform's OAuth app for '${oauthApp.spec?.provider??""}' is ${statusLabel} by the vendor. ${alternative}`)}let clientSecret=oauthApp.spec?.clientSecret??"";if(deps.secretService.isEncrypted(clientSecret))try{clientSecret=await deps.secretService.decrypt(clientSecret)}catch(error2){throw internalError(error2,"failed to decrypt OAuthApp client secret")}let scopes=oauthApp.spec?.scopes??[];return{authorizationUrl:buildAuthorizationUrl(oauthApp.spec?.authorizationUrl??"",oauthApp.spec?.clientId??"",deps.oauthRedirectUri,pkcePair.codeChallenge,stateParam,scopes,oauthApp.spec?.scopeParameterName??""),providerName:oauthApp.spec?.provider??"",scopes,clientId:oauthApp.spec?.clientId??"",clientSecret,tokenEndpoint:oauthApp.spec?.tokenUrl??"",tokenAuthMethod:tokenAuthMethodFromSpec(oauthApp.spec?.tokenEndpointAuthMethod??TokenEndpointAuthMethod.UNSPECIFIED)}}function buildAuthorizationUrl(authEndpoint,clientId,redirectUri,codeChallenge,state2,scopes,scopeParamName){let scopeParam=scopeParamName===""?"scope":scopeParamName,params=new URLSearchParams({response_type:"code",client_id:clientId,redirect_uri:redirectUri,code_challenge:codeChallenge,code_challenge_method:"S256",state:state2});scopes.length>0&&params.set(scopeParam,scopes.join(" ")),params.sort();let separator=authEndpoint.includes("?")?"&":"?";return authEndpoint+separator+params.toString()}function dcrRejectionMessage(providerName,redirectUri,rejection){let callbackHost=redirectUri;try{let parsed=new URL(redirectUri);parsed.host!==""&&(callbackHost=parsed.host)}catch{}let message6=`${providerName} rejected the sign-in request before showing a login page (HTTP ${rejection.statusCode}). The most common cause is a redirect-host allowlist: this deployment's OAuth callback host (${callbackHost}) is not on the provider's approved list. Self-hosted deployments with a localhost callback are typically unaffected.`;return rejection.vendorDetail!==""&&(message6+=" Provider detail: "+rejection.vendorDetail),message6}function generateState(){return(0,import_node_crypto21.randomBytes)(32).toString("base64url")}async function sealPendingOAuthState(secretService,logger2,state2){if(!secretService.isEnabled())return logger2.warn("Encryption disabled: pending OAuth state secrets will be stored in plaintext"),state2;let scope=EncryptionScope.forOrganization(state2.org),sealedVerifier;try{sealedVerifier=await secretService.encrypt(state2.codeVerifier,scope)}catch(error2){throw new Error(`failed to encrypt code_verifier: ${error2 instanceof Error?error2.message:String(error2)}`)}let sealedSecret=state2.clientSecret;if(state2.clientSecret!=="")try{sealedSecret=await secretService.encrypt(state2.clientSecret,scope)}catch(error2){throw new Error(`failed to encrypt client_secret: ${error2 instanceof Error?error2.message:String(error2)}`)}return{...state2,codeVerifier:sealedVerifier,clientSecret:sealedSecret}}var mcpServerSearchExtractor={kind:ApiResourceKind.mcp_server,schema:McpServerSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let mcpServer=resource;return buildSearchResult({kind:ApiResourceKind.mcp_server,metadata:mcpServer.metadata,summary:mcpServer.spec?.description??"",score,createdAt:mcpServer.status?.audit?.specAudit?.createdAt,updatedAt:mcpServer.status?.audit?.specAudit?.updatedAt,iconUrl:mcpServer.spec?.iconUrl??""})},getSearchIndexEntry(resource){let mcpServer=resource,metadata=mcpServer.metadata;if(metadata!==void 0)return{name:metadata.name,description:mcpServer.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(mcpServer.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var RUNNER_QUEUE_WARNING="no runner appears to be polling the task queue \u2014 the connect will wait for one to come up (start your local runner if it is not running)";async function startConnect(deps,input,identity2){let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError("connect is not available: Temporal not configured");let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");if(input.org==="")throw invalidArgumentError("org is required for connect");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.startConnect,deps.authorizer,identity2,input);let connectStatus=mcpServer.status?.connectStatus;if(connectStatus?.phase===ConnectPhase.connecting&&await engineState.engine.isConnectRunRunning(connectStatus.workflowId))return deps.logger.info("StartConnect attached to in-flight connect operation",{mcp_server_id:mcpServerId,workflow_id:connectStatus.workflowId}),mcpServer;let prepared=await prepareConnect(deps,mcpServer,input,identity2),warning2=await runnerQueueWarning(engineState.engine),run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,prepared.workflowInput,ASYNC_CONNECT_TIMEOUT.ms)}catch(error2){throw prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId),deps.logger.error("Failed to start MCP connect workflow",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to start connect workflow")}if(run.attached){prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId);try{return await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}}let persisted;try{persisted=await persistConnectStarting(deps.store,mcpServerId,run.workflowId,warning2)}catch(error2){throw detachSettle(deps,mcpServer,run,prepared),internalError(error2,"failed to record connect operation")}return detachSettle(deps,mcpServer,run,prepared),persisted}function detachSettle(deps,mcpServer,run,prepared){settleConnectAsync(deps,mcpServer,run,prepared.ecResourceId,prepared.executionId).catch(error2=>{deps.logger.warn("Async connect settle task failed unexpectedly",{mcp_server_id:mcpServer.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})})}async function settleConnectAsync(deps,mcpServer,run,ecResourceId,executionId){let mcpServerId=mcpServer.metadata?.id??"";try{let outcome=await run.result(ASYNC_CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,ASYNC_CONNECT_TIMEOUT);await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure);return}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){if(error2 instanceof ResourceNotFoundError){deps.logger.info("Skipping async connect persistence: MCP server deleted before connect completed",{mcp_server_id:mcpServerId});return}deps.logger.warn("Failed to persist async connect result",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.info("Async MCP server connect completed and stored",{workflow_id:run.workflowId,mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount})}finally{ecResourceId!==""&&await deleteConnectExecutionContext(deps,ecResourceId,executionId)}}async function runnerQueueWarning(engine){let hasPollers=await engine.hasRunnerQueuePollers();return hasPollers===void 0||hasPollers?"":RUNNER_QUEUE_WARNING}function newValidateDefaultEnabledToolsStep(){return{name:"ValidateDefaultEnabledTools",execute(ctx){let mcpServer=ctx.newState,requested=mcpServer.spec?.defaultEnabledTools??[];if(requested.length===0)return;let caps=mcpServer.status?.discoveredCapabilities;if(caps===void 0)return;let classification=classify(caps,requested);if(isValidClassification(classification))return;let problems=[];throw classification.unknown.length>0&&problems.push(`default_enabled_tools names tool(s) this server does not expose: ${quoteJoin(classification.unknown)}`),classification.resourceTemplates.length>0&&problems.push(`default_enabled_tools names resource template(s): ${quoteJoin(classification.resourceTemplates)} \u2014 resource templates are read-only data endpoints, not callable tools, and must not appear in default_enabled_tools`),invalidArgumentError(`MCP server '${mcpServer.metadata?.slug??""}': ${problems.join("; ")}. Discovered tools: ${quoteJoin(toolNames(caps))}. If the server's toolset changed, run 'stigmer connect' on it to refresh discovered capabilities.`)}}}function newEnrichOAuthStatusStep(store,logger2){return{name:"EnrichOAuthStatus",async execute(ctx){let mcpServer=ctx.get(TARGET_RESOURCE_KEY);if(mcpServer===void 0)return;let ref=mcpServer.spec?.auth?.oauthAppRef;if((ref?.slug??"")==="")return;let oauthApp;try{oauthApp=await resolveOAuthAppRef2(store,ref,logger2)}catch(error2){logger2.warn("OAuthApp lookup failed; returning MCP server without oauth_status enrichment",{mcpServerId:mcpServer.metadata?.id??"",oauthAppSlug:ref?.slug??"",error:error2 instanceof Error?error2.message:String(error2)});return}if(oauthApp===void 0){logger2.debug("OAuthApp not found for ref; skipping oauth_status enrichment",{mcpServerId:mcpServer.metadata?.id??"",oauthAppSlug:ref?.slug??""});return}let approvalStatus=oauthApp.spec?.vendorApprovalStatus??VendorApprovalStatus.UNSPECIFIED,docsUrl=oauthApp.spec?.vendorApprovalDocsUrl??"";approvalStatus===VendorApprovalStatus.UNSPECIFIED&&docsUrl===""||(mcpServer.status??=create2(McpServerStatusSchema,{}),mcpServer.status.oauthStatus=create2(OAuthStatusSchema,{vendorApprovalStatus:approvalStatus,vendorApprovalDocsUrl:docsUrl}))}}}function registerMcpServerServices(router,deps){router.service(McpServerCommandController,{apply:(server,ctx)=>apply11(deps,server,ctx),create:(server,ctx)=>createMcpServer(deps,server,ctx),update:(server,ctx)=>update14(deps,server,ctx),updateVisibility:(input,ctx)=>updateVisibility4(deps,input,ctx),delete:(input,ctx)=>deleteMcpServer(deps,input,ctx),connect:(input,ctx)=>connect(deps.connect,input,callerIdentityOf(ctx)),startConnect:(input,ctx)=>startConnect(deps.connect,input,callerIdentityOf(ctx)),initiateOAuthConnect:(input,ctx)=>initiateOAuthConnect(deps.connect,input,callerIdentityOf(ctx)),completeOAuthConnect:(input,ctx)=>completeOAuthConnect(deps.connect,input,callerIdentityOf(ctx)),disconnectOAuth:(input,ctx)=>disconnectOAuth(deps.connect,input,callerIdentityOf(ctx)),setOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("SetOrgOAuthApp")},deleteOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("DeleteOrgOAuthApp")}}),router.service(McpServerQueryController,{get:(id,ctx)=>get18(deps,id,ctx),getByReference:(ref,ctx)=>getByReference10(deps,ref,ctx),getOAuthGrantStatus:(input,ctx)=>getOAuthGrantStatus(deps.connect,input,callerIdentityOf(ctx)),getOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("GetOrgOAuthApp")}})}function orgOAuthAppUnimplemented(method){return new ConnectError(`method ${method} not implemented`,Code.Unimplemented)}function kindOf17(ctx){return ctx.values.get(apiResourceKindKey)}async function createMcpServer(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("mcpserver-create",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardPublicVisibilityStep(deps.authorizer)).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,mcpServerSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update14(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("mcpserver-update",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newValidateDefaultEnabledToolsStep()).addStep(newNormalizeReferencesStep()).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,mcpServerSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply11(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf17(ctx));await newPipeline("mcpserver-apply",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");let result=shouldCreate?await createMcpServer(deps,server,ctx):await update14(deps,withResolvedApplyId(McpServerSchema,server,reqCtx),ctx);return startBestEffortConnect(deps.connect,result).catch(error2=>{deps.logger.warn("Best-effort connect task failed unexpectedly",{mcp_server_id:result.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}),result}async function deleteMcpServer(deps,input,ctx){let reqCtx=new RequestContext(McpServerCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf17(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("mcpserver-delete",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,McpServerSchema)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted mcp server not found in context"),"deleted mcp server not found in context");return deleted}var UPDATE_VISIBILITY_MCP_SERVER_KEY="updateVisibilityMcpServer";async function updateVisibility4(deps,input,ctx){let reqCtx=new RequestContext(McpServerCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("mcpserver-update-visibility",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadMcpServerForVisibilityUpdateStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store,{existingKey:UPDATE_VISIBILITY_MCP_SERVER_KEY})).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_MCP_SERVER_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newAuthorizeVisibilityTransitionStep(UPDATE_VISIBILITY_MCP_SERVER_KEY,deps.authorizer)).addStep(newSetMcpServerVisibilityStep()).addStep(newPersistMcpServerForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_MCP_SERVER_KEY)).addStep(newIndexMcpServerAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY)}function newLoadMcpServerForVisibilityUpdateStep(store){return{name:"LoadMcpServerForVisibilityUpdate",async execute(ctx){let input=ctx.input,mcpServer;try{mcpServer=await store.getResource(ctx.apiResourceKind,input.resourceId,McpServerSchema)}catch{throw notFoundError("mcp_server",input.resourceId)}ctx.set(UPDATE_VISIBILITY_MCP_SERVER_KEY,mcpServer)}}}function newSetMcpServerVisibilityStep(){return{name:"SetMcpServerVisibility",execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY);mcpServer.metadata!==void 0&&(mcpServer.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(McpServerSchema,mcpServer,"status_audit",ctx.callerIdentity)}}}function newPersistMcpServerForVisibilityUpdateStep(store){return{name:"PersistMcpServerForVisibilityUpdate",async execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY);try{await store.saveResource(ctx.apiResourceKind,mcpServer.metadata?.id??"",McpServerSchema,mcpServer)}catch(error2){throw internalError(error2,"failed to save mcp server")}}}}function newIndexMcpServerAfterVisibilityUpdateStep(store,logger2){return{name:"IndexMcpServerAfterVisibilityUpdate",async execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY),entry=mcpServerSearchExtractor.getSearchIndexEntry(mcpServer);if(entry===void 0){logger2.warn("IndexMcpServerAfterVisibilityUpdate: extractor returned nil, skipping",{id:mcpServer.metadata?.id??""});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,mcpServer.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexMcpServerAfterVisibilityUpdate: failed (best-effort)",{id:mcpServer.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function get18(deps,id,ctx){let reqCtx=new RequestContext(McpServerQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("mcpserver-get",deps.logger).addStep(newAuthorizeStep(McpServerQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,McpServerSchema)).addStep(newEnrichOAuthStatusStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference10(deps,ref,ctx){let reqCtx=new RequestContext(McpServerQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("mcpserver-get-by-reference",deps.logger).addStep(newAuthorizeStep(McpServerQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,McpServerSchema)).addStep(newEnrichOAuthStatusStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var SERVER_VERSION="3.17.0";function registerPlatformServices(router,deps){router.service(PlatformQueryController,{getServerInfo:()=>getServerInfo(deps),getLicenseStatus:()=>getLicenseStatus(deps),getRunnerBootstrapConfig:(_input,ctx)=>getRunnerBootstrapConfig(deps,ctx),getRunnerScopedToken:(input,ctx)=>getRunnerScopedToken(deps,input,ctx)})}function getServerInfo(deps){return create2(GetServerInfoOutputSchema,{edition:deps.edition,version:SERVER_VERSION})}async function getLicenseStatus(deps){let now=deps.now(),report=await deps.licenseStatus.status(now),output=create2(GetLicenseStatusOutputSchema,{state:report.state,checkedAt:timestampFromDate(now)});switch(report.state){case LicenseState.absent:return output;case LicenseState.invalid:return output.keyId=report.keyId,output;case LicenseState.valid:case LicenseState.expiring:case LicenseState.grace:case LicenseState.expired:return output.keyId=report.keyId,output.claims=report.claims,output;default:{let exhaustive=report;throw new Error(`unhandled license report: ${JSON.stringify(exhaustive)}`)}}}async function getRunnerBootstrapConfig(deps,ctx){let output=create2(GetRunnerBootstrapConfigOutputSchema,{temporalAddress:deps.temporalHostPort,temporalNamespace:deps.temporalNamespace}),bootstrapCredentials=deps.runnerAuthService.bootstrapCredentials?.bind(deps.runnerAuthService);if(bootstrapCredentials===void 0)return output;try{let credentials=await bootstrapCredentials(callerIdentityOf(ctx));credentials.accessToken!==void 0&&(output.runnerAccessToken=credentials.accessToken.token,output.tokenType="Bearer",output.runnerAccessTokenExpiresInSeconds=credentials.accessToken.expiresInSeconds),credentials.payloadKeys!==void 0&&(output.payloadEncryptionKey=credentials.payloadKeys.keyBase64,output.payloadEncryptionKeyId=credentials.payloadKeys.keyId,output.payloadEncryptionSecondaryKey=credentials.payloadKeys.secondaryKeyBase64??"",output.payloadEncryptionSecondaryKeyId=credentials.payloadKeys.secondaryKeyId??"")}catch(error2){deps.logger.warn("Bootstrap credentials unavailable \u2014 answering coordinates without them",{error:error2 instanceof Error?error2.message:String(error2)})}return output}async function getRunnerScopedToken(deps,input,ctx){let exchange=deps.runnerAuthService.exchangeScopedToken?.bind(deps.runnerAuthService);if(exchange!==void 0){let minted=await exchange(exchangeRequestOf(input),callerIdentityOf(ctx));return minted.minted?create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.expiresInSeconds}):create2(GetRunnerScopedTokenOutputSchema)}let executionId;switch(input.scope.case){case"agentExecutionId":executionId=input.scope.value;break;case"workflowExecutionId":executionId=input.scope.value;break;case"poolClaim":case"renewal":case void 0:return create2(GetRunnerScopedTokenOutputSchema);default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}if(executionId===""||!deps.runnerAuthService.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))return create2(GetRunnerScopedTokenOutputSchema);try{let minted=deps.runnerAuthService.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.ttlSeconds})}catch(error2){return deps.logger.warn("failed to mint runner scoped token \u2014 answering not-minted",{executionId,error:error2 instanceof Error?error2.message:String(error2)}),create2(GetRunnerScopedTokenOutputSchema)}}function exchangeRequestOf(input){switch(input.scope.case){case"agentExecutionId":return{arm:"agent-execution",executionId:input.scope.value};case"workflowExecutionId":return{arm:"workflow-execution",executionId:input.scope.value};case"poolClaim":return{arm:"pool-claim",sessionId:input.scope.value.sessionId};case"renewal":return{arm:"renewal"};case void 0:return{arm:"unset"};default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}}var file_ai_stigmer_tenancy_project_v1_io=fileDesc("CiZhaS9zdGlnbWVyL3RlbmFuY3kvcHJvamVjdC92MS9pby5wcm90bxIdYWkuc3RpZ21lci50ZW5hbmN5LnByb2plY3QudjEiIgoJUHJvamVjdElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQFiBnByb3RvMw",[file_buf_validate_validate]);var file_ai_stigmer_tenancy_project_v1_command=fileDesc("CithaS9zdGlnbWVyL3RlbmFuY3kvcHJvamVjdC92MS9jb21tYW5kLnByb3RvEh1haS5zdGlnbWVyLnRlbmFuY3kucHJvamVjdC52MTLBBAoYUHJvamVjdENvbW1hbmRDb250cm9sbGVyElcKBWFwcGx5EiYuYWkuc3RpZ21lci50ZW5hbmN5LnByb2plY3QudjEuUHJvamVjdBomLmFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxLlByb2plY3QSpQEKBmNyZWF0ZRImLmFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxLlByb2plY3QaJi5haS5zdGlnbWVyLnRlbmFuY3kucHJvamVjdC52MS5Qcm9qZWN0IkvCuBhHCAoQHiIMbWV0YWRhdGEub3JnKjN1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIHByb2plY3QgaW4gdGhpcyBvcmdhbml6YXRpb24SjwEKBnVwZGF0ZRImLmFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxLlByb2plY3QaJi5haS5zdGlnbWVyLnRlbmFuY3kucHJvamVjdC52MS5Qcm9qZWN0IjXCuBgxCAIQPCILbWV0YWRhdGEuaWQqHnVuYXV0aG9yaXplZCB0byB1cGRhdGUgcHJvamVjdBKLAQoGZGVsZXRlEiguYWkuc3RpZ21lci50ZW5hbmN5LnByb2plY3QudjEuUHJvamVjdElkGiYuYWkuc3RpZ21lci50ZW5hbmN5LnByb2plY3QudjEuUHJvamVjdCIvwrgYKwgDEDwiBXZhbHVlKh51bmF1dGhvcml6ZWQgdG8gZGVsZXRlIHByb2plY3QaBKD/KzxiBnByb3RvMw",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_project_v1_api,file_ai_stigmer_tenancy_project_v1_io]),ProjectCommandController=serviceDesc(file_ai_stigmer_tenancy_project_v1_command,0);var file_ai_stigmer_tenancy_project_v1_query=fileDesc("CilhaS9zdGlnbWVyL3RlbmFuY3kvcHJvamVjdC92MS9xdWVyeS5wcm90bxIdYWkuc3RpZ21lci50ZW5hbmN5LnByb2plY3QudjEynAIKFlByb2plY3RRdWVyeUNvbnRyb2xsZXIShQEKA2dldBIoLmFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxLlByb2plY3RJZBomLmFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxLlByb2plY3QiLMK4GCgIARA8IgV2YWx1ZSobdW5hdXRob3JpemVkIHRvIGdldCBwcm9qZWN0EnQKDmdldEJ5UmVmZXJlbmNlEjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlGiYuYWkuc3RpZ21lci50ZW5hbmN5LnByb2plY3QudjEuUHJvamVjdCIE0LgYARoEoP8rPGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_project_v1_api,file_ai_stigmer_tenancy_project_v1_io]),ProjectQueryController=serviceDesc(file_ai_stigmer_tenancy_project_v1_query,0);var DEFAULT_RECONCILIATION_OPTIONS={pruneEnabled:!0,dryRun:!1};function newReconciliationService(deps){return{async reconcile(previousMembers,currentMembers,options){let previousSet=buildReferenceSet(previousMembers),currentSet=buildReferenceSet(currentMembers),added=currentMembers.filter(ref=>!previousSet.has(referenceKey(ref))),orphans=previousMembers.filter(ref=>!currentSet.has(referenceKey(ref)));if(added.length===0&&orphans.length===0)return{added:[],removed:[],errors:[]};if(options.dryRun)return{added,removed:orphans,errors:[]};if(!options.pruneEnabled||orphans.length===0)return{added,removed:[],errors:[]};let{removed,errors}=await deleteOrphans(deps,orphans);return{added,removed,errors}}}}async function deleteOrphans(deps,orphans){let removed=[],errors=[];for(let ref of orphans){let refKey=referenceKey(ref),resourceId;try{resourceId=await resolveResourceId2(deps.store,ref)}catch(cause){errors.push({resourceKey:refKey,message:"failed to resolve resource for deletion",cause}),deps.logger.warn("reconciliation: failed to resolve orphan for deletion",{resource:refKey,error:cause instanceof Error?cause.message:String(cause)});continue}try{await deps.orphanDeleter().delete(ref.kind,resourceId)}catch(cause){errors.push({resourceKey:refKey,message:"failed to delete orphaned resource",cause}),deps.logger.warn("reconciliation: failed to delete orphaned resource",{resource:refKey,resourceId,error:cause instanceof Error?cause.message:String(cause)});continue}removed.push(ref)}return{removed,errors}}async function resolveResourceId2(store,ref){let schema2=schemaForKind(ref.kind),resource=await findResourceBySlug(store,ref.kind,schema2,ref.slug,ref.org);if(resource===void 0){let where=ref.org===""?"":` in org '${ref.org}'`;throw new Error(`resource ${kindName(ref.kind)}/${ref.slug} not found${where}`)}let id=metadataOf(resource)?.id??"";if(id==="")throw new Error(`resource ${kindName(ref.kind)}/${ref.slug} has no ID`);return id}function schemaForKind(kind){switch(kind){case ApiResourceKind.agent:return AgentSchema;case ApiResourceKind.workflow:return WorkflowSchema;case ApiResourceKind.mcp_server:return McpServerSchema;case ApiResourceKind.skill:return SkillSchema;default:throw new Error(`unsupported resource kind: ${kindName(kind)}`)}}function referenceKey(ref){return`${kindName(ref.kind)}:${ref.slug}`}function kindName(kind){return ApiResourceKind[kind]??String(kind)}function buildReferenceSet(refs){return new Set(refs.map(referenceKey))}function toProtoSummary(result){return create2(ReconciliationSummarySchema,{created:[...result.added],updated:[],deleted:[...result.removed]})}var projectSearchExtractor={kind:ApiResourceKind.project,schema:ProjectSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let project=resource;return buildSearchResult({kind:ApiResourceKind.project,metadata:project.metadata,summary:project.spec?.description??"",score,createdAt:project.status?.audit?.specAudit?.createdAt,updatedAt:project.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let project=resource,metadata=project.metadata;if(metadata!==void 0)return{name:metadata.name,description:project.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(project.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function registerProjectServices(router,deps){let reconciliation=newReconciliationService({store:deps.store,orphanDeleter:deps.orphanDeleter,logger:deps.logger});router.service(ProjectCommandController,{apply:(project,ctx)=>apply12(deps,reconciliation,project,ctx),create:(project,ctx)=>createProject(deps,project,ctx),update:(project,ctx)=>update15(deps,project,ctx),delete:(projectId,ctx)=>deleteProject(deps,projectId,ctx)}),router.service(ProjectQueryController,{get:(projectId,ctx)=>get19(deps,projectId,ctx),getByReference:(ref,ctx)=>getByReference11(deps,ref,ctx)})}function kindOf18(ctx){return ctx.values.get(apiResourceKindKey)}async function createProject(deps,project,ctx){let reqCtx=new RequestContext(ProjectSchema,project,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("project-create",deps.logger).addStep(newAuthorizeStep(ProjectCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,projectSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update15(deps,project,ctx){let reqCtx=new RequestContext(ProjectSchema,project,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("project-update",deps.logger).addStep(newAuthorizeStep(ProjectCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,projectSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply12(deps,reconciliation,project,ctx){let reqCtx=new RequestContext(ProjectSchema,project,callerIdentityOf(ctx),kindOf18(ctx));await newPipeline("project-apply",deps.logger).addStep(newAuthorizeStep(ProjectCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");let previousMembers=shouldCreate?[]:reqCtx.get(EXISTING_RESOURCE_KEY)?.spec?.members??[],persisted=shouldCreate?await createProject(deps,project,ctx):await update15(deps,withResolvedApplyId(ProjectSchema,project,reqCtx),ctx),currentMembers=persisted.spec?.members??[];try{let result=await reconciliation.reconcile(previousMembers,currentMembers,DEFAULT_RECONCILIATION_OPTIONS);persisted.status??=create2(ProjectStatusSchema),persisted.status.lastReconciliation=toProtoSummary(result)}catch(error2){deps.logger.error("Reconciliation failed",{projectId:persisted.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}return persisted}async function deleteProject(deps,projectId,ctx){let reqCtx=new RequestContext(ProjectCommandController.method.delete.input,projectId,callerIdentityOf(ctx),kindOf18(ctx));await newPipeline("project-delete",deps.logger).addStep(newAuthorizeStep(ProjectCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,ProjectSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("delete pipeline completed without a loaded resource"),"deleted project not found in context");return deleted}async function get19(deps,projectId,ctx){let reqCtx=new RequestContext(ProjectQueryController.method.get.input,projectId,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("project-get",deps.logger).addStep(newAuthorizeStep(ProjectQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ProjectSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference11(deps,ref,ctx){let reqCtx=new RequestContext(ProjectQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("project-get-by-reference",deps.logger).addStep(newAuthorizeStep(ProjectQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ProjectSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var file_ai_stigmer_agentic_session_v1_io=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9pby5wcm90bxIdYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEiIgoJU2Vzc2lvbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiIAoHQWdlbnRJZBIVCgV2YWx1ZRgBIAEoCUIGukgDyAEBIlsKC1Nlc3Npb25MaXN0EhMKC3RvdGFsX3BhZ2VzGAEgASgFEjcKB2VudHJpZXMYAiADKAsyJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uIkoKE0xpc3RTZXNzaW9uc1JlcXVlc3QSEQoJcGFnZV9zaXplGAEgASgFEhIKCnBhZ2VfdG9rZW4YAiABKAkSDAoEdGFncxgDIAMoCSJuCiJMaXN0U2Vzc2lvbnNCeUFnZW50SW5zdGFuY2VSZXF1ZXN0EiEKEWFnZW50X2luc3RhbmNlX2lkGAEgASgJQga6SAPIAQESEQoJcGFnZV9zaXplGAIgASgFEhIKCnBhZ2VfdG9rZW4YAyABKAkiYQocTGlzdFNlc3Npb25zQnlDaGFubmVsUmVxdWVzdBIaCgpjaGFubmVsX2lkGAEgASgJQga6SAPIAQESEQoJcGFnZV9zaXplGAIgASgFEhIKCnBhZ2VfdG9rZW4YAyABKAkiQgobVXBkYXRlU2Vzc2lvblN1YmplY3RSZXF1ZXN0EhIKAmlkGAEgASgJQga6SAPIAQESDwoHc3ViamVjdBgCIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_session_v1_api,file_buf_validate_validate]),SessionIdSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_io,0);var SessionListSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_io,2);var file_ai_stigmer_agentic_session_v1_command=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9jb21tYW5kLnByb3RvEh1haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MTLtBQoYU2Vzc2lvbkNvbW1hbmRDb250cm9sbGVyElcKBWFwcGx5EiYuYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbhomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24SpQEKBmNyZWF0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24aJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uIkvCuBhHCAgQHiIMbWV0YWRhdGEub3JnKjN1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIHNlc3Npb24gaW4gdGhpcyBvcmdhbml6YXRpb24SjwEKBnVwZGF0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24aJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uIjXCuBgxCAIQKiILbWV0YWRhdGEuaWQqHnVuYXV0aG9yaXplZCB0byB1cGRhdGUgc2Vzc2lvbhKpAQoNdXBkYXRlU3ViamVjdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlVwZGF0ZVNlc3Npb25TdWJqZWN0UmVxdWVzdBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iNMK4GDAIAhAqIgJpZComdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBzZXNzaW9uIHN1YmplY3QSiwEKBmRlbGV0ZRIoLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iL8K4GCsIAxAqIgV2YWx1ZSoedW5hdXRob3JpemVkIHRvIGRlbGV0ZSBzZXNzaW9uGgSg/ysqYgZwcm90bzM",[file_ai_stigmer_agentic_session_v1_api,file_ai_stigmer_agentic_session_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SessionCommandController=serviceDesc(file_ai_stigmer_agentic_session_v1_command,0);var file_ai_stigmer_agentic_session_v1_query=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9xdWVyeS5wcm90bxIdYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEyoQQKFlNlc3Npb25RdWVyeUNvbnRyb2xsZXIShQEKA2dldBIoLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iLMK4GCgIARAqIgV2YWx1ZSobdW5hdXRob3JpemVkIHRvIGdldCBzZXNzaW9uEmwKBGxpc3QSMi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5MaXN0U2Vzc2lvbnNSZXF1ZXN0GiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbkxpc3QiBNC4GAESigEKE2xpc3RCeUFnZW50SW5zdGFuY2USQS5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5MaXN0U2Vzc2lvbnNCeUFnZW50SW5zdGFuY2VSZXF1ZXN0GiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbkxpc3QiBNC4GAESfgoNbGlzdEJ5Q2hhbm5lbBI7LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLkxpc3RTZXNzaW9uc0J5Q2hhbm5lbFJlcXVlc3QaKi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uTGlzdCIE0LgYARoEoP8rKmIGcHJvdG8z",[file_ai_stigmer_agentic_session_v1_api,file_ai_stigmer_agentic_session_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SessionQueryController=serviceDesc(file_ai_stigmer_agentic_session_v1_query,0);function runAgentInstanceDeniedMessage2(agentInstanceId){return`unauthorized to run agent instance '${agentInstanceId}'`}function sessionRunTarget(session){let agentInstanceId=session.spec?.agentInstanceId??"";if(agentInstanceId!=="")return{...RUN_GATE_CHECKS.agentInstance,resourceId:agentInstanceId,deniedMessage:runAgentInstanceDeniedMessage2(agentInstanceId)}}var sessionSearchExtractor={kind:ApiResourceKind.session,schema:SessionSchema,getSearchSummary(resource){return resource.spec?.subject??""},toSearchResult(resource,score){let session=resource;return buildSearchResult({kind:ApiResourceKind.session,metadata:session.metadata,summary:session.spec?.subject??"",score,createdAt:session.status?.audit?.specAudit?.createdAt,updatedAt:session.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let session=resource,metadata=session.metadata;if(metadata!==void 0)return{name:metadata.name,description:session.spec?.subject??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(session.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var LIST_RESULT_KEY8="listResult",CHANNEL_ID_LABEL_KEY="stigmer.ai/channel-id";function newResolveDefaultAgentInstanceStep(store,creator,logger2,authorizationLifecycle){return{name:"ResolveDefaultAgentInstance",async execute(ctx){if((ctx.input.spec?.agentInstanceId??"")!=="")return;logger2.info("agent_instance_id not provided on session, resolving platform default agent");let defaultAgent;try{defaultAgent=await findDefaultAgent(store,logger2)}catch(error2){throw error2 instanceof DefaultAgentNotConfiguredError?(logger2.error("No platform default agent configured",{error:error2.message}),new ConnectError(`No default agent available. Ensure an agent with label stigmer.ai/default-agent=true and visibility_public exists: no default agent available on this platform: ${error2.message}`,Code.NotFound)):error2 instanceof DefaultAgentNotPublicError?(logger2.error("Default agent is not visibility_public",{error:error2.message}),new ConnectError(`Default agent exists but is not visibility_public: ${error2.message}`,Code.FailedPrecondition)):(logger2.error("Failed to resolve platform default agent",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to resolve the platform default agent"))}let metadata=defaultAgent.metadata;if(metadata===void 0)throw internalError(new Error("default agent metadata is nil"),"failed to resolve the platform default agent");let agentId=metadata.id;logger2.info("Resolved platform default agent",{agentId,agentName:metadata.name});let defaultInstanceId=defaultAgent.status?.defaultInstanceId??"";if(defaultInstanceId===""){logger2.info("Default instance missing, creating one",{agentId});let instanceRequest=buildDefaultInstanceRequest(metadata),createdInstance;try{createdInstance=await creator().createAsCaller(instanceRequest,ctx.callerIdentity)}catch(error2){throw logger2.error("Failed to create default instance",{agentId,error:error2 instanceof Error?error2.message:String(error2)}),error2 instanceof ConnectError?goWrappedStatusError("failed to create default instance for default agent",error2):new Error(`failed to create default instance for default agent: ${error2 instanceof Error?error2.message:String(error2)}`)}defaultInstanceId=createdInstance.metadata?.id??"",defaultAgent.status===void 0&&(defaultAgent.status=create2(AgentStatusSchema,{})),defaultAgent.status.defaultInstanceId=defaultInstanceId;try{await store.saveResource(ApiResourceKind.agent,agentId,AgentSchema,defaultAgent)}catch(error2){throw logger2.error("Failed to persist agent with default_instance_id",{agentId,error:error2 instanceof Error?error2.message:String(error2)}),new Error(`failed to persist agent with default instance: ${error2 instanceof Error?error2.message:String(error2)}`)}await notifyDefaultInstanceLinked(authorizationLifecycle,{instanceKind:ApiResourceKind.agent_instance,instanceId:defaultInstanceId,blueprintKind:ApiResourceKind.agent,blueprintId:agentId}),logger2.info("Created default instance for default agent",{instanceId:defaultInstanceId,agentId})}let newState=ctx.newState;newState.spec===void 0&&(newState.spec=create2(SessionSpecSchema,{})),newState.spec.agentInstanceId=defaultInstanceId,logger2.info("Set agent_instance_id on session from platform default agent",{agentInstanceId:defaultInstanceId})}}}function newValidateHarnessImmutabilityStep(){return{name:"ValidateHarnessImmutability",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0||existingSpec.harnessStateId==="")return;let inputSpec=ctx.input.spec;if(inputSpec===void 0)return;let existingHarness=existingSpec.harness,inputHarness=inputSpec.harness;if(existingHarness===Harness.UNSPECIFIED&&(existingHarness=Harness.NATIVE),inputHarness===Harness.UNSPECIFIED&&(inputHarness=Harness.NATIVE),inputHarness!==existingHarness)throw failedPreconditionError("session harness cannot be changed after the first execution \u2014 each harness owns its conversation state independently")}}}var EXECUTION_TARGET_GO_NAMES={[ExecutionTarget.UNSPECIFIED]:"EXECUTION_TARGET_UNSPECIFIED",[ExecutionTarget.LOCAL]:"EXECUTION_TARGET_LOCAL",[ExecutionTarget.CLOUD]:"EXECUTION_TARGET_CLOUD"};function newValidateExecutionTargetImmutabilityStep(temporalConfig){return{name:"ValidateExecutionTargetImmutability",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0||existingSpec.harnessStateId==="")return;let inputSpec=ctx.input.spec;if(inputSpec===void 0)return;let existingTarget=temporalConfig.resolveExecutionTarget(existingSpec.executionTarget),inputTarget=temporalConfig.resolveExecutionTarget(inputSpec.executionTarget);if(inputTarget!==existingTarget)throw failedPreconditionError(`session execution_target cannot be changed after the first execution (${EXECUTION_TARGET_GO_NAMES[existingTarget]} \u2192 ${EXECUTION_TARGET_GO_NAMES[inputTarget]}; unset resolves to the deployment default, ${temporalConfig.defaultExecutionTarget}) \u2014 workspace state may not be portable between local and cloud environments`)}}}function newRecordHarnessStateHistoryStep(){return{name:"RecordHarnessStateHistory",execute(ctx){let mergedSpec=ctx.newState.spec;if(mergedSpec===void 0)return;let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0||existing.spec===void 0)return;let existingSpec=existing.spec,history=[...existingSpec.harnessStateIdHistory],previousId=existingSpec.harnessStateId;previousId!==""&&previousId!==mergedSpec.harnessStateId&&!history.includes(previousId)&&history.push(previousId),mergedSpec.harnessStateIdHistory=history}}}function isActiveExecutionPhase(phase){switch(phase){case ExecutionPhase.EXECUTION_PENDING:case ExecutionPhase.EXECUTION_IN_PROGRESS:case ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL:case ExecutionPhase.EXECUTION_PAUSED:return!0;default:return!1}}async function listExecutionsBySession(store,logger2,sessionId){let rows;try{rows=await store.listResources(ApiResourceKind.agent_execution)}catch(error2){throw internalError(error2,"failed to list agent executions")}let executions=[];for(let data of rows){let execution;try{execution=fromBinary2(AgentExecutionSchema,data)}catch(error2){logger2.warn("Failed to unmarshal execution, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}(execution.spec?.sessionId??"")===sessionId&&executions.push(execution)}return executions}function newRejectDeleteWithActiveExecutionsStep(store,logger2){return{name:"RejectDeleteWithActiveExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId),activeCount=0;for(let execution of executions)isActiveExecutionPhase(execution.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED)&&activeCount++;if(activeCount>0)throw failedPreconditionError(`session has ${activeCount} active execution(s); cancel them or wait for completion before deleting`)}}}function newCascadeDeleteAgentExecutionsStep(store,logger2){return{name:"CascadeDeleteAgentExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId);if(executions.length!==0){for(let execution of executions){let executionId=execution.metadata?.id??"";try{await store.deleteResource(ApiResourceKind.agent_execution,executionId)}catch(error2){throw internalError(error2,`failed to cascade-delete execution ${executionId} of session ${sessionId}`)}try{await store.deleteSearchIndex(ApiResourceKind.agent_execution,executionId)}catch(error2){logger2.warn("CascadeDeleteAgentExecutions: failed to remove search index entry (best-effort)",{executionId,error:error2 instanceof Error?error2.message:String(error2)})}}logger2.info("Cascade-deleted executions of session",{sessionId,count:executions.length})}}}}function requireSessionId(ctx){let sessionId=ctx.get(RESOURCE_ID_KEY);if(typeof sessionId!="string"||sessionId==="")throw internalError(new Error("session id not found in context (ExtractResourceId must run first)"),"session id not found in context (ExtractResourceId must run first)");return sessionId}function newListAllSessionsStep(store,logger2,listReadScope){return{name:"ListAllSessions",async execute(ctx){let sessions=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.session,await loadAllSessions(store,logger2,ctx.apiResourceKind),"");sessions.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),logger2.info("Loaded sessions from database",{count:sessions.length}),ctx.set(LIST_RESULT_KEY8,create2(SessionListSchema,{entries:sessions}))}}}function newFilterByAgentInstanceStep(store,logger2,listReadScope){return{name:"FilterByAgentInstance",async execute(ctx){let agentInstanceId=ctx.input.agentInstanceId;if(agentInstanceId==="")throw invalidArgumentError("agent_instance_id is required");let sessions=await loadAllSessions(store,logger2,ctx.apiResourceKind),filtered=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.session,sessions.filter(session=>(session.spec?.agentInstanceId??"")===agentInstanceId),"");logger2.info("Filtered sessions by agent instance",{agentInstanceId,totalSessions:sessions.length,filteredSessions:filtered.length}),ctx.set(LIST_RESULT_KEY8,create2(SessionListSchema,{entries:filtered}))}}}function newAuthorizeChannelAccessStep(authorizer){return{name:"AuthorizeChannelAccess",async execute(ctx){ctx.input.channelId!==""&&await authorizeResolvedResource(authorizer,ctx.callerIdentity,{permission:IamPermission.can_view,resourceKind:ApiResourceKind.agent_channel,resourceId:ctx.input.channelId},"unauthorized to list channel conversations")}}}function newFilterByChannelStep(store,logger2,listReadScope){return{name:"FilterByChannel",async execute(ctx){let channelId=ctx.input.channelId;if(channelId==="")throw invalidArgumentError("channel_id is required");let sessions=await loadAllSessions(store,logger2,ctx.apiResourceKind),filtered=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.session,sessions.filter(session=>(session.metadata?.labels??{})[CHANNEL_ID_LABEL_KEY]===channelId),"");logger2.info("Filtered sessions by channel",{channelId,totalSessions:sessions.length,filteredSessions:filtered.length}),ctx.set(LIST_RESULT_KEY8,create2(SessionListSchema,{entries:filtered}))}}}async function loadAllSessions(store,logger2,kind){let rows;try{rows=await store.listResources(kind)}catch(error2){throw internalError(error2,"failed to list sessions")}let sessions=[];for(let data of rows){let session;try{session=fromBinary2(SessionSchema,data)}catch(error2){logger2.warn("Failed to unmarshal session, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}sessions.push(session)}return sessions}function registerSessionServices(router,deps){router.service(SessionCommandController,{apply:(session,ctx)=>apply13(deps,session,ctx),create:(session,ctx)=>createSession(deps,session,ctx),update:(session,ctx)=>update16(deps,session,ctx),updateSubject:(req,ctx)=>updateSubject(deps,req,callerIdentityOf(ctx)),delete:(id,ctx)=>deleteSession(deps,id,ctx)}),router.service(SessionQueryController,{get:(id,ctx)=>get20(deps,id,ctx),list:(req,ctx)=>list9(deps,req,ctx),listByAgentInstance:(req,ctx)=>listByAgentInstance(deps,req,ctx),listByChannel:(req,ctx)=>listByChannel(deps,req,ctx)})}function kindOf19(ctx){return ctx.values.get(apiResourceKindKey)}async function createSession(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx)),builder2=newPipeline("session-create",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.create,deps.authorizer)).addStep(newResolveDefaultAgentInstanceStep(deps.store,deps.agentInstanceCreator,deps.logger,deps.authorizationLifecycle)).addStep(newAuthorizeRunTargetStep(deps.authorizer,sessionRunTarget)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep());for(let step of stepsForSlot(deps.gateSteps,"session-create:pre-side-effect-gate"))builder2.addStep(step);return await builder2.addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update16(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-update",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateHarnessImmutabilityStep()).addStep(newValidateExecutionTargetImmutabilityStep(deps.temporalConfig)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newRecordHarnessStateHistoryStep()).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply13(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("session-apply",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createSession(deps,session,ctx):update16(deps,withResolvedApplyId(SessionSchema,session,reqCtx),ctx)}async function deleteSession(deps,sessionId,ctx){let reqCtx=new RequestContext(SessionCommandController.method.delete.input,sessionId,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("session-delete",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,SessionSchema)).addStep(newRejectDeleteWithActiveExecutionsStep(deps.store,deps.logger)).addStep(newCascadeDeleteAgentExecutionsStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted session not found in context"),"deleted session not found in context");return await deprovisionSessionSandboxBestEffort(deps.sandboxLane,deps.logger,deleted.metadata?.id??""),deleted}async function updateSubject(deps,req,identity2){if(req.id==="")throw invalidArgumentError("id is required");let kind=ApiResourceKind.session,session;try{session=await deps.store.getResource(kind,req.id,SessionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("session",req.id):internalError(error2,"failed to load session")}await authorizeDirect(SessionCommandController.method.updateSubject,deps.authorizer,identity2,req),session.spec===void 0&&(session.spec=create2(SessionSpecSchema,{})),session.spec.subject=req.subject,setAuditFieldsForUpdate(SessionSchema,session,"spec_audit",identity2);try{await deps.store.saveResource(kind,req.id,SessionSchema,session)}catch(error2){throw internalError(error2,"failed to persist session")}return await indexSessionSearch(deps,kind,session),session}async function indexSessionSearch(deps,kind,session){let entry=sessionSearchExtractor.getSearchIndexEntry(session);if(entry!==void 0)try{await deps.store.upsertSearchIndex(kind,session.metadata?.id??"",entry)}catch(error2){deps.logger.warn("UpdateSubject: failed to update search index (best-effort)",{id:session.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}async function get20(deps,id,ctx){let reqCtx=new RequestContext(SessionQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-get",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,SessionSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function list9(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListAllSessionsStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}async function listByAgentInstance(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByAgentInstance.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list-by-agent-instance",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByAgentInstance,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newFilterByAgentInstanceStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}async function listByChannel(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByChannel.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list-by-channel",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByChannel,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeChannelAccessStep(deps.authorizer)).addStep(newFilterByChannelStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}function requireListResult2(result){if(result===void 0)throw internalError(new Error("session list not found in context"),"session list not found in context");return result}var file_ai_stigmer_agentic_plugin_v1_io=fileDesc("CiVhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2lvLnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxIiEKCFBsdWdpbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEi9wIKEVB1c2hQbHVnaW5SZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhAKCGFydGlmYWN0GAIgASgMEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYAyABKAkSUwoKdmlzaWJpbGl0eRgEIAEoDjI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVZpc2liaWxpdHlCCLpIBYIBAhABEg8KB21lc3NhZ2UYBSABKAk6twG6SLMBGrABCiNwdXNoX3BsdWdpbl9yZXF1ZXN0LmFydGlmYWN0X3NvdXJjZRJJZXhhY3RseSBvbmUgb2YgYXJ0aWZhY3QgKGlubGluZSBieXRlcykgb3IgYXJ0aWZhY3RfdXBsb2FkX3JlZiBtdXN0IGJlIHNldBo+KHRoaXMuYXJ0aWZhY3Quc2l6ZSgpID4gMCkgIT0gKHRoaXMuYXJ0aWZhY3RfdXBsb2FkX3JlZiAhPSAnJykiWAokQ3JlYXRlUGx1Z2luQXJ0aWZhY3RVcGxvYWRVcmxSZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhsKCnNpemVfYnl0ZXMYAiABKANCB7pIBCICIAAiWAoXUGx1Z2luQXJ0aWZhY3RVcGxvYWRVcmwSCwoDdXJsGAEgASgJEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYAiABKAkSEwoLdHRsX3NlY29uZHMYAyABKAUihQEKDFBsdWdpbk1lbWJlchJNCgRraW5kGAEgASgOMj8uYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUtpbmQSCgoCaWQYAiABKAkSDAoEc2x1ZxgDIAEoCRIMCgRuYW1lGAQgASgJIlgKGUxpc3RQbHVnaW5NZW1iZXJzUmVzcG9uc2USOwoHbWVtYmVycxgBIAMoCzIqLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luTWVtYmVyImsKF0xpc3RQbHVnaW5WZXJzaW9uc0lucHV0EhMKA29yZxgBIAEoCUIGukgDyAEBEhQKBHNsdWcYAiABKAlCBrpIA8gBARISCgpwYWdlX3Rva2VuGAMgASgJEhEKCXBhZ2Vfc2l6ZRgEIAEoBSLtAQoSUGx1Z2luVmVyc2lvbkVudHJ5Eg4KBmRpZ2VzdBgBIAEoCRItCglwdXNoZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkgKCXB1c2hlZF9ieRgDIAEoCzI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0QWN0b3ISCwoDdGFnGAQgASgJEhIKCmlzX2N1cnJlbnQYBSABKAgSDwoHbWVzc2FnZRgGIAEoCRIcChRhcnRpZmFjdF9zdG9yYWdlX2tleRgHIAEoCSKOAQoaTGlzdFBsdWdpblZlcnNpb25zUmVzcG9uc2USQgoIdmVyc2lvbnMYASADKAsyMC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpblZlcnNpb25FbnRyeRIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEwoLdG90YWxfY291bnQYAyABKAViBnByb3RvMw",[file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind,file_ai_stigmer_commons_apiresource_enum,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_timestamp]);var PushPluginRequestSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,1);var PluginArtifactUploadUrlSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,3),PluginMemberSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,4),ListPluginMembersResponseSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,5);var PluginVersionEntrySchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,7),ListPluginVersionsResponseSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,8);var file_ai_stigmer_agentic_plugin_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEy2gUKF1BsdWdpbkNvbW1hbmRDb250cm9sbGVyEqEBCgRwdXNoEi8uYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QdXNoUGx1Z2luUmVxdWVzdBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24S2AEKF2NyZWF0ZUFydGlmYWN0VXBsb2FkVXJsEkIuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5DcmVhdGVQbHVnaW5BcnRpZmFjdFVwbG9hZFVybFJlcXVlc3QaNS5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbkFydGlmYWN0VXBsb2FkVXJsIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24SsAEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiQuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW4iP8K4GDsIAhA6IgtyZXNvdXJjZV9pZCoodW5hdXRob3JpemVkIHRvIHVwZGF0ZSBwbHVnaW4gdmlzaWJpbGl0eRKGAQoGZGVsZXRlEiYuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5JZBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIi7CuBgqCAMQOiIFdmFsdWUqHXVuYXV0aG9yaXplZCB0byBkZWxldGUgcGx1Z2luGgSg/ys6YgZwcm90bzM",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginCommandController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_command,0);var file_ai_stigmer_agentic_plugin_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxMsMEChVQbHVnaW5RdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luSWQaJC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbiIrwrgYJwgBEDoiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IHBsdWdpbhJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIgTQuBgBEqQBCgtsaXN0TWVtYmVycxImLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luSWQaNy5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5NZW1iZXJzUmVzcG9uc2UiNMK4GDAIARA6IgV2YWx1ZSojdW5hdXRob3JpemVkIHRvIGxpc3QgcGx1Z2luIG1lbWJlcnMShQEKDGxpc3RWZXJzaW9ucxI1LmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuTGlzdFBsdWdpblZlcnNpb25zSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5WZXJzaW9uc1Jlc3BvbnNlIgTQuBgBGgSg/ys6YgZwcm90bzM",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginQueryController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_query,0);var PLATFORM_ARCHIVE_LIMITS={maxFiles:1e4,maxUncompressedSize:524288e3,maxCompressionRatio:100};var ARTIFACT_BYTES_KEY="pushArtifactBytes";function newResolveArtifactSourceStep(slots,binding){return{name:"ResolveArtifactSource",async execute(ctx){let{artifact,artifactUploadRef}=binding.source(ctx.input);if(artifactUploadRef===""){ctx.set(ARTIFACT_BYTES_KEY,artifact);return}if(slots===void 0)throw failedPreconditionError(binding.laneNotConfigured);let data;try{data=await slots.consume(artifactUploadRef)}catch(error2){throw invalidArgumentError(`artifact_upload_ref not usable: ${error2 instanceof Error?error2.message:String(error2)} \u2014 request a new upload URL via createArtifactUploadUrl`)}ctx.set(ARTIFACT_BYTES_KEY,data)}}}function newArchiveCurrentVersionStep(store,logger2,binding){return{name:binding.stepName,async execute(ctx){let resource=ctx.get(binding.resourceKey),versionHash=binding.headHashOf(resource);if(versionHash==="")return;let tag2=binding.liveTagOf(resource),resourceId=metadataOf(resource)?.id??"",idField=`${binding.noun}Id`,alreadyArchived=!1;try{await store.getAuditByHash(ctx.apiResourceKind,resourceId,versionHash,binding.schema),alreadyArchived=!0}catch(error2){error2 instanceof AuditNotFoundError||logger2.warn(`Could not check for an existing archived ${binding.noun} version \u2014 archiving anyway`,{[idField]:resourceId,versionHash,error:error2 instanceof Error?error2.message:String(error2)})}if(!alreadyArchived)try{await store.saveAudit(ctx.apiResourceKind,resourceId,binding.schema,resource,versionHash,"")}catch(error2){logger2.error(`Failed to archive ${binding.noun} version \u2014 reverting the version hash to maintain the audit-resolvability invariant`,{[idField]:resourceId,versionHash,error:error2 instanceof Error?error2.message:String(error2)}),binding.clearHeadHash(resource);return}if(tag2!=="")try{await store.setAuditTag(ctx.apiResourceKind,resourceId,versionHash,tag2)}catch(error2){logger2.error(`Archived ${binding.noun} version but failed to assign its tag \u2014 clearing the live tag to stay consistent with the audit column`,{[idField]:resourceId,versionHash,tag:tag2,error:error2 instanceof Error?error2.message:String(error2)}),binding.clearLiveTag(resource)}alreadyArchived?logger2.info(`${capitalize(binding.noun)} version content already archived \u2014 repointed head without a new history row`,{[idField]:resourceId,versionHash,tag:tag2}):logger2.info(`Archived ${binding.noun} version to audit history`,{[idField]:resourceId,versionHash,tag:tag2})}}}function newDeleteVersionArchivesStep(store,logger2,binding){return{name:binding.stepName,async execute(ctx){let resourceId=ctx.get(RESOURCE_ID_KEY);if(typeof resourceId!="string")throw new Error("resource id not found in context (ExtractResourceIdStep must run first)");let idField=`${binding.noun}Id`;try{let deletedCount=await store.deleteAuditByResourceId(ctx.apiResourceKind,resourceId);deletedCount>0&&logger2.info(`Deleted archive records for ${binding.noun}`,{[idField]:resourceId,count:deletedCount})}catch(error2){logger2.warn(`failed to delete ${binding.noun} archives (best-effort)`,{[idField]:resourceId,error:error2 instanceof Error?error2.message:String(error2)})}}}}function capitalize(word){return word.charAt(0).toUpperCase()+word.slice(1)}var HASH_PATTERN=/^[a-f0-9]{64}$/;function isVersionHash(version){return HASH_PATTERN.test(version)}function newLoadByReferenceWithVersionStep(store,binding,stepName){return{name:stepName,async execute(ctx){let ref=ctx.input;if(ref.slug==="")throw invalidArgumentError("slug is required in reference");if(requireOrgForReference(ctx.apiResourceKind,ref.org),ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==binding.kind)throw invalidArgumentError(`kind mismatch: expected ${ApiResourceKind[binding.kind]}, got ${ApiResourceKind[ref.kind]}`);let head;try{head=await findResourceBySlug(store,ctx.apiResourceKind,binding.schema,ref.slug,ref.org)}catch(error2){throw internalError(error2,`failed to list ${binding.noun}s`)}if(head===void 0)throw notFoundError(binding.noun,ref.slug);let version=ref.version.trim();if(version===""||version==="latest"){ctx.set(TARGET_RESOURCE_KEY,head);return}if(headMatchesVersion(binding,head,version)){ctx.set(TARGET_RESOURCE_KEY,head);return}let archived=await findAuditByVersion(store,ctx.apiResourceKind,binding.schema,idOf(head),version);if(archived===void 0)throw notFoundError(`${binding.noun} version`,`${ref.slug}:${version}`);ctx.set(TARGET_RESOURCE_KEY,archived)}}}function headMatchesVersion(binding,head,version){if(isVersionHash(version))return binding.headHashOf(head)===version;let liveTag=binding.liveTagOf(head);return liveTag!==""&&liveTag===version}async function findAuditByVersion(store,kind,schema2,resourceId,version){if(isVersionHash(version))try{return await store.getAuditByHash(kind,resourceId,version,schema2)}catch(error2){if(error2 instanceof AuditNotFoundError)return;throw internalError(error2,"failed to query audit by hash")}try{return await store.getAuditByTag(kind,resourceId,version,schema2)}catch(error2){if(error2 instanceof AuditNotFoundError)return;throw internalError(error2,"failed to query audit by tag")}}var DEFAULT_PAGE_SIZE=50,MAX_PAGE_SIZE=100,LIST_VERSIONS_RESOURCE_ID_KEY="listVersionsResourceId",LIST_VERSIONS_HEAD_HASH_KEY="listVersionsHeadHash",LIST_VERSIONS_RESPONSE_KEY="listVersionsResponse";function newResolveBySlugForVersionsStep(store,binding,stepName){return{name:stepName,async execute(ctx){let req=binding.input(ctx.input),head;try{head=await findResourceBySlug(store,ctx.apiResourceKind,binding.schema,req.slug,req.org)}catch(error2){throw internalError(error2,`failed to search for ${binding.noun}`)}if(head===void 0)throw notFoundError(binding.noun,`${req.slug} (org: ${req.org})`);ctx.set(LIST_VERSIONS_RESOURCE_ID_KEY,idOf(head)),ctx.set(LIST_VERSIONS_HEAD_HASH_KEY,binding.headHashOf(head))}}}function newLoadAndMapVersionsStep(store,binding,stepName){return{name:stepName,async execute(ctx){let req=binding.input(ctx.input),resourceId=ctx.get(LIST_VERSIONS_RESOURCE_ID_KEY),records;try{records=await store.listAuditRecords(ctx.apiResourceKind,resourceId)}catch(error2){throw internalError(error2,"failed to load version history")}let headHash=ctx.get(LIST_VERSIONS_HEAD_HASH_KEY),currentMarked=!1,entries=[];for(let record of records){let snapshot;try{snapshot=fromBinary2(binding.schema,record.data)}catch{continue}let isCurrent=!currentMarked&&headHash!==""&&binding.headHashOf(snapshot)===headHash;currentMarked=currentMarked||isCurrent,entries.push(binding.mapEntry(snapshot,isCurrent,record.tag))}let pageSize=req.pageSize;pageSize<=0&&(pageSize=DEFAULT_PAGE_SIZE),pageSize>MAX_PAGE_SIZE&&(pageSize=MAX_PAGE_SIZE);let startIndex=0;req.pageToken!==""&&(startIndex=decodePageToken(req.pageToken));let pageEntries=[],nextPageToken="";if(startIndex<entries.length){let end=Math.min(startIndex+pageSize,entries.length);pageEntries=entries.slice(startIndex,end),end<entries.length&&(nextPageToken=Buffer.from(String(end)).toString("base64"))}ctx.set(LIST_VERSIONS_RESPONSE_KEY,binding.response(pageEntries,nextPageToken,entries.length))}}}function decodePageToken(token){let decoded=Buffer.from(token,"base64");if(decoded.toString("base64")!==token)throw invalidArgumentError("invalid page_token");let text=decoded.toString("utf8"),index2=Number.parseInt(text,10);if(!Number.isSafeInteger(index2)||String(index2)!==text||index2<0)throw invalidArgumentError("invalid page_token");return index2}function idOf(resource){return metadataOf(resource)?.id??""}var TASK_KIND_REGISTRY_PATH="/v1/proxy/task-kind-registry",MODEL_REGISTRY_PATH="/v1/proxy/model-registry",SKILL_ARTIFACTS_PATH_PREFIX="/v1/skill-artifacts";var MAX_SKILL_MD_SIZE=1*1024*1024,DEFAULT_SLOT_TTL_MS=900*1e3,REF_BYTE_LEN=16,REF_PREFIX="sau_",UPLOADS_SEGMENT="/uploads/",DOWNLOAD_KEY_PREFIX="skills/",NESTED_SKILL_MD_HINT="SKILL.md must be at the archive root \u2014 zip the skill folder's contents, not the folder itself",TRANSFER_LANE_NOT_CONFIGURED="skill artifact transfer lane is not configured on this server";var import_node_path11=__toESM(require("node:path"),1);var ArtifactNotFoundError=class extends Error{constructor(storageKey){super(`artifact not found: ${storageKey}`),this.name="ArtifactNotFoundError"}},ARCHIVE_CONTENT_TYPE="application/zip";function newContentAddressedArchiveStore(driver,keyPrefix){let virtualRoot=import_node_path11.default.resolve(import_node_path11.default.sep,"archive-store"),keyEscapesStore=storageKey=>{let resolved=import_node_path11.default.resolve(virtualRoot,storageKey);return resolved!==virtualRoot&&!resolved.startsWith(virtualRoot+import_node_path11.default.sep)};return{getStorageKey(hash){return`${keyPrefix}${hash}.zip`},async store(hash,data){let storageKey=this.getStorageKey(hash);return await driver.upload(storageKey,data,ARCHIVE_CONTENT_TYPE),storageKey},async get(storageKey){if(keyEscapesStore(storageKey))throw new ArtifactNotFoundError(storageKey);try{return await driver.download(storageKey)}catch(error2){throw error2 instanceof ArtifactStorageNotFoundError?new ArtifactNotFoundError(storageKey):new Error(`failed to read artifact: ${error2 instanceof Error?error2.message:String(error2)}`)}},async exists(hash){return driver.exists(this.getStorageKey(hash))},async size(storageKey){if(keyEscapesStore(storageKey))throw new ArtifactNotFoundError(storageKey);try{return await driver.size(storageKey)}catch(error2){throw error2 instanceof ArtifactStorageNotFoundError?new ArtifactNotFoundError(storageKey):new Error(`failed to stat artifact: ${error2 instanceof Error?error2.message:String(error2)}`)}}}}var SKILL_ARTIFACT_KEY_PREFIX="skills/";function newSkillArtifactStorage(driver){return newContentAddressedArchiveStore(driver,SKILL_ARTIFACT_KEY_PREFIX)}var import_node_crypto22=require("node:crypto"),import_node_fs7=__toESM(require("node:fs"),1),import_node_path12=__toESM(require("node:path"),1),import_promises5=require("node:stream/promises");var SlotUnknownError=class extends Error{constructor(){super("upload reference unknown or expired"),this.name="SlotUnknownError"}},SlotConsumedError=class extends Error{constructor(){super("upload reference already carries an upload"),this.name="SlotConsumedError"}},SlotEmptyError=class extends Error{constructor(){super("upload reference has no uploaded bytes"),this.name="SlotEmptyError"}},SizeMismatchError=class extends Error{constructor(received,declared){super(`upload size mismatch: received ${received} bytes, declared ${declared}`),this.name="SizeMismatchError"}},UploadSlots=class{slots=new Map;stagingDir;ttlMs;maxSize;now;constructor(stagingDir,ttlMs,maxSize,now=Date.now){import_node_fs7.default.rmSync(stagingDir,{recursive:!0,force:!0}),import_node_fs7.default.mkdirSync(stagingDir,{recursive:!0,mode:448}),this.stagingDir=stagingDir,this.ttlMs=ttlMs,this.maxSize=maxSize,this.now=now}mint(declaredSize){if(declaredSize<=0||declaredSize>this.maxSize)throw new Error(`declared size ${declaredSize} outside (0, ${this.maxSize}]`);let ref=REF_PREFIX+(0,import_node_crypto22.randomBytes)(REF_BYTE_LEN).toString("hex");return this.sweep(),this.slots.set(ref,{declaredSize,expiresAtMs:this.now()+this.ttlMs,uploaded:!1}),{ref,ttlMs:this.ttlMs}}async receive(ref,body){let slot=this.slots.get(ref);if(slot===void 0||this.now()>slot.expiresAtMs)throw new SlotUnknownError;if(slot.uploaded)throw new SlotConsumedError;let declared=slot.declaredSize,filePath=this.stagePath(ref),written=0;try{await(0,import_promises5.pipeline)(body,limitBytes(declared+1,n3=>{written+=n3}),import_node_fs7.default.createWriteStream(filePath,{flags:"w",mode:384}))}catch(error2){throw await import_node_fs7.default.promises.rm(filePath,{force:!0}),new Error(`failed to receive upload: ${error2 instanceof Error?error2.message:String(error2)}`)}if(written!==declared)throw await import_node_fs7.default.promises.rm(filePath,{force:!0}),new SizeMismatchError(written,declared);let current=this.slots.get(ref);if(current===void 0||this.now()>current.expiresAtMs)throw await import_node_fs7.default.promises.rm(filePath,{force:!0}),new SlotUnknownError;current.uploaded=!0}async consume(ref){let slot=this.slots.get(ref);if(slot===void 0||this.now()>slot.expiresAtMs)throw new SlotUnknownError;if(!slot.uploaded)throw new SlotEmptyError;this.slots.delete(ref);let filePath=this.stagePath(ref);try{return await import_node_fs7.default.promises.readFile(filePath)}catch(error2){throw new Error(`failed to read staged artifact: ${error2 instanceof Error?error2.message:String(error2)}`)}finally{await import_node_fs7.default.promises.rm(filePath,{force:!0})}}sweep(){let nowMs=this.now();for(let[ref,slot]of this.slots)nowMs>slot.expiresAtMs&&(this.slots.delete(ref),import_node_fs7.default.rmSync(this.stagePath(ref),{force:!0}))}stagedFileName(ref){return`${ref}.zip`}stagePath(ref){return import_node_path12.default.join(this.stagingDir,this.stagedFileName(ref))}};function limitBytes(limit,onBytes){return async function*(source){let remaining=limit;for await(let chunk of source){if(remaining<=0)return;let slice=chunk.length<=remaining?chunk:chunk.subarray(0,remaining);remaining-=slice.length,onBytes(slice.length),yield slice}}}function uploadUrl(baseUrl,ref){return`${trimTrailingSlash(baseUrl)}${SKILL_ARTIFACTS_PATH_PREFIX}${UPLOADS_SEGMENT}${ref}`}function downloadUrl(baseUrl,storageKey){return`${trimTrailingSlash(baseUrl)}${SKILL_ARTIFACTS_PATH_PREFIX}/${storageKey}`}function trimTrailingSlash(url){return url.endsWith("/")?url.slice(0,-1):url}function newSkillTransferLane(slots,artifacts,logger2){return(request,response)=>{let pathOnly=(request.url??"").split("?")[0]??"";if(!pathOnly.startsWith(SKILL_ARTIFACTS_PATH_PREFIX)){writeText(response,404,"404 page not found");return}let rest=pathOnly.slice(SKILL_ARTIFACTS_PATH_PREFIX.length),logDetachedFailure=arm=>error2=>{logger2.error(`skill transfer lane ${arm} handler failed`,{error:error2 instanceof Error?error2.message:String(error2)})};if(rest.startsWith(UPLOADS_SEGMENT)){let ref=rest.slice(UPLOADS_SEGMENT.length);handleUpload(request,response,slots,ref,logger2).catch(logDetachedFailure("upload"));return}handleDownload(request,response,artifacts,rest.replace(/^\//,""),logger2).catch(logDetachedFailure("download"))}}async function handleUpload(request,response,slots,ref,logger2){if(request.method!=="PUT"){response.setHeader("Allow","PUT"),writeText(response,405,"method not allowed");return}try{await slots.receive(ref,request),response.statusCode=204,response.end()}catch(error2){error2 instanceof SlotUnknownError?writeText(response,404,"upload reference unknown or expired \u2014 request a new upload URL"):error2 instanceof SlotConsumedError?writeText(response,409,"upload reference already used \u2014 request a new upload URL"):error2 instanceof SizeMismatchError?writeText(response,400,`${error2.message} \u2014 the upload must match the size declared to createArtifactUploadUrl`):(logger2.error("skill artifact upload failed",{ref,error:error2 instanceof Error?error2.message:String(error2)}),writeText(response,500,"failed to stage upload"))}}async function handleDownload(request,response,artifacts,key,logger2){if(request.method!=="GET"){response.setHeader("Allow","GET"),writeText(response,405,"method not allowed");return}if(!key.startsWith(DOWNLOAD_KEY_PREFIX)){writeText(response,404,"404 page not found");return}let data;try{data=await artifacts.get(key)}catch(error2){if(error2 instanceof ArtifactNotFoundError){writeText(response,404,"404 page not found");return}logger2.error("skill artifact download failed",{storageKey:key,error:error2 instanceof Error?error2.message:String(error2)}),writeText(response,500,"failed to load artifact");return}response.setHeader("Content-Type","application/zip"),response.setHeader("Content-Length",String(data.length)),response.statusCode=200,response.end(Buffer.from(data))}function writeText(response,status,body){response.statusCode=status,response.setHeader("Content-Type","text/plain; charset=utf-8"),response.end(`${body}
-`)}var PLUGIN_ARTIFACT_KEY_PREFIX="plugins/",VERSION_TAG_PATTERN=/^[a-zA-Z0-9._-]+$/,BUILT_IN_SUB_AGENT_NAMES=new Set(["explore","shell","general-purpose"]);var TRANSFER_LANE_NOT_CONFIGURED2="plugin artifact transfer lane is not configured on this server",SERVER_WARNING_KINDS={componentIgnored:"component-ignored",modelHintUnresolved:"model-hint-unresolved",subAgentNameBuiltin:"sub-agent-name-builtin",versionNotTaggable:"version-not-taggable"};var MEMBER_KINDS=[{kind:ApiResourceKind.skill,schema:SkillSchema},{kind:ApiResourceKind.mcp_server,schema:McpServerSchema},{kind:ApiResourceKind.agent,schema:AgentSchema},{kind:ApiResourceKind.workflow,schema:WorkflowSchema}];function memberOf(kind,metadata){return{kind,id:metadata.id,slug:metadata.slug,name:metadata.name,version:metadata.labels[PLUGIN_VERSION_LABEL]??""}}async function findMembers(store,pluginId,org){let members=[];for(let{kind,schema:schema2}of MEMBER_KINDS){let raws=await store.findAllByLabel(kind,PLUGIN_LABEL,pluginId,schema2);for(let raw of raws){let metadata=metadataOf(fromBinary2(schema2,raw));metadata!==void 0&&metadata.org===org&&members.push(memberOf(kind,metadata))}}return members}async function slugHolder(store,planned,org){let entry=MEMBER_KINDS.find(candidate=>candidate.kind===planned.kind);if(entry===void 0)throw new Error(`kind ${ApiResourceKind[planned.kind]} is not a plugin member kind`);let existing=await findResourceBySlug(store,planned.kind,entry.schema,planned.slug,org),metadata=existing===void 0?void 0:metadataOf(existing);return metadata===void 0?{held:!1}:{held:!0,byPlugin:pluginIdOf(metadata),holder:memberOf(planned.kind,metadata)}}function membersConverge(existing,planned,digest3){if(existing.length!==planned.length)return!1;let byKey=new Map(existing.map(member2=>[`${member2.kind}:${member2.slug}`,member2]));return planned.every(member2=>{let found=byKey.get(`${member2.kind}:${member2.slug}`);return found!==void 0&&found.version===digest3})}function droppedMembers(existing,planned){let keep=new Set(planned.map(member2=>`${member2.kind}:${member2.slug}`));return existing.filter(member2=>!keep.has(`${member2.kind}:${member2.slug}`))}var PLUGIN_DOCUMENT_LIMITS={manifest:262144,mcpConfig:262144,skillMd:1048576,subAgent:1048576,overlay:1048576,marketplace:1048576},encoder5=new TextEncoder,decoder3=new TextDecoder("utf-8",{fatal:!1});function comparePaths(a5,b7){return a5<b7?-1:a5>b7?1:0}function decodeUtf8(bytes){let text=decoder3.decode(bytes);return text.charCodeAt(0)===65279?text.slice(1):text}function isContainedPath(path14){return path14===""||path14.startsWith("/")||path14.includes("\\")?!1:path14.split("/").every(segment=>segment!==""&&segment!=="."&&segment!=="..")}var GLOB_CHARACTERS=/[*?[\]{}]/;function resolveDeclaredPath(value){if(GLOB_CHARACTERS.test(value))return{ok:!1,kind:"path-glob-unsupported"};if(value==="."||value==="./")return{ok:!0,path:""};if(!value.startsWith("./"))return{ok:!1,kind:"path-not-relative"};let trimmed=value.slice(2).replace(/\/+$/,"");return trimmed===""?{ok:!0,path:""}:isContainedPath(trimmed)?{ok:!0,path:trimmed}:{ok:!1,kind:"path-escapes-root"}}function joinPath(dir,name){return dir===""?name:`${dir}/${name}`}function basename(path14){let slash=path14.lastIndexOf("/");return slash===-1?path14:path14.slice(slash+1)}function dirname(path14){let slash=path14.lastIndexOf("/");return slash===-1?"":path14.slice(0,slash)}var PluginFileIndex=class{files;byPath;constructor(files){this.files=files,this.byPath=new Map(files.entries.map(entry=>[entry.path,entry]))}has(path14){return this.byPath.has(path14)}entry(path14){return this.byPath.get(path14)}filesUnder(dir){if(dir==="")return this.files.entries.map(entry=>entry.path);let prefix=`${dir}/`;return this.files.entries.filter(entry=>entry.path.startsWith(prefix)).map(entry=>entry.path)}isDirectory(dir){if(dir==="")return this.files.entries.length>0;let prefix=`${dir}/`;return this.files.entries.some(entry=>entry.path.startsWith(prefix))}childDirectories(dir){let prefix=dir===""?"":`${dir}/`,names=new Set;for(let entry of this.files.entries){if(!entry.path.startsWith(prefix))continue;let rest=entry.path.slice(prefix.length),slash=rest.indexOf("/");slash!==-1&&names.add(rest.slice(0,slash))}return[...names].sort(comparePaths)}childFiles(dir){let prefix=dir===""?"":`${dir}/`,names=[];for(let entry of this.files.entries){if(!entry.path.startsWith(prefix))continue;let rest=entry.path.slice(prefix.length);rest.includes("/")||names.push(rest)}return names.sort(comparePaths)}};function readText(index2,path14,cls,findings){let bytes=readBytes(index2,path14,cls,findings);return bytes===void 0?void 0:decodeUtf8(bytes)}function readBytes(index2,path14,cls,findings){let limit=PLUGIN_DOCUMENT_LIMITS[cls],entry=index2.entry(path14);if(entry===void 0)throw new Error(`plugin file '${path14}' is not listed`);if(entry.size>limit){findings.error("document-too-large",{path:path14,subject:String(entry.size),detail:String(limit)});return}let bytes=index2.files.read(path14);if(bytes.length>limit){findings.error("document-too-large",{path:path14,subject:String(bytes.length),detail:String(limit)});return}return bytes}function parseJsonObject(text,path14,kind,findings){let value;try{value=JSON.parse(text)}catch(error2){findings.error(kind,{path:path14,detail:error2 instanceof Error?error2.message:String(error2)});return}if(!isJsonObject2(value)){findings.error(kind,{path:path14,detail:"the document is not a JSON object"});return}return value}function isJsonObject2(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)}function isStringArray(value){return Array.isArray(value)&&value.every(item=>typeof item=="string")}function isStringRecord(value){return isJsonObject2(value)&&Object.values(value).every(item=>typeof item=="string")}function describeValue(value){return typeof value=="string"?value:JSON.stringify(value)}function fields(object){return Object.entries(object)}function optionalString(object,field2,path14,findings){let value=object[field2];if(value!==void 0){if(typeof value!="string"){findings.error("manifest-field-type",{path:path14,subject:field2,detail:"a string"});return}return value}}function optionalStringArray(object,field2,path14,findings){let value=object[field2];if(value!==void 0){if(!isStringArray(value)){findings.error("manifest-field-type",{path:path14,subject:field2,detail:"an array of strings"});return}return value}}function stringOrStringArray(object,field2,path14,findings){let value=object[field2];if(value!==void 0){if(typeof value=="string")return[value];if(isStringArray(value))return value;findings.error("manifest-field-type",{path:path14,subject:field2,detail:"a string or an array of strings"})}}function warnUnknownFields(object,known,path14,findings){for(let[name]of fields(object))known.has(name)||findings.warn("manifest-field-unknown",{path:path14,subject:name})}function readIdentity(object,path14,findings){let identity2={},name=optionalString(object,"name",path14,findings);name!==void 0&&(identity2.name=name);let version=optionalString(object,"version",path14,findings);version!==void 0&&(identity2.version=version);let description=optionalString(object,"description",path14,findings);description!==void 0&&(identity2.description=description);let homepage=optionalString(object,"homepage",path14,findings);homepage!==void 0&&(identity2.homepage=homepage);let repository=optionalString(object,"repository",path14,findings);repository!==void 0&&(identity2.repository=repository);let license=optionalString(object,"license",path14,findings);license!==void 0&&(identity2.license=license);let keywords=optionalStringArray(object,"keywords",path14,findings);keywords!==void 0&&(identity2.keywords=keywords);let author=readAuthor(object,path14,findings);return author!==void 0&&(identity2.author=author),identity2}function readAuthor(object,path14,findings){let value=object.author;if(value===void 0)return;if(!isJsonObject2(value)){findings.error("manifest-field-type",{path:path14,subject:"author",detail:"an object"});return}let author={},name=optionalString(value,"name",path14,findings);name!==void 0&&(author.name=name);let email=optionalString(value,"email",path14,findings);email!==void 0&&(author.email=email);let url=optionalString(value,"url",path14,findings);return url!==void 0&&(author.url=url),author}function readDeclaredPaths(object,field2,path14,findings){let values=stringOrStringArray(object,field2,path14,findings);if(values===void 0)return;let declared=[];for(let value of values){let resolved=resolveDeclaredPath(value);if(!resolved.ok){findings.error(resolved.kind,{path:path14,subject:value});continue}declared.push({path:resolved.path,manifest:path14})}return declared}function readMcpSources(object,field2,path14,dialect,findings){let value=object[field2];if(value===void 0)return[];let items=Array.isArray(value)?value:[value],sources=[];for(let item of items)if(typeof item=="string"){let resolved=resolveDeclaredPath(item);if(!resolved.ok){findings.error(resolved.kind,{path:path14,subject:item});continue}sources.push({kind:"file",path:resolved.path,dialect,manifest:path14})}else isJsonObject2(item)?sources.push({kind:"inline",manifest:path14,servers:item,dialect}):findings.error("manifest-field-type",{path:path14,subject:field2,detail:"a path, an object, or an array of either"});return sources}var IGNORED_FIELD_KINDS={hooks:"hooks",rules:"rules",commands:"commands",workflows:"workflows",outputStyles:"output-styles",lspServers:"lsp-servers",channels:"channels",dependencies:"dependencies",defaultEnabled:"default-enabled",minClientVersions:"min-client-versions",logo:"logo",apps:"apps"};function ignoredFieldComponents(object,path14){let ignored=[];for(let[name,value]of fields(object)){let kind=IGNORED_FIELD_KINDS[name];if(kind!==void 0&&ignored.push({kind,path:`${path14}#${name}`}),name==="experimental"&&isJsonObject2(value))for(let[sub]of fields(value)){let subKind=EXPERIMENTAL_KINDS[sub];subKind!==void 0&&ignored.push({kind:subKind,path:`${path14}#experimental.${sub}`})}}return ignored}var EXPERIMENTAL_KINDS={themes:"themes",monitors:"monitors",evals:"evals"};function extensionComponents(object,path14,findings){let value=object.extensions;if(value===void 0)return[];if(!isJsonObject2(value))return findings.warn("manifest-extensions-invalid",{path:path14}),[];let ignored=[];for(let[namespace,content]of fields(value))isJsonObject2(content)&&fields(content).length===0||ignored.push({kind:"extension",path:`${path14}#extensions.${namespace}`});return ignored}var CLAUDE_KNOWN_FIELDS=new Set(["name","version","description","author","homepage","repository","license","keywords","skills","commands","agents","workflows","hooks","mcpServers","outputStyles","lspServers","experimental","userConfig","channels","dependencies","defaultEnabled"]),CLAUDE_DEFAULT_MCP_CONFIG=".mcp.json";function readClaudeManifest(object,path14,findings){return readClaudeShapedManifest(object,path14,"claude",CLAUDE_KNOWN_FIELDS,findings)}function readClaudeShapedManifest(object,path14,dialect,known,findings){warnUnknownFields(object,known,path14,findings);let identity2=readIdentity(object,path14,findings),skillPaths=readDeclaredPaths(object,"skills",path14,findings)??[],agentPaths=readDeclaredPaths(object,"agents",path14,findings),declaredMcp=readMcpSources(object,"mcpServers",path14,dialect,findings),manifest={dialect,path:path14,identity:identity2,skillPaths,mcpConfigs:declaredMcp,ignored:ignoredFieldComponents(object,path14)};return agentPaths!==void 0&&(manifest.agentPaths=agentPaths),object.userConfig!==void 0&&(manifest.variables={dialect:"claude",value:object.userConfig,manifest:path14}),manifest}var KNOWN_FIELDS=new Set([...CLAUDE_KNOWN_FIELDS,"apps","interface"]);function readCodexManifest(object,path14,findings){return readClaudeShapedManifest(object,path14,"codex",KNOWN_FIELDS,findings)}var KNOWN_FIELDS2=new Set(["name","displayName","description","version","minClientVersions","author","publisher","homepage","repository","license","logo","keywords","category","tags","commands","agents","skills","rules","hooks","variables","mcpServers"]);function readCursorManifest(object,path14,findings){warnUnknownFields(object,KNOWN_FIELDS2,path14,findings);let identity2=readIdentity(object,path14,findings),skillPaths=readDeclaredPaths(object,"skills",path14,findings)??[],agentPaths=readDeclaredPaths(object,"agents",path14,findings),manifest={dialect:"cursor",path:path14,identity:identity2,skillPaths,mcpConfigs:readMcpSources(object,"mcpServers",path14,"cursor",findings),ignored:ignoredFieldComponents(object,path14)};return agentPaths!==void 0&&(manifest.agentPaths=agentPaths),object.variables!==void 0&&(manifest.variables={dialect:"cursor",value:object.variables,manifest:path14}),manifest}var AGENT_PLUGINS_MANIFEST_SCHEMA="https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",AGENT_PLUGINS_MCP_SCHEMA="https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",MANIFEST_LOCATIONS={"agent-plugins":"plugin.json",claude:".claude-plugin/plugin.json",cursor:".cursor-plugin/plugin.json",codex:".codex-plugin/plugin.json"},q3=value=>`'${value??""}'`,at=path14=>path14===void 0?"":` in ${q3(path14)}`,ERROR_MESSAGES={"no-manifest":()=>`no plugin manifest found: expected one of ${Object.values(MANIFEST_LOCATIONS).map(p3=>q3(p3)).join(", ")}`,"manifest-unreadable":c5=>`manifest ${q3(c5.path)} is not valid JSON: ${c5.detail??"parse error"}`,"manifest-schema-missing":c5=>`manifest ${q3(c5.path)} is missing the required '$schema' field; an Agent Plugins manifest declares ${q3(AGENT_PLUGINS_MANIFEST_SCHEMA)}`,"manifest-schema-unsupported":c5=>`manifest ${q3(c5.path)} declares an unsupported '$schema' ${q3(c5.detail)}; this reader supports ${q3(AGENT_PLUGINS_MANIFEST_SCHEMA)}`,"manifest-name-missing":c5=>`manifest ${q3(c5.path)} is missing the required 'name' field`,"manifest-name-invalid":c5=>`plugin name ${q3(c5.subject)}${at(c5.path)} is invalid: 1 to 64 characters of lowercase letters, digits, hyphens and periods, starting and ending alphanumeric, with no '--' or '..'`,"manifest-name-conflict":c5=>`manifests disagree on the plugin name: ${q3(c5.subject)} in ${q3(c5.path)} versus ${c5.detail??"another manifest"}`,"manifest-field-type":c5=>`field ${q3(c5.subject)}${at(c5.path)} has the wrong type: expected ${c5.detail??"a different type"}`,"path-not-relative":c5=>`path ${q3(c5.subject)}${at(c5.path)} must be plugin-relative and begin with './'`,"path-escapes-root":c5=>`path ${q3(c5.subject)}${at(c5.path)} escapes the plugin root`,"path-glob-unsupported":c5=>`path ${q3(c5.subject)}${at(c5.path)} is a glob pattern; declare directories and files by path`,"path-uncontained":c5=>`the reader listed a path outside the plugin root: ${q3(c5.path)}`,"document-too-large":c5=>`${q3(c5.path)} is ${c5.subject??"too many"} bytes, over the ${c5.detail??""}-byte limit for this kind of document`,"skill-frontmatter-missing":c5=>`${q3(c5.path)} must start with YAML frontmatter ('---')`,"skill-frontmatter-unclosed":c5=>`${q3(c5.path)} frontmatter is not closed (missing the closing '---')`,"skill-frontmatter-unreadable":c5=>`${q3(c5.path)} frontmatter is not valid YAML: ${c5.detail??"parse error"}`,"skill-name-invalid":c5=>`skill name ${q3(c5.subject)}${at(c5.path)} is invalid: lowercase letters, digits and hyphens, optionally dot-scoped, with every segment alphanumeric`,"skill-name-duplicate":c5=>`skill name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"mcp-config-unreadable":c5=>`MCP configuration ${q3(c5.path)} is not valid JSON: ${c5.detail??"parse error"}`,"mcp-config-shape":c5=>`MCP configuration ${q3(c5.path)} must be an object with an 'mcpServers' object`,"mcp-config-schema-missing":c5=>`MCP configuration ${q3(c5.path)} is missing the required '$schema' field; an Agent Plugins configuration declares ${q3(AGENT_PLUGINS_MCP_SCHEMA)}`,"mcp-config-schema-unsupported":c5=>`MCP configuration ${q3(c5.path)} declares an unsupported '$schema' ${q3(c5.detail)}; this reader supports ${q3(AGENT_PLUGINS_MCP_SCHEMA)}`,"mcp-config-field-unknown":c5=>`MCP configuration ${q3(c5.path)} has an unexpected top-level field ${q3(c5.subject)}; only '$schema' and 'mcpServers' are allowed`,"mcp-server-shape":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} must be an object`,"mcp-server-type-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'type' field the Agent Plugins format requires ('stdio', 'streamable-http' or 'sse')`,"mcp-server-transport-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has no 'type' and neither a 'command' nor a 'url' to infer it from`,"mcp-server-type-ambiguous":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares both 'command' and 'url'; a server is either stdio or HTTP`,"mcp-server-type-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an unknown 'type' ${q3(c5.detail)}; expected 'stdio', 'http', 'streamable-http' or 'sse'`,"mcp-server-field-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} that its transport does not define`,"mcp-server-field-type":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} field ${q3(c5.detail)} has the wrong type`,"mcp-server-url-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'url' its HTTP transport requires`,"mcp-server-url-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an invalid 'url' ${q3(c5.detail)}: expected an absolute HTTPS URL (HTTP only for localhost) with no user information or fragment`,"mcp-server-url-variable":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a variable in its 'url'; Stigmer sends the URL as written, so write the URL out and put variables in 'headers'`,"mcp-server-command-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'command' its stdio transport requires`,"mcp-server-command-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a 'command' that is not a single executable name; put arguments in 'args'`,"mcp-server-command-relative":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} runs a command bundled in the plugin ${q3(c5.detail)}; Stigmer runs only commands on the runner's PATH (for example 'npx' or 'uvx')`,"mcp-server-plugin-root-reference":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} references the plugin's own files through ${q3(c5.detail)}; Stigmer does not mount plugin files into the runner`,"mcp-server-cwd-unsupported":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} sets a working directory; Stigmer does not mount plugin files, so a bundled directory cannot be reached`,"mcp-server-env-literal":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} sets environment variable ${q3(c5.detail)} to a literal value; Stigmer passes declared variables by name, so write ${q3(`${c5.detail??"KEY"}: "\${${c5.detail??"KEY"}}"`)} and declare the variable`,"mcp-server-env-rename":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} maps environment variable ${q3(c5.detail)} to a differently named variable; Stigmer passes declared variables by name, so use the same name on both sides`,"mcp-server-name-duplicate":c5=>`MCP server name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"mcp-server-header-duplicate":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares header ${q3(c5.detail)} more than once (header names are case-insensitive)`,"mcp-server-header-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an invalid header name ${q3(c5.detail)}`,"sub-agent-frontmatter-unreadable":c5=>`${q3(c5.path)} frontmatter is not valid YAML: ${c5.detail??"parse error"}`,"sub-agent-instructions-short":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} has instructions under ${c5.detail??""} characters; the body of the file is the sub-agent's prompt`,"sub-agent-name-duplicate":c5=>`sub-agent name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"variable-name-invalid":c5=>`variable name ${q3(c5.subject)}${at(c5.path)} is invalid: an environment variable name is letters, digits and underscores, not starting with a digit`,"overlay-server-unknown":c5=>`${q3(c5.path)} overlays MCP server ${q3(c5.subject)}, which the plugin does not declare`,"overlay-document-unknown":c5=>`${q3(c5.path)} is not a document Stigmer reads; the 'ai.stigmer/' folder holds 'agent.yaml', 'workflows/<name>.yaml' and 'mcp-servers/<server>.yaml'`},WARNING_MESSAGES={"manifest-field-unknown":c5=>`manifest ${q3(c5.path)} has an unknown field ${q3(c5.subject)}, ignored`,"manifest-extensions-invalid":c5=>`manifest ${q3(c5.path)} has an 'extensions' field that is not an object, ignored`,"path-missing":c5=>`path ${q3(c5.subject)} declared${at(c5.path)} does not exist in the plugin`,"skill-name-defaulted":c5=>`${q3(c5.path)} has no 'name' in its frontmatter; the skill is named after its directory, ${q3(c5.subject)}`,"skill-name-differs-from-directory":c5=>`skill ${q3(c5.subject)}${at(c5.path)} is named differently from its directory ${q3(c5.detail)}`,"skill-description-missing":c5=>`skill ${q3(c5.subject)}${at(c5.path)} has no 'description'`,"mcp-config-field-ignored":c5=>`MCP configuration ${q3(c5.path)} has a top-level field ${q3(c5.subject)} Stigmer does not read, ignored`,"mcp-server-sse-mapped":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares the legacy 'sse' transport; Stigmer connects over Streamable HTTP and falls back to SSE only when the server rejects it`,"mcp-server-field-ignored":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} Stigmer does not read, ignored`,"mcp-server-auth-ignored":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an 'auth' block Stigmer does not read; OAuth for a server is declared in 'ai.stigmer/mcp-servers/${c5.subject??"<server>"}.yaml'`,"variable-inferred":c5=>`variable ${q3(c5.subject)} is referenced by MCP server ${q3(c5.detail)} but not declared; it is declared as a required secret`,"variable-unreferenced":c5=>`variable ${q3(c5.subject)}${at(c5.path)} is declared but no MCP server references it`,"variable-default-dropped":c5=>`variable ${q3(c5.subject)}${at(c5.path)} has a default value, which Stigmer does not carry; the user supplies the value`,"variable-type-narrowed":c5=>`variable ${q3(c5.subject)}${at(c5.path)} is typed ${q3(c5.detail)}; Stigmer variables are strings`,"variable-option-dropped":c5=>`variable ${q3(c5.subject)}${at(c5.path)} has a ${q3(c5.detail)} constraint, which Stigmer does not carry`,"sub-agent-name-defaulted":c5=>`${q3(c5.path)} has no 'name' in its frontmatter; the sub-agent is named after the file, ${q3(c5.subject)}`,"sub-agent-skill-unknown":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} asks for skill ${q3(c5.detail)}, which the plugin does not ship`,"sub-agent-model-unknown":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} names model ${q3(c5.detail)}, which Stigmer cannot map; the sub-agent runs on the session's model`,"sub-agent-field-ignored":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} Stigmer does not read, ignored`};var FindingCollector=class{errorSentences;warningSentences;errors=[];warnings=[];constructor(errorSentences,warningSentences){this.errorSentences=errorSentences,this.warningSentences=warningSentences}error(kind,ctx={}){this.errors.push(compose(kind,ctx,this.errorSentences[kind](ctx)))}warn(kind,ctx={}){this.warnings.push(compose(kind,ctx,this.warningSentences[kind](ctx)))}},Findings=class extends FindingCollector{constructor(){super(ERROR_MESSAGES,WARNING_MESSAGES)}};function compose(kind,ctx,message6){return{kind,...ctx.path!==void 0&&{path:ctx.path},...ctx.subject!==void 0&&{subject:ctx.subject},...ctx.detail!==void 0&&{detail:ctx.detail},message:message6}}var KNOWN_FIELDS3=new Set(["$schema","name","version","description","author","homepage","repository","license","keywords","extensions"]);function readOpenManifest(object,path14,findings){let schema2=object.$schema;return schema2===void 0?findings.error("manifest-schema-missing",{path:path14}):schema2!==AGENT_PLUGINS_MANIFEST_SCHEMA&&findings.error("manifest-schema-unsupported",{path:path14,detail:describeValue(schema2)}),warnUnknownFields(object,KNOWN_FIELDS3,path14,findings),{dialect:"agent-plugins",path:path14,identity:readIdentity(object,path14,findings),skillPaths:[],mcpConfigs:[],ignored:extensionComponents(object,path14,findings)}}var OPEN_MCP_CONFIG="mcp.json",VENDOR_PRECEDENCE=["claude","cursor","codex"],NAME_MAX_LENGTH=64,NAME_PATTERN=/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/;function detectManifests(index2,findings){let manifests=[],present=dialect=>{let path14=MANIFEST_LOCATIONS[dialect];if(!index2.has(path14))return;let object=readManifestObject(index2,path14,findings),manifest=object===void 0?emptyManifest(dialect,path14):readDialect(dialect,object,path14,findings);return manifests.push(manifest),manifest},root5=present("agent-plugins"),vendors=VENDOR_PRECEDENCE.map(present).filter(m3=>m3!==void 0);if(manifests.length===0){findings.error("no-manifest");return}let identity2=root5??vendors[0];if(identity2===void 0)throw new Error("manifest set without an identity manifest");let ordered=[identity2,...manifests.filter(m3=>m3!==identity2)],name=resolveName(identity2,ordered,findings);return{dialect:identity2.dialect,manifests:ordered,name,readsAgents:vendors.length>0,mcpSources:resolveMcpSources(index2,root5,vendors)}}function readManifestObject(index2,path14,findings){let text=readText(index2,path14,"manifest",findings);return text===void 0?void 0:parseJsonObject(text,path14,"manifest-unreadable",findings)}function readDialect(dialect,object,path14,findings){switch(dialect){case"agent-plugins":return readOpenManifest(object,path14,findings);case"claude":return readClaudeManifest(object,path14,findings);case"cursor":return readCursorManifest(object,path14,findings);case"codex":return readCodexManifest(object,path14,findings);default:{let exhaustive=dialect;throw new Error(`unknown dialect ${String(exhaustive)}`)}}}function emptyManifest(dialect,path14){return{dialect,path:path14,identity:{},skillPaths:[],mcpConfigs:[],ignored:[]}}function resolveName(identity2,all,findings){let name=identity2.identity.name;if(name===void 0){if(findings.errors.some(f5=>f5.kind==="manifest-unreadable"&&f5.path===identity2.path))return;findings.error("manifest-name-missing",{path:identity2.path});return}let valid=!0;isValidPluginName(name)||(findings.error("manifest-name-invalid",{path:identity2.path,subject:name}),valid=!1);for(let other of all){if(other===identity2)continue;let otherName=other.identity.name;otherName!==void 0&&otherName!==name&&(findings.error("manifest-name-conflict",{path:identity2.path,subject:name,detail:`'${otherName}' in '${other.path}'`}),valid=!1)}return valid?name:void 0}function isValidPluginName(name){return name.length<=NAME_MAX_LENGTH&&NAME_PATTERN.test(name)&&!name.includes("--")&&!name.includes("..")}function resolveMcpSources(index2,root5,vendors){let sources=[];root5!==void 0&&index2.has(OPEN_MCP_CONFIG)&&sources.push({kind:"file",path:OPEN_MCP_CONFIG,dialect:"agent-plugins",manifest:root5.path});for(let vendor of vendors)vendor.mcpConfigs.length>0?sources.push(...vendor.mcpConfigs):vendor.dialect!=="cursor"&&index2.has(CLAUDE_DEFAULT_MCP_CONFIG)&&sources.push({kind:"file",path:CLAUDE_DEFAULT_MCP_CONFIG,dialect:vendor.dialect,manifest:vendor.path});let seen=new Set;return sources.filter(source=>source.kind==="inline"?!0:seen.has(source.path)?!1:(seen.add(source.path),!0))}var import_yaml=__toESM(require_dist2(),1);var SKILL_NAME_PATTERN=/^[a-z0-9]+([.-][a-z0-9]+)*$/;function extractFrontmatter(content){let lines=content.split(/\r?\n/);if(lines.length===0||lines[0]?.trim()!=="---")return{ok:!1,reason:"missing"};for(let i6=1;i6<lines.length;i6++)if(lines[i6]?.trim()==="---")return{ok:!0,yaml:lines.slice(1,i6).join(`
+`);return}let headers2={"Content-Length":String(info.size)},downloadName=url.searchParams.get(LOCAL_DOWNLOAD_QUERY_PARAM)??"";if(downloadName!==""&&(headers2["Content-Disposition"]=contentDispositionAttachment(downloadName)),res.writeHead(200,headers2),req.method==="HEAD"){res.end();return}let stream=(0,import_node_fs6.createReadStream)(filePath);stream.on("error",error2=>{logger2.error("artifact file stream failed",{key,error:error2.message}),res.destroy()}),stream.pipe(res)}catch(error2){logger2.error("artifact file server request failed",{error:error2 instanceof Error?error2.message:String(error2)}),res.headersSent||res.writeHead(500),res.end()}}async function warnOnLegacyArtifactLayout(basePath,logger2){for(let sub of["attachments","artifacts"]){let legacy=import_node_path10.default.join(basePath,"artifacts",sub);try{if((await(0,import_promises4.stat)(legacy)).isDirectory()){logger2.warn("Detected artifacts under a pre-#285 layout at <base>/artifacts/*. The artifact root is now <base> itself. Move <base>/artifacts/* up into <base> (or set ARTIFACT_LOCAL_BASE_PATH to the old <base>/artifacts) so existing artifacts remain reachable.",{legacyDir:import_node_path10.default.join(basePath,"artifacts"),artifactRoot:basePath});return}}catch{}}}var file_ai_stigmer_agentic_channelapp_v1_command=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9jb21tYW5kLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MTKOBQobQ2hhbm5lbEFwcENvbW1hbmRDb250cm9sbGVyEmMKBWFwcGx5EiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcBosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAStQEKBmNyZWF0ZRIsLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAaLC5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwIk/CuBhLCB8QHiIMbWV0YWRhdGEub3JnKjd1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIGNoYW5uZWwgYXBwIGluIHRoaXMgb3JnYW5pemF0aW9uEp8BCgZ1cGRhdGUSLC5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwGiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcCI5wrgYNQgCEDAiC21ldGFkYXRhLmlkKiJ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGNoYW5uZWwgYXBwEqkBCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiOcK4GDUIAxAwIgtyZXNvdXJjZV9pZCoidW5hdXRob3JpemVkIHRvIGRlbGV0ZSBjaGFubmVsIGFwcBoEoP8rMGIGcHJvdG8z",[file_ai_stigmer_agentic_channelapp_v1_api,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelAppCommandController=serviceDesc(file_ai_stigmer_agentic_channelapp_v1_command,0);var file_ai_stigmer_agentic_channelapp_v1_io=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9pby5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEiTAoLQ2hhbm5lbEFwcHMSPQoHZW50cmllcxgBIAMoCzIsLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiMQoZTGlzdENoYW5uZWxBcHBzQnlPcmdJbnB1dBIUCgNvcmcYASABKAlCB7pIBHICEAFiBnByb3RvMw",[file_ai_stigmer_agentic_channelapp_v1_api,file_buf_validate_validate]),ChannelAppsSchema=messageDesc2(file_ai_stigmer_agentic_channelapp_v1_io,0);var file_ai_stigmer_agentic_channelapp_v1_query=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9xdWVyeS5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEy9gMKGUNoYW5uZWxBcHBRdWVyeUNvbnRyb2xsZXISlQEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcCIxwrgYLQgBEDAiBXZhbHVlKiB1bmF1dGhvcml6ZWQgdG8gdmlldyBjaGFubmVsIGFwcBJ6Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiBNC4GAESvgEKCWxpc3RCeU9yZxI7LmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkxpc3RDaGFubmVsQXBwc0J5T3JnSW5wdXQaLS5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwcyJFwrgYQQgBEB4iA29yZyo2dW5hdXRob3JpemVkIHRvIGxpc3QgY2hhbm5lbCBhcHBzIGluIHRoaXMgb3JnYW5pemF0aW9uGgSg/yswYgZwcm90bzM",[file_ai_stigmer_agentic_channelapp_v1_api,file_ai_stigmer_agentic_channelapp_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelAppQueryController=serviceDesc(file_ai_stigmer_agentic_channelapp_v1_query,0);async function destroySecretBackingState(secretService,logger2,fields2,storedValues){for(let storedValue of storedValues)if(storedValue!=="")try{await secretService.delete(storedValue)}catch(error2){logger2.error("secret backing-state destruction failed after persist \u2014 external state may be orphaned",{...fields2,error:error2 instanceof Error?error2.message:String(error2)})}}function newDestroySecretBackingStateStep(secretService,logger2,extractSecretValues){return{name:"DestroySecretBackingState",async execute(ctx){let deleted=ctx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)return;let metadata=deleted.metadata;await destroySecretBackingState(secretService,logger2,{kind:getKindName(ctx.apiResourceKind),resourceId:metadata?.id??""},extractSecretValues(deleted))}}}var REDACTED_MARKER2="***REDACTED***";function plaintextRequiredMessage(fieldName){return`${fieldName} must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients`}function markerOnCreateMessage(fieldName){return`cannot use the redaction marker as ${fieldName} on create`}function noExistingSecretMessage(fieldName){return`cannot preserve ${fieldName}: no existing secret value found`}var PROVIDER_IMMUTABLE_MESSAGE="the provider of a channel app cannot be changed";function deleteBlockedByChannelMessage(org,slug,channelName){return`cannot delete ChannelApp '${org}/${slug}': referenced by agent channel '${channelName}'`}function redactChannelApp(app){let provider=app.spec?.providerConfig;switch(provider?.case){case"slack":redactSlack(provider.value);return;case"whatsapp":redactWhatsApp(provider.value);return;case void 0:return;default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}function redactSlack(slack){slack.clientSecret!==""&&(slack.clientSecret=REDACTED_MARKER2),slack.signingSecret!==""&&(slack.signingSecret=REDACTED_MARKER2)}function redactWhatsApp(whatsapp){whatsapp.appSecret!==""&&(whatsapp.appSecret=REDACTED_MARKER2),whatsapp.accessToken!==""&&(whatsapp.accessToken=REDACTED_MARKER2),whatsapp.verifyToken!==""&&(whatsapp.verifyToken=REDACTED_MARKER2)}function secretValuesOfChannelApp(app){let provider=app.spec?.providerConfig;switch(provider?.case){case"slack":return[provider.value.clientSecret,provider.value.signingSecret];case"whatsapp":return[provider.value.appSecret,provider.value.accessToken,provider.value.verifyToken];case void 0:return[];default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}function newEncryptChannelAppSecretsForCreateStep(secretService,logger2){return newEncryptChannelAppSecretsStep(secretService,logger2,!0)}function newEncryptChannelAppSecretsForUpdateStep(secretService,logger2){return newEncryptChannelAppSecretsStep(secretService,logger2,!1)}function newEncryptChannelAppSecretsStep(secretService,logger2,isCreate){async function resolveSecret(ctx,fieldName,requestValue,readExisting){if(requestValue==="")return requestValue;if(requestValue===REDACTED_MARKER2)return preserveExistingSecret2(ctx,fieldName,readExisting);if(isCiphertextShaped(requestValue))throw invalidArgumentError(plaintextRequiredMessage(fieldName));if(!secretService.isEnabled())return logger2.warn(`Encryption disabled: ${fieldName} will be stored in plaintext`),requestValue;try{return await secretService.encrypt(requestValue,EncryptionScope.forOrganization(ctx.newState.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt ${fieldName}`)}}function preserveExistingSecret2(ctx,fieldName,readExisting){if(isCreate)throw invalidArgumentError(markerOnCreateMessage(fieldName));let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not loaded"),`cannot preserve ${fieldName}: existing resource not loaded`);let existingSecret=readExisting(existing);if(existingSecret==="")throw invalidArgumentError(noExistingSecretMessage(fieldName));return existingSecret}return{name:"EncryptChannelAppSecrets",async execute(ctx){let provider=ctx.newState.spec?.providerConfig;switch(provider?.case){case"slack":{let slack=provider.value;slack.clientSecret=await resolveSecret(ctx,"client_secret",slack.clientSecret,existing=>existing.spec?.providerConfig.case==="slack"?existing.spec.providerConfig.value.clientSecret:""),slack.signingSecret=await resolveSecret(ctx,"signing_secret",slack.signingSecret,existing=>existing.spec?.providerConfig.case==="slack"?existing.spec.providerConfig.value.signingSecret:"");return}case"whatsapp":{let whatsapp=provider.value;whatsapp.appSecret=await resolveSecret(ctx,"app_secret",whatsapp.appSecret,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.appSecret:""),whatsapp.accessToken=await resolveSecret(ctx,"access_token",whatsapp.accessToken,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.accessToken:""),whatsapp.verifyToken=await resolveSecret(ctx,"verify_token",whatsapp.verifyToken,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.verifyToken:"");return}case void 0:return;default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}}}function newValidateProviderImmutableStep(){return{name:"ValidateProviderImmutable",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing channel app not found in context"),"existing channel app not found in context");let existingCase=existing.spec?.providerConfig.case,inputCase=ctx.input.spec?.providerConfig.case;if(existingCase!==inputCase)throw invalidArgumentError(PROVIDER_IMMUTABLE_MESSAGE)}}}function newCheckNoReferencingChannelsStep(store,logger2){return{name:"CheckNoReferencingChannels",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing ChannelApp not loaded in delete pipeline"),"existing ChannelApp not loaded in delete pipeline");let org=existing.metadata?.org??"",slug=existing.metadata?.slug??"",rows;try{rows=await store.listResources(ApiResourceKind.agent_channel)}catch(error2){throw internalError(error2,"failed to list agent channels for referential integrity check")}for(let bytes of rows){let channel;try{channel=fromBinary2(AgentChannelSchema,bytes)}catch{logger2.warn("Failed to unmarshal agent channel during referential integrity check, skipping");continue}let ref=channel.spec?.appRef;if(ref===void 0||ref.slug==="")continue;if((ref.org!==""?ref.org:channel.metadata?.org??"")===org&&ref.slug===slug)throw failedPreconditionError(deleteBlockedByChannelMessage(org,slug,channel.metadata?.name??""))}}}}function registerChannelAppServices(router,deps){router.service(ChannelAppCommandController,{apply:(app,ctx)=>apply6(deps,app,ctx),create:(app,ctx)=>createChannelApp(deps,app,ctx),update:(app,ctx)=>update9(deps,app,ctx),delete:(input,ctx)=>deleteChannelApp(deps,input,ctx)}),router.service(ChannelAppQueryController,{get:(id,ctx)=>get12(deps,id,ctx),getByReference:(ref,ctx)=>getByReference6(deps,ref,ctx),listByOrg:(req,ctx)=>listByOrg(deps,req,ctx)})}function kindOf11(ctx){return ctx.values.get(apiResourceKindKey)}async function createChannelApp(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));return await newPipeline("channelapp-create",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEncryptChannelAppSecretsForCreateStep(deps.secretService,deps.logger)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),redactChannelApp(reqCtx.newState),reqCtx.newState}async function update9(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));return await newPipeline("channelapp-update",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateProviderImmutableStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newEncryptChannelAppSecretsForUpdateStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).build().execute(reqCtx),redactChannelApp(reqCtx.newState),reqCtx.newState}async function apply6(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-apply",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createChannelApp(deps,app,ctx):update9(deps,withResolvedApplyId(ChannelAppSchema,app,reqCtx),ctx)}async function deleteChannelApp(deps,input,ctx){let reqCtx=new RequestContext(ChannelAppCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf11(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("channelapp-delete",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,ChannelAppSchema)).addStep(newCheckNoReferencingChannelsStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,secretValuesOfChannelApp)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted ChannelApp not found in context"),"deleted ChannelApp not found in context");let app=deleted;return redactChannelApp(app),app}async function get12(deps,id,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-get",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ChannelAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactChannelApp(app),app}async function getByReference6(deps,ref,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-get-by-reference",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ChannelAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactChannelApp(app),app}var LIST_RESULT_KEY4="listResult";async function listByOrg(deps,req,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.listByOrg.input,req,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-list-by-org",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgStep(deps.store,deps.logger)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY4);if(result===void 0)throw internalError(new Error("ChannelApp list not found in context"),"ChannelApp list not found in context");return result}function newListByOrgStep(store,logger2){return{name:"ListByOrg",async execute(ctx){let org=ctx.input.org,rows;try{rows=await store.listResources(ApiResourceKind.channel_app)}catch(error2){throw internalError(error2,"failed to list ChannelApps")}let apps=[];for(let bytes of rows){let app;try{app=fromBinary2(ChannelAppSchema,bytes)}catch{logger2.warn("Failed to unmarshal ChannelApp, skipping");continue}(app.metadata?.org??"")===org&&(redactChannelApp(app),apps.push(app))}apps.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY4,create2(ChannelAppsSchema,{entries:apps}))}}}var file_ai_stigmer_agentic_environment_v1_command=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvZW52aXJvbm1lbnQvdjEvY29tbWFuZC5wcm90bxIhYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxMoMKChxFbnZpcm9ubWVudENvbW1hbmRDb250cm9sbGVyEmcKBWFwcGx5Ei4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50Gi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50ErkBCgZjcmVhdGUSLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiT8K4GEsIDBAeIgxtZXRhZGF0YS5vcmcqN3VuYXV0aG9yaXplZCB0byBjcmVhdGUgZW52aXJvbm1lbnQgaW4gdGhpcyBvcmdhbml6YXRpb24SowEKBnVwZGF0ZRIuLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudBouLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudCI5wrgYNQgCEDUiC21ldGFkYXRhLmlkKiJ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGVudmlyb25tZW50Er8BChB1cGRhdGVWaXNpYmlsaXR5EjUuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlVwZGF0ZVZpc2liaWxpdHlJbnB1dBouLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudCJEwrgYQAgCEDUiC3Jlc291cmNlX2lkKi11bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGVudmlyb25tZW50IHZpc2liaWxpdHkSqwEKBmRlbGV0ZRI2LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZURlbGV0ZUlucHV0Gi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50IjnCuBg1CAIQNSILcmVzb3VyY2VfaWQqInVuYXV0aG9yaXplZCB0byBkZWxldGUgZW52aXJvbm1lbnQSzwEKD3VwZGF0ZVZhcmlhYmxlcxJELmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5VcGRhdGVFbnZpcm9ubWVudFZhcmlhYmxlc1JlcXVlc3QaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiRsK4GEIIAhA1Ig5lbnZpcm9ubWVudF9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBlbnZpcm9ubWVudCB2YXJpYWJsZXMSzwEKD3JlbW92ZVZhcmlhYmxlcxJELmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5SZW1vdmVFbnZpcm9ubWVudFZhcmlhYmxlc1JlcXVlc3QaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiRsK4GEIIAhA1Ig5lbnZpcm9ubWVudF9pZCosdW5hdXRob3JpemVkIHRvIHJlbW92ZSBlbnZpcm9ubWVudCB2YXJpYWJsZXMaBKD/KzViBnByb3RvMw",[file_ai_stigmer_agentic_environment_v1_api,file_ai_stigmer_agentic_environment_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EnvironmentCommandController=serviceDesc(file_ai_stigmer_agentic_environment_v1_command,0);var file_ai_stigmer_agentic_environment_v1_query=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvZW52aXJvbm1lbnQvdjEvcXVlcnkucHJvdG8SIWFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MTKMBQoaRW52aXJvbm1lbnRRdWVyeUNvbnRyb2xsZXISlgEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50IjDCuBgsCAEQNSIFdmFsdWUqH3VuYXV0aG9yaXplZCB0byBnZXQgZW52aXJvbm1lbnQSfAoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiBNC4GAES0gEKDmdldFNlY3JldFZhbHVlEj4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50U2VjcmV0VmFsdWVJbnB1dBozLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudFZhbHVlIkvCuBhHCBAQNSIOZW52aXJvbm1lbnRfaWQqMXVuYXV0aG9yaXplZCB0byByZWFkIHNlY3JldCB2YWx1ZXMgKGNyZWF0b3Itb25seSkSfAoEbGlzdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5MaXN0RW52aXJvbm1lbnRzUmVxdWVzdBoyLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudExpc3QiBNC4GAEaBKD/KzViBnByb3RvMw",[file_ai_stigmer_agentic_environment_v1_api,file_ai_stigmer_agentic_environment_v1_io,file_ai_stigmer_agentic_environment_v1_spec,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EnvironmentQueryController=serviceDesc(file_ai_stigmer_agentic_environment_v1_query,0);var PERSONAL_LABEL_KEY="stigmer.ai/personal",PERSONAL_LABEL_VALUE="true",MANAGED_LABEL_KEY="stigmer.ai/managed",MANAGED_LABEL_VALUE="true";function markerRejectionMessage(key){return`variable '${key}': cannot use the redaction marker as a secret value`}function forgedCiphertextMessage(key){return`variable '${key}' must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients`}function personalEnvironmentExistsMessage(existingId){return`a personal environment already exists for this organization: ${existingId}`}var PERSONAL_SHARE_RESTRICTION="personal environments cannot be shared with the organization - create a dedicated environment with only the credentials the agent needs",MANAGED_SHARE_RESTRICTION="OAuth-managed environments cannot be shared with the organization - OAuth tokens are per-user credentials";function redactEnvironmentSecrets(env2){let data=env2?.spec?.data;if(data!==void 0)for(let value of Object.values(data))value.isSecret&&value.value!==""&&(value.value=REDACTED_MARKER)}function shareRestrictionReason(metadata){let labels=metadata?.labels??{};return labels[PERSONAL_LABEL_KEY]===PERSONAL_LABEL_VALUE?PERSONAL_SHARE_RESTRICTION:labels[MANAGED_LABEL_KEY]===MANAGED_LABEL_VALUE?MANAGED_SHARE_RESTRICTION:""}var environmentSearchExtractor={kind:ApiResourceKind.environment,schema:EnvironmentSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let env2=resource;return buildSearchResult({kind:ApiResourceKind.environment,metadata:env2.metadata,summary:env2.spec?.description??"",score,createdAt:env2.status?.audit?.specAudit?.createdAt,updatedAt:env2.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let env2=resource,metadata=env2.metadata;if(metadata!==void 0)return{name:metadata.name,description:env2.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(env2.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var SECRET_VALUE_KEY="secretValue",UPDATED_ENVIRONMENT_KEY="updatedEnvironment";function newPreserveRedactedSecretsStep(){return{name:"PreserveRedactedSecrets",execute(ctx){let data=ctx.newState.spec?.data;if(data===void 0||Object.keys(data).length===0)return;let existingData=ctx.get(EXISTING_RESOURCE_KEY)?.spec?.data??{};for(let[key,value]of Object.entries(data))if(value.isSecret){if(value.value===REDACTED_MARKER){let existingEntry=existingData[key];if(existingEntry!==void 0&&existingEntry.isSecret){data[key]=existingEntry;continue}throw invalidArgumentError(markerRejectionMessage(key))}if(isCiphertextShaped(value.value))throw invalidArgumentError(forgedCiphertextMessage(key))}}}}function newEncryptSecretValuesStep(secretService,logger2){return{name:"EncryptSecretValues",async execute(ctx){let env2=ctx.newState,data=env2.spec?.data;if(!(data===void 0||Object.keys(data).length===0)){if(!secretService.isEnabled()){hasNonEmptySecret(data)&&logger2.warn("Encryption disabled: environment secret values will be stored in plaintext",{environmentId:env2.metadata?.id??""});return}for(let[key,value]of Object.entries(data))if(!(!value.isSecret||value.value===""))try{value.value=await secretService.encrypt(value.value,EncryptionScope.forOrganization(env2.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt secret value for variable '${key}'`)}}}}}function hasNonEmptySecret(data){return Object.values(data).some(v=>v.isSecret&&v.value!=="")}function newEnforcePersonalUniquenessStep(store){return{name:"EnforcePersonalEnvUniqueness",async execute(ctx){let metadata=ctx.newState.metadata;if(metadata===void 0||metadata.labels[PERSONAL_LABEL_KEY]!==PERSONAL_LABEL_VALUE)return;let existing;try{existing=await findResourceByLabelAndOrg(store,ctx.apiResourceKind,EnvironmentSchema,PERSONAL_LABEL_KEY,PERSONAL_LABEL_VALUE,metadata.org)}catch(error2){throw internalError(error2,"failed to check personal environment uniqueness")}if(existing!==void 0)throw new ConnectError(personalEnvironmentExistsMessage(existing.metadata?.id??""),Code.AlreadyExists)}}}function newLoadEnvironmentByIdStep(store){return{name:"LoadEnvironmentByID",async execute(ctx){let environmentId=ctx.input.environmentId;if(typeof environmentId!="string"||environmentId==="")throw invalidArgumentError("environment_id is required");let env2;try{env2=await store.getResource(ctx.apiResourceKind,environmentId,EnvironmentSchema)}catch{throw notFoundError("environment",environmentId)}ctx.set(TARGET_RESOURCE_KEY,env2)}}}function newExtractAndDecryptSingleKeyStep(secretService,logger2){return{name:"ExtractAndDecryptSingleKey",async execute(ctx){let key=ctx.input.key,env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");let envValue=env2.spec?.data[key];if(envValue===void 0)throw notFoundError("environment key",key);if(envValue.isSecret&&envValue.value!==""){let decrypted;try{decrypted=await secretService.decrypt(envValue.value)}catch(error2){throw logger2.error("Failed to decrypt secret value",{key,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to decrypt secret value")}ctx.set(SECRET_VALUE_KEY,create2(EnvironmentValueSchema,{value:decrypted,isSecret:!0,description:envValue.description}));return}ctx.set(SECRET_VALUE_KEY,envValue)}}}function newMergeVariablesAndPersistStep(store,secretService,logger2){return{name:"MergeVariablesAndPersist",async execute(ctx){let env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");env2.spec===void 0&&(env2.spec=create2(EnvironmentSpecSchema,{}));let incoming=ctx.input.variables;for(let[key,incomingValue]of Object.entries(incoming)){let value=incomingValue;if(value.isSecret&&value.value===REDACTED_MARKER){let existing=env2.spec.data[key];if(existing!==void 0&&existing.isSecret)continue;throw invalidArgumentError(markerRejectionMessage(key))}if(value.isSecret&&isCiphertextShaped(value.value))throw invalidArgumentError(forgedCiphertextMessage(key));if(value.isSecret&&value.value!=="")if(!secretService.isEnabled())logger2.warn("Encryption disabled: environment secret value will be stored in plaintext",{key});else{let encrypted;try{encrypted=await secretService.encrypt(value.value,EncryptionScope.forOrganization(env2.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt secret value for variable '${key}'`)}value=create2(EnvironmentValueSchema,{value:encrypted,isSecret:!0,description:value.description})}env2.spec.data[key]=value}try{setAuditFieldsForUpdate(EnvironmentSchema,env2,"spec_audit",ctx.callerIdentity)}catch(error2){throw internalError(error2,"failed to set audit fields")}try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to persist environment after merging variables")}ctx.set(UPDATED_ENVIRONMENT_KEY,env2)}}}function newRemoveVariableKeysAndPersistStep(store,secretService,logger2){return{name:"RemoveVariableKeysAndPersist",async execute(ctx){let env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");let keys=ctx.input.keys,removedSecretValues=[];if(env2.spec?.data!==void 0)for(let key of keys){let removed=env2.spec.data[key];removed!==void 0&&removed.isSecret&&removedSecretValues.push(removed.value),delete env2.spec.data[key]}try{setAuditFieldsForUpdate(EnvironmentSchema,env2,"spec_audit",ctx.callerIdentity)}catch(error2){throw internalError(error2,"failed to set audit fields")}try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to persist environment after removing variables")}await destroySecretBackingState(secretService,logger2,{kind:"environment",resourceId:env2.metadata?.id??"",operation:"removeVariables"},removedSecretValues),ctx.set(UPDATED_ENVIRONMENT_KEY,env2)}}}function newDestroyDroppedEnvironmentSecretsStep(secretService,logger2){return{name:"DestroyDroppedEnvironmentSecrets",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY),oldData=existing?.spec?.data;if(oldData===void 0)return;let newData=ctx.newState.spec?.data??{},droppedSecretValues=Object.entries(oldData).filter(([key,value])=>value.isSecret&&newData[key]===void 0).map(([,value])=>value.value);await destroySecretBackingState(secretService,logger2,{kind:"environment",resourceId:existing?.metadata?.id??"",operation:"update"},droppedSecretValues)}}}function secretValuesOfEnvironment(env2){return Object.values(env2.spec?.data??{}).filter(value=>value.isSecret).map(value=>value.value)}function registerEnvironmentServices(router,deps){router.service(EnvironmentCommandController,{apply:(env2,ctx)=>apply7(deps,env2,ctx),create:(env2,ctx)=>createEnvironment(deps,env2,ctx),update:(env2,ctx)=>update10(deps,env2,ctx),updateVisibility:(input,ctx)=>updateVisibility3(deps,input,ctx),delete:(input,ctx)=>deleteEnvironment(deps,input,ctx),updateVariables:(req,ctx)=>updateVariables(deps,req,ctx),removeVariables:(req,ctx)=>removeVariables(deps,req,ctx)}),router.service(EnvironmentQueryController,{get:(id,ctx)=>get13(deps,id,ctx),getByReference:(ref,ctx)=>getByReference7(deps,ref,ctx),getSecretValue:(input,ctx)=>getSecretValue(deps,input,ctx),list:(req,ctx)=>list7(deps,req,ctx)})}function kindOf12(ctx){return ctx.values.get(apiResourceKindKey)}async function createEnvironment(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-create",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEnforcePersonalUniquenessStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPreserveRedactedSecretsStep()).addStep(newEncryptSecretValuesStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,environmentSearchExtractor,deps.logger)).build().execute(reqCtx),redactEnvironmentSecrets(reqCtx.newState),reqCtx.newState}async function update10(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-update",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPreserveRedactedSecretsStep()).addStep(newEncryptSecretValuesStep(deps.secretService,deps.logger)).addStep(newNormalizeReferencesStep()).addStep(newPersistStep(deps.store)).addStep(newDestroyDroppedEnvironmentSecretsStep(deps.secretService,deps.logger)).addStep(newIndexSearchStep(deps.store,environmentSearchExtractor,deps.logger)).build().execute(reqCtx),redactEnvironmentSecrets(reqCtx.newState),reqCtx.newState}async function apply7(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-apply",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createEnvironment(deps,env2,ctx):update10(deps,withResolvedApplyId(EnvironmentSchema,env2,reqCtx),ctx)}async function deleteEnvironment(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf12(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("environment-delete",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,EnvironmentSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,secretValuesOfEnvironment)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted environment not found in context"),"deleted environment not found in context");let env2=deleted;return redactEnvironmentSecrets(env2),env2}var UPDATE_VISIBILITY_ENVIRONMENT_KEY="updateVisibilityEnvironment";async function updateVisibility3(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-update-visibility",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentForVisibilityUpdateStep(deps.store)).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_ENVIRONMENT_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newAuthorizeVisibilityTransitionStep(UPDATE_VISIBILITY_ENVIRONMENT_KEY,deps.authorizer)).addStep(newValidateEnvironmentShareRestrictionStep()).addStep(newSetEnvironmentVisibilityStep()).addStep(newPersistEnvironmentForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_ENVIRONMENT_KEY)).addStep(newIndexEnvironmentAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx);let env2=reqCtx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);return redactEnvironmentSecrets(env2),env2}function newLoadEnvironmentForVisibilityUpdateStep(store){return{name:"LoadEnvironmentForVisibilityUpdate",async execute(ctx){let input=ctx.input,env2;try{env2=await store.getResource(ctx.apiResourceKind,input.resourceId,EnvironmentSchema)}catch{throw notFoundError("environment",input.resourceId)}ctx.set(UPDATE_VISIBILITY_ENVIRONMENT_KEY,env2)}}}function newValidateEnvironmentShareRestrictionStep(){return{name:"ValidateEnvironmentShareRestriction",execute(ctx){if(ctx.input.visibility!==ApiResourceVisibility.visibility_org)return;let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY),reason=shareRestrictionReason(env2.metadata);if(reason!=="")throw failedPreconditionError(reason)}}}function newSetEnvironmentVisibilityStep(){return{name:"SetVisibility",execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);env2.metadata!==void 0&&(env2.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(EnvironmentSchema,env2,"status_audit",ctx.callerIdentity)}}}function newPersistEnvironmentForVisibilityUpdateStep(store){return{name:"PersistEnvironmentForVisibilityUpdate",async execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to save environment")}}}}function newIndexEnvironmentAfterVisibilityUpdateStep(store,logger2){return{name:"IndexEnvironmentAfterVisibilityUpdate",async execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY),entry=environmentSearchExtractor.getSearchIndexEntry(env2);if(entry===void 0){logger2.warn("IndexEnvironmentAfterVisibilityUpdate: extractor returned nil, skipping",{id:env2.metadata?.id??""});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,env2.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexEnvironmentAfterVisibilityUpdate: failed (best-effort)",{id:env2.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function updateVariables(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.updateVariables.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-update-variables",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.updateVariables,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newMergeVariablesAndPersistStep(deps.store,deps.secretService,deps.logger)).build().execute(reqCtx);let updated=reqCtx.get(UPDATED_ENVIRONMENT_KEY);return redactEnvironmentSecrets(updated),updated}async function removeVariables(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.removeVariables.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-remove-variables",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.removeVariables,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newRemoveVariableKeysAndPersistStep(deps.store,deps.secretService,deps.logger)).build().execute(reqCtx);let updated=reqCtx.get(UPDATED_ENVIRONMENT_KEY);return redactEnvironmentSecrets(updated),updated}async function get13(deps,id,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-get",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,EnvironmentSchema)).build().execute(reqCtx);let env2=reqCtx.get(TARGET_RESOURCE_KEY);return redactEnvironmentSecrets(env2),env2}async function getByReference7(deps,ref,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-get-by-reference",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,EnvironmentSchema)).build().execute(reqCtx);let env2=reqCtx.get(TARGET_RESOURCE_KEY);return redactEnvironmentSecrets(env2),env2}async function getSecretValue(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.getSecretValue.input,input,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-get-secret-value",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.getSecretValue,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newExtractAndDecryptSingleKeyStep(deps.secretService,deps.logger)).build().execute(reqCtx),reqCtx.get(SECRET_VALUE_KEY)}var LIST_RESULT_KEY5="listResult";async function list7(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-list",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgAndLabelsStep5(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY5);if(result===void 0)throw internalError(new Error("environment list not found in context"),"environment list not found in context");return result}function newListByOrgAndLabelsStep5(store,listReadScope){return{name:"ListByOrgAndLabels",async execute(ctx){let{org,labels:filterLabels}=ctx.input,rows;try{rows=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list environments")}let decoded=[];for(let bytes of rows)try{decoded.push(fromBinary2(EnvironmentSchema,bytes))}catch{continue}let requested=decoded.filter(env2=>(env2.metadata?.org??"")===org&&matchesAllLabels(env2.metadata?.labels??{},filterLabels)),environments=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.environment,requested,"");for(let env2 of environments)redactEnvironmentSecrets(env2);environments.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY5,create2(EnvironmentListSchema,{totalCount:environments.length,items:environments}))}}}var file_ai_stigmer_agentic_executioncontext_v1_command=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9jb21tYW5kLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MTKuAwohRXhlY3V0aW9uQ29udGV4dENvbW1hbmRDb250cm9sbGVyEnsKBWFwcGx5EjguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQSggEKBmNyZWF0ZRI4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQaOC5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0IgTQuBgBEoABCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQiBNC4GAEaBKD/KzZiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_api,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ExecutionContextCommandController=serviceDesc(file_ai_stigmer_agentic_executioncontext_v1_command,0);var file_ai_stigmer_agentic_executioncontext_v1_io=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9pby5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEiKwoSRXhlY3V0aW9uQ29udGV4dElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiQQogRXhlY3V0aW9uQ29udGV4dEV4ZWN1dGlvbklkSW5wdXQSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABYgZwcm90bzM",[file_buf_validate_validate]);var file_ai_stigmer_agentic_executioncontext_v1_query=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9xdWVyeS5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEy0wMKH0V4ZWN1dGlvbkNvbnRleHRRdWVyeUNvbnRyb2xsZXISgQEKA2dldBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHRJZBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQiBNC4GAEShgEKDmdldEJ5UmVmZXJlbmNlEjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlGjguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dCIE0LgYARKcAQoQZ2V0QnlFeGVjdXRpb25JZBJILmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHRFeGVjdXRpb25JZElucHV0GjguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dCIE0LgYARoEoP8rNmIGcHJvdG8z",[file_ai_stigmer_agentic_executioncontext_v1_api,file_ai_stigmer_agentic_executioncontext_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ExecutionContextQueryController=serviceDesc(file_ai_stigmer_agentic_executioncontext_v1_query,0);function redactExecutionContextSecrets(ec2){let data=ec2?.spec?.data;if(data!==void 0)for(let value of Object.values(data))value.isSecret&&value.value!==""&&(value.value=REDACTED_MARKER)}var import_node_crypto18=require("node:crypto"),CONNECT_EXECUTION_ID_PREFIX="connect-";function newConnectExecutionId(mcpServerId){return`${CONNECT_EXECUTION_ID_PREFIX}${mcpServerId}-${(0,import_node_crypto18.randomUUID)().slice(0,8)}`}function isConnectExecutionId(executionId){return executionId.startsWith(CONNECT_EXECUTION_ID_PREFIX)}function isTerminalWorkflowExecutionPhase(phase){switch(phase){case ExecutionPhase2.EXECUTION_COMPLETED:case ExecutionPhase2.EXECUTION_FAILED:case ExecutionPhase2.EXECUTION_CANCELLED:case ExecutionPhase2.EXECUTION_TERMINATED:return!0;default:return!1}}var RUNNER_VERIFIER_NAME="runner",RUNNER_CREDENTIAL_INVALID_MESSAGE="runner credential is not valid on this server",RUNNER_CREDENTIAL_NOT_LIVE_MESSAGE="runner credential names a run that is over or belongs to nobody this server recognizes",RUN_CREDENTIAL_NOT_RUNS_PERSON_MESSAGE="a run credential is minted only for the person whose run it is",WORKFLOW_LINEAGE_BINDING_MISMATCH_MESSAGE="workflow lineage label names a workflow execution this runner credential is not bound to",MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE="memory capture is scoped to the session's organization";function boundExecutionKindOf(executionId){switch(kindByIdPrefix(executionId)){case ApiResourceKind.agent_execution:return"agent-execution";case ApiResourceKind.workflow_execution:return"workflow-execution";default:return isConnectExecutionId(executionId)?"mcp-connect":void 0}}function bindsARun(kind){switch(kind){case"agent-execution":case"workflow-execution":return!0;case"mcp-connect":return!1;default:{let exhaustive=kind;throw new Error(`unknown bound execution kind ${String(exhaustive)}`)}}}async function loadBoundExecution(store,executionId,now=Date.now()){let kind=boundExecutionKindOf(executionId);if(kind!==void 0)switch(kind){case"agent-execution":{let row=await getRow(store,ApiResourceKind.agent_execution,executionId,AgentExecutionSchema);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(AgentExecutionSchema,row),sessionId:row.spec?.sessionId??"",live:isLive(row.status!==void 0&&isTerminalExecutionPhase(row.status.phase),row.status?.completedAt??"",now)}}case"workflow-execution":{let row=await getRow(store,ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(WorkflowExecutionSchema,row),sessionId:"",live:isLive(row.status!==void 0&&isTerminalWorkflowExecutionPhase(row.status.phase),row.status?.completedAt??"",now)}}case"mcp-connect":{let row=await getExecutionContextRow(store,executionId);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(ExecutionContextSchema,row),sessionId:"",live:!0}}default:{let exhaustive=kind;throw new Error(`unknown bound execution kind ${String(exhaustive)}`)}}}function isLive(terminal,completedAt,now){if(!terminal)return!0;let finishedAt=Date.parse(completedAt);return Number.isNaN(finishedAt)?!1:now-finishedAt<6e5}function creatorStampOf(schema2,row){return auditOf(schema2,row)?.specAudit?.createdBy?.id??""}async function getRow(store,kind,id,schema2){try{return await store.getResource(kind,id,schema2)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function getExecutionContextRow(store,executionId){try{return await store.findByField(ApiResourceKind.execution_context,"spec.executionId",executionId,ExecutionContextSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}function ciphertextShapedMessage(key){return`value for '${key}' looks like stored ciphertext (enc:v<N>: prefix); supply the plaintext value`}var ENCRYPT_BATCH_FAILURE_MESSAGE="failed to encrypt secret values";function encryptionKeyMissingMessage(executionId,key){return`execution context for ${executionId} holds encrypted secret '${key}' but no encryption key is configured`}async function resolveValuesForCaller(deps,ctx,ec2){if(await runnerMayDecrypt(deps,ctx,ec2)){await decryptSecretValues(deps,ec2);return}redactExecutionContextSecrets(ec2)}async function runnerMayDecrypt(deps,ctx,ec2){let authorizeRead=deps.runnerAuthService.authorizeExecutionContextRead?.bind(deps.runnerAuthService);if(authorizeRead!==void 0){let token2=bearerToken(ctx);if(token2==="")return!1;try{return await authorizeRead(token2,ec2.spec?.executionId??"")}catch(error2){return deps.logger.warn("ExecutionContext read authorization failed \u2014 redacting secrets",{error:error2 instanceof Error?error2.message:String(error2)}),!1}}let token=bearerToken(ctx),executionId=verifyRunnerToken(deps,token,ec2);return executionId===void 0?!1:!isClockedToken(token)&&!await runIsLive(deps,executionId)?(deps.logger.debug("Run credential presented for a run that is over - redacting execution context secrets",{executionId}),!1):(deps.logger.debug("Scope-bound runner token presented - decrypting execution context secrets",{executionId}),!0)}function verifyRunnerToken(deps,token,ec2){if(token==="")return;let tokenExecutionId;try{tokenExecutionId=deps.runnerAuthService.verify(TOKEN_TYPE_EXECUTION_SCOPED,token)}catch{deps.logger.debug("Presented runner token failed verification - redacting execution context secrets");return}if(tokenExecutionId!==(ec2.spec?.executionId??"")){deps.logger.warn("Runner token is not scope-bound to this execution context - redacting secrets",{tokenExecutionId,executionId:ec2.spec?.executionId??""});return}return tokenExecutionId}async function runIsLive(deps,executionId){try{let execution=await loadBoundExecution(deps.store,executionId);return execution!==void 0&&bindsARun(execution.kind)&&execution.live}catch(error2){throw internalError(error2,"failed to load the run credential's execution")}}function bearerToken(ctx){return parseBearerToken(ctx.requestHeader.get("authorization")??"")}async function decryptSecretValues(deps,ec2){let executionId=ec2.spec?.executionId??"",data=ec2.spec?.data??{};for(let[key,value]of Object.entries(data))if(!(!value.isSecret||!deps.secretService.isEncrypted(value.value)))try{value.value=await deps.secretService.decrypt(value.value)}catch(error2){if(error2 instanceof EncryptionUnavailableError)throw internalError(error2,encryptionKeyMissingMessage(executionId,key));deps.logger.warn("Undecryptable ciphertext in execution context \u2014 dropping this value from the runner read",{key,executionId,error:error2 instanceof Error?error2.message:String(error2)}),delete data[key]}}var executionContextSearchExtractor={kind:ApiResourceKind.execution_context,schema:ExecutionContextSchema,getSearchSummary(){return""},toSearchResult(resource,score){let ec2=resource;return buildSearchResult({kind:ApiResourceKind.execution_context,metadata:ec2.metadata,summary:"",score,createdAt:ec2.status?.audit?.specAudit?.createdAt,updatedAt:ec2.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let ec2=resource,metadata=ec2.metadata;if(metadata!==void 0)return{name:metadata.name,description:"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(ec2.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function newRejectCiphertextShapedStep(){return{name:"RejectCiphertextShapedValues",execute(ctx){let data=ctx.input.spec?.data??{};for(let[key,value]of Object.entries(data))if(isCiphertextShaped(value.value))throw invalidArgumentError(ciphertextShapedMessage(key))}}}function newEncryptSecretValuesStep2(secretService,logger2){return{name:"EncryptSecretValues",async execute(ctx){let ec2=ctx.newState,data=ec2.spec?.data;if(data===void 0||Object.keys(data).length===0)return;if(!secretService.isEnabled()){hasNonEmptySecret2(data)&&logger2.warn("Encryption disabled: execution context secret values will be stored in plaintext",{executionId:ec2.spec?.executionId??""});return}let toSeal=new Map;for(let[key,value]of Object.entries(data))!value.isSecret||value.value===""||toSeal.set(key,value.value);if(toSeal.size===0)return;let sealed;try{sealed=await secretService.encryptAllAtMostV2(toSeal,EncryptionScope.forOrganization(ec2.metadata?.org??""))}catch(error2){throw internalError(error2,ENCRYPT_BATCH_FAILURE_MESSAGE)}for(let[key,value]of Object.entries(data)){let sealedValue=sealed.get(key);sealedValue!==void 0&&(value.value=sealedValue)}}}}function hasNonEmptySecret2(data){return Object.values(data).some(v=>v.isSecret&&v.value!=="")}function newLoadByExecutionIdStep(store){return{name:"LoadByExecutionId",async execute(ctx){let input=ctx.input;if(input.executionId==="")throw invalidArgumentError("execution_id is required");let executionContext;try{executionContext=await store.findByField(ctx.apiResourceKind,"spec.executionId",input.executionId,ExecutionContextSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("execution_context",`execution_id=${input.executionId}`):internalError(error2,"failed to query execution context")}ctx.set(TARGET_RESOURCE_KEY,executionContext)}}}function newAuthorizeExecutionContextCreateStep(authorizer){return{name:"AuthorizeCreate",async execute(ctx){let caller=ctx.callerIdentity;if(caller.callerClass==="internal"||caller.origin==="in-process")return;let decision;try{decision=await authorizer.authorize(caller,{permission:IamPermission.can_create_execution_in,resourceKind:ApiResourceKind.organization,resourceId:ctx.newState.metadata?.org??""})}catch(error2){throw internalError(error2 instanceof Error?error2:new Error(String(error2)),"execution-context create authorization could not be completed")}switch(decision.kind){case"allow":return;case"deny":case"not-found":throw new ConnectError("unauthorized to create execution context in this organization",Code.PermissionDenied);case"unavailable":throw internalError(decision.cause,"execution-context create authorization could not be completed");default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),"execution-context create authorization could not be completed")}}}}}function registerExecutionContextServices(router,deps){router.service(ExecutionContextCommandController,{apply:(ec2,ctx)=>apply8(deps,ec2,ctx),create:(ec2,ctx)=>createExecutionContext(deps,ec2,ctx),delete:(input,ctx)=>deleteExecutionContext(deps,input,ctx)}),router.service(ExecutionContextQueryController,{get:(id,ctx)=>get14(deps,id,ctx),getByReference:(ref,ctx)=>getByReference8(deps,ref,ctx),getByExecutionId:(input,ctx)=>getByExecutionId(deps,input,ctx)})}function kindOf13(ctx){return ctx.values.get(apiResourceKindKey)}async function createExecutionContext(deps,ec2,ctx){let reqCtx=new RequestContext(ExecutionContextSchema,ec2,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("execution-context-create",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeExecutionContextCreateStep(deps.authorizer)).addStep(newValidateVisibilityStep()).addStep(newRejectCiphertextShapedStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newEncryptSecretValuesStep2(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,executionContextSearchExtractor,deps.logger)).build().execute(reqCtx),redactExecutionContextSecrets(reqCtx.newState),reqCtx.newState}async function apply8(deps,ec2,ctx){let reqCtx=new RequestContext(ExecutionContextSchema,ec2,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-apply",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");if(shouldCreate)return createExecutionContext(deps,ec2,ctx);throw deps.logger.warn("ExecutionContext already exists - UPDATE not supported",{slug:ec2.metadata?.name??"",id:ec2.metadata?.id??""}),alreadyExistsError("ExecutionContext",ec2.metadata?.name??"")}async function deleteExecutionContext(deps,input,ctx){let reqCtx=new RequestContext(ExecutionContextCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf13(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("execution-context-delete",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,ExecutionContextSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted execution context not found in context"),"deleted execution context not found in context");let ec2=deleted;return redactExecutionContextSecrets(ec2),ec2}async function get14(deps,id,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ExecutionContextSchema)).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return redactExecutionContextSecrets(ec2),ec2}async function getByReference8(deps,ref,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get-by-reference",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ExecutionContextSchema)).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return redactExecutionContextSecrets(ec2),ec2}async function getByExecutionId(deps,input,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.getByExecutionId.input,input,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get-by-execution-id",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.getByExecutionId,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByExecutionIdStep(deps.store)).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return await resolveValuesForCaller(deps,ctx,ec2),ec2}var import_node_crypto19=require("node:crypto");var file_ai_stigmer_platform_github_v1_service=fileDesc("CithaS9zdGlnbWVyL3BsYXRmb3JtL2dpdGh1Yi92MS9zZXJ2aWNlLnByb3RvEh1haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MSI8ChtHZXRPQXV0aEF1dGhvcml6ZVVybFJlcXVlc3QSHQoMcmVkaXJlY3RfdXJpGAEgASgJQge6SARyAhABIkQKHEdldE9BdXRoQXV0aG9yaXplVXJsUmVzcG9uc2USFQoNYXV0aG9yaXplX3VybBgBIAEoCRINCgVzdGF0ZRgCIAEoCSJoChhFeGNoYW5nZU9BdXRoQ29kZVJlcXVlc3QSFQoEY29kZRgBIAEoCUIHukgEcgIQARIWCgVzdGF0ZRgCIAEoCUIHukgEcgIQARIdCgxyZWRpcmVjdF91cmkYAyABKAlCB7pIBHICEAEiVAoZRXhjaGFuZ2VPQXV0aENvZGVSZXNwb25zZRIUCgxhY2Nlc3NfdG9rZW4YASABKAkSEgoKdG9rZW5fdHlwZRgCIAEoCRINCgVzY29wZRgDIAEoCTK2AgoNR2l0SHViU2VydmljZRKVAQoUZ2V0T0F1dGhBdXRob3JpemVVcmwSOi5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HZXRPQXV0aEF1dGhvcml6ZVVybFJlcXVlc3QaOy5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HZXRPQXV0aEF1dGhvcml6ZVVybFJlc3BvbnNlIgTQuBgBEowBChFleGNoYW5nZU9BdXRoQ29kZRI3LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkV4Y2hhbmdlT0F1dGhDb2RlUmVxdWVzdBo4LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkV4Y2hhbmdlT0F1dGhDb2RlUmVzcG9uc2UiBNC4GAFiBnByb3RvMw",[file_ai_stigmer_commons_rpc_method_options,file_buf_validate_validate]);var GetOAuthAuthorizeUrlResponseSchema=messageDesc2(file_ai_stigmer_platform_github_v1_service,1);var ExchangeOAuthCodeResponseSchema=messageDesc2(file_ai_stigmer_platform_github_v1_service,3),GitHubService=serviceDesc(file_ai_stigmer_platform_github_v1_service,0);var GITHUB_AUTHORIZE_URL="https://github.com/login/oauth/authorize",GITHUB_TOKEN_URL="https://github.com/login/oauth/access_token",OAUTH_SCOPES="repo,read:user",HTTP_TIMEOUT_MS=1e4;function registerGitHubServices(router,deps){router.service(GitHubService,{getOAuthAuthorizeUrl:req=>getOAuthAuthorizeUrl(deps,req),exchangeOAuthCode:req=>exchangeOAuthCode(deps,req)})}function getOAuthAuthorizeUrl(deps,req){if(deps.clientId==="")throw failedPreconditionError("GitHub OAuth is not configured (STIGMER_GITHUB_CLIENT_ID not set)");let state2;try{state2=(0,import_node_crypto19.randomBytes)(16).toString("hex")}catch(error2){throw deps.logger.error("failed to generate OAuth state",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to generate OAuth state")}let authorizeUrl=GITHUB_AUTHORIZE_URL+"?"+goUrlValuesEncode({client_id:deps.clientId,redirect_uri:req.redirectUri,scope:OAUTH_SCOPES,state:state2});return create2(GetOAuthAuthorizeUrlResponseSchema,{authorizeUrl,state:state2})}async function exchangeOAuthCode(deps,req){if(deps.clientId===""||deps.clientSecret==="")throw failedPreconditionError("GitHub OAuth is not configured");let body=goUrlValuesEncode({client_id:deps.clientId,client_secret:deps.clientSecret,code:req.code,redirect_uri:req.redirectUri}),fetchImpl=deps.fetchImpl??fetch,response;try{response=await fetchImpl(GITHUB_TOKEN_URL,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body,signal:AbortSignal.timeout(HTTP_TIMEOUT_MS)})}catch(error2){throw deps.logger.error("GitHub token exchange failed",{error:error2 instanceof Error?error2.message:String(error2)}),unavailableError("failed to reach GitHub for token exchange")}let raw;try{raw=await response.text()}catch(error2){throw deps.logger.error("failed to read GitHub token response",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to read GitHub response")}let tokenResponse;try{tokenResponse=JSON.parse(raw)}catch(error2){throw deps.logger.error("failed to parse GitHub token response",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to parse GitHub response")}if(tokenResponse.error!==void 0&&tokenResponse.error!=="")throw deps.logger.warn("GitHub OAuth error",{error:tokenResponse.error,description:tokenResponse.error_description??""}),invalidArgumentError(`GitHub OAuth error: ${tokenResponse.error_description??""}`);return create2(ExchangeOAuthCodeResponseSchema,{accessToken:tokenResponse.access_token??"",tokenType:tokenResponse.token_type??"",scope:tokenResponse.scope??""})}var file_ai_stigmer_agentic_memory_v1_io=fileDesc("CiVhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2lvLnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxIiEKCE1lbW9yeUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiYAoTTGlzdE1lbW9yaWVzUmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESMwoJcGFnZV9pbmZvGAIgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbyJWCgpNZW1vcnlMaXN0EhMKC3RvdGFsX2NvdW50GAEgASgFEjMKBWl0ZW1zGAIgAygLMiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnliBnByb3RvMw",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]),MemoryIdSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,0);var MemoryListSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,2);var file_ai_stigmer_agentic_memory_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEypQUKF01lbW9yeUNvbW1hbmRDb250cm9sbGVyEloKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5GiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnkiBNC4GAESigEKBnVwZGF0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5GiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnkiNMK4GDAIAhA5IgttZXRhZGF0YS5pZCoddW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtZW1vcnkShgEKBmRlbGV0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIuwrgYKggDEDkiBXZhbHVlKh11bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1lbW9yeRKIAQoHY29uZmlybRImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIvwrgYKwgCEDkiBXZhbHVlKh51bmF1dGhvcml6ZWQgdG8gY29uZmlybSBtZW1vcnkShgEKBnJlamVjdBImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIuwrgYKggCEDkiBXZhbHVlKh11bmF1dGhvcml6ZWQgdG8gcmVqZWN0IG1lbW9yeRoEoP8rOWIGcHJvdG8z",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryCommandController=serviceDesc(file_ai_stigmer_agentic_memory_v1_command,0);var file_ai_stigmer_agentic_memory_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxMosCChVNZW1vcnlRdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIrwrgYJwgBEDkiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IG1lbW9yeRJpCgRsaXN0EjEuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5MaXN0TWVtb3JpZXNSZXF1ZXN0GiguYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlMaXN0IgTQuBgBGgSg/ys5YgZwcm90bzM",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryQueryController=serviceDesc(file_ai_stigmer_agentic_memory_v1_query,0);var MEMORY_CAPTURE_CALLER_MESSAGE="memory can only be captured for a first-party human operator",MEMORY_CAPTURE_CREDENTIAL_KEY="memoryCaptureCredential";function newGuardMemoryCaptureStep(provider){return{name:"GuardMemoryCapture",async execute(ctx){let caller=ctx.callerIdentity;if(caller.callerClass==="internal"||caller.origin==="in-process")return;let decide=provider?.authorizeMemoryCapture;if(decide!==void 0){let org=metadataOf(ctx.newState)?.org??"",decision=await decide.call(provider,caller,org);switch(decision.verdict){case"admit":ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY,{subjectIdentityAccountId:decision.subjectIdentityAccountId,provedSessionId:decision.provedSessionId});return;case"refuse":throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied);case"no-opinion":break;default:{let exhaustive=decision;throw new Error(`unknown memory capture decision ${JSON.stringify(exhaustive)}`)}}}if(caller.callerClass==="machine"||carriesPlatformClientClaim(caller.rawToken))throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied)}}}function memoryCaptureCredentialOf(ctx){let payload=ctx.get(MEMORY_CAPTURE_CREDENTIAL_KEY);if(typeof payload=="object"&&payload!==null&&"subjectIdentityAccountId"in payload&&"provedSessionId"in payload)return payload}function carriesPlatformClientClaim(rawToken){let segments=rawToken.split(".");if(segments.length!==3)return!1;try{let payload=JSON.parse(Buffer.from(segments[1],"base64url").toString("utf8"));return typeof payload.platform_client_id=="string"&&payload.platform_client_id!==""}catch{return!1}}var MEMORY_FULL_MESSAGE="memory is full \u2014 review and delete existing memories";function memoryDisabledMessage(org){return`memory is not enabled for organization ${org} \u2014 an organization admin can enable it in organization preferences`}var MEMORY_CONFIRM_REJECTED_MESSAGE="memory was rejected \u2014 delete it and let the agent propose it again",MEMORY_REJECT_CONFIRMED_MESSAGE="memory was confirmed \u2014 delete it to stop it from being recalled",MEMORY_SUBJECT_IMMUTABLE_MESSAGE="spec.subject_identity_account_id is immutable \u2014 it is derived from the capturing credential at create",MEMORY_PROVENANCE_IMMUTABLE_MESSAGE="spec.provenance is immutable \u2014 it records where the fact came from";var LIST_RESULT_KEY6="listResult";function newResolveMemoryDefaultsStep(){return{name:"ResolveMemoryDefaults",execute(ctx){let memory=ctx.newState,metadata=memory.metadata;if((metadata?.org??"")==="")throw invalidArgumentError("metadata.org is required for a memory");if(metadata===void 0)throw internalError(new Error("metadata is nil"),"metadata is nil");metadata.id===""&&(metadata.id=generateId("mem")),metadata.name===""&&metadata.slug===""&&(metadata.name=metadata.id);let spec=memory.spec;if(spec===void 0)throw internalError(new Error("memory spec is nil"),"memory spec is nil");let captureCredential=memoryCaptureCredentialOf(ctx);spec.subjectIdentityAccountId=captureCredential?.subjectIdentityAccountId??"",spec.provenance!==void 0&&(spec.provenance.toolCallId=""),captureCredential!==void 0&&(spec.provenance===void 0&&(spec.provenance=create2(MemoryProvenanceSchema,{})),spec.provenance.sessionId=captureCredential.provedSessionId)}}}function newCheckMemoryEnablementStep(store){return{name:"CheckMemoryEnablement",async execute(ctx){let orgID=ctx.newState.metadata?.org??"",org;try{org=await store.getResource(ApiResourceKind.organization,orgID,OrganizationSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Organization",orgID):internalError(error2,"failed to load organization for memory enablement check")}if(org.spec?.preferences?.memoryEnabled!==!0)throw failedPreconditionError(memoryDisabledMessage(orgID))}}}function newCheckMemoryCapStep(store){return{name:"CheckMemoryCap",async execute(ctx){let newState=ctx.newState,org=newState.metadata?.org??"",subject=newState.spec?.subjectIdentityAccountId??"",rows;try{rows=await store.listResources(ApiResourceKind.memory)}catch(error2){throw internalError(error2,"failed to count memories for cap check")}let count=0;for(let bytes of rows){let existing=unmarshalMemory(bytes);existing!==void 0&&(existing.metadata?.org??"")===org&&(existing.spec?.subjectIdentityAccountId??"")===subject&&count++}if(count>=100)throw failedPreconditionError(MEMORY_FULL_MESSAGE)}}}function newInitializeMemoryLifecycleStep(){return{name:"InitializeMemoryLifecycle",execute(ctx){let memory=ctx.newState;memory.status===void 0&&(memory.status=create2(MemoryStatusSchema,{})),memory.status.lifecycleState=MemoryLifecycleState.lifecycle_state_proposed,memory.status.stateChangedAt=timestampNow()}}}function newValidateMemoryUpdateStep(){return{name:"ValidateMemoryUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing memory not found in context"),"existing memory not found in context");let newState=ctx.newState;if((newState.spec?.subjectIdentityAccountId??"")!==(existing.spec?.subjectIdentityAccountId??""))throw failedPreconditionError(MEMORY_SUBJECT_IMMUTABLE_MESSAGE);let newProvenance=newState.spec?.provenance,existingProvenance=existing.spec?.provenance;if(!(newProvenance===void 0||existingProvenance===void 0?newProvenance===existingProvenance:equals(MemoryProvenanceSchema,newProvenance,existingProvenance)))throw failedPreconditionError(MEMORY_PROVENANCE_IMMUTABLE_MESSAGE)}}}function newPersistMemoryUpdateStep(store){return{name:"PersistMemoryUpdate",async execute(ctx){let newState=ctx.newState,memoryId=newState.metadata?.id??"",live;try{live=await store.updateResource(ApiResourceKind.memory,memoryId,MemorySchema,row=>{row.apiVersion=newState.apiVersion,row.kind=newState.kind,row.metadata=newState.metadata,row.spec=newState.spec,newState.status?.audit!==void 0&&(row.status===void 0&&(row.status=create2(MemoryStatusSchema,{})),row.status.audit=newState.status.audit)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Memory",memoryId):internalError(error2,"failed to persist memory update")}ctx.setNewState(live)}}}function newTransitionMemoryLifecycleStep(store,target,blockedMessage){return{name:"TransitionMemoryLifecycle",async execute(ctx){let memoryId=ctx.get(EXISTING_RESOURCE_KEY).metadata?.id??"",transitionNoOp=new Error("memory already in target state"),blocked,live;try{live=await store.updateResource(ApiResourceKind.memory,memoryId,MemorySchema,row=>{live=row;let current=row.status?.lifecycleState??MemoryLifecycleState.lifecycle_state_unspecified;if(current===target)throw transitionNoOp;if(current!==MemoryLifecycleState.lifecycle_state_proposed&&current!==MemoryLifecycleState.lifecycle_state_unspecified)throw blocked=failedPreconditionError(blockedMessage),blocked;row.status===void 0&&(row.status=create2(MemoryStatusSchema,{})),row.status.lifecycleState=target,row.status.stateChangedAt=timestampNow(),setAuditFieldsForUpdate(MemorySchema,row,"status_audit",ctx.callerIdentity)})}catch(error2){if(error2!==transitionNoOp)throw blocked!==void 0&&error2===blocked?blocked:error2 instanceof ResourceNotFoundError?notFoundError("Memory",memoryId):internalError(error2,"failed to transition memory lifecycle")}if(live===void 0)throw internalError(new Error("transition closure did not observe the row"),"failed to transition memory lifecycle");ctx.set(EXISTING_RESOURCE_KEY,live)}}}function newListMemoriesByOrgStep(store,listReadScope){return{name:"ListMemoriesByOrg",async execute(ctx){let org=ctx.input.org,rows;try{rows=await store.listResources(ApiResourceKind.memory)}catch(error2){throw internalError(error2,"failed to list memories")}let decoded=[];for(let bytes of rows){let memory=unmarshalMemory(bytes);memory!==void 0&&decoded.push(memory)}let memories=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.memory,decoded.filter(memory=>(memory.metadata?.org??"")===org),"");memories.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY6,create2(MemoryListSchema,{totalCount:memories.length,items:memories}))}}}function unmarshalMemory(data){try{return fromBinary2(MemorySchema,data)}catch{return}}function registerMemoryServices(router,deps){router.service(MemoryCommandController,{create:(memory,ctx)=>createMemory(deps,memory,ctx),update:(memory,ctx)=>update11(deps,memory,ctx),delete:(id,ctx)=>deleteMemory(deps,id,ctx),confirm:(id,ctx)=>confirm(deps,id,ctx),reject:(id,ctx)=>reject(deps,id,ctx)}),router.service(MemoryQueryController,{get:(id,ctx)=>get15(deps,id,ctx),list:(req,ctx)=>list8(deps,req,ctx)})}function kindOf14(ctx){return ctx.values.get(apiResourceKindKey)}async function createMemory(deps,memory,ctx){let reqCtx=new RequestContext(MemorySchema,memory,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("memory-create",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider)).addStep(newValidateVisibilityStep()).addStep(newResolveMemoryDefaultsStep()).addStep(newCheckMemoryEnablementStep(deps.store)).addStep(newCheckMemoryCapStep(deps.store)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newInitializeMemoryLifecycleStep()).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update11(deps,memory,ctx){let reqCtx=new RequestContext(MemorySchema,memory,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("memory-update",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateMemoryUpdateStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistMemoryUpdateStep(deps.store)).build().execute(reqCtx),reqCtx.newState}async function confirm(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-confirm",MemoryCommandController.method.confirm,MemoryLifecycleState.lifecycle_state_confirmed,MEMORY_CONFIRM_REJECTED_MESSAGE)}async function reject(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-reject",MemoryCommandController.method.reject,MemoryLifecycleState.lifecycle_state_rejected,MEMORY_REJECT_CONFIRMED_MESSAGE)}async function runTransition(deps,memoryId,ctx,name,method,target,blockedMessage){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline(name,deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newTransitionMemoryLifecycleStep(deps.store,target,blockedMessage)).build().execute(reqCtx);let transitioned=reqCtx.get(EXISTING_RESOURCE_KEY);if(transitioned===void 0)throw internalError(new Error("transitioned memory not found in context"),"transitioned memory not found in context");return transitioned}async function deleteMemory(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-delete",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted memory not found in context"),"deleted memory not found in context");return deleted}async function get15(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-get",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,MemorySchema)).build().execute(reqCtx);let target=reqCtx.get(TARGET_RESOURCE_KEY);if(target===void 0)throw internalError(new Error("target memory not found in context"),"target memory not found in context");return target}async function list8(deps,req,ctx){let reqCtx=new RequestContext(MemoryQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-list",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListMemoriesByOrgStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY6);if(result===void 0)throw internalError(new Error("memory list not found in context"),"memory list not found in context");return result}var file_ai_stigmer_iam_oauthapp_v1_command=fileDesc("CihhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9jb21tYW5kLnByb3RvEhphaS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MTLOBAoZT0F1dGhBcHBDb21tYW5kQ29udHJvbGxlchJTCgVhcHBseRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHASowEKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiTcK4GEkIFxAeIgxtZXRhZGF0YS5vcmcqNXVuYXV0aG9yaXplZCB0byBjcmVhdGUgb2F1dGggYXBwIGluIHRoaXMgb3JnYW5pemF0aW9uEo0BCgZ1cGRhdGUSJC5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5PQXV0aEFwcBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAIQFiILbWV0YWRhdGEuaWQqIHVuYXV0aG9yaXplZCB0byB1cGRhdGUgb2F1dGggYXBwEp8BCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAMQFiILcmVzb3VyY2VfaWQqIHVuYXV0aG9yaXplZCB0byBkZWxldGUgb2F1dGggYXBwGgSg/ysWYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api]),OAuthAppCommandController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_command,0);var file_ai_stigmer_iam_oauthapp_v1_io=fileDesc("CiNhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9pby5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEiJgoKT0F1dGhBcHBJZBIYCgV2YWx1ZRgBIAEoCUIJukgGcgQQARhAIkIKCU9BdXRoQXBwcxI1CgdlbnRyaWVzGAEgAygLMiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiLwoXTGlzdE9BdXRoQXBwc0J5T3JnSW5wdXQSFAoDb3JnGAEgASgJQge6SARyAhABYgZwcm90bzM",[file_ai_stigmer_iam_oauthapp_v1_api,file_buf_validate_validate]);var OAuthAppsSchema=messageDesc2(file_ai_stigmer_iam_oauthapp_v1_io,1);var file_ai_stigmer_iam_oauthapp_v1_query=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9xdWVyeS5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEy0AMKF09BdXRoQXBwUXVlcnlDb250cm9sbGVyEosBCgNnZXQSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIi/CuBgrCAEQFiIFdmFsdWUqHnVuYXV0aG9yaXplZCB0byB2aWV3IG9hdXRoIGFwcBJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIgTQuBgBEqwBCglsaXN0QnlPcmcSMy5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5MaXN0T0F1dGhBcHBzQnlPcmdJbnB1dBolLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwcyJDwrgYPwgBEB4iA29yZyo0dW5hdXRob3JpemVkIHRvIGxpc3Qgb2F1dGggYXBwcyBpbiB0aGlzIG9yZ2FuaXphdGlvbhoEoP8rFmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api,file_ai_stigmer_iam_oauthapp_v1_io]),OAuthAppQueryController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_query,0);var REDACTED_MARKER3="***REDACTED***",MARKER_ON_CREATE_MESSAGE="cannot use the redaction marker as client_secret on create",PRESERVE_NO_EXISTING_SECRET_MESSAGE="cannot preserve client_secret: no existing secret value found",CIPHERTEXT_SHAPED_SECRET_MESSAGE="client_secret must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients";function deleteBlockedByMcpServerMessage(org,slug,mcpServerName){return`cannot delete OAuthApp '${org}/${slug}': referenced by MCP server '${mcpServerName}'`}async function resolveOAuthAppRef(store,ref,logger2){if(ref.slug==="")return;let rows=await store.listResources(ApiResourceKind.oauth_app),slugMatches=[];for(let data of rows){let app;try{app=fromBinary2(OAuthAppSchema,data)}catch{continue}if((app.metadata?.slug??"")===ref.slug){if(ref.org!==""&&app.metadata?.org===ref.org)return app;slugMatches.push(app)}}if(slugMatches.length!==0){if(slugMatches.length===1)return slugMatches[0];logger2.warn("oauth_app_ref is ambiguous (slug exists in several orgs, none matching the ref); refusing to pick \u2014 pin the ref's org to resolve",{oauthAppSlug:ref.slug,refOrg:ref.org,candidateOrgs:slugMatches.map(app=>app.metadata?.org??"")})}}function redactOAuthApp(app){app.spec!==void 0&&app.spec.clientSecret!==""&&(app.spec.clientSecret=REDACTED_MARKER3)}function newEncryptClientSecretForCreateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!0)}function newEncryptClientSecretForUpdateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!1)}function newEncryptClientSecretStep(secretService,logger2,isCreate){return{name:"EncryptClientSecret",async execute(ctx){let app=ctx.newState;if(app.spec===void 0)return;let clientSecret=app.spec.clientSecret;if(clientSecret!==""){if(clientSecret===REDACTED_MARKER3){preserveExistingSecret(ctx,app,isCreate,logger2);return}if(isCiphertextShaped(clientSecret))throw invalidArgumentError(CIPHERTEXT_SHAPED_SECRET_MESSAGE);if(!secretService.isEnabled()){logger2.warn("encryption disabled: client_secret will be stored in plaintext");return}try{app.spec.clientSecret=await secretService.encrypt(clientSecret,EncryptionScope.forOrganization(app.metadata?.org??""))}catch(error2){throw internalError(error2,"failed to encrypt client_secret")}}}}}function preserveExistingSecret(ctx,app,isCreate,logger2){if(isCreate)throw invalidArgumentError(MARKER_ON_CREATE_MESSAGE);let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not loaded"),"cannot preserve client_secret: existing resource not loaded");let existingSecret=existing.spec?.clientSecret??"";if(existingSecret==="")throw invalidArgumentError(PRESERVE_NO_EXISTING_SECRET_MESSAGE);app.spec!==void 0&&(app.spec.clientSecret=existingSecret),logger2.debug("preserved existing encrypted client_secret",{oauthAppId:app.metadata?.id??""})}function newCheckNoReferencingMcpServersStep(store,logger2){return{name:"CheckNoReferencingMcpServers",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing OAuthApp missing from pipeline context"),"existing OAuthApp not loaded in delete pipeline");let resources;try{resources=await store.listResources(ApiResourceKind.mcp_server)}catch(error2){throw internalError(error2,"failed to list MCP servers for referential integrity check")}for(let data of resources){let mcp;try{mcp=fromBinary2(McpServerSchema,data)}catch(error2){logger2.warn("failed to unmarshal MCP server during referential integrity check, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}let ref=mcp.spec?.auth?.oauthAppRef;if(ref===void 0)continue;let resolved;try{resolved=await resolveOAuthAppRef(store,ref,logger2)}catch(error2){throw internalError(error2,"failed to resolve oauth_app_ref during referential integrity check")}if(resolved!==void 0&&(resolved.metadata?.id??"")===(existing.metadata?.id??""))throw failedPreconditionError(deleteBlockedByMcpServerMessage(existing.metadata?.org??"",existing.metadata?.slug??"",mcp.metadata?.name??""))}}}}function registerOAuthAppServices(router,deps){router.service(OAuthAppCommandController,{apply:(app,ctx)=>apply9(deps,app,ctx),create:(app,ctx)=>createOAuthApp(deps,app,ctx),update:(app,ctx)=>update12(deps,app,ctx),delete:(input,ctx)=>deleteOAuthApp(deps,input,ctx)}),router.service(OAuthAppQueryController,{get:(id,ctx)=>get16(deps,id,ctx),getByReference:(ref,ctx)=>getByReference9(deps,ref,ctx),listByOrg:(req,ctx)=>listByOrg2(deps,req,ctx)})}function kindOf15(ctx){return ctx.values.get(apiResourceKindKey)}async function createOAuthApp(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-create",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEncryptClientSecretForCreateStep(deps.secretService,deps.logger)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let result=reqCtx.newState;return redactOAuthApp(result),result}async function update12(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-update",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newEncryptClientSecretForUpdateStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).build().execute(reqCtx);let result=reqCtx.newState;return redactOAuthApp(result),result}async function apply9(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-apply",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOAuthApp(deps,app,ctx):update12(deps,withResolvedApplyId(OAuthAppSchema,app,reqCtx),ctx)}async function deleteOAuthApp(deps,input,ctx){let reqCtx=new RequestContext(OAuthAppCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf15(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("oauthapp-delete",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,OAuthAppSchema)).addStep(newCheckNoReferencingMcpServersStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,app=>app.spec===void 0?[]:[app.spec.clientSecret])).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted OAuthApp not found in context"),"deleted OAuthApp not found in context");return deleted}async function get16(deps,id,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-get",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OAuthAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}async function getByReference9(deps,ref,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-get-by-reference",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,OAuthAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}var LIST_RESULT_KEY7="listResult";async function listByOrg2(deps,req,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.listByOrg.input,req,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-list-by-org",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgStep2(deps.store,deps.logger)).build().execute(reqCtx);let list11=reqCtx.get(LIST_RESULT_KEY7);if(list11===void 0)throw internalError(new Error("list result missing from pipeline context"),"OAuthApp list not found in context");return list11}function newListByOrgStep2(store,logger2){return{name:"ListByOrg",async execute(ctx){let org=ctx.input.org,resources;try{resources=await store.listResources(ApiResourceKind.oauth_app)}catch(error2){throw internalError(error2,"failed to list OAuthApps")}let apps=[];for(let data of resources){let app;try{app=fromBinary2(OAuthAppSchema,data)}catch(error2){logger2.warn("failed to unmarshal OAuthApp, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}(app.metadata?.org??"")===org&&(redactOAuthApp(app),apps.push(app))}apps.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),logger2.info("listed OAuthApps by organization",{org,matchCount:apps.length}),ctx.set(LIST_RESULT_KEY7,create2(OAuthAppsSchema,{entries:apps}))}}}var file_ai_stigmer_tenancy_organization_v1_io=fileDesc("CithaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2lvLnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxIlIKDU9yZ2FuaXphdGlvbnMSQQoHZW50cmllcxgBIAMoCzIwLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uImoKEE9yZ2FuaXphdGlvbkxpc3QSEwoLdG90YWxfcGFnZXMYASABKAUSQQoHZW50cmllcxgCIAMoCzIwLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIioKDk9yZ2FuaXphdGlvbklkEhgKBXZhbHVlGAEgASgJQgm6SAZyBBABGEAimwEKGk9yZ2FuaXphdGlvbkV4dGVybmFsTG9va3VwElsKFWlkZW50aXR5X3Byb3ZpZGVyX3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUIGukgDyAEBEiAKD2V4dGVybmFsX29yZ19pZBgCIAEoCUIHukgEcgIQAWIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_tenancy_organization_v1_api,file_buf_validate_validate]),OrganizationsSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,0),OrganizationListSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,1);var file_ai_stigmer_tenancy_organization_v1_command=fileDesc("CjBhaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2NvbW1hbmQucHJvdG8SImFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEy2AQKHU9yZ2FuaXphdGlvbkNvbW1hbmRDb250cm9sbGVyEmsKBWFwcGx5EjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24aMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhJyCgZjcmVhdGUSMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhowLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIgTQuBgBEqgBCgZ1cGRhdGUSMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhowLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIjrCuBg2CAIQHiILbWV0YWRhdGEuaWQqI3VuYXV0aG9yaXplZCB0byB1cGRhdGUgb3JnYW5pemF0aW9uEqQBCgZkZWxldGUSMi5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbklkGjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iNMK4GDAIAxAeIgV2YWx1ZSojdW5hdXRob3JpemVkIHRvIGRlbGV0ZSBvcmdhbml6YXRpb24aBKD/Kx5iBnByb3RvMw",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io]),OrganizationCommandController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_command,0);var file_ai_stigmer_tenancy_organization_v1_query=fileDesc("Ci5haS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL3F1ZXJ5LnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxMrkEChtPcmdhbml6YXRpb25RdWVyeUNvbnRyb2xsZXISnwEKA2dldBIyLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uSWQaMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbiIywrgYLggBEB4iBXZhbHVlKiF1bmF1dGhvcml6ZWQgdG8gdmlldyBvcmdhbml6YXRpb24SewoEZmluZBI3LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5GaW5kQXBpUmVzb3VyY2VzUmVxdWVzdBo0LmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uTGlzdCIE0LgYARJmChNmaW5kTXlPcmdhbml6YXRpb25zEhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5GjEuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb25zIgTQuBgBEowBChJnZXRCeUV4dGVybmFsT3JnSWQSPi5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbkV4dGVybmFsTG9va3VwGjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iBNC4GAEaBKD/Kx5iBnByb3RvMw",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io,file_google_protobuf_empty]),OrganizationQueryController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_query,0);var organizationSearchExtractor={kind:ApiResourceKind.organization,schema:OrganizationSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let org=resource;return buildSearchResult({kind:ApiResourceKind.organization,metadata:org.metadata,summary:org.spec?.description??"",score,createdAt:org.status?.audit?.specAudit?.createdAt,updatedAt:org.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let org=resource,metadata=org.metadata;if(metadata!==void 0)return{name:metadata.name,description:org.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(org.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function newCheckOrgDuplicateStep(store){return{name:"CheckDuplicate",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("organization metadata is nil"),"duplicate check");if(metadata.slug==="")throw internalError(new Error("organization slug is empty"),"duplicate check");try{await store.getResource(ctx.apiResourceKind,metadata.slug,OrganizationSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw internalError(error2,"failed to check for duplicate organization")}throw alreadyExistsError("Organization",`slug '${metadata.slug}'`)}}}function newCopySlugToIdStep(){return{name:"CopySlugToId",execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("organization metadata is nil"),"copy slug to id");if(metadata.slug==="")throw internalError(new Error("organization slug is empty"),"copy slug to id");metadata.id=metadata.slug}}}function registerOrganizationServices(router,deps){router.service(OrganizationCommandController,{apply:(org,ctx)=>apply10(deps,org,ctx),create:(org,ctx)=>createOrganization(deps,org,ctx),update:(org,ctx)=>update13(deps,org,ctx),delete:(orgId,ctx)=>deleteOrganization(deps,orgId,ctx)});let externalLookup=deps.organizationDirectory?.getOrganizationIdByExternalOrgId?.bind(deps.organizationDirectory);router.service(OrganizationQueryController,{get:(orgId,ctx)=>get17(deps,orgId,ctx),find:(req,ctx)=>find(deps,req,ctx),findMyOrganizations:(_,ctx)=>findMyOrganizations(deps,ctx),...externalLookup===void 0?{}:{getByExternalOrgId:(lookup2,ctx)=>getByExternalOrgId(deps,externalLookup,lookup2,ctx)}})}function kindOf16(ctx){return ctx.values.get(apiResourceKindKey)}async function createOrganization(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf16(ctx)),builder2=newPipeline("organization-create",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckOrgDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newCopySlugToIdStep()).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger));for(let step of stepsForSlot(deps.gateSteps,"org-create:post-persist"))builder2.addStep(step);return await builder2.addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update13(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("organization-update",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply10(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("organization-apply",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOrganization(deps,org,ctx):update13(deps,withResolvedApplyId(OrganizationSchema,org,reqCtx),ctx)}async function deleteOrganization(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationCommandController.method.delete.input,orgId,callerIdentityOf(ctx),kindOf16(ctx));await newPipeline("organization-delete",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,OrganizationSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted organization not found in context"),"delete operation lost its loaded resource");return deleted}async function get17(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.get.input,orgId,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("organization-get",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OrganizationSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var FIND_RESULT_KEY="findResult";async function find(deps,req,ctx){if(deps.organizationDirectory?.refusesEnumeration===!0)throw new ConnectError("ai.stigmer.tenancy.organization.v1.OrganizationQueryController.find is not implemented",Code.Unimplemented);let reqCtx=new RequestContext(OrganizationQueryController.method.find.input,req,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("organization-find",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.find,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListAllOrganizationsStep(deps.store)).build().execute(reqCtx),reqCtx.get(FIND_RESULT_KEY)}function newListAllOrganizationsStep(store){return{name:"ListAllOrganizations",async execute(ctx){let data;try{data=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list organizations")}let orgs=[];for(let bytes of data)try{orgs.push(fromBinary2(OrganizationSchema,bytes))}catch{continue}let req=ctx.input,pageSize=req.pageSize,pageNumber=req.pageNumber;req.page!==void 0&&(req.page.size>0&&(pageSize=req.page.size),req.page.num>0&&(pageNumber=req.page.num)),pageSize<=0&&(pageSize=20),pageSize>100&&(pageSize=100),pageNumber<=0&&(pageNumber=1);let totalPages=Math.ceil(orgs.length/pageSize),start=(pageNumber-1)*pageSize,entries=start>=orgs.length?[]:orgs.slice(start,start+pageSize);ctx.set(FIND_RESULT_KEY,create2(OrganizationListSchema,{totalPages,entries}))}}}async function findMyOrganizations(deps,ctx){let directory=deps.organizationDirectory;if(directory!==void 0){let authorized=await directory.listMyOrganizationIds(callerIdentityOf(ctx));if(authorized!=="all"){let entries2=[];for(let id of authorized)try{entries2.push(await deps.store.getResource(ApiResourceKind.organization,id,OrganizationSchema))}catch(error2){if(error2 instanceof ResourceNotFoundError)continue;throw internalError(error2,"failed to list organizations")}return create2(OrganizationsSchema,{entries:entries2})}}let data;try{data=await deps.store.listResources(ApiResourceKind.organization)}catch(error2){throw internalError(error2,"failed to list organizations")}let entries=[];for(let bytes of data)try{entries.push(fromBinary2(OrganizationSchema,bytes))}catch{continue}return create2(OrganizationsSchema,{entries})}async function getByExternalOrgId(deps,lookup2,input,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.getByExternalOrgId.input,input,callerIdentityOf(ctx),kindOf16(ctx));if(await newPipeline("organization-get-by-external-org-id",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.getByExternalOrgId,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx),input.externalOrgId==="")throw invalidArgumentError("external_org_id is required");let orgId=await lookup2(input.externalOrgId);if(orgId===void 0)throw notFoundError("Organization",input.externalOrgId);try{return await deps.store.getResource(ApiResourceKind.organization,orgId,OrganizationSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Organization",input.externalOrgId):internalError(error2,"failed to load organization")}}var file_ai_stigmer_agentic_mcpserver_v1_io=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2lvLnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxIiQKC01jcFNlcnZlcklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiggIKDENvbm5lY3RJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESUgoLcnVudGltZV9lbnYYAiADKAsyPS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dC5SdW50aW1lRW52RW50cnkSFAoDb3JnGAMgASgJQge6SARyAhABGmkKD1J1bnRpbWVFbnZFbnRyeRILCgNrZXkYASABKAkSRQoFdmFsdWUYAiABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25WYWx1ZToCOAEiUAoZSW5pdGlhdGVPQXV0aENvbm5lY3RJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESFAoDb3JnGAIgASgJQge6SARyAhABIm0KGkluaXRpYXRlT0F1dGhDb25uZWN0T3V0cHV0EhkKEWF1dGhvcml6YXRpb25fdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEg4KBnNjb3BlcxgDIAMoCRIVCg1wcm92aWRlcl9uYW1lGAQgASgJIncKGUNvbXBsZXRlT0F1dGhDb25uZWN0SW5wdXQSHQoNbWNwX3NlcnZlcl9pZBgBIAEoCUIGukgDyAEBEiMKEmF1dGhvcml6YXRpb25fY29kZRgCIAEoCUIHukgEcgIQARIWCgVzdGF0ZRgDIAEoCUIHukgEcgIQASJkChpDb21wbGV0ZU9BdXRoQ29ubmVjdE91dHB1dBIRCgljb25uZWN0ZWQYASABKAgSFgoOdGFyZ2V0X2Vudl92YXIYAiABKAkSGwoTdG9rZW5fbGlmZXRpbWVfaGludBgDIAEoCSJNChhHZXRPQXV0aEdyYW50U3RhdHVzSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBARIUCgNvcmcYAiABKAlCB7pIBHICEAEizwEKGUdldE9BdXRoR3JhbnRTdGF0dXNPdXRwdXQSEQoJY29ubmVjdGVkGAEgASgIEh8KF2FjY2Vzc190b2tlbl9leHBpcmVzX2F0GAIgASgDEhYKDnRhcmdldF9lbnZfdmFyGAMgASgJEhMKC2F1dGhfbWV0aG9kGAQgASgJElEKEWNvbm5lY3Rpb25faGVhbHRoGAUgASgOMjYuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5PQXV0aENvbm5lY3Rpb25IZWFsdGgiSQoURGlzY29ubmVjdE9BdXRoSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBARIUCgNvcmcYAiABKAlCB7pIBHICEAEiLQoVRGlzY29ubmVjdE9BdXRoT3V0cHV0EhQKDGRpc2Nvbm5lY3RlZBgBIAEoCCKEAQoTU2V0T3JnT0F1dGhBcHBJbnB1dBIbCgtyZXNvdXJjZV9pZBgBIAEoCUIGukgDyAEBEhQKA29yZxgCIAEoCUIHukgEcgIQARIaCgljbGllbnRfaWQYAyABKAlCB7pIBHICEAESHgoNY2xpZW50X3NlY3JldBgEIAEoCUIHukgEcgIQASIsChRTZXRPcmdPQXV0aEFwcE91dHB1dBIUCgxvYXV0aF9hcHBfaWQYASABKAkiSAoTR2V0T3JnT0F1dGhBcHBJbnB1dBIbCgtyZXNvdXJjZV9pZBgBIAEoCUIGukgDyAEBEhQKA29yZxgCIAEoCUIHukgEcgIQASJVChRHZXRPcmdPQXV0aEFwcE91dHB1dBIUCgxoYXNfb3ZlcnJpZGUYASABKAgSFAoMb2F1dGhfYXBwX2lkGAIgASgJEhEKCWNsaWVudF9pZBgDIAEoCSJLChZEZWxldGVPcmdPQXV0aEFwcElucHV0EhsKC3Jlc291cmNlX2lkGAEgASgJQga6SAPIAQESFAoDb3JnGAIgASgJQge6SARyAhABIioKF0RlbGV0ZU9yZ09BdXRoQXBwT3V0cHV0Eg8KB2RlbGV0ZWQYASABKAgq7QEKFU9BdXRoQ29ubmVjdGlvbkhlYWx0aBInCiNPQVVUSF9DT05ORUNUSU9OX0hFQUxUSF9VTlNQRUNJRklFRBAAEiMKH09BVVRIX0NPTk5FQ1RJT05fSEVBTFRIX0hFQUxUSFkQARIpCiVPQVVUSF9DT05ORUNUSU9OX0hFQUxUSF9UT0tFTl9FWFBJUkVEEAISNQoxT0FVVEhfQ09OTkVDVElPTl9IRUFMVEhfVE9LRU5fRVhQSVJFRF9SRUZSRVNIQUJMRRADEiQKIE9BVVRIX0NPTk5FQ1RJT05fSEVBTFRIX05PX0dSQU5UEARiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_spec,file_buf_validate_validate]);var InitiateOAuthConnectOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,3);var CompleteOAuthConnectOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,5);var GetOAuthGrantStatusOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,7);var DisconnectOAuthOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,9);var OAuthConnectionHealth;(function(OAuthConnectionHealth2){OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_UNSPECIFIED=0]="OAUTH_CONNECTION_HEALTH_UNSPECIFIED",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_HEALTHY=1]="OAUTH_CONNECTION_HEALTH_HEALTHY",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED=2]="OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE=3]="OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_NO_GRANT=4]="OAUTH_CONNECTION_HEALTH_NO_GRANT"})(OAuthConnectionHealth||(OAuthConnectionHealth={}));var file_ai_stigmer_agentic_mcpserver_v1_command=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2NvbW1hbmQucHJvdG8SH2FpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEy0hAKGk1jcFNlcnZlckNvbW1hbmRDb250cm9sbGVyEl8KBWFwcGx5EiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchJmCgZjcmVhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBEpoBCgZ1cGRhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIjjCuBg0CAIQLCILbWV0YWRhdGEuaWQqIXVuYXV0aG9yaXplZCB0byB1cGRhdGUgbWNwIHNlcnZlchKmAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI4wrgYNAgDECwiC3Jlc291cmNlX2lkKiF1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1jcCBzZXJ2ZXISugEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiQ8K4GD8IAhAsIgtyZXNvdXJjZV9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtY3Agc2VydmVyIHZpc2liaWxpdHkSpAEKB2Nvbm5lY3QSLS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dBoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIj7CuBg6CBYQLCINbWNwX3NlcnZlcl9pZColdW5hdXRob3JpemVkIHRvIGNvbm5lY3QgdG8gbWNwIHNlcnZlchKpAQoMc3RhcnRDb25uZWN0Ei0uYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Db25uZWN0SW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI+wrgYOggWECwiDW1jcF9zZXJ2ZXJfaWQqJXVuYXV0aG9yaXplZCB0byBjb25uZWN0IHRvIG1jcCBzZXJ2ZXIS3wEKFGluaXRpYXRlT0F1dGhDb25uZWN0EjouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Jbml0aWF0ZU9BdXRoQ29ubmVjdElucHV0GjsuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Jbml0aWF0ZU9BdXRoQ29ubmVjdE91dHB1dCJOwrgYSggWECwiDW1jcF9zZXJ2ZXJfaWQqNXVuYXV0aG9yaXplZCB0byBpbml0aWF0ZSBvYXV0aCBjb25uZWN0IGZvciBtY3Agc2VydmVyEt8BChRjb21wbGV0ZU9BdXRoQ29ubmVjdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuQ29tcGxldGVPQXV0aENvbm5lY3RJbnB1dBo7LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuQ29tcGxldGVPQXV0aENvbm5lY3RPdXRwdXQiTsK4GEoIFhAsIg1tY3Bfc2VydmVyX2lkKjV1bmF1dGhvcml6ZWQgdG8gY29tcGxldGUgb2F1dGggY29ubmVjdCBmb3IgbWNwIHNlcnZlchLIAQoPZGlzY29ubmVjdE9BdXRoEjUuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5EaXNjb25uZWN0T0F1dGhJbnB1dBo2LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuRGlzY29ubmVjdE9BdXRoT3V0cHV0IkbCuBhCCBYQLCILcmVzb3VyY2VfaWQqL3VuYXV0aG9yaXplZCB0byBkaXNjb25uZWN0IG9hdXRoIGZvciBtY3Agc2VydmVyErgBCg5zZXRPcmdPQXV0aEFwcBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU2V0T3JnT0F1dGhBcHBJbnB1dBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU2V0T3JnT0F1dGhBcHBPdXRwdXQiOcK4GDUIFxAeIgNvcmcqKnVuYXV0aG9yaXplZCB0byBzZXQgb3JnIG9hdXRoIGFwcCBvdmVycmlkZRLEAQoRZGVsZXRlT3JnT0F1dGhBcHASNy5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRlbGV0ZU9yZ09BdXRoQXBwSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRlbGV0ZU9yZ09BdXRoQXBwT3V0cHV0IjzCuBg4CBcQHiIDb3JnKi11bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG9yZyBvYXV0aCBhcHAgb3ZlcnJpZGUaBKD/KyxiBnByb3RvMw",[file_ai_stigmer_agentic_mcpserver_v1_api,file_ai_stigmer_agentic_mcpserver_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),McpServerCommandController=serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_command,0);var file_ai_stigmer_agentic_mcpserver_v1_query=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL3F1ZXJ5LnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxMssFChhNY3BTZXJ2ZXJRdWVyeUNvbnRyb2xsZXISkgEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiMMK4GCwIARAsIgV2YWx1ZSofdW5hdXRob3JpemVkIHRvIHZpZXcgbWNwIHNlcnZlchJ4Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBEtUBChNnZXRPQXV0aEdyYW50U3RhdHVzEjkuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5HZXRPQXV0aEdyYW50U3RhdHVzSW5wdXQaOi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkdldE9BdXRoR3JhbnRTdGF0dXNPdXRwdXQiR8K4GEMIARAsIgtyZXNvdXJjZV9pZCowdW5hdXRob3JpemVkIHRvIHZpZXcgb2F1dGggc3RhdHVzIGZvciBtY3Agc2VydmVyEsEBCg5nZXRPcmdPQXV0aEFwcBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuR2V0T3JnT0F1dGhBcHBJbnB1dBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuR2V0T3JnT0F1dGhBcHBPdXRwdXQiQsK4GD4IARAsIgtyZXNvdXJjZV9pZCordW5hdXRob3JpemVkIHRvIHZpZXcgb3JnIG9hdXRoIGFwcCBvdmVycmlkZRoEoP8rLGIGcHJvdG8z",[file_ai_stigmer_agentic_mcpserver_v1_api,file_ai_stigmer_agentic_mcpserver_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),McpServerQueryController=serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_query,0);async function completeOAuthConnect(deps,input,identity2){let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");let stateParam=input.state;if(stateParam==="")throw invalidArgumentError("state is required");let code=input.authorizationCode;if(code==="")throw invalidArgumentError("authorization_code is required");let pendingState;try{pendingState=await deps.pendingOAuthStates.getAndDelete(stateParam)}catch(error2){throw internalError(error2,"failed to load pending OAuth state")}if(pendingState===void 0)throw failedPreconditionError("no pending OAuth state found for the given state parameter (expired or already used)");if(pendingState.mcpServerId!==mcpServerId)throw failedPreconditionError("state parameter does not match the requested mcp_server_id");await authorizeDirect(McpServerCommandController.method.completeOAuthConnect,deps.authorizer,identity2,input,{resourceId:pendingState.mcpServerId});try{pendingState=await unsealPendingOAuthState(deps.secretService,pendingState)}catch(error2){throw deps.logger.error("Failed to decrypt pending OAuth state secrets",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to decrypt OAuth handshake secrets \u2014 please retry the connect flow")}let tokenResponse;try{tokenResponse=await exchangeCode(pendingState.tokenEndpoint,code,pendingState.redirectUri,pendingState.codeVerifier,pendingState.clientId,pendingState.clientSecret,pendingState.tokenAuthMethod)}catch(error2){throw unavailableError(`token exchange failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}let org=pendingState.org;org===""&&(org=mcpServer.metadata?.org??"");let managedEnvId=await resolveOrCreateManagedEnvironment(deps,pendingState.identityAccountId,mcpServerId,org,mcpServer.metadata?.name??"",identity2),tokenVars={[pendingState.targetEnvVar]:create2(EnvironmentValueSchema,{value:tokenResponse.accessToken,isSecret:!0})},refreshTokenEnvVar=`${pendingState.targetEnvVar}_REFRESH_TOKEN`;tokenResponse.refreshToken!==""&&(tokenVars[refreshTokenEnvVar]=create2(EnvironmentValueSchema,{value:tokenResponse.refreshToken,isSecret:!0}));try{await deps.managedEnv.updateSecrets(managedEnvId,tokenVars)}catch(error2){throw internalError(error2,"failed to store OAuth tokens in managed environment")}let expiresAt=0;tokenResponse.expiresIn>0&&(expiresAt=Math.floor(Date.now()/1e3)+tokenResponse.expiresIn);try{await deps.oauthGrants.upsert({identityAccountId:pendingState.identityAccountId,resourceId:mcpServerId,resourceKind:"mcp_server",orgId:org,accessTokenExpiresAt:expiresAt,clientId:pendingState.clientId,authMethod:pendingState.authMethod,tokenEndpoint:pendingState.tokenEndpoint,accessTokenEnvVar:pendingState.targetEnvVar,refreshTokenEnvVar,environmentId:managedEnvId,createdAt:0,updatedAt:0})}catch(error2){throw internalError(error2,"failed to create OAuth grant record")}let auth=mcpServer.spec?.auth;return deps.logger.info("OAuth Connect completed: tokens stored in managed environment",{mcp_server_id:mcpServerId,auth_method:pendingState.authMethod,target_env_var:pendingState.targetEnvVar,managed_env_id:managedEnvId,expires_at:expiresAt,has_refresh_token:tokenResponse.refreshToken!==""}),create2(CompleteOAuthConnectOutputSchema,{connected:!0,targetEnvVar:pendingState.targetEnvVar,tokenLifetimeHint:auth?.tokenLifetimeHint??""})}async function unsealPendingOAuthState(secretService,state2){let verifier;try{verifier=await secretService.decrypt(state2.codeVerifier)}catch(error2){throw new Error(`failed to decrypt code_verifier: ${error2 instanceof Error?error2.message:String(error2)}`)}let secret;try{secret=await secretService.decrypt(state2.clientSecret)}catch(error2){throw new Error(`failed to decrypt client_secret: ${error2 instanceof Error?error2.message:String(error2)}`)}return{...state2,codeVerifier:verifier,clientSecret:secret}}async function resolveOrCreateManagedEnvironment(deps,identityAccountId,mcpServerId,org,mcpServerName,caller){let existingGrant;try{existingGrant=await deps.oauthGrants.find(identityAccountId,mcpServerId,org)}catch(error2){deps.logger.warn("Failed to look up existing OAuth grant (non-fatal, will create new managed env)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}if(existingGrant!==void 0&&existingGrant.environmentId!=="")return deps.logger.info("Reusing existing managed environment for OAuth re-connect",{mcp_server_id:mcpServerId,environment_id:existingGrant.environmentId}),existingGrant.environmentId;let envName=`OAuth: ${mcpServerName}`;try{return await deps.managedEnv.createManagedEnvironment(envName,org,caller)}catch(error2){throw internalError(error2,"failed to create managed environment for OAuth tokens")}}async function resolveOAuthAppRef2(store,ref,logger2){let slug=ref?.slug??"";if(slug==="")return;let rows=await store.listResources(ApiResourceKind.oauth_app),slugMatches=[];for(let data of rows){let app;try{app=fromBinary2(OAuthAppSchema,data)}catch{continue}if((app.metadata?.slug??"")!==slug)continue;let refOrg=ref?.org??"";if(refOrg!==""&&app.metadata?.org===refOrg)return app;slugMatches.push(app)}if(slugMatches.length!==0){if(slugMatches.length===1)return slugMatches[0];logger2.warn("oauth_app_ref is ambiguous (slug exists in several orgs, none matching the ref); refusing to pick \u2014 pin the ref's org to resolve",{oauthAppSlug:slug,refOrg:ref?.org??"",candidateOrgs:slugMatches.map(app=>app.metadata?.org??"")})}}function convertToDiscoveredCapabilities(output){let capabilities=create2(DiscoveredCapabilitiesSchema,{lastDiscoveredAt:timestampNow()});for(let t of output.tools??[]){let tool=create2(DiscoveredToolSchema,{name:t.name??"",description:t.description??""});t.input_schema!==void 0&&(tool.inputSchema=t.input_schema),capabilities.tools.push(tool)}for(let rt of output.resource_templates??[])capabilities.resourceTemplates.push(create2(DiscoveredResourceTemplateSchema,{uriTemplate:rt.uri_template??"",name:rt.name??"",description:rt.description??"",mimeType:rt.mime_type??""}));return capabilities}function convertToToolApprovals(output){let approvals=[];for(let a5 of output.tool_approvals??[])a5.requires_approval!==!0||(a5.tool_name??"")===""||approvals.push(create2(ToolApprovalPolicySchema,{toolName:a5.tool_name,message:a5.message??"",fromDestructiveHint:a5.from_destructive_hint??!1}));return approvals}function setToolApprovalsFromConnect(status,output){let approvals=convertToToolApprovals(output);return approvals.length>0&&(status.toolApprovals=approvals),approvals.length}function settleConnectStatus(mcpStatus,workflowId,failure){let cs=mcpStatus.connectStatus;if(cs===void 0&&(cs=create2(ConnectStatusSchema),mcpStatus.connectStatus=cs),cs.workflowId=workflowId,cs.finishedAt=timestampNow(),cs.warning="",failure===void 0){cs.phase=ConnectPhase.succeeded,cs.failureCode="",cs.failureMessage="";return}cs.phase=ConnectPhase.failed,cs.failureCode=grpcCodeName(failure.code),cs.failureMessage=failure.rawMessage}async function persistConnectResult(store,mcpServerId,workflowId,output){let toolApprovalCount=0;return{persisted:await store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),mcpServer.status.discoveredCapabilities=convertToDiscoveredCapabilities(output),toolApprovalCount=setToolApprovalsFromConnect(mcpServer.status,output),settleConnectStatus(mcpServer.status,workflowId,void 0)}),toolApprovalCount}}async function persistConnectStarting(store,mcpServerId,workflowId,warning2){return store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),mcpServer.status.connectStatus=create2(ConnectStatusSchema,{phase:ConnectPhase.connecting,workflowId,startedAt:timestampNow(),warning:warning2})})}async function persistConnectFailure(store,logger2,mcpServerId,failure){try{await store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),settleConnectStatus(mcpServer.status,mcpServer.status.connectStatus?.workflowId??"",failure)})}catch(error2){if(error2 instanceof ResourceNotFoundError){logger2.info("Skipping connect failure persistence: MCP server deleted before connect settled",{mcp_server_id:mcpServerId});return}logger2.warn("Failed to record connect failure on connect_status (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}}var CONNECT_TIMEOUT={ms:42e4,goLabel:"7m0s"},ASYNC_CONNECT_TIMEOUT={ms:3600*1e3,goLabel:"1h0m0s"},BEST_EFFORT_CONNECT_GET_BUFFER_MS=15e3,PERSONAL_ENV_LABEL2="stigmer.ai/personal";async function connect(deps,input,identity2){let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError("connect is not available: Temporal not configured");let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");if(input.org==="")throw invalidArgumentError("org is required for connect");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.connect,deps.authorizer,identity2,input);let prepared=await prepareConnect(deps,mcpServer,input,identity2);try{let run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,prepared.workflowInput,CONNECT_TIMEOUT.ms)}catch(error2){throw deps.logger.error("Failed to start MCP connect workflow",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to start connect workflow")}if(!run.attached)try{await persistConnectStarting(deps.store,mcpServerId,run.workflowId,"")}catch(error2){deps.logger.warn("Failed to record CONNECTING on connect_status (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let outcome=await run.result(CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,CONNECT_TIMEOUT);throw await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure),failure}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){throw internalError(error2,"failed to save mcp server after connect")}return deps.logger.info("MCP server connect completed and stored",{mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount}),persisted}finally{prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId)}}async function prepareConnect(deps,mcpServer,input,identity2){let mcpServerId=mcpServer.metadata?.id??"",callerOrg=input.org;Object.keys(input.runtimeEnv).length===0&&await refreshOAuthTokenIfNeeded(deps,mcpServer,callerOrg);let executionId=newConnectExecutionId(mcpServerId),ecResourceId=await createConnectExecutionContext(deps,mcpServer,executionId,callerOrg,input.runtimeEnv,identity2),workflowInput={mcp_server_id:mcpServerId,...ecResourceId!==""?{execution_context_id:executionId}:{}};if(ecResourceId!==""&&deps.runnerAuth.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))try{let minted=deps.runnerAuth.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return{workflowInput:{...workflowInput,execution_context_token:minted.token},ecResourceId,executionId}}catch(error2){deps.logger.warn("Failed to mint connect EC token \u2014 discovery will read redacted credentials",{execution_id:executionId,error:error2 instanceof Error?error2.message:String(error2)})}return{workflowInput,ecResourceId,executionId}}async function createConnectExecutionContext(deps,mcpServer,executionId,callerOrg,runtimeEnv,caller){let ecData;if(Object.keys(runtimeEnv).length>0)ecData=runtimeEnv,deps.logger.info("Using runtime_env for connect ExecutionContext (one-time use)",{execution_id:executionId,runtime_env_count:Object.keys(runtimeEnv).length});else{let envDecls=mcpServer.spec?.env??{};if(Object.keys(envDecls).length===0)return deps.logger.debug("MCP server has no env declarations \u2014 skipping ExecutionContext creation",{execution_id:executionId}),"";let mcpServerId=mcpServer.metadata?.id??"",{oauthVars,remainingDecls}=await resolveOAuthVarsFromManagedEnv(deps,mcpServerId,callerOrg,envDecls),personalVars={};Object.keys(remainingDecls).length>0&&(personalVars=await resolveFromPersonalEnvironment(deps,callerOrg,remainingDecls)),ecData={...personalVars,...oauthVars},deps.logger.info("Resolved env vars for connect ExecutionContext",{execution_id:executionId,oauth_count:Object.keys(oauthVars).length,personal_count:Object.keys(personalVars).length})}if(Object.keys(ecData).length===0)return"";let created;try{created=await deps.executionContext.create(create2(ExecutionContextSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"ExecutionContext",metadata:{name:`exec-ctx-${executionId}`,org:callerOrg},spec:{executionId,data:ecData}}),caller)}catch(error2){throw internalError(error2,"failed to create connect ExecutionContext")}let resourceId=created.metadata?.id??"";return deps.logger.info("Created ephemeral ExecutionContext for MCP connect",{execution_context_id:resourceId,execution_id:executionId,data_entries:Object.keys(ecData).length}),resourceId}async function resolveOAuthVarsFromManagedEnv(deps,mcpServerId,org,envDecls){let grant;try{grant=await deps.oauthGrants.find("",mcpServerId,org)}catch{return{oauthVars:{},remainingDecls:envDecls}}if(grant===void 0||grant.environmentId==="")return{oauthVars:{},remainingDecls:envDecls};let oauthKey=grant.accessTokenEnvVar;if(!(oauthKey in envDecls))return{oauthVars:{},remainingDecls:envDecls};let tokenValue="";try{tokenValue=await deps.managedEnv.readSecretValue(grant.environmentId,oauthKey)}catch(error2){return deps.logger.warn("Failed to read OAuth token from managed environment \u2014 falling back to personal env",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId,error:error2 instanceof Error?error2.message:String(error2)}),{oauthVars:{},remainingDecls:envDecls}}if(tokenValue==="")return deps.logger.warn("Failed to read OAuth token from managed environment \u2014 falling back to personal env",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId}),{oauthVars:{},remainingDecls:envDecls};let remainingDecls={};for(let[k5,v]of Object.entries(envDecls))k5!==oauthKey&&(remainingDecls[k5]=v);return deps.logger.debug("Resolved OAuth token from managed environment",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId}),{oauthVars:{[oauthKey]:create2(ExecutionValueSchema,{value:tokenValue,isSecret:!0})},remainingDecls}}async function resolveFromPersonalEnvironment(deps,org,envDecls){let requiredKeys=[];for(let[k5,decl]of Object.entries(envDecls))decl.optional||requiredKeys.push(k5);let listResponse;try{listResponse=await deps.environmentReader.list({org,labels:{[PERSONAL_ENV_LABEL2]:"true"}})}catch(error2){throw internalError(error2,"failed to list personal environments")}if(listResponse.totalCount===0||listResponse.items.length===0){if(requiredKeys.length===0)return{};throw failedPreconditionError(`personal environment not found for org '${org}'; save required credentials first: [${requiredKeys.join(" ")}]`)}let personalEnv=listResponse.items[0],personalEnvId=personalEnv?.metadata?.id??"",storedKeys=new Set(Object.keys(personalEnv?.spec?.data??{})),result={},missing=[];for(let[key,decl]of Object.entries(envDecls)){if(!storedKeys.has(key)){if(decl.optional){deps.logger.debug("Optional env var not in personal environment \u2014 skipping",{key});continue}missing.push(key);continue}let secretValue;try{secretValue=await deps.environmentReader.getSecretValue({environmentId:personalEnvId,key})}catch(error2){if(deps.logger.warn("Failed to get secret value from personal environment",{key,personal_env_id:personalEnvId,error:error2 instanceof Error?error2.message:String(error2)}),decl.optional)continue;missing.push(key);continue}if(secretValue.value===""){if(decl.optional)continue;missing.push(key);continue}result[key]=create2(ExecutionValueSchema,{value:secretValue.value,isSecret:decl.isSecret})}if(missing.length>0)throw failedPreconditionError(`missing required credentials in personal environment: [${missing.join(" ")}]`);return result}async function deleteConnectExecutionContext(deps,resourceId,executionId){try{await deps.executionContext.delete({resourceId})}catch(error2){deps.logger.warn("Failed to delete connect ExecutionContext (non-fatal)",{resource_id:resourceId,execution_id:executionId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.debug("Deleted ephemeral connect ExecutionContext",{resource_id:resourceId,execution_id:executionId})}function mapConnectFailure(logger2,mcpServer,workflowId,failure,budget){let mcpServerId=mcpServer.metadata?.id??"";switch(logger2.error("MCP connect workflow failed",{workflow_id:workflowId,mcp_server_id:mcpServerId,failure_kind:failure.kind}),failure.kind){case"application":return failedPreconditionError(buildConnectFailureMessage(mcpServer,failure.message));case"timeout":return new ConnectError(`connect did not complete within the ${budget.goLabel} budget for MCP server '${mcpServerId}' \u2014 if this repeats, check that your runner is running and healthy`,Code.DeadlineExceeded);case"service-not-found":return unavailableError(`connect service temporarily unavailable for MCP server '${mcpServerId}'`);case"other":return new ConnectError(buildConnectFailureMessage(mcpServer,failure.message),Code.Internal);default:{let exhaustive=failure;throw new Error(`unhandled connect failure ${String(exhaustive)}`)}}}function buildConnectFailureMessage(mcpServer,cause){let name=mcpServer.metadata?.name??"";if(cause.includes("requires OAuth"))return cause;if(mcpServer.spec?.serverType.case==="stdio"){let slug=mcpServer.metadata?.slug??"";return`connect failed for MCP server '${name}': ${cause}. This is a stdio server launched by your local runner \u2014 verify the command is installed and its arguments and environment variables are correct. Preview discovery locally with: stigmer connect mcp-server ${slug} --dry-run`}return`connect failed for MCP server '${name}': ${cause}. Check that the server URL is reachable and your credentials are valid.`}async function refreshOAuthTokenIfNeeded(deps,mcpServer,callerOrg){if(mcpServer.spec?.auth===void 0)return;let mcpServerId=mcpServer.metadata?.id??"",grant;try{grant=await deps.oauthGrants.find("",mcpServerId,callerOrg)}catch(error2){deps.logger.warn("Failed to load OAuth grant for pre-flight check (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}if(grant===void 0)return;if(grant.environmentId===""){deps.logger.warn("OAuth grant has no managed environment ID \u2014 user must re-authenticate via OAuth Connect",{mcp_server_id:mcpServerId});return}let refreshTokenValue;try{refreshTokenValue=await deps.managedEnv.readSecretValue(grant.environmentId,grant.refreshTokenEnvVar)}catch(error2){deps.logger.debug("No refresh token found in managed environment (may not be OAuth-connected)",{mcp_server_id:mcpServerId,refresh_token_var:grant.refreshTokenEnvVar,managed_env_id:grant.environmentId,error:error2 instanceof Error?error2.message:String(error2)});return}let clientSecret="",tokenAuthMethod="";if(grant.authMethod==="vendor_oauth")try{({clientSecret,tokenAuthMethod}=await loadOAuthAppClientCredentials(deps,mcpServer))}catch(error2){deps.logger.warn("Failed to load OAuthApp client secret for refresh",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let result;try{result=await refreshTokenIfExpired(grant,refreshTokenValue,clientSecret,tokenAuthMethod,deps.logger)}catch(error2){throw failedPreconditionError(error2 instanceof Error?error2.message:String(error2))}if(!result.refreshed)return;let tokenVars={[grant.accessTokenEnvVar]:create2(EnvironmentValueSchema,{value:result.newAccessToken,isSecret:!0})};result.newRefreshToken!==refreshTokenValue&&(tokenVars[grant.refreshTokenEnvVar]=create2(EnvironmentValueSchema,{value:result.newRefreshToken,isSecret:!0}));try{await deps.managedEnv.updateSecrets(grant.environmentId,tokenVars)}catch(error2){throw internalError(error2,"failed to update refreshed tokens in managed environment")}try{await deps.oauthGrants.upsert({...grant,accessTokenExpiresAt:result.newExpiresAt})}catch(error2){deps.logger.warn("Failed to update OAuth grant after refresh (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}}async function loadOAuthAppClientCredentials(deps,mcpServer){let ref=mcpServer.spec?.auth?.oauthAppRef;if(ref===void 0||ref.slug==="")return{clientSecret:"",tokenAuthMethod:""};let app;try{app=await resolveOAuthAppRef2(deps.store,ref,deps.logger)}catch(error2){throw new Error(`failed to list oauth apps: ${error2 instanceof Error?error2.message:String(error2)}`)}if(app===void 0)throw new Error(`OAuthApp '${ref.slug}' not found`);let tokenAuthMethod=tokenAuthMethodFromSpec(app.spec?.tokenEndpointAuthMethod??TokenEndpointAuthMethod.UNSPECIFIED),secret=app.spec?.clientSecret??"";return deps.secretService.isEncrypted(secret)&&(secret=await deps.secretService.decrypt(secret)),{clientSecret:secret,tokenAuthMethod}}function tokenAuthMethodFromSpec(method){return method===TokenEndpointAuthMethod.CLIENT_SECRET_POST?TOKEN_AUTH_METHOD_POST:TOKEN_AUTH_METHOD_BASIC}async function startBestEffortConnect(deps,mcpServer){let engineState=deps.engineState();if(!engineState.connected)return;let envKeys=Object.keys(mcpServer.spec?.env??{}).length;if(envKeys>0){deps.logger.debug("Skipping best-effort auto-connect: MCP server has env declarations (requires manual connect)",{mcp_server_id:mcpServer.metadata?.id??"",env_keys:envKeys});return}let mcpServerId=mcpServer.metadata?.id??"",run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,{mcp_server_id:mcpServerId},CONNECT_TIMEOUT.ms)}catch(error2){deps.logger.warn("Failed to start best-effort connect workflow (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}if(!run.attached)try{await persistConnectStarting(deps.store,mcpServerId,run.workflowId,"")}catch(error2){deps.logger.warn("Failed to record CONNECTING for best-effort connect (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let outcome=await run.result(CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){deps.logger.warn("Best-effort connect workflow did not complete (non-fatal)",{workflow_id:run.workflowId,mcp_server_id:mcpServerId,failure_kind:outcome.failure.kind}),await persistConnectFailure(deps.store,deps.logger,mcpServerId,internalError(new Error(`connect run failed: ${outcome.failure.kind}`),"best-effort connect did not complete"));return}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){if(error2 instanceof ResourceNotFoundError){deps.logger.info("Skipping best-effort connect persistence: MCP server deleted before connect completed",{mcp_server_id:mcpServerId});return}deps.logger.warn("Failed to persist best-effort connect result (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.info("Best-effort auto-connect completed and stored",{workflow_id:run.workflowId,mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount})}async function disconnectOAuth(deps,input,identity2){let resourceId=input.resourceId;if(resourceId==="")throw invalidArgumentError("resource_id is required");let org=input.org;if(org==="")throw invalidArgumentError("org is required");await authorizeDirect(McpServerCommandController.method.disconnectOAuth,deps.authorizer,identity2,input);let grant;try{grant=await deps.oauthGrants.find("",resourceId,org)}catch(error2){throw internalError(error2,"failed to look up OAuth grant")}if(grant===void 0)return deps.logger.debug("No OAuth grant to disconnect",{resource_id:resourceId,org}),create2(DisconnectOAuthOutputSchema,{disconnected:!1});let envId=grant.environmentId;if(envId!=="")try{await deps.managedEnv.deleteManagedEnvironment(envId)}catch(error2){deps.logger.warn("Failed to delete managed environment \u2014 may already be deleted",{resource_id:resourceId,environment_id:envId,error:error2 instanceof Error?error2.message:String(error2)})}try{await deps.oauthGrants.delete("",resourceId,org)}catch(error2){throw internalError(error2,"failed to delete OAuth grant")}return deps.logger.info("OAuth connection disconnected",{resource_id:resourceId,org,env_deleted:envId!==""}),create2(DisconnectOAuthOutputSchema,{disconnected:!0})}async function getOAuthGrantStatus(deps,input,identity2){if(input.resourceId==="")throw invalidArgumentError("resource_id is required");if(input.org==="")throw invalidArgumentError("org is required");await authorizeDirect(McpServerQueryController.method.getOAuthGrantStatus,deps.authorizer,identity2,input);let grant;try{grant=await deps.oauthGrants.find("",input.resourceId,input.org)}catch(error2){throw internalError(error2,"failed to look up OAuth grant")}return grant===void 0?create2(GetOAuthGrantStatusOutputSchema,{connected:!1,connectionHealth:OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_NO_GRANT}):create2(GetOAuthGrantStatusOutputSchema,{connected:!0,accessTokenExpiresAt:BigInt(grant.accessTokenExpiresAt),targetEnvVar:grant.accessTokenEnvVar,authMethod:grant.authMethod,connectionHealth:evaluateHealth(grant)})}function evaluateHealth(grant){return grant.accessTokenExpiresAt===0?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY:Math.floor(Date.now()/1e3)<grant.accessTokenExpiresAt-REFRESH_EXPIRY_BUFFER_SECONDS?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY:grant.refreshTokenEnvVar!==""?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE:OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED}var import_node_crypto21=require("node:crypto");var import_node_crypto20=require("node:crypto");function generatePkce(){let verifier=(0,import_node_crypto20.randomBytes)(32).toString("base64url"),challenge=(0,import_node_crypto20.createHash)("sha256").update(verifier).digest().toString("base64url");return{codeVerifier:verifier,codeChallenge:challenge}}async function discoverAuthorizationServer(serverUrl,fetchImpl=fetch){let wellKnownUrl=buildWellKnownUrl(serverUrl),response;try{response=await fetchImpl(wellKnownUrl,{method:"GET",headers:{Accept:"application/json"},signal:AbortSignal.timeout(1e4)})}catch(error2){throw new Error(`discovery request to ${wellKnownUrl} failed: ${error2 instanceof Error?error2.message:String(error2)}`)}if(response.status!==200)throw await response.text(),new Error(`authorization server discovery failed: ${wellKnownUrl} returned HTTP ${response.status} (expected 200). This MCP server may not support the MCP Authorization specification`);let raw;try{raw=await response.json()}catch(error2){throw new Error(`failed to parse authorization server metadata: ${error2 instanceof Error?error2.message:String(error2)}`)}let metadata={issuer:raw.issuer??"",authorizationEndpoint:raw.authorization_endpoint??"",tokenEndpoint:raw.token_endpoint??"",registrationEndpoint:raw.registration_endpoint??"",scopesSupported:raw.scopes_supported??[],codeChallengeMethodsSupported:raw.code_challenge_methods_supported??[]};return validateMetadata(metadata,wellKnownUrl),metadata}function buildWellKnownUrl(serverUrl){let parsed;try{parsed=new URL(serverUrl)}catch(error2){throw new Error(`invalid server URL for discovery: ${error2 instanceof Error?error2.message:String(error2)}`)}let scheme=parsed.protocol.replace(/:$/,"");if(scheme!=="http"&&scheme!=="https")throw new Error(`invalid server URL for discovery: unsupported scheme "${scheme}": only http and https are supported`);if(parsed.host==="")throw new Error("invalid server URL for discovery: server URL has no host");return`${`${scheme}://${parsed.host}`.replace(/\/+$/,"")}/.well-known/oauth-authorization-server`}function validateMetadata(m3,sourceUrl){if(m3.authorizationEndpoint==="")throw new Error(`authorization server at ${sourceUrl} is missing authorization_endpoint`);if(m3.tokenEndpoint==="")throw new Error(`authorization server at ${sourceUrl} is missing token_endpoint`);if(m3.codeChallengeMethodsSupported.length>0&&!m3.codeChallengeMethodsSupported.includes("S256"))throw new Error(`authorization server at ${sourceUrl} does not support S256 PKCE (supports: [${m3.codeChallengeMethodsSupported.join(" ")}]). S256 is required by the MCP Authorization specification`)}var DCR_REQUEST_TIMEOUT_MS=15e3;async function registerClient(registrationEndpoint,redirectUri,clientName,fetchImpl=fetch){let requestBody=JSON.stringify({redirect_uris:[redirectUri],client_name:clientName,grant_types:["authorization_code"],response_types:["code"],token_endpoint_auth_method:"none"}),response;try{response=await fetchImpl(registrationEndpoint,{method:"POST",headers:{"Content-Type":"application/json",Accept:"application/json"},body:requestBody,signal:AbortSignal.timeout(DCR_REQUEST_TIMEOUT_MS)})}catch(error2){throw new Error(`DCR request to ${registrationEndpoint} failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let body=await response.text();if(response.status!==201&&response.status!==200)throw new Error(`DCR at ${registrationEndpoint} returned HTTP ${response.status}: ${truncateBody(body)}`);let raw;try{raw=JSON.parse(body)}catch(error2){throw new Error(`failed to parse DCR response: ${error2 instanceof Error?error2.message:String(error2)}`)}if((raw.client_id??"")==="")throw new Error(`DCR response from ${registrationEndpoint} is missing client_id`);return{clientId:raw.client_id,clientSecret:raw.client_secret??"",clientName:raw.client_name??"",tokenEndpointAuthMethod:raw.token_endpoint_auth_method??""}}var PREFLIGHT_REQUEST_TIMEOUT_MS=4e3,PREFLIGHT_BODY_READ_CAP=4096;async function preflightAuthorize(authorizationUrl,fetchImpl=fetch){let response=await fetchImpl(authorizationUrl,{method:"GET",redirect:"manual",signal:AbortSignal.timeout(PREFLIGHT_REQUEST_TIMEOUT_MS)});if(response.status!==400){await response.text().catch(()=>"");return}let body=(await response.text()).slice(0,PREFLIGHT_BODY_READ_CAP);return{statusCode:response.status,vendorDetail:extractVendorDetail(body),bodySnippet:truncateBody(body)}}function extractVendorDetail(body){let parsed;try{parsed=JSON.parse(body)}catch{return""}return(parsed.error_description??"")!==""?parsed.error_description:parsed.error??""}async function initiateOAuthConnect(deps,input,identity2){if(deps.oauthRedirectUri==="")throw failedPreconditionError("OAuth Connect is not configured: STIGMER_OAUTH_REDIRECT_URI is not set");let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.initiateOAuthConnect,deps.authorizer,identity2,input);let auth=mcpServer.spec?.auth;if(auth===void 0)throw failedPreconditionError(`MCP server '${mcpServerId}' does not have an auth block configured`);let pkcePair=generatePkce(),stateParam=generateState(),oauthAppRef=auth.oauthAppRef,isDcr=oauthAppRef===void 0||oauthAppRef.slug==="",result=isDcr?await initiateDcr(deps,mcpServer,pkcePair,stateParam):await initiateVendorOAuth(deps,mcpServer,pkcePair,stateParam),authMethod=isDcr?"mcp_oauth":"vendor_oauth",pendingState={state:stateParam,codeVerifier:pkcePair.codeVerifier,clientId:result.clientId,clientSecret:result.clientSecret,tokenEndpoint:result.tokenEndpoint,mcpServerId,identityAccountId:"",targetEnvVar:auth.targetEnvVar,authMethod,tokenAuthMethod:result.tokenAuthMethod,redirectUri:deps.oauthRedirectUri,org:input.org,createdAt:0},sealed;try{sealed=await sealPendingOAuthState(deps.secretService,deps.logger,pendingState)}catch(error2){throw internalError(error2,"failed to encrypt OAuth handshake secrets")}try{await deps.pendingOAuthStates.save(sealed)}catch(error2){throw internalError(error2,"failed to save pending OAuth state")}return deps.logger.info("Initiated OAuth Connect flow",{mcp_server_id:mcpServerId,auth_method:authMethod,provider:result.providerName}),create2(InitiateOAuthConnectOutputSchema,{authorizationUrl:result.authorizationUrl,state:stateParam,scopes:result.scopes,providerName:result.providerName})}async function initiateDcr(deps,mcpServer,pkcePair,stateParam){let serverUrl=mcpServer.spec?.auth?.discoveryUrl??"";if(serverUrl===""){let serverType=mcpServer.spec?.serverType;serverType?.case==="http"&&(serverUrl=serverType.value.url)}if(serverUrl==="")throw failedPreconditionError(`DCR requires a discoverable URL. MCP server '${mcpServer.metadata?.id??""}' has no http.url and no auth.discovery_url. Set auth.discovery_url for stdio servers, oauth_app_ref for vendor OAuth, or switch to HTTP transport`);let metadata;try{metadata=await discoverAuthorizationServer(serverUrl)}catch(error2){throw failedPreconditionError(`OAuth authorization server discovery failed for ${serverUrl}: ${error2 instanceof Error?error2.message:String(error2)}`)}if(metadata.registrationEndpoint==="")throw failedPreconditionError(`MCP server at ${serverUrl} does not advertise a registration_endpoint for DCR`);let clientName=`Stigmer (${mcpServer.metadata?.name??""})`,dcrResponse;try{dcrResponse=await registerClient(metadata.registrationEndpoint,deps.oauthRedirectUri,clientName)}catch(error2){throw failedPreconditionError(`DCR registration failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let scopes=mcpServer.spec?.auth?.scopeHints??[];scopes.length===0&&metadata.scopesSupported.length>0&&(scopes=metadata.scopesSupported);let authUrl=buildAuthorizationUrl(metadata.authorizationEndpoint,dcrResponse.clientId,deps.oauthRedirectUri,pkcePair.codeChallenge,stateParam,scopes,"scope"),rejection;try{rejection=await preflightAuthorize(authUrl)}catch(probeError){deps.logger.debug("authorize pre-flight probe inconclusive; proceeding",{mcp_server_id:mcpServer.metadata?.id??"",error:probeError instanceof Error?probeError.message:String(probeError)})}if(rejection!==void 0)throw deps.logger.warn("authorization endpoint rejected the sign-in request pre-flight",{status_code:rejection.statusCode,mcp_server_id:mcpServer.metadata?.id??"",body_snippet:rejection.bodySnippet}),failedPreconditionError(dcrRejectionMessage(mcpServer.metadata?.name??"",deps.oauthRedirectUri,rejection));return{authorizationUrl:authUrl,providerName:mcpServer.metadata?.name??"",scopes,clientId:dcrResponse.clientId,clientSecret:"",tokenEndpoint:metadata.tokenEndpoint,tokenAuthMethod:""}}async function initiateVendorOAuth(deps,mcpServer,pkcePair,stateParam){let ref=mcpServer.spec?.auth?.oauthAppRef,oauthApp;try{oauthApp=await resolveOAuthAppRef2(deps.store,ref,deps.logger)}catch(error2){throw internalError(error2,"failed to list oauth apps")}if(oauthApp===void 0)throw notFoundError("oauth_app",ref?.slug??"");let approvalStatus=oauthApp.spec?.vendorApprovalStatus;if(approvalStatus===VendorApprovalStatus.PENDING||approvalStatus===VendorApprovalStatus.REJECTED){let statusLabel=approvalStatus===VendorApprovalStatus.REJECTED?"rejected":"pending approval",alternative=mcpServer.spec?.auth?.oauthOnly?"This server only accepts OAuth sign-in; an org admin can configure your own OAuth app instead.":"Please enter a token manually instead.";throw failedPreconditionError(`OAuth sign-in is unavailable: the platform's OAuth app for '${oauthApp.spec?.provider??""}' is ${statusLabel} by the vendor. ${alternative}`)}let clientSecret=oauthApp.spec?.clientSecret??"";if(deps.secretService.isEncrypted(clientSecret))try{clientSecret=await deps.secretService.decrypt(clientSecret)}catch(error2){throw internalError(error2,"failed to decrypt OAuthApp client secret")}let scopes=oauthApp.spec?.scopes??[];return{authorizationUrl:buildAuthorizationUrl(oauthApp.spec?.authorizationUrl??"",oauthApp.spec?.clientId??"",deps.oauthRedirectUri,pkcePair.codeChallenge,stateParam,scopes,oauthApp.spec?.scopeParameterName??""),providerName:oauthApp.spec?.provider??"",scopes,clientId:oauthApp.spec?.clientId??"",clientSecret,tokenEndpoint:oauthApp.spec?.tokenUrl??"",tokenAuthMethod:tokenAuthMethodFromSpec(oauthApp.spec?.tokenEndpointAuthMethod??TokenEndpointAuthMethod.UNSPECIFIED)}}function buildAuthorizationUrl(authEndpoint,clientId,redirectUri,codeChallenge,state2,scopes,scopeParamName){let scopeParam=scopeParamName===""?"scope":scopeParamName,params=new URLSearchParams({response_type:"code",client_id:clientId,redirect_uri:redirectUri,code_challenge:codeChallenge,code_challenge_method:"S256",state:state2});scopes.length>0&&params.set(scopeParam,scopes.join(" ")),params.sort();let separator=authEndpoint.includes("?")?"&":"?";return authEndpoint+separator+params.toString()}function dcrRejectionMessage(providerName,redirectUri,rejection){let callbackHost=redirectUri;try{let parsed=new URL(redirectUri);parsed.host!==""&&(callbackHost=parsed.host)}catch{}let message6=`${providerName} rejected the sign-in request before showing a login page (HTTP ${rejection.statusCode}). The most common cause is a redirect-host allowlist: this deployment's OAuth callback host (${callbackHost}) is not on the provider's approved list. Self-hosted deployments with a localhost callback are typically unaffected.`;return rejection.vendorDetail!==""&&(message6+=" Provider detail: "+rejection.vendorDetail),message6}function generateState(){return(0,import_node_crypto21.randomBytes)(32).toString("base64url")}async function sealPendingOAuthState(secretService,logger2,state2){if(!secretService.isEnabled())return logger2.warn("Encryption disabled: pending OAuth state secrets will be stored in plaintext"),state2;let scope=EncryptionScope.forOrganization(state2.org),sealedVerifier;try{sealedVerifier=await secretService.encrypt(state2.codeVerifier,scope)}catch(error2){throw new Error(`failed to encrypt code_verifier: ${error2 instanceof Error?error2.message:String(error2)}`)}let sealedSecret=state2.clientSecret;if(state2.clientSecret!=="")try{sealedSecret=await secretService.encrypt(state2.clientSecret,scope)}catch(error2){throw new Error(`failed to encrypt client_secret: ${error2 instanceof Error?error2.message:String(error2)}`)}return{...state2,codeVerifier:sealedVerifier,clientSecret:sealedSecret}}var mcpServerSearchExtractor={kind:ApiResourceKind.mcp_server,schema:McpServerSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let mcpServer=resource;return buildSearchResult({kind:ApiResourceKind.mcp_server,metadata:mcpServer.metadata,summary:mcpServer.spec?.description??"",score,createdAt:mcpServer.status?.audit?.specAudit?.createdAt,updatedAt:mcpServer.status?.audit?.specAudit?.updatedAt,iconUrl:mcpServer.spec?.iconUrl??""})},getSearchIndexEntry(resource){let mcpServer=resource,metadata=mcpServer.metadata;if(metadata!==void 0)return{name:metadata.name,description:mcpServer.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(mcpServer.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var RUNNER_QUEUE_WARNING="no runner appears to be polling the task queue \u2014 the connect will wait for one to come up (start your local runner if it is not running)";async function startConnect(deps,input,identity2){let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError("connect is not available: Temporal not configured");let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");if(input.org==="")throw invalidArgumentError("org is required for connect");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.startConnect,deps.authorizer,identity2,input);let connectStatus=mcpServer.status?.connectStatus;if(connectStatus?.phase===ConnectPhase.connecting&&await engineState.engine.isConnectRunRunning(connectStatus.workflowId))return deps.logger.info("StartConnect attached to in-flight connect operation",{mcp_server_id:mcpServerId,workflow_id:connectStatus.workflowId}),mcpServer;let prepared=await prepareConnect(deps,mcpServer,input,identity2),warning2=await runnerQueueWarning(engineState.engine),run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,prepared.workflowInput,ASYNC_CONNECT_TIMEOUT.ms)}catch(error2){throw prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId),deps.logger.error("Failed to start MCP connect workflow",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to start connect workflow")}if(run.attached){prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId);try{return await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}}let persisted;try{persisted=await persistConnectStarting(deps.store,mcpServerId,run.workflowId,warning2)}catch(error2){throw detachSettle(deps,mcpServer,run,prepared),internalError(error2,"failed to record connect operation")}return detachSettle(deps,mcpServer,run,prepared),persisted}function detachSettle(deps,mcpServer,run,prepared){settleConnectAsync(deps,mcpServer,run,prepared.ecResourceId,prepared.executionId).catch(error2=>{deps.logger.warn("Async connect settle task failed unexpectedly",{mcp_server_id:mcpServer.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})})}async function settleConnectAsync(deps,mcpServer,run,ecResourceId,executionId){let mcpServerId=mcpServer.metadata?.id??"";try{let outcome=await run.result(ASYNC_CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,ASYNC_CONNECT_TIMEOUT);await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure);return}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){if(error2 instanceof ResourceNotFoundError){deps.logger.info("Skipping async connect persistence: MCP server deleted before connect completed",{mcp_server_id:mcpServerId});return}deps.logger.warn("Failed to persist async connect result",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.info("Async MCP server connect completed and stored",{workflow_id:run.workflowId,mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount})}finally{ecResourceId!==""&&await deleteConnectExecutionContext(deps,ecResourceId,executionId)}}async function runnerQueueWarning(engine){let hasPollers=await engine.hasRunnerQueuePollers();return hasPollers===void 0||hasPollers?"":RUNNER_QUEUE_WARNING}function newValidateDefaultEnabledToolsStep(){return{name:"ValidateDefaultEnabledTools",execute(ctx){let mcpServer=ctx.newState,requested=mcpServer.spec?.defaultEnabledTools??[];if(requested.length===0)return;let caps=mcpServer.status?.discoveredCapabilities;if(caps===void 0)return;let classification=classify(caps,requested);if(isValidClassification(classification))return;let problems=[];throw classification.unknown.length>0&&problems.push(`default_enabled_tools names tool(s) this server does not expose: ${quoteJoin(classification.unknown)}`),classification.resourceTemplates.length>0&&problems.push(`default_enabled_tools names resource template(s): ${quoteJoin(classification.resourceTemplates)} \u2014 resource templates are read-only data endpoints, not callable tools, and must not appear in default_enabled_tools`),invalidArgumentError(`MCP server '${mcpServer.metadata?.slug??""}': ${problems.join("; ")}. Discovered tools: ${quoteJoin(toolNames(caps))}. If the server's toolset changed, run 'stigmer connect' on it to refresh discovered capabilities.`)}}}function newEnrichOAuthStatusStep(store,logger2){return{name:"EnrichOAuthStatus",async execute(ctx){let mcpServer=ctx.get(TARGET_RESOURCE_KEY);if(mcpServer===void 0)return;let ref=mcpServer.spec?.auth?.oauthAppRef;if((ref?.slug??"")==="")return;let oauthApp;try{oauthApp=await resolveOAuthAppRef2(store,ref,logger2)}catch(error2){logger2.warn("OAuthApp lookup failed; returning MCP server without oauth_status enrichment",{mcpServerId:mcpServer.metadata?.id??"",oauthAppSlug:ref?.slug??"",error:error2 instanceof Error?error2.message:String(error2)});return}if(oauthApp===void 0){logger2.debug("OAuthApp not found for ref; skipping oauth_status enrichment",{mcpServerId:mcpServer.metadata?.id??"",oauthAppSlug:ref?.slug??""});return}let approvalStatus=oauthApp.spec?.vendorApprovalStatus??VendorApprovalStatus.UNSPECIFIED,docsUrl=oauthApp.spec?.vendorApprovalDocsUrl??"";approvalStatus===VendorApprovalStatus.UNSPECIFIED&&docsUrl===""||(mcpServer.status??=create2(McpServerStatusSchema,{}),mcpServer.status.oauthStatus=create2(OAuthStatusSchema,{vendorApprovalStatus:approvalStatus,vendorApprovalDocsUrl:docsUrl}))}}}function registerMcpServerServices(router,deps){router.service(McpServerCommandController,{apply:(server,ctx)=>apply11(deps,server,ctx),create:(server,ctx)=>createMcpServer(deps,server,ctx),update:(server,ctx)=>update14(deps,server,ctx),updateVisibility:(input,ctx)=>updateVisibility4(deps,input,ctx),delete:(input,ctx)=>deleteMcpServer(deps,input,ctx),connect:(input,ctx)=>connect(deps.connect,input,callerIdentityOf(ctx)),startConnect:(input,ctx)=>startConnect(deps.connect,input,callerIdentityOf(ctx)),initiateOAuthConnect:(input,ctx)=>initiateOAuthConnect(deps.connect,input,callerIdentityOf(ctx)),completeOAuthConnect:(input,ctx)=>completeOAuthConnect(deps.connect,input,callerIdentityOf(ctx)),disconnectOAuth:(input,ctx)=>disconnectOAuth(deps.connect,input,callerIdentityOf(ctx)),setOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("SetOrgOAuthApp")},deleteOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("DeleteOrgOAuthApp")}}),router.service(McpServerQueryController,{get:(id,ctx)=>get18(deps,id,ctx),getByReference:(ref,ctx)=>getByReference10(deps,ref,ctx),getOAuthGrantStatus:(input,ctx)=>getOAuthGrantStatus(deps.connect,input,callerIdentityOf(ctx)),getOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("GetOrgOAuthApp")}})}function orgOAuthAppUnimplemented(method){return new ConnectError(`method ${method} not implemented`,Code.Unimplemented)}function kindOf17(ctx){return ctx.values.get(apiResourceKindKey)}async function createMcpServer(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("mcpserver-create",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardPublicVisibilityStep(deps.authorizer)).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,mcpServerSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update14(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("mcpserver-update",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newValidateDefaultEnabledToolsStep()).addStep(newNormalizeReferencesStep()).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,mcpServerSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply11(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf17(ctx));await newPipeline("mcpserver-apply",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");let result=shouldCreate?await createMcpServer(deps,server,ctx):await update14(deps,withResolvedApplyId(McpServerSchema,server,reqCtx),ctx);return startBestEffortConnect(deps.connect,result).catch(error2=>{deps.logger.warn("Best-effort connect task failed unexpectedly",{mcp_server_id:result.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}),result}async function deleteMcpServer(deps,input,ctx){let reqCtx=new RequestContext(McpServerCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf17(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("mcpserver-delete",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,McpServerSchema)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted mcp server not found in context"),"deleted mcp server not found in context");return deleted}var UPDATE_VISIBILITY_MCP_SERVER_KEY="updateVisibilityMcpServer";async function updateVisibility4(deps,input,ctx){let reqCtx=new RequestContext(McpServerCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("mcpserver-update-visibility",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadMcpServerForVisibilityUpdateStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store,{existingKey:UPDATE_VISIBILITY_MCP_SERVER_KEY})).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_MCP_SERVER_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newAuthorizeVisibilityTransitionStep(UPDATE_VISIBILITY_MCP_SERVER_KEY,deps.authorizer)).addStep(newSetMcpServerVisibilityStep()).addStep(newPersistMcpServerForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_MCP_SERVER_KEY)).addStep(newIndexMcpServerAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY)}function newLoadMcpServerForVisibilityUpdateStep(store){return{name:"LoadMcpServerForVisibilityUpdate",async execute(ctx){let input=ctx.input,mcpServer;try{mcpServer=await store.getResource(ctx.apiResourceKind,input.resourceId,McpServerSchema)}catch{throw notFoundError("mcp_server",input.resourceId)}ctx.set(UPDATE_VISIBILITY_MCP_SERVER_KEY,mcpServer)}}}function newSetMcpServerVisibilityStep(){return{name:"SetMcpServerVisibility",execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY);mcpServer.metadata!==void 0&&(mcpServer.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(McpServerSchema,mcpServer,"status_audit",ctx.callerIdentity)}}}function newPersistMcpServerForVisibilityUpdateStep(store){return{name:"PersistMcpServerForVisibilityUpdate",async execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY);try{await store.saveResource(ctx.apiResourceKind,mcpServer.metadata?.id??"",McpServerSchema,mcpServer)}catch(error2){throw internalError(error2,"failed to save mcp server")}}}}function newIndexMcpServerAfterVisibilityUpdateStep(store,logger2){return{name:"IndexMcpServerAfterVisibilityUpdate",async execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY),entry=mcpServerSearchExtractor.getSearchIndexEntry(mcpServer);if(entry===void 0){logger2.warn("IndexMcpServerAfterVisibilityUpdate: extractor returned nil, skipping",{id:mcpServer.metadata?.id??""});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,mcpServer.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexMcpServerAfterVisibilityUpdate: failed (best-effort)",{id:mcpServer.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function get18(deps,id,ctx){let reqCtx=new RequestContext(McpServerQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("mcpserver-get",deps.logger).addStep(newAuthorizeStep(McpServerQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,McpServerSchema)).addStep(newEnrichOAuthStatusStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference10(deps,ref,ctx){let reqCtx=new RequestContext(McpServerQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("mcpserver-get-by-reference",deps.logger).addStep(newAuthorizeStep(McpServerQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,McpServerSchema)).addStep(newEnrichOAuthStatusStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}function registerPlatformServices(router,deps){router.service(PlatformQueryController,{getServerInfo:()=>getServerInfo(deps),getLicenseStatus:()=>getLicenseStatus(deps),getRunnerBootstrapConfig:(_input,ctx)=>getRunnerBootstrapConfig(deps,ctx),getRunnerScopedToken:(input,ctx)=>getRunnerScopedToken(deps,input,ctx)})}function getServerInfo(deps){return create2(GetServerInfoOutputSchema,{edition:deps.edition,version:deps.version})}async function getLicenseStatus(deps){let now=deps.now(),report=await deps.licenseStatus.status(now),output=create2(GetLicenseStatusOutputSchema,{state:report.state,checkedAt:timestampFromDate(now)});switch(report.state){case LicenseState.absent:return output;case LicenseState.invalid:return output.keyId=report.keyId,output;case LicenseState.valid:case LicenseState.expiring:case LicenseState.grace:case LicenseState.expired:return output.keyId=report.keyId,output.claims=report.claims,output;default:{let exhaustive=report;throw new Error(`unhandled license report: ${JSON.stringify(exhaustive)}`)}}}async function getRunnerBootstrapConfig(deps,ctx){let output=create2(GetRunnerBootstrapConfigOutputSchema,{temporalAddress:deps.temporalHostPort,temporalNamespace:deps.temporalNamespace}),bootstrapCredentials=deps.runnerAuthService.bootstrapCredentials?.bind(deps.runnerAuthService);if(bootstrapCredentials===void 0)return output;try{let credentials=await bootstrapCredentials(callerIdentityOf(ctx));credentials.accessToken!==void 0&&(output.runnerAccessToken=credentials.accessToken.token,output.tokenType="Bearer",output.runnerAccessTokenExpiresInSeconds=credentials.accessToken.expiresInSeconds),credentials.payloadKeys!==void 0&&(output.payloadEncryptionKey=credentials.payloadKeys.keyBase64,output.payloadEncryptionKeyId=credentials.payloadKeys.keyId,output.payloadEncryptionSecondaryKey=credentials.payloadKeys.secondaryKeyBase64??"",output.payloadEncryptionSecondaryKeyId=credentials.payloadKeys.secondaryKeyId??"")}catch(error2){deps.logger.warn("Bootstrap credentials unavailable \u2014 answering coordinates without them",{error:error2 instanceof Error?error2.message:String(error2)})}return output}async function getRunnerScopedToken(deps,input,ctx){let exchange=deps.runnerAuthService.exchangeScopedToken?.bind(deps.runnerAuthService);if(exchange!==void 0){let minted=await exchange(exchangeRequestOf(input),callerIdentityOf(ctx));return minted.minted?create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.expiresInSeconds}):create2(GetRunnerScopedTokenOutputSchema)}let executionId;switch(input.scope.case){case"agentExecutionId":executionId=input.scope.value;break;case"workflowExecutionId":executionId=input.scope.value;break;case"poolClaim":case"renewal":case void 0:return create2(GetRunnerScopedTokenOutputSchema);default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}if(executionId===""||!deps.runnerAuthService.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))return create2(GetRunnerScopedTokenOutputSchema);try{let minted=deps.runnerAuthService.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.ttlSeconds})}catch(error2){return deps.logger.warn("failed to mint runner scoped token \u2014 answering not-minted",{executionId,error:error2 instanceof Error?error2.message:String(error2)}),create2(GetRunnerScopedTokenOutputSchema)}}function exchangeRequestOf(input){switch(input.scope.case){case"agentExecutionId":return{arm:"agent-execution",executionId:input.scope.value};case"workflowExecutionId":return{arm:"workflow-execution",executionId:input.scope.value};case"poolClaim":return{arm:"pool-claim",sessionId:input.scope.value.sessionId};case"renewal":return{arm:"renewal"};case void 0:return{arm:"unset"};default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}}var SERVER_VERSION="3.18.0";var file_ai_stigmer_tenancy_project_v1_io=fileDesc("CiZhaS9zdGlnbWVyL3RlbmFuY3kvcHJvamVjdC92MS9pby5wcm90bxIdYWkuc3RpZ21lci50ZW5hbmN5LnByb2plY3QudjEiIgoJUHJvamVjdElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQFiBnByb3RvMw",[file_buf_validate_validate]);var file_ai_stigmer_tenancy_project_v1_command=fileDesc("CithaS9zdGlnbWVyL3RlbmFuY3kvcHJvamVjdC92MS9jb21tYW5kLnByb3RvEh1haS5zdGlnbWVyLnRlbmFuY3kucHJvamVjdC52MTLBBAoYUHJvamVjdENvbW1hbmRDb250cm9sbGVyElcKBWFwcGx5EiYuYWkuc3RpZ21lci50ZW5hbmN5LnByb2plY3QudjEuUHJvamVjdBomLmFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxLlByb2plY3QSpQEKBmNyZWF0ZRImLmFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxLlByb2plY3QaJi5haS5zdGlnbWVyLnRlbmFuY3kucHJvamVjdC52MS5Qcm9qZWN0IkvCuBhHCAoQHiIMbWV0YWRhdGEub3JnKjN1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIHByb2plY3QgaW4gdGhpcyBvcmdhbml6YXRpb24SjwEKBnVwZGF0ZRImLmFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxLlByb2plY3QaJi5haS5zdGlnbWVyLnRlbmFuY3kucHJvamVjdC52MS5Qcm9qZWN0IjXCuBgxCAIQPCILbWV0YWRhdGEuaWQqHnVuYXV0aG9yaXplZCB0byB1cGRhdGUgcHJvamVjdBKLAQoGZGVsZXRlEiguYWkuc3RpZ21lci50ZW5hbmN5LnByb2plY3QudjEuUHJvamVjdElkGiYuYWkuc3RpZ21lci50ZW5hbmN5LnByb2plY3QudjEuUHJvamVjdCIvwrgYKwgDEDwiBXZhbHVlKh51bmF1dGhvcml6ZWQgdG8gZGVsZXRlIHByb2plY3QaBKD/KzxiBnByb3RvMw",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_project_v1_api,file_ai_stigmer_tenancy_project_v1_io]),ProjectCommandController=serviceDesc(file_ai_stigmer_tenancy_project_v1_command,0);var file_ai_stigmer_tenancy_project_v1_query=fileDesc("CilhaS9zdGlnbWVyL3RlbmFuY3kvcHJvamVjdC92MS9xdWVyeS5wcm90bxIdYWkuc3RpZ21lci50ZW5hbmN5LnByb2plY3QudjEynAIKFlByb2plY3RRdWVyeUNvbnRyb2xsZXIShQEKA2dldBIoLmFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxLlByb2plY3RJZBomLmFpLnN0aWdtZXIudGVuYW5jeS5wcm9qZWN0LnYxLlByb2plY3QiLMK4GCgIARA8IgV2YWx1ZSobdW5hdXRob3JpemVkIHRvIGdldCBwcm9qZWN0EnQKDmdldEJ5UmVmZXJlbmNlEjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlGiYuYWkuc3RpZ21lci50ZW5hbmN5LnByb2plY3QudjEuUHJvamVjdCIE0LgYARoEoP8rPGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_project_v1_api,file_ai_stigmer_tenancy_project_v1_io]),ProjectQueryController=serviceDesc(file_ai_stigmer_tenancy_project_v1_query,0);var DEFAULT_RECONCILIATION_OPTIONS={pruneEnabled:!0,dryRun:!1};function newReconciliationService(deps){return{async reconcile(previousMembers,currentMembers,options){let previousSet=buildReferenceSet(previousMembers),currentSet=buildReferenceSet(currentMembers),added=currentMembers.filter(ref=>!previousSet.has(referenceKey(ref))),orphans=previousMembers.filter(ref=>!currentSet.has(referenceKey(ref)));if(added.length===0&&orphans.length===0)return{added:[],removed:[],errors:[]};if(options.dryRun)return{added,removed:orphans,errors:[]};if(!options.pruneEnabled||orphans.length===0)return{added,removed:[],errors:[]};let{removed,errors}=await deleteOrphans(deps,orphans);return{added,removed,errors}}}}async function deleteOrphans(deps,orphans){let removed=[],errors=[];for(let ref of orphans){let refKey=referenceKey(ref),resourceId;try{resourceId=await resolveResourceId2(deps.store,ref)}catch(cause){errors.push({resourceKey:refKey,message:"failed to resolve resource for deletion",cause}),deps.logger.warn("reconciliation: failed to resolve orphan for deletion",{resource:refKey,error:cause instanceof Error?cause.message:String(cause)});continue}try{await deps.orphanDeleter().delete(ref.kind,resourceId)}catch(cause){errors.push({resourceKey:refKey,message:"failed to delete orphaned resource",cause}),deps.logger.warn("reconciliation: failed to delete orphaned resource",{resource:refKey,resourceId,error:cause instanceof Error?cause.message:String(cause)});continue}removed.push(ref)}return{removed,errors}}async function resolveResourceId2(store,ref){let schema2=schemaForKind(ref.kind),resource=await findResourceBySlug(store,ref.kind,schema2,ref.slug,ref.org);if(resource===void 0){let where=ref.org===""?"":` in org '${ref.org}'`;throw new Error(`resource ${kindName(ref.kind)}/${ref.slug} not found${where}`)}let id=metadataOf(resource)?.id??"";if(id==="")throw new Error(`resource ${kindName(ref.kind)}/${ref.slug} has no ID`);return id}function schemaForKind(kind){switch(kind){case ApiResourceKind.agent:return AgentSchema;case ApiResourceKind.workflow:return WorkflowSchema;case ApiResourceKind.mcp_server:return McpServerSchema;case ApiResourceKind.skill:return SkillSchema;default:throw new Error(`unsupported resource kind: ${kindName(kind)}`)}}function referenceKey(ref){return`${kindName(ref.kind)}:${ref.slug}`}function kindName(kind){return ApiResourceKind[kind]??String(kind)}function buildReferenceSet(refs){return new Set(refs.map(referenceKey))}function toProtoSummary(result){return create2(ReconciliationSummarySchema,{created:[...result.added],updated:[],deleted:[...result.removed]})}var projectSearchExtractor={kind:ApiResourceKind.project,schema:ProjectSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let project=resource;return buildSearchResult({kind:ApiResourceKind.project,metadata:project.metadata,summary:project.spec?.description??"",score,createdAt:project.status?.audit?.specAudit?.createdAt,updatedAt:project.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let project=resource,metadata=project.metadata;if(metadata!==void 0)return{name:metadata.name,description:project.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(project.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function registerProjectServices(router,deps){let reconciliation=newReconciliationService({store:deps.store,orphanDeleter:deps.orphanDeleter,logger:deps.logger});router.service(ProjectCommandController,{apply:(project,ctx)=>apply12(deps,reconciliation,project,ctx),create:(project,ctx)=>createProject(deps,project,ctx),update:(project,ctx)=>update15(deps,project,ctx),delete:(projectId,ctx)=>deleteProject(deps,projectId,ctx)}),router.service(ProjectQueryController,{get:(projectId,ctx)=>get19(deps,projectId,ctx),getByReference:(ref,ctx)=>getByReference11(deps,ref,ctx)})}function kindOf18(ctx){return ctx.values.get(apiResourceKindKey)}async function createProject(deps,project,ctx){let reqCtx=new RequestContext(ProjectSchema,project,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("project-create",deps.logger).addStep(newAuthorizeStep(ProjectCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,projectSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update15(deps,project,ctx){let reqCtx=new RequestContext(ProjectSchema,project,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("project-update",deps.logger).addStep(newAuthorizeStep(ProjectCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,projectSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply12(deps,reconciliation,project,ctx){let reqCtx=new RequestContext(ProjectSchema,project,callerIdentityOf(ctx),kindOf18(ctx));await newPipeline("project-apply",deps.logger).addStep(newAuthorizeStep(ProjectCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");let previousMembers=shouldCreate?[]:reqCtx.get(EXISTING_RESOURCE_KEY)?.spec?.members??[],persisted=shouldCreate?await createProject(deps,project,ctx):await update15(deps,withResolvedApplyId(ProjectSchema,project,reqCtx),ctx),currentMembers=persisted.spec?.members??[];try{let result=await reconciliation.reconcile(previousMembers,currentMembers,DEFAULT_RECONCILIATION_OPTIONS);persisted.status??=create2(ProjectStatusSchema),persisted.status.lastReconciliation=toProtoSummary(result)}catch(error2){deps.logger.error("Reconciliation failed",{projectId:persisted.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}return persisted}async function deleteProject(deps,projectId,ctx){let reqCtx=new RequestContext(ProjectCommandController.method.delete.input,projectId,callerIdentityOf(ctx),kindOf18(ctx));await newPipeline("project-delete",deps.logger).addStep(newAuthorizeStep(ProjectCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,ProjectSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("delete pipeline completed without a loaded resource"),"deleted project not found in context");return deleted}async function get19(deps,projectId,ctx){let reqCtx=new RequestContext(ProjectQueryController.method.get.input,projectId,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("project-get",deps.logger).addStep(newAuthorizeStep(ProjectQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ProjectSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference11(deps,ref,ctx){let reqCtx=new RequestContext(ProjectQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("project-get-by-reference",deps.logger).addStep(newAuthorizeStep(ProjectQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ProjectSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var file_ai_stigmer_agentic_session_v1_io=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9pby5wcm90bxIdYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEiIgoJU2Vzc2lvbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiIAoHQWdlbnRJZBIVCgV2YWx1ZRgBIAEoCUIGukgDyAEBIlsKC1Nlc3Npb25MaXN0EhMKC3RvdGFsX3BhZ2VzGAEgASgFEjcKB2VudHJpZXMYAiADKAsyJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uIkoKE0xpc3RTZXNzaW9uc1JlcXVlc3QSEQoJcGFnZV9zaXplGAEgASgFEhIKCnBhZ2VfdG9rZW4YAiABKAkSDAoEdGFncxgDIAMoCSJuCiJMaXN0U2Vzc2lvbnNCeUFnZW50SW5zdGFuY2VSZXF1ZXN0EiEKEWFnZW50X2luc3RhbmNlX2lkGAEgASgJQga6SAPIAQESEQoJcGFnZV9zaXplGAIgASgFEhIKCnBhZ2VfdG9rZW4YAyABKAkiYQocTGlzdFNlc3Npb25zQnlDaGFubmVsUmVxdWVzdBIaCgpjaGFubmVsX2lkGAEgASgJQga6SAPIAQESEQoJcGFnZV9zaXplGAIgASgFEhIKCnBhZ2VfdG9rZW4YAyABKAkiQgobVXBkYXRlU2Vzc2lvblN1YmplY3RSZXF1ZXN0EhIKAmlkGAEgASgJQga6SAPIAQESDwoHc3ViamVjdBgCIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_session_v1_api,file_buf_validate_validate]),SessionIdSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_io,0);var SessionListSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_io,2);var file_ai_stigmer_agentic_session_v1_command=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9jb21tYW5kLnByb3RvEh1haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MTLtBQoYU2Vzc2lvbkNvbW1hbmRDb250cm9sbGVyElcKBWFwcGx5EiYuYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbhomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24SpQEKBmNyZWF0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24aJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uIkvCuBhHCAgQHiIMbWV0YWRhdGEub3JnKjN1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIHNlc3Npb24gaW4gdGhpcyBvcmdhbml6YXRpb24SjwEKBnVwZGF0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24aJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uIjXCuBgxCAIQKiILbWV0YWRhdGEuaWQqHnVuYXV0aG9yaXplZCB0byB1cGRhdGUgc2Vzc2lvbhKpAQoNdXBkYXRlU3ViamVjdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlVwZGF0ZVNlc3Npb25TdWJqZWN0UmVxdWVzdBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iNMK4GDAIAhAqIgJpZComdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBzZXNzaW9uIHN1YmplY3QSiwEKBmRlbGV0ZRIoLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iL8K4GCsIAxAqIgV2YWx1ZSoedW5hdXRob3JpemVkIHRvIGRlbGV0ZSBzZXNzaW9uGgSg/ysqYgZwcm90bzM",[file_ai_stigmer_agentic_session_v1_api,file_ai_stigmer_agentic_session_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SessionCommandController=serviceDesc(file_ai_stigmer_agentic_session_v1_command,0);var file_ai_stigmer_agentic_session_v1_query=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9xdWVyeS5wcm90bxIdYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEyoQQKFlNlc3Npb25RdWVyeUNvbnRyb2xsZXIShQEKA2dldBIoLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iLMK4GCgIARAqIgV2YWx1ZSobdW5hdXRob3JpemVkIHRvIGdldCBzZXNzaW9uEmwKBGxpc3QSMi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5MaXN0U2Vzc2lvbnNSZXF1ZXN0GiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbkxpc3QiBNC4GAESigEKE2xpc3RCeUFnZW50SW5zdGFuY2USQS5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5MaXN0U2Vzc2lvbnNCeUFnZW50SW5zdGFuY2VSZXF1ZXN0GiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbkxpc3QiBNC4GAESfgoNbGlzdEJ5Q2hhbm5lbBI7LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLkxpc3RTZXNzaW9uc0J5Q2hhbm5lbFJlcXVlc3QaKi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uTGlzdCIE0LgYARoEoP8rKmIGcHJvdG8z",[file_ai_stigmer_agentic_session_v1_api,file_ai_stigmer_agentic_session_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SessionQueryController=serviceDesc(file_ai_stigmer_agentic_session_v1_query,0);function runAgentInstanceDeniedMessage2(agentInstanceId){return`unauthorized to run agent instance '${agentInstanceId}'`}function sessionRunTarget(session){let agentInstanceId=session.spec?.agentInstanceId??"";if(agentInstanceId!=="")return{...RUN_GATE_CHECKS.agentInstance,resourceId:agentInstanceId,deniedMessage:runAgentInstanceDeniedMessage2(agentInstanceId)}}var sessionSearchExtractor={kind:ApiResourceKind.session,schema:SessionSchema,getSearchSummary(resource){return resource.spec?.subject??""},toSearchResult(resource,score){let session=resource;return buildSearchResult({kind:ApiResourceKind.session,metadata:session.metadata,summary:session.spec?.subject??"",score,createdAt:session.status?.audit?.specAudit?.createdAt,updatedAt:session.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let session=resource,metadata=session.metadata;if(metadata!==void 0)return{name:metadata.name,description:session.spec?.subject??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(session.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var LIST_RESULT_KEY8="listResult",CHANNEL_ID_LABEL_KEY="stigmer.ai/channel-id";function newResolveDefaultAgentInstanceStep(store,creator,logger2,authorizationLifecycle){return{name:"ResolveDefaultAgentInstance",async execute(ctx){if((ctx.input.spec?.agentInstanceId??"")!=="")return;logger2.info("agent_instance_id not provided on session, resolving platform default agent");let defaultAgent;try{defaultAgent=await findDefaultAgent(store,logger2)}catch(error2){throw error2 instanceof DefaultAgentNotConfiguredError?(logger2.error("No platform default agent configured",{error:error2.message}),new ConnectError(`No default agent available. Ensure an agent with label stigmer.ai/default-agent=true and visibility_public exists: no default agent available on this platform: ${error2.message}`,Code.NotFound)):error2 instanceof DefaultAgentNotPublicError?(logger2.error("Default agent is not visibility_public",{error:error2.message}),new ConnectError(`Default agent exists but is not visibility_public: ${error2.message}`,Code.FailedPrecondition)):(logger2.error("Failed to resolve platform default agent",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to resolve the platform default agent"))}let metadata=defaultAgent.metadata;if(metadata===void 0)throw internalError(new Error("default agent metadata is nil"),"failed to resolve the platform default agent");let agentId=metadata.id;logger2.info("Resolved platform default agent",{agentId,agentName:metadata.name});let defaultInstanceId=defaultAgent.status?.defaultInstanceId??"";if(defaultInstanceId===""){logger2.info("Default instance missing, creating one",{agentId});let instanceRequest=buildDefaultInstanceRequest(metadata),createdInstance;try{createdInstance=await creator().createAsCaller(instanceRequest,ctx.callerIdentity)}catch(error2){throw logger2.error("Failed to create default instance",{agentId,error:error2 instanceof Error?error2.message:String(error2)}),error2 instanceof ConnectError?goWrappedStatusError("failed to create default instance for default agent",error2):new Error(`failed to create default instance for default agent: ${error2 instanceof Error?error2.message:String(error2)}`)}defaultInstanceId=createdInstance.metadata?.id??"",defaultAgent.status===void 0&&(defaultAgent.status=create2(AgentStatusSchema,{})),defaultAgent.status.defaultInstanceId=defaultInstanceId;try{await store.saveResource(ApiResourceKind.agent,agentId,AgentSchema,defaultAgent)}catch(error2){throw logger2.error("Failed to persist agent with default_instance_id",{agentId,error:error2 instanceof Error?error2.message:String(error2)}),new Error(`failed to persist agent with default instance: ${error2 instanceof Error?error2.message:String(error2)}`)}await notifyDefaultInstanceLinked(authorizationLifecycle,{instanceKind:ApiResourceKind.agent_instance,instanceId:defaultInstanceId,blueprintKind:ApiResourceKind.agent,blueprintId:agentId}),logger2.info("Created default instance for default agent",{instanceId:defaultInstanceId,agentId})}let newState=ctx.newState;newState.spec===void 0&&(newState.spec=create2(SessionSpecSchema,{})),newState.spec.agentInstanceId=defaultInstanceId,logger2.info("Set agent_instance_id on session from platform default agent",{agentInstanceId:defaultInstanceId})}}}function newValidateHarnessImmutabilityStep(){return{name:"ValidateHarnessImmutability",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0||existingSpec.harnessStateId==="")return;let inputSpec=ctx.input.spec;if(inputSpec===void 0)return;let existingHarness=existingSpec.harness,inputHarness=inputSpec.harness;if(existingHarness===Harness.UNSPECIFIED&&(existingHarness=Harness.NATIVE),inputHarness===Harness.UNSPECIFIED&&(inputHarness=Harness.NATIVE),inputHarness!==existingHarness)throw failedPreconditionError("session harness cannot be changed after the first execution \u2014 each harness owns its conversation state independently")}}}var EXECUTION_TARGET_GO_NAMES={[ExecutionTarget.UNSPECIFIED]:"EXECUTION_TARGET_UNSPECIFIED",[ExecutionTarget.LOCAL]:"EXECUTION_TARGET_LOCAL",[ExecutionTarget.CLOUD]:"EXECUTION_TARGET_CLOUD"};function newValidateExecutionTargetImmutabilityStep(temporalConfig){return{name:"ValidateExecutionTargetImmutability",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0||existingSpec.harnessStateId==="")return;let inputSpec=ctx.input.spec;if(inputSpec===void 0)return;let existingTarget=temporalConfig.resolveExecutionTarget(existingSpec.executionTarget),inputTarget=temporalConfig.resolveExecutionTarget(inputSpec.executionTarget);if(inputTarget!==existingTarget)throw failedPreconditionError(`session execution_target cannot be changed after the first execution (${EXECUTION_TARGET_GO_NAMES[existingTarget]} \u2192 ${EXECUTION_TARGET_GO_NAMES[inputTarget]}; unset resolves to the deployment default, ${temporalConfig.defaultExecutionTarget}) \u2014 workspace state may not be portable between local and cloud environments`)}}}function newRecordHarnessStateHistoryStep(){return{name:"RecordHarnessStateHistory",execute(ctx){let mergedSpec=ctx.newState.spec;if(mergedSpec===void 0)return;let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0||existing.spec===void 0)return;let existingSpec=existing.spec,history=[...existingSpec.harnessStateIdHistory],previousId=existingSpec.harnessStateId;previousId!==""&&previousId!==mergedSpec.harnessStateId&&!history.includes(previousId)&&history.push(previousId),mergedSpec.harnessStateIdHistory=history}}}function isActiveExecutionPhase(phase){switch(phase){case ExecutionPhase.EXECUTION_PENDING:case ExecutionPhase.EXECUTION_IN_PROGRESS:case ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL:case ExecutionPhase.EXECUTION_PAUSED:return!0;default:return!1}}async function listExecutionsBySession(store,logger2,sessionId){let rows;try{rows=await store.listResources(ApiResourceKind.agent_execution)}catch(error2){throw internalError(error2,"failed to list agent executions")}let executions=[];for(let data of rows){let execution;try{execution=fromBinary2(AgentExecutionSchema,data)}catch(error2){logger2.warn("Failed to unmarshal execution, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}(execution.spec?.sessionId??"")===sessionId&&executions.push(execution)}return executions}function newRejectDeleteWithActiveExecutionsStep(store,logger2){return{name:"RejectDeleteWithActiveExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId),activeCount=0;for(let execution of executions)isActiveExecutionPhase(execution.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED)&&activeCount++;if(activeCount>0)throw failedPreconditionError(`session has ${activeCount} active execution(s); cancel them or wait for completion before deleting`)}}}function newCascadeDeleteAgentExecutionsStep(store,logger2){return{name:"CascadeDeleteAgentExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId);if(executions.length!==0){for(let execution of executions){let executionId=execution.metadata?.id??"";try{await store.deleteResource(ApiResourceKind.agent_execution,executionId)}catch(error2){throw internalError(error2,`failed to cascade-delete execution ${executionId} of session ${sessionId}`)}try{await store.deleteSearchIndex(ApiResourceKind.agent_execution,executionId)}catch(error2){logger2.warn("CascadeDeleteAgentExecutions: failed to remove search index entry (best-effort)",{executionId,error:error2 instanceof Error?error2.message:String(error2)})}}logger2.info("Cascade-deleted executions of session",{sessionId,count:executions.length})}}}}function requireSessionId(ctx){let sessionId=ctx.get(RESOURCE_ID_KEY);if(typeof sessionId!="string"||sessionId==="")throw internalError(new Error("session id not found in context (ExtractResourceId must run first)"),"session id not found in context (ExtractResourceId must run first)");return sessionId}function newListAllSessionsStep(store,logger2,listReadScope){return{name:"ListAllSessions",async execute(ctx){let sessions=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.session,await loadAllSessions(store,logger2,ctx.apiResourceKind),"");sessions.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),logger2.info("Loaded sessions from database",{count:sessions.length}),ctx.set(LIST_RESULT_KEY8,create2(SessionListSchema,{entries:sessions}))}}}function newFilterByAgentInstanceStep(store,logger2,listReadScope){return{name:"FilterByAgentInstance",async execute(ctx){let agentInstanceId=ctx.input.agentInstanceId;if(agentInstanceId==="")throw invalidArgumentError("agent_instance_id is required");let sessions=await loadAllSessions(store,logger2,ctx.apiResourceKind),filtered=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.session,sessions.filter(session=>(session.spec?.agentInstanceId??"")===agentInstanceId),"");logger2.info("Filtered sessions by agent instance",{agentInstanceId,totalSessions:sessions.length,filteredSessions:filtered.length}),ctx.set(LIST_RESULT_KEY8,create2(SessionListSchema,{entries:filtered}))}}}function newAuthorizeChannelAccessStep(authorizer){return{name:"AuthorizeChannelAccess",async execute(ctx){ctx.input.channelId!==""&&await authorizeResolvedResource(authorizer,ctx.callerIdentity,{permission:IamPermission.can_view,resourceKind:ApiResourceKind.agent_channel,resourceId:ctx.input.channelId},"unauthorized to list channel conversations")}}}function newFilterByChannelStep(store,logger2,listReadScope){return{name:"FilterByChannel",async execute(ctx){let channelId=ctx.input.channelId;if(channelId==="")throw invalidArgumentError("channel_id is required");let sessions=await loadAllSessions(store,logger2,ctx.apiResourceKind),filtered=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.session,sessions.filter(session=>(session.metadata?.labels??{})[CHANNEL_ID_LABEL_KEY]===channelId),"");logger2.info("Filtered sessions by channel",{channelId,totalSessions:sessions.length,filteredSessions:filtered.length}),ctx.set(LIST_RESULT_KEY8,create2(SessionListSchema,{entries:filtered}))}}}async function loadAllSessions(store,logger2,kind){let rows;try{rows=await store.listResources(kind)}catch(error2){throw internalError(error2,"failed to list sessions")}let sessions=[];for(let data of rows){let session;try{session=fromBinary2(SessionSchema,data)}catch(error2){logger2.warn("Failed to unmarshal session, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}sessions.push(session)}return sessions}function registerSessionServices(router,deps){router.service(SessionCommandController,{apply:(session,ctx)=>apply13(deps,session,ctx),create:(session,ctx)=>createSession(deps,session,ctx),update:(session,ctx)=>update16(deps,session,ctx),updateSubject:(req,ctx)=>updateSubject(deps,req,callerIdentityOf(ctx)),delete:(id,ctx)=>deleteSession(deps,id,ctx)}),router.service(SessionQueryController,{get:(id,ctx)=>get20(deps,id,ctx),list:(req,ctx)=>list9(deps,req,ctx),listByAgentInstance:(req,ctx)=>listByAgentInstance(deps,req,ctx),listByChannel:(req,ctx)=>listByChannel(deps,req,ctx)})}function kindOf19(ctx){return ctx.values.get(apiResourceKindKey)}async function createSession(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx)),builder2=newPipeline("session-create",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.create,deps.authorizer)).addStep(newResolveDefaultAgentInstanceStep(deps.store,deps.agentInstanceCreator,deps.logger,deps.authorizationLifecycle)).addStep(newAuthorizeRunTargetStep(deps.authorizer,sessionRunTarget)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep());for(let step of stepsForSlot(deps.gateSteps,"session-create:pre-side-effect-gate"))builder2.addStep(step);return await builder2.addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update16(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-update",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateHarnessImmutabilityStep()).addStep(newValidateExecutionTargetImmutabilityStep(deps.temporalConfig)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newRecordHarnessStateHistoryStep()).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply13(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("session-apply",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createSession(deps,session,ctx):update16(deps,withResolvedApplyId(SessionSchema,session,reqCtx),ctx)}async function deleteSession(deps,sessionId,ctx){let reqCtx=new RequestContext(SessionCommandController.method.delete.input,sessionId,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("session-delete",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,SessionSchema)).addStep(newRejectDeleteWithActiveExecutionsStep(deps.store,deps.logger)).addStep(newCascadeDeleteAgentExecutionsStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted session not found in context"),"deleted session not found in context");return await deprovisionSessionSandboxBestEffort(deps.sandboxLane,deps.logger,deleted.metadata?.id??""),deleted}async function updateSubject(deps,req,identity2){if(req.id==="")throw invalidArgumentError("id is required");let kind=ApiResourceKind.session,session;try{session=await deps.store.getResource(kind,req.id,SessionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("session",req.id):internalError(error2,"failed to load session")}await authorizeDirect(SessionCommandController.method.updateSubject,deps.authorizer,identity2,req),session.spec===void 0&&(session.spec=create2(SessionSpecSchema,{})),session.spec.subject=req.subject,setAuditFieldsForUpdate(SessionSchema,session,"spec_audit",identity2);try{await deps.store.saveResource(kind,req.id,SessionSchema,session)}catch(error2){throw internalError(error2,"failed to persist session")}return await indexSessionSearch(deps,kind,session),session}async function indexSessionSearch(deps,kind,session){let entry=sessionSearchExtractor.getSearchIndexEntry(session);if(entry!==void 0)try{await deps.store.upsertSearchIndex(kind,session.metadata?.id??"",entry)}catch(error2){deps.logger.warn("UpdateSubject: failed to update search index (best-effort)",{id:session.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}async function get20(deps,id,ctx){let reqCtx=new RequestContext(SessionQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-get",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,SessionSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function list9(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListAllSessionsStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}async function listByAgentInstance(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByAgentInstance.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list-by-agent-instance",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByAgentInstance,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newFilterByAgentInstanceStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}async function listByChannel(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByChannel.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list-by-channel",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByChannel,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeChannelAccessStep(deps.authorizer)).addStep(newFilterByChannelStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}function requireListResult2(result){if(result===void 0)throw internalError(new Error("session list not found in context"),"session list not found in context");return result}var file_ai_stigmer_agentic_plugin_v1_io=fileDesc("CiVhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2lvLnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxIiEKCFBsdWdpbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEi9wIKEVB1c2hQbHVnaW5SZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhAKCGFydGlmYWN0GAIgASgMEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYAyABKAkSUwoKdmlzaWJpbGl0eRgEIAEoDjI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVZpc2liaWxpdHlCCLpIBYIBAhABEg8KB21lc3NhZ2UYBSABKAk6twG6SLMBGrABCiNwdXNoX3BsdWdpbl9yZXF1ZXN0LmFydGlmYWN0X3NvdXJjZRJJZXhhY3RseSBvbmUgb2YgYXJ0aWZhY3QgKGlubGluZSBieXRlcykgb3IgYXJ0aWZhY3RfdXBsb2FkX3JlZiBtdXN0IGJlIHNldBo+KHRoaXMuYXJ0aWZhY3Quc2l6ZSgpID4gMCkgIT0gKHRoaXMuYXJ0aWZhY3RfdXBsb2FkX3JlZiAhPSAnJykiWAokQ3JlYXRlUGx1Z2luQXJ0aWZhY3RVcGxvYWRVcmxSZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhsKCnNpemVfYnl0ZXMYAiABKANCB7pIBCICIAAiWAoXUGx1Z2luQXJ0aWZhY3RVcGxvYWRVcmwSCwoDdXJsGAEgASgJEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYAiABKAkSEwoLdHRsX3NlY29uZHMYAyABKAUihQEKDFBsdWdpbk1lbWJlchJNCgRraW5kGAEgASgOMj8uYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUtpbmQSCgoCaWQYAiABKAkSDAoEc2x1ZxgDIAEoCRIMCgRuYW1lGAQgASgJIlgKGUxpc3RQbHVnaW5NZW1iZXJzUmVzcG9uc2USOwoHbWVtYmVycxgBIAMoCzIqLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luTWVtYmVyImsKF0xpc3RQbHVnaW5WZXJzaW9uc0lucHV0EhMKA29yZxgBIAEoCUIGukgDyAEBEhQKBHNsdWcYAiABKAlCBrpIA8gBARISCgpwYWdlX3Rva2VuGAMgASgJEhEKCXBhZ2Vfc2l6ZRgEIAEoBSLtAQoSUGx1Z2luVmVyc2lvbkVudHJ5Eg4KBmRpZ2VzdBgBIAEoCRItCglwdXNoZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkgKCXB1c2hlZF9ieRgDIAEoCzI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0QWN0b3ISCwoDdGFnGAQgASgJEhIKCmlzX2N1cnJlbnQYBSABKAgSDwoHbWVzc2FnZRgGIAEoCRIcChRhcnRpZmFjdF9zdG9yYWdlX2tleRgHIAEoCSKOAQoaTGlzdFBsdWdpblZlcnNpb25zUmVzcG9uc2USQgoIdmVyc2lvbnMYASADKAsyMC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpblZlcnNpb25FbnRyeRIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEwoLdG90YWxfY291bnQYAyABKAViBnByb3RvMw",[file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind,file_ai_stigmer_commons_apiresource_enum,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_timestamp]);var PushPluginRequestSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,1);var PluginArtifactUploadUrlSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,3),PluginMemberSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,4),ListPluginMembersResponseSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,5);var PluginVersionEntrySchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,7),ListPluginVersionsResponseSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,8);var file_ai_stigmer_agentic_plugin_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEy2gUKF1BsdWdpbkNvbW1hbmRDb250cm9sbGVyEqEBCgRwdXNoEi8uYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QdXNoUGx1Z2luUmVxdWVzdBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24S2AEKF2NyZWF0ZUFydGlmYWN0VXBsb2FkVXJsEkIuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5DcmVhdGVQbHVnaW5BcnRpZmFjdFVwbG9hZFVybFJlcXVlc3QaNS5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbkFydGlmYWN0VXBsb2FkVXJsIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24SsAEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiQuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW4iP8K4GDsIAhA6IgtyZXNvdXJjZV9pZCoodW5hdXRob3JpemVkIHRvIHVwZGF0ZSBwbHVnaW4gdmlzaWJpbGl0eRKGAQoGZGVsZXRlEiYuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5JZBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIi7CuBgqCAMQOiIFdmFsdWUqHXVuYXV0aG9yaXplZCB0byBkZWxldGUgcGx1Z2luGgSg/ys6YgZwcm90bzM",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginCommandController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_command,0);var file_ai_stigmer_agentic_plugin_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxMsMEChVQbHVnaW5RdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luSWQaJC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbiIrwrgYJwgBEDoiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IHBsdWdpbhJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIgTQuBgBEqQBCgtsaXN0TWVtYmVycxImLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luSWQaNy5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5NZW1iZXJzUmVzcG9uc2UiNMK4GDAIARA6IgV2YWx1ZSojdW5hdXRob3JpemVkIHRvIGxpc3QgcGx1Z2luIG1lbWJlcnMShQEKDGxpc3RWZXJzaW9ucxI1LmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuTGlzdFBsdWdpblZlcnNpb25zSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5WZXJzaW9uc1Jlc3BvbnNlIgTQuBgBGgSg/ys6YgZwcm90bzM",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginQueryController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_query,0);var PLATFORM_ARCHIVE_LIMITS={maxFiles:1e4,maxUncompressedSize:524288e3,maxCompressionRatio:100};var ARTIFACT_BYTES_KEY="pushArtifactBytes";function newResolveArtifactSourceStep(slots,binding){return{name:"ResolveArtifactSource",async execute(ctx){let{artifact,artifactUploadRef}=binding.source(ctx.input);if(artifactUploadRef===""){ctx.set(ARTIFACT_BYTES_KEY,artifact);return}if(slots===void 0)throw failedPreconditionError(binding.laneNotConfigured);let data;try{data=await slots.consume(artifactUploadRef)}catch(error2){throw invalidArgumentError(`artifact_upload_ref not usable: ${error2 instanceof Error?error2.message:String(error2)} \u2014 request a new upload URL via createArtifactUploadUrl`)}ctx.set(ARTIFACT_BYTES_KEY,data)}}}function newArchiveCurrentVersionStep(store,logger2,binding){return{name:binding.stepName,async execute(ctx){let resource=ctx.get(binding.resourceKey),versionHash=binding.headHashOf(resource);if(versionHash==="")return;let tag2=binding.liveTagOf(resource),resourceId=metadataOf(resource)?.id??"",idField=`${binding.noun}Id`,alreadyArchived=!1;try{await store.getAuditByHash(ctx.apiResourceKind,resourceId,versionHash,binding.schema),alreadyArchived=!0}catch(error2){error2 instanceof AuditNotFoundError||logger2.warn(`Could not check for an existing archived ${binding.noun} version \u2014 archiving anyway`,{[idField]:resourceId,versionHash,error:error2 instanceof Error?error2.message:String(error2)})}if(!alreadyArchived)try{await store.saveAudit(ctx.apiResourceKind,resourceId,binding.schema,resource,versionHash,"")}catch(error2){logger2.error(`Failed to archive ${binding.noun} version \u2014 reverting the version hash to maintain the audit-resolvability invariant`,{[idField]:resourceId,versionHash,error:error2 instanceof Error?error2.message:String(error2)}),binding.clearHeadHash(resource);return}if(tag2!=="")try{await store.setAuditTag(ctx.apiResourceKind,resourceId,versionHash,tag2)}catch(error2){logger2.error(`Archived ${binding.noun} version but failed to assign its tag \u2014 clearing the live tag to stay consistent with the audit column`,{[idField]:resourceId,versionHash,tag:tag2,error:error2 instanceof Error?error2.message:String(error2)}),binding.clearLiveTag(resource)}alreadyArchived?logger2.info(`${capitalize(binding.noun)} version content already archived \u2014 repointed head without a new history row`,{[idField]:resourceId,versionHash,tag:tag2}):logger2.info(`Archived ${binding.noun} version to audit history`,{[idField]:resourceId,versionHash,tag:tag2})}}}function newDeleteVersionArchivesStep(store,logger2,binding){return{name:binding.stepName,async execute(ctx){let resourceId=ctx.get(RESOURCE_ID_KEY);if(typeof resourceId!="string")throw new Error("resource id not found in context (ExtractResourceIdStep must run first)");let idField=`${binding.noun}Id`;try{let deletedCount=await store.deleteAuditByResourceId(ctx.apiResourceKind,resourceId);deletedCount>0&&logger2.info(`Deleted archive records for ${binding.noun}`,{[idField]:resourceId,count:deletedCount})}catch(error2){logger2.warn(`failed to delete ${binding.noun} archives (best-effort)`,{[idField]:resourceId,error:error2 instanceof Error?error2.message:String(error2)})}}}}function capitalize(word){return word.charAt(0).toUpperCase()+word.slice(1)}var HASH_PATTERN=/^[a-f0-9]{64}$/;function isVersionHash(version){return HASH_PATTERN.test(version)}function newLoadByReferenceWithVersionStep(store,binding,stepName){return{name:stepName,async execute(ctx){let ref=ctx.input;if(ref.slug==="")throw invalidArgumentError("slug is required in reference");if(requireOrgForReference(ctx.apiResourceKind,ref.org),ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==binding.kind)throw invalidArgumentError(`kind mismatch: expected ${ApiResourceKind[binding.kind]}, got ${ApiResourceKind[ref.kind]}`);let head;try{head=await findResourceBySlug(store,ctx.apiResourceKind,binding.schema,ref.slug,ref.org)}catch(error2){throw internalError(error2,`failed to list ${binding.noun}s`)}if(head===void 0)throw notFoundError(binding.noun,ref.slug);let version=ref.version.trim();if(version===""||version==="latest"){ctx.set(TARGET_RESOURCE_KEY,head);return}if(headMatchesVersion(binding,head,version)){ctx.set(TARGET_RESOURCE_KEY,head);return}let archived=await findAuditByVersion(store,ctx.apiResourceKind,binding.schema,idOf(head),version);if(archived===void 0)throw notFoundError(`${binding.noun} version`,`${ref.slug}:${version}`);ctx.set(TARGET_RESOURCE_KEY,archived)}}}function headMatchesVersion(binding,head,version){if(isVersionHash(version))return binding.headHashOf(head)===version;let liveTag=binding.liveTagOf(head);return liveTag!==""&&liveTag===version}async function findAuditByVersion(store,kind,schema2,resourceId,version){if(isVersionHash(version))try{return await store.getAuditByHash(kind,resourceId,version,schema2)}catch(error2){if(error2 instanceof AuditNotFoundError)return;throw internalError(error2,"failed to query audit by hash")}try{return await store.getAuditByTag(kind,resourceId,version,schema2)}catch(error2){if(error2 instanceof AuditNotFoundError)return;throw internalError(error2,"failed to query audit by tag")}}var DEFAULT_PAGE_SIZE=50,MAX_PAGE_SIZE=100,LIST_VERSIONS_RESOURCE_ID_KEY="listVersionsResourceId",LIST_VERSIONS_HEAD_HASH_KEY="listVersionsHeadHash",LIST_VERSIONS_RESPONSE_KEY="listVersionsResponse";function newResolveBySlugForVersionsStep(store,binding,stepName){return{name:stepName,async execute(ctx){let req=binding.input(ctx.input),head;try{head=await findResourceBySlug(store,ctx.apiResourceKind,binding.schema,req.slug,req.org)}catch(error2){throw internalError(error2,`failed to search for ${binding.noun}`)}if(head===void 0)throw notFoundError(binding.noun,`${req.slug} (org: ${req.org})`);ctx.set(LIST_VERSIONS_RESOURCE_ID_KEY,idOf(head)),ctx.set(LIST_VERSIONS_HEAD_HASH_KEY,binding.headHashOf(head))}}}function newLoadAndMapVersionsStep(store,binding,stepName){return{name:stepName,async execute(ctx){let req=binding.input(ctx.input),resourceId=ctx.get(LIST_VERSIONS_RESOURCE_ID_KEY),records;try{records=await store.listAuditRecords(ctx.apiResourceKind,resourceId)}catch(error2){throw internalError(error2,"failed to load version history")}let headHash=ctx.get(LIST_VERSIONS_HEAD_HASH_KEY),currentMarked=!1,entries=[];for(let record of records){let snapshot;try{snapshot=fromBinary2(binding.schema,record.data)}catch{continue}let isCurrent=!currentMarked&&headHash!==""&&binding.headHashOf(snapshot)===headHash;currentMarked=currentMarked||isCurrent,entries.push(binding.mapEntry(snapshot,isCurrent,record.tag))}let pageSize=req.pageSize;pageSize<=0&&(pageSize=DEFAULT_PAGE_SIZE),pageSize>MAX_PAGE_SIZE&&(pageSize=MAX_PAGE_SIZE);let startIndex=0;req.pageToken!==""&&(startIndex=decodePageToken(req.pageToken));let pageEntries=[],nextPageToken="";if(startIndex<entries.length){let end=Math.min(startIndex+pageSize,entries.length);pageEntries=entries.slice(startIndex,end),end<entries.length&&(nextPageToken=Buffer.from(String(end)).toString("base64"))}ctx.set(LIST_VERSIONS_RESPONSE_KEY,binding.response(pageEntries,nextPageToken,entries.length))}}}function decodePageToken(token){let decoded=Buffer.from(token,"base64");if(decoded.toString("base64")!==token)throw invalidArgumentError("invalid page_token");let text=decoded.toString("utf8"),index2=Number.parseInt(text,10);if(!Number.isSafeInteger(index2)||String(index2)!==text||index2<0)throw invalidArgumentError("invalid page_token");return index2}function idOf(resource){return metadataOf(resource)?.id??""}var TASK_KIND_REGISTRY_PATH="/v1/proxy/task-kind-registry",MODEL_REGISTRY_PATH="/v1/proxy/model-registry",SKILL_ARTIFACTS_PATH_PREFIX="/v1/skill-artifacts";var MAX_SKILL_MD_SIZE=1*1024*1024,DEFAULT_SLOT_TTL_MS=900*1e3,REF_BYTE_LEN=16,REF_PREFIX="sau_",UPLOADS_SEGMENT="/uploads/",DOWNLOAD_KEY_PREFIX="skills/",NESTED_SKILL_MD_HINT="SKILL.md must be at the archive root \u2014 zip the skill folder's contents, not the folder itself",TRANSFER_LANE_NOT_CONFIGURED="skill artifact transfer lane is not configured on this server";var import_node_path11=__toESM(require("node:path"),1);var ArtifactNotFoundError=class extends Error{constructor(storageKey){super(`artifact not found: ${storageKey}`),this.name="ArtifactNotFoundError"}},ARCHIVE_CONTENT_TYPE="application/zip";function newContentAddressedArchiveStore(driver,keyPrefix){let virtualRoot=import_node_path11.default.resolve(import_node_path11.default.sep,"archive-store"),keyEscapesStore=storageKey=>{let resolved=import_node_path11.default.resolve(virtualRoot,storageKey);return resolved!==virtualRoot&&!resolved.startsWith(virtualRoot+import_node_path11.default.sep)};return{getStorageKey(hash){return`${keyPrefix}${hash}.zip`},async store(hash,data){let storageKey=this.getStorageKey(hash);return await driver.upload(storageKey,data,ARCHIVE_CONTENT_TYPE),storageKey},async get(storageKey){if(keyEscapesStore(storageKey))throw new ArtifactNotFoundError(storageKey);try{return await driver.download(storageKey)}catch(error2){throw error2 instanceof ArtifactStorageNotFoundError?new ArtifactNotFoundError(storageKey):new Error(`failed to read artifact: ${error2 instanceof Error?error2.message:String(error2)}`)}},async exists(hash){return driver.exists(this.getStorageKey(hash))},async size(storageKey){if(keyEscapesStore(storageKey))throw new ArtifactNotFoundError(storageKey);try{return await driver.size(storageKey)}catch(error2){throw error2 instanceof ArtifactStorageNotFoundError?new ArtifactNotFoundError(storageKey):new Error(`failed to stat artifact: ${error2 instanceof Error?error2.message:String(error2)}`)}}}}var SKILL_ARTIFACT_KEY_PREFIX="skills/";function newSkillArtifactStorage(driver){return newContentAddressedArchiveStore(driver,SKILL_ARTIFACT_KEY_PREFIX)}var import_node_crypto22=require("node:crypto"),import_node_fs7=__toESM(require("node:fs"),1),import_node_path12=__toESM(require("node:path"),1),import_promises5=require("node:stream/promises");var SlotUnknownError=class extends Error{constructor(){super("upload reference unknown or expired"),this.name="SlotUnknownError"}},SlotConsumedError=class extends Error{constructor(){super("upload reference already carries an upload"),this.name="SlotConsumedError"}},SlotEmptyError=class extends Error{constructor(){super("upload reference has no uploaded bytes"),this.name="SlotEmptyError"}},SizeMismatchError=class extends Error{constructor(received,declared){super(`upload size mismatch: received ${received} bytes, declared ${declared}`),this.name="SizeMismatchError"}},UploadSlots=class{slots=new Map;stagingDir;ttlMs;maxSize;now;constructor(stagingDir,ttlMs,maxSize,now=Date.now){import_node_fs7.default.rmSync(stagingDir,{recursive:!0,force:!0}),import_node_fs7.default.mkdirSync(stagingDir,{recursive:!0,mode:448}),this.stagingDir=stagingDir,this.ttlMs=ttlMs,this.maxSize=maxSize,this.now=now}mint(declaredSize){if(declaredSize<=0||declaredSize>this.maxSize)throw new Error(`declared size ${declaredSize} outside (0, ${this.maxSize}]`);let ref=REF_PREFIX+(0,import_node_crypto22.randomBytes)(REF_BYTE_LEN).toString("hex");return this.sweep(),this.slots.set(ref,{declaredSize,expiresAtMs:this.now()+this.ttlMs,uploaded:!1}),{ref,ttlMs:this.ttlMs}}async receive(ref,body){let slot=this.slots.get(ref);if(slot===void 0||this.now()>slot.expiresAtMs)throw new SlotUnknownError;if(slot.uploaded)throw new SlotConsumedError;let declared=slot.declaredSize,filePath=this.stagePath(ref),written=0;try{await(0,import_promises5.pipeline)(body,limitBytes(declared+1,n3=>{written+=n3}),import_node_fs7.default.createWriteStream(filePath,{flags:"w",mode:384}))}catch(error2){throw await import_node_fs7.default.promises.rm(filePath,{force:!0}),new Error(`failed to receive upload: ${error2 instanceof Error?error2.message:String(error2)}`)}if(written!==declared)throw await import_node_fs7.default.promises.rm(filePath,{force:!0}),new SizeMismatchError(written,declared);let current=this.slots.get(ref);if(current===void 0||this.now()>current.expiresAtMs)throw await import_node_fs7.default.promises.rm(filePath,{force:!0}),new SlotUnknownError;current.uploaded=!0}async consume(ref){let slot=this.slots.get(ref);if(slot===void 0||this.now()>slot.expiresAtMs)throw new SlotUnknownError;if(!slot.uploaded)throw new SlotEmptyError;this.slots.delete(ref);let filePath=this.stagePath(ref);try{return await import_node_fs7.default.promises.readFile(filePath)}catch(error2){throw new Error(`failed to read staged artifact: ${error2 instanceof Error?error2.message:String(error2)}`)}finally{await import_node_fs7.default.promises.rm(filePath,{force:!0})}}sweep(){let nowMs=this.now();for(let[ref,slot]of this.slots)nowMs>slot.expiresAtMs&&(this.slots.delete(ref),import_node_fs7.default.rmSync(this.stagePath(ref),{force:!0}))}stagedFileName(ref){return`${ref}.zip`}stagePath(ref){return import_node_path12.default.join(this.stagingDir,this.stagedFileName(ref))}};function limitBytes(limit,onBytes){return async function*(source){let remaining=limit;for await(let chunk of source){if(remaining<=0)return;let slice=chunk.length<=remaining?chunk:chunk.subarray(0,remaining);remaining-=slice.length,onBytes(slice.length),yield slice}}}function uploadUrl(baseUrl,ref){return`${trimTrailingSlash(baseUrl)}${SKILL_ARTIFACTS_PATH_PREFIX}${UPLOADS_SEGMENT}${ref}`}function downloadUrl(baseUrl,storageKey){return`${trimTrailingSlash(baseUrl)}${SKILL_ARTIFACTS_PATH_PREFIX}/${storageKey}`}function trimTrailingSlash(url){return url.endsWith("/")?url.slice(0,-1):url}function newSkillTransferLane(slots,artifacts,logger2){return(request,response)=>{let pathOnly=(request.url??"").split("?")[0]??"";if(!pathOnly.startsWith(SKILL_ARTIFACTS_PATH_PREFIX)){writeText(response,404,"404 page not found");return}let rest=pathOnly.slice(SKILL_ARTIFACTS_PATH_PREFIX.length),logDetachedFailure=arm=>error2=>{logger2.error(`skill transfer lane ${arm} handler failed`,{error:error2 instanceof Error?error2.message:String(error2)})};if(rest.startsWith(UPLOADS_SEGMENT)){let ref=rest.slice(UPLOADS_SEGMENT.length);handleUpload(request,response,slots,ref,logger2).catch(logDetachedFailure("upload"));return}handleDownload(request,response,artifacts,rest.replace(/^\//,""),logger2).catch(logDetachedFailure("download"))}}async function handleUpload(request,response,slots,ref,logger2){if(request.method!=="PUT"){response.setHeader("Allow","PUT"),writeText(response,405,"method not allowed");return}try{await slots.receive(ref,request),response.statusCode=204,response.end()}catch(error2){error2 instanceof SlotUnknownError?writeText(response,404,"upload reference unknown or expired \u2014 request a new upload URL"):error2 instanceof SlotConsumedError?writeText(response,409,"upload reference already used \u2014 request a new upload URL"):error2 instanceof SizeMismatchError?writeText(response,400,`${error2.message} \u2014 the upload must match the size declared to createArtifactUploadUrl`):(logger2.error("skill artifact upload failed",{ref,error:error2 instanceof Error?error2.message:String(error2)}),writeText(response,500,"failed to stage upload"))}}async function handleDownload(request,response,artifacts,key,logger2){if(request.method!=="GET"){response.setHeader("Allow","GET"),writeText(response,405,"method not allowed");return}if(!key.startsWith(DOWNLOAD_KEY_PREFIX)){writeText(response,404,"404 page not found");return}let data;try{data=await artifacts.get(key)}catch(error2){if(error2 instanceof ArtifactNotFoundError){writeText(response,404,"404 page not found");return}logger2.error("skill artifact download failed",{storageKey:key,error:error2 instanceof Error?error2.message:String(error2)}),writeText(response,500,"failed to load artifact");return}response.setHeader("Content-Type","application/zip"),response.setHeader("Content-Length",String(data.length)),response.statusCode=200,response.end(Buffer.from(data))}function writeText(response,status,body){response.statusCode=status,response.setHeader("Content-Type","text/plain; charset=utf-8"),response.end(`${body}
+`)}var PLUGIN_ARTIFACT_KEY_PREFIX="plugins/",VERSION_TAG_PATTERN=/^[a-zA-Z0-9._-]+$/,BUILT_IN_SUB_AGENT_NAMES=new Set(["explore","shell","general-purpose"]);var TRANSFER_LANE_NOT_CONFIGURED2="plugin artifact transfer lane is not configured on this server",SERVER_WARNING_KINDS={componentIgnored:"component-ignored",memberAdopted:"member-adopted",modelHintUnresolved:"model-hint-unresolved",subAgentNameBuiltin:"sub-agent-name-builtin",versionNotTaggable:"version-not-taggable"};var MEMBER_KINDS=[{kind:ApiResourceKind.skill,schema:SkillSchema},{kind:ApiResourceKind.mcp_server,schema:McpServerSchema},{kind:ApiResourceKind.agent,schema:AgentSchema},{kind:ApiResourceKind.workflow,schema:WorkflowSchema}];function memberOf(kind,metadata){return{kind,id:metadata.id,slug:metadata.slug,name:metadata.name,version:metadata.labels[PLUGIN_VERSION_LABEL]??"",system:isSystemContent(metadata)}}async function findMembers(store,pluginId,org){let members=[];for(let{kind,schema:schema2}of MEMBER_KINDS){let raws=await store.findAllByLabel(kind,PLUGIN_LABEL,pluginId,schema2);for(let raw of raws){let metadata=metadataOf(fromBinary2(schema2,raw));metadata!==void 0&&metadata.org===org&&members.push(memberOf(kind,metadata))}}return members}async function slugHolder(store,planned,org){let entry=MEMBER_KINDS.find(candidate=>candidate.kind===planned.kind);if(entry===void 0)throw new Error(`kind ${ApiResourceKind[planned.kind]} is not a plugin member kind`);let existing=await findResourceBySlug(store,planned.kind,entry.schema,planned.slug,org),metadata=existing===void 0?void 0:metadataOf(existing);return metadata===void 0?{held:!1}:{held:!0,byPlugin:pluginIdOf(metadata),holder:memberOf(planned.kind,metadata)}}function judgeSlug(holder,planned,pluginId){return holder.held?holder.byPlugin===pluginId?{kind:"ours",holder:holder.holder}:holder.byPlugin!==void 0?{kind:"held-by-plugin",holder:holder.holder,pluginId:holder.byPlugin}:holder.holder.system&&planned.system?{kind:"adopt",holder:holder.holder}:{kind:"held-unmanaged",holder:holder.holder}:{kind:"free"}}function membersConverge(existing,planned,digest3){if(existing.length!==planned.length)return!1;let byKey=new Map(existing.map(member2=>[`${member2.kind}:${member2.slug}`,member2]));return planned.every(member2=>{let found=byKey.get(`${member2.kind}:${member2.slug}`);return found!==void 0&&found.version===digest3})}function droppedMembers(existing,planned){let keep=new Set(planned.map(member2=>`${member2.kind}:${member2.slug}`));return existing.filter(member2=>!keep.has(`${member2.kind}:${member2.slug}`))}var PLUGIN_DOCUMENT_LIMITS={manifest:262144,mcpConfig:262144,skillMd:1048576,subAgent:1048576,overlay:1048576,marketplace:1048576},encoder5=new TextEncoder,decoder3=new TextDecoder("utf-8",{fatal:!1});function comparePaths(a5,b7){return a5<b7?-1:a5>b7?1:0}function decodeUtf8(bytes){let text=decoder3.decode(bytes);return text.charCodeAt(0)===65279?text.slice(1):text}function isContainedPath(path14){return path14===""||path14.startsWith("/")||path14.includes("\\")?!1:path14.split("/").every(segment=>segment!==""&&segment!=="."&&segment!=="..")}var GLOB_CHARACTERS=/[*?[\]{}]/;function resolveDeclaredPath(value){if(GLOB_CHARACTERS.test(value))return{ok:!1,kind:"path-glob-unsupported"};if(value==="."||value==="./")return{ok:!0,path:""};if(!value.startsWith("./"))return{ok:!1,kind:"path-not-relative"};let trimmed=value.slice(2).replace(/\/+$/,"");return trimmed===""?{ok:!0,path:""}:isContainedPath(trimmed)?{ok:!0,path:trimmed}:{ok:!1,kind:"path-escapes-root"}}function joinPath(dir,name){return dir===""?name:`${dir}/${name}`}function basename(path14){let slash=path14.lastIndexOf("/");return slash===-1?path14:path14.slice(slash+1)}function dirname(path14){let slash=path14.lastIndexOf("/");return slash===-1?"":path14.slice(0,slash)}var PluginFileIndex=class{files;byPath;constructor(files){this.files=files,this.byPath=new Map(files.entries.map(entry=>[entry.path,entry]))}has(path14){return this.byPath.has(path14)}entry(path14){return this.byPath.get(path14)}filesUnder(dir){if(dir==="")return this.files.entries.map(entry=>entry.path);let prefix=`${dir}/`;return this.files.entries.filter(entry=>entry.path.startsWith(prefix)).map(entry=>entry.path)}isDirectory(dir){if(dir==="")return this.files.entries.length>0;let prefix=`${dir}/`;return this.files.entries.some(entry=>entry.path.startsWith(prefix))}childDirectories(dir){let prefix=dir===""?"":`${dir}/`,names=new Set;for(let entry of this.files.entries){if(!entry.path.startsWith(prefix))continue;let rest=entry.path.slice(prefix.length),slash=rest.indexOf("/");slash!==-1&&names.add(rest.slice(0,slash))}return[...names].sort(comparePaths)}childFiles(dir){let prefix=dir===""?"":`${dir}/`,names=[];for(let entry of this.files.entries){if(!entry.path.startsWith(prefix))continue;let rest=entry.path.slice(prefix.length);rest.includes("/")||names.push(rest)}return names.sort(comparePaths)}};function readText(index2,path14,cls,findings){let bytes=readBytes(index2,path14,cls,findings);return bytes===void 0?void 0:decodeUtf8(bytes)}function readBytes(index2,path14,cls,findings){let limit=PLUGIN_DOCUMENT_LIMITS[cls],entry=index2.entry(path14);if(entry===void 0)throw new Error(`plugin file '${path14}' is not listed`);if(entry.size>limit){findings.error("document-too-large",{path:path14,subject:String(entry.size),detail:String(limit)});return}let bytes=index2.files.read(path14);if(bytes.length>limit){findings.error("document-too-large",{path:path14,subject:String(bytes.length),detail:String(limit)});return}return bytes}function parseJsonObject(text,path14,kind,findings){let value;try{value=JSON.parse(text)}catch(error2){findings.error(kind,{path:path14,detail:error2 instanceof Error?error2.message:String(error2)});return}if(!isJsonObject2(value)){findings.error(kind,{path:path14,detail:"the document is not a JSON object"});return}return value}function isJsonObject2(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)}function isStringArray(value){return Array.isArray(value)&&value.every(item=>typeof item=="string")}function isStringRecord(value){return isJsonObject2(value)&&Object.values(value).every(item=>typeof item=="string")}function describeValue(value){return typeof value=="string"?value:JSON.stringify(value)}function fields(object){return Object.entries(object)}function optionalString(object,field2,path14,findings){let value=object[field2];if(value!==void 0){if(typeof value!="string"){findings.error("manifest-field-type",{path:path14,subject:field2,detail:"a string"});return}return value}}function optionalStringArray(object,field2,path14,findings){let value=object[field2];if(value!==void 0){if(!isStringArray(value)){findings.error("manifest-field-type",{path:path14,subject:field2,detail:"an array of strings"});return}return value}}function stringOrStringArray(object,field2,path14,findings){let value=object[field2];if(value!==void 0){if(typeof value=="string")return[value];if(isStringArray(value))return value;findings.error("manifest-field-type",{path:path14,subject:field2,detail:"a string or an array of strings"})}}function warnUnknownFields(object,known,path14,findings){for(let[name]of fields(object))known.has(name)||findings.warn("manifest-field-unknown",{path:path14,subject:name})}function readIdentity(object,path14,findings){let identity2={},name=optionalString(object,"name",path14,findings);name!==void 0&&(identity2.name=name);let version=optionalString(object,"version",path14,findings);version!==void 0&&(identity2.version=version);let description=optionalString(object,"description",path14,findings);description!==void 0&&(identity2.description=description);let homepage=optionalString(object,"homepage",path14,findings);homepage!==void 0&&(identity2.homepage=homepage);let repository=optionalString(object,"repository",path14,findings);repository!==void 0&&(identity2.repository=repository);let license=optionalString(object,"license",path14,findings);license!==void 0&&(identity2.license=license);let keywords=optionalStringArray(object,"keywords",path14,findings);keywords!==void 0&&(identity2.keywords=keywords);let author=readAuthor(object,path14,findings);return author!==void 0&&(identity2.author=author),identity2}function readAuthor(object,path14,findings){let value=object.author;if(value===void 0)return;if(!isJsonObject2(value)){findings.error("manifest-field-type",{path:path14,subject:"author",detail:"an object"});return}let author={},name=optionalString(value,"name",path14,findings);name!==void 0&&(author.name=name);let email=optionalString(value,"email",path14,findings);email!==void 0&&(author.email=email);let url=optionalString(value,"url",path14,findings);return url!==void 0&&(author.url=url),author}function readDeclaredPaths(object,field2,path14,findings){let values=stringOrStringArray(object,field2,path14,findings);if(values===void 0)return;let declared=[];for(let value of values){let resolved=resolveDeclaredPath(value);if(!resolved.ok){findings.error(resolved.kind,{path:path14,subject:value});continue}declared.push({path:resolved.path,manifest:path14})}return declared}function readMcpSources(object,field2,path14,dialect,findings){let value=object[field2];if(value===void 0)return[];let items=Array.isArray(value)?value:[value],sources=[];for(let item of items)if(typeof item=="string"){let resolved=resolveDeclaredPath(item);if(!resolved.ok){findings.error(resolved.kind,{path:path14,subject:item});continue}sources.push({kind:"file",path:resolved.path,dialect,manifest:path14})}else isJsonObject2(item)?sources.push({kind:"inline",manifest:path14,servers:item,dialect}):findings.error("manifest-field-type",{path:path14,subject:field2,detail:"a path, an object, or an array of either"});return sources}var IGNORED_FIELD_KINDS={hooks:"hooks",rules:"rules",commands:"commands",workflows:"workflows",outputStyles:"output-styles",lspServers:"lsp-servers",channels:"channels",dependencies:"dependencies",defaultEnabled:"default-enabled",minClientVersions:"min-client-versions",logo:"logo",apps:"apps"};function ignoredFieldComponents(object,path14){let ignored=[];for(let[name,value]of fields(object)){let kind=IGNORED_FIELD_KINDS[name];if(kind!==void 0&&ignored.push({kind,path:`${path14}#${name}`}),name==="experimental"&&isJsonObject2(value))for(let[sub]of fields(value)){let subKind=EXPERIMENTAL_KINDS[sub];subKind!==void 0&&ignored.push({kind:subKind,path:`${path14}#experimental.${sub}`})}}return ignored}var EXPERIMENTAL_KINDS={themes:"themes",monitors:"monitors",evals:"evals"};function extensionComponents(object,path14,findings){let value=object.extensions;if(value===void 0)return[];if(!isJsonObject2(value))return findings.warn("manifest-extensions-invalid",{path:path14}),[];let ignored=[];for(let[namespace,content]of fields(value))isJsonObject2(content)&&fields(content).length===0||ignored.push({kind:"extension",path:`${path14}#extensions.${namespace}`});return ignored}var CLAUDE_KNOWN_FIELDS=new Set(["name","version","description","author","homepage","repository","license","keywords","skills","commands","agents","workflows","hooks","mcpServers","outputStyles","lspServers","experimental","userConfig","channels","dependencies","defaultEnabled"]),CLAUDE_DEFAULT_MCP_CONFIG=".mcp.json";function readClaudeManifest(object,path14,findings){return readClaudeShapedManifest(object,path14,"claude",CLAUDE_KNOWN_FIELDS,findings)}function readClaudeShapedManifest(object,path14,dialect,known,findings){warnUnknownFields(object,known,path14,findings);let identity2=readIdentity(object,path14,findings),skillPaths=readDeclaredPaths(object,"skills",path14,findings)??[],agentPaths=readDeclaredPaths(object,"agents",path14,findings),declaredMcp=readMcpSources(object,"mcpServers",path14,dialect,findings),manifest={dialect,path:path14,identity:identity2,skillPaths,mcpConfigs:declaredMcp,ignored:ignoredFieldComponents(object,path14)};return agentPaths!==void 0&&(manifest.agentPaths=agentPaths),object.userConfig!==void 0&&(manifest.variables={dialect:"claude",value:object.userConfig,manifest:path14}),manifest}var KNOWN_FIELDS=new Set([...CLAUDE_KNOWN_FIELDS,"apps","interface"]);function readCodexManifest(object,path14,findings){return readClaudeShapedManifest(object,path14,"codex",KNOWN_FIELDS,findings)}var KNOWN_FIELDS2=new Set(["name","displayName","description","version","minClientVersions","author","publisher","homepage","repository","license","logo","keywords","category","tags","commands","agents","skills","rules","hooks","variables","mcpServers"]);function readCursorManifest(object,path14,findings){warnUnknownFields(object,KNOWN_FIELDS2,path14,findings);let identity2=readIdentity(object,path14,findings),skillPaths=readDeclaredPaths(object,"skills",path14,findings)??[],agentPaths=readDeclaredPaths(object,"agents",path14,findings),manifest={dialect:"cursor",path:path14,identity:identity2,skillPaths,mcpConfigs:readMcpSources(object,"mcpServers",path14,"cursor",findings),ignored:ignoredFieldComponents(object,path14)};return agentPaths!==void 0&&(manifest.agentPaths=agentPaths),object.variables!==void 0&&(manifest.variables={dialect:"cursor",value:object.variables,manifest:path14}),manifest}var AGENT_PLUGINS_MANIFEST_SCHEMA="https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",AGENT_PLUGINS_MCP_SCHEMA="https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",MANIFEST_LOCATIONS={"agent-plugins":"plugin.json",claude:".claude-plugin/plugin.json",cursor:".cursor-plugin/plugin.json",codex:".codex-plugin/plugin.json"},q3=value=>`'${value??""}'`,at=path14=>path14===void 0?"":` in ${q3(path14)}`,ERROR_MESSAGES={"no-manifest":()=>`no plugin manifest found: expected one of ${Object.values(MANIFEST_LOCATIONS).map(p3=>q3(p3)).join(", ")}`,"manifest-unreadable":c5=>`manifest ${q3(c5.path)} is not valid JSON: ${c5.detail??"parse error"}`,"manifest-schema-missing":c5=>`manifest ${q3(c5.path)} is missing the required '$schema' field; an Agent Plugins manifest declares ${q3(AGENT_PLUGINS_MANIFEST_SCHEMA)}`,"manifest-schema-unsupported":c5=>`manifest ${q3(c5.path)} declares an unsupported '$schema' ${q3(c5.detail)}; this reader supports ${q3(AGENT_PLUGINS_MANIFEST_SCHEMA)}`,"manifest-name-missing":c5=>`manifest ${q3(c5.path)} is missing the required 'name' field`,"manifest-name-invalid":c5=>`plugin name ${q3(c5.subject)}${at(c5.path)} is invalid: 1 to 64 characters of lowercase letters, digits, hyphens and periods, starting and ending alphanumeric, with no '--' or '..'`,"manifest-name-conflict":c5=>`manifests disagree on the plugin name: ${q3(c5.subject)} in ${q3(c5.path)} versus ${c5.detail??"another manifest"}`,"manifest-field-type":c5=>`field ${q3(c5.subject)}${at(c5.path)} has the wrong type: expected ${c5.detail??"a different type"}`,"path-not-relative":c5=>`path ${q3(c5.subject)}${at(c5.path)} must be plugin-relative and begin with './'`,"path-escapes-root":c5=>`path ${q3(c5.subject)}${at(c5.path)} escapes the plugin root`,"path-glob-unsupported":c5=>`path ${q3(c5.subject)}${at(c5.path)} is a glob pattern; declare directories and files by path`,"path-uncontained":c5=>`the reader listed a path outside the plugin root: ${q3(c5.path)}`,"document-too-large":c5=>`${q3(c5.path)} is ${c5.subject??"too many"} bytes, over the ${c5.detail??""}-byte limit for this kind of document`,"skill-frontmatter-missing":c5=>`${q3(c5.path)} must start with YAML frontmatter ('---')`,"skill-frontmatter-unclosed":c5=>`${q3(c5.path)} frontmatter is not closed (missing the closing '---')`,"skill-frontmatter-unreadable":c5=>`${q3(c5.path)} frontmatter is not valid YAML: ${c5.detail??"parse error"}`,"skill-name-invalid":c5=>`skill name ${q3(c5.subject)}${at(c5.path)} is invalid: lowercase letters, digits and hyphens, optionally dot-scoped, with every segment alphanumeric`,"skill-name-duplicate":c5=>`skill name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"mcp-config-unreadable":c5=>`MCP configuration ${q3(c5.path)} is not valid JSON: ${c5.detail??"parse error"}`,"mcp-config-shape":c5=>`MCP configuration ${q3(c5.path)} must be an object with an 'mcpServers' object`,"mcp-config-schema-missing":c5=>`MCP configuration ${q3(c5.path)} is missing the required '$schema' field; an Agent Plugins configuration declares ${q3(AGENT_PLUGINS_MCP_SCHEMA)}`,"mcp-config-schema-unsupported":c5=>`MCP configuration ${q3(c5.path)} declares an unsupported '$schema' ${q3(c5.detail)}; this reader supports ${q3(AGENT_PLUGINS_MCP_SCHEMA)}`,"mcp-config-field-unknown":c5=>`MCP configuration ${q3(c5.path)} has an unexpected top-level field ${q3(c5.subject)}; only '$schema' and 'mcpServers' are allowed`,"mcp-server-shape":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} must be an object`,"mcp-server-type-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'type' field the Agent Plugins format requires ('stdio', 'streamable-http' or 'sse')`,"mcp-server-transport-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has no 'type' and neither a 'command' nor a 'url' to infer it from`,"mcp-server-type-ambiguous":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares both 'command' and 'url'; a server is either stdio or HTTP`,"mcp-server-type-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an unknown 'type' ${q3(c5.detail)}; expected 'stdio', 'http', 'streamable-http' or 'sse'`,"mcp-server-field-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} that its transport does not define`,"mcp-server-field-type":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} field ${q3(c5.detail)} has the wrong type`,"mcp-server-url-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'url' its HTTP transport requires`,"mcp-server-url-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an invalid 'url' ${q3(c5.detail)}: expected an absolute HTTPS URL (HTTP only for localhost) with no user information or fragment`,"mcp-server-url-variable":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a variable in its 'url'; Stigmer sends the URL as written, so write the URL out and put variables in 'headers'`,"mcp-server-command-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'command' its stdio transport requires`,"mcp-server-command-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a 'command' that is not a single executable name; put arguments in 'args'`,"mcp-server-command-relative":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} runs a command bundled in the plugin ${q3(c5.detail)}; Stigmer runs only commands on the runner's PATH (for example 'npx' or 'uvx')`,"mcp-server-plugin-root-reference":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} references the plugin's own files through ${q3(c5.detail)}; Stigmer does not mount plugin files into the runner`,"mcp-server-cwd-unsupported":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} sets a working directory; Stigmer does not mount plugin files, so a bundled directory cannot be reached`,"mcp-server-env-literal":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} sets environment variable ${q3(c5.detail)} to a literal value; Stigmer passes declared variables by name, so write ${q3(`${c5.detail??"KEY"}: "\${${c5.detail??"KEY"}}"`)} and declare the variable`,"mcp-server-env-rename":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} maps environment variable ${q3(c5.detail)} to a differently named variable; Stigmer passes declared variables by name, so use the same name on both sides`,"mcp-server-name-duplicate":c5=>`MCP server name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"mcp-server-header-duplicate":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares header ${q3(c5.detail)} more than once (header names are case-insensitive)`,"mcp-server-header-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an invalid header name ${q3(c5.detail)}`,"sub-agent-frontmatter-unreadable":c5=>`${q3(c5.path)} frontmatter is not valid YAML: ${c5.detail??"parse error"}`,"sub-agent-instructions-short":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} has instructions under ${c5.detail??""} characters; the body of the file is the sub-agent's prompt`,"sub-agent-name-duplicate":c5=>`sub-agent name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"variable-name-invalid":c5=>`variable name ${q3(c5.subject)}${at(c5.path)} is invalid: an environment variable name is letters, digits and underscores, not starting with a digit`,"overlay-server-unknown":c5=>`${q3(c5.path)} overlays MCP server ${q3(c5.subject)}, which the plugin does not declare`,"overlay-document-unknown":c5=>`${q3(c5.path)} is not a document Stigmer reads; the 'ai.stigmer/' folder holds 'agent.yaml', 'workflows/<name>.yaml' and 'mcp-servers/<server>.yaml'`},WARNING_MESSAGES={"manifest-field-unknown":c5=>`manifest ${q3(c5.path)} has an unknown field ${q3(c5.subject)}, ignored`,"manifest-extensions-invalid":c5=>`manifest ${q3(c5.path)} has an 'extensions' field that is not an object, ignored`,"path-missing":c5=>`path ${q3(c5.subject)} declared${at(c5.path)} does not exist in the plugin`,"skill-name-defaulted":c5=>`${q3(c5.path)} has no 'name' in its frontmatter; the skill is named after its directory, ${q3(c5.subject)}`,"skill-name-differs-from-directory":c5=>`skill ${q3(c5.subject)}${at(c5.path)} is named differently from its directory ${q3(c5.detail)}`,"skill-description-missing":c5=>`skill ${q3(c5.subject)}${at(c5.path)} has no 'description'`,"mcp-config-field-ignored":c5=>`MCP configuration ${q3(c5.path)} has a top-level field ${q3(c5.subject)} Stigmer does not read, ignored`,"mcp-server-sse-mapped":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares the legacy 'sse' transport; Stigmer connects over Streamable HTTP and falls back to SSE only when the server rejects it`,"mcp-server-field-ignored":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} Stigmer does not read, ignored`,"mcp-server-auth-ignored":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an 'auth' block Stigmer does not read; OAuth for a server is declared in 'ai.stigmer/mcp-servers/${c5.subject??"<server>"}.yaml'`,"variable-inferred":c5=>`variable ${q3(c5.subject)} is referenced by MCP server ${q3(c5.detail)} but not declared; it is declared as a required secret`,"variable-unreferenced":c5=>`variable ${q3(c5.subject)}${at(c5.path)} is declared but no MCP server references it`,"variable-default-dropped":c5=>`variable ${q3(c5.subject)}${at(c5.path)} has a default value, which Stigmer does not carry; the user supplies the value`,"variable-type-narrowed":c5=>`variable ${q3(c5.subject)}${at(c5.path)} is typed ${q3(c5.detail)}; Stigmer variables are strings`,"variable-option-dropped":c5=>`variable ${q3(c5.subject)}${at(c5.path)} has a ${q3(c5.detail)} constraint, which Stigmer does not carry`,"sub-agent-name-defaulted":c5=>`${q3(c5.path)} has no 'name' in its frontmatter; the sub-agent is named after the file, ${q3(c5.subject)}`,"sub-agent-skill-unknown":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} asks for skill ${q3(c5.detail)}, which the plugin does not ship`,"sub-agent-model-unknown":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} names model ${q3(c5.detail)}, which Stigmer cannot map; the sub-agent runs on the session's model`,"sub-agent-field-ignored":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} Stigmer does not read, ignored`};var FindingCollector=class{errorSentences;warningSentences;errors=[];warnings=[];constructor(errorSentences,warningSentences){this.errorSentences=errorSentences,this.warningSentences=warningSentences}error(kind,ctx={}){this.errors.push(compose(kind,ctx,this.errorSentences[kind](ctx)))}warn(kind,ctx={}){this.warnings.push(compose(kind,ctx,this.warningSentences[kind](ctx)))}},Findings=class extends FindingCollector{constructor(){super(ERROR_MESSAGES,WARNING_MESSAGES)}};function compose(kind,ctx,message6){return{kind,...ctx.path!==void 0&&{path:ctx.path},...ctx.subject!==void 0&&{subject:ctx.subject},...ctx.detail!==void 0&&{detail:ctx.detail},message:message6}}var KNOWN_FIELDS3=new Set(["$schema","name","version","description","author","homepage","repository","license","keywords","extensions"]);function readOpenManifest(object,path14,findings){let schema2=object.$schema;return schema2===void 0?findings.error("manifest-schema-missing",{path:path14}):schema2!==AGENT_PLUGINS_MANIFEST_SCHEMA&&findings.error("manifest-schema-unsupported",{path:path14,detail:describeValue(schema2)}),warnUnknownFields(object,KNOWN_FIELDS3,path14,findings),{dialect:"agent-plugins",path:path14,identity:readIdentity(object,path14,findings),skillPaths:[],mcpConfigs:[],ignored:extensionComponents(object,path14,findings)}}var OPEN_MCP_CONFIG="mcp.json",VENDOR_PRECEDENCE=["claude","cursor","codex"],NAME_MAX_LENGTH=64,NAME_PATTERN=/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/;function detectManifests(index2,findings){let manifests=[],present=dialect=>{let path14=MANIFEST_LOCATIONS[dialect];if(!index2.has(path14))return;let object=readManifestObject(index2,path14,findings),manifest=object===void 0?emptyManifest(dialect,path14):readDialect(dialect,object,path14,findings);return manifests.push(manifest),manifest},root5=present("agent-plugins"),vendors=VENDOR_PRECEDENCE.map(present).filter(m3=>m3!==void 0);if(manifests.length===0){findings.error("no-manifest");return}let identity2=root5??vendors[0];if(identity2===void 0)throw new Error("manifest set without an identity manifest");let ordered=[identity2,...manifests.filter(m3=>m3!==identity2)],name=resolveName(identity2,ordered,findings);return{dialect:identity2.dialect,manifests:ordered,name,readsAgents:vendors.length>0,mcpSources:resolveMcpSources(index2,root5,vendors)}}function readManifestObject(index2,path14,findings){let text=readText(index2,path14,"manifest",findings);return text===void 0?void 0:parseJsonObject(text,path14,"manifest-unreadable",findings)}function readDialect(dialect,object,path14,findings){switch(dialect){case"agent-plugins":return readOpenManifest(object,path14,findings);case"claude":return readClaudeManifest(object,path14,findings);case"cursor":return readCursorManifest(object,path14,findings);case"codex":return readCodexManifest(object,path14,findings);default:{let exhaustive=dialect;throw new Error(`unknown dialect ${String(exhaustive)}`)}}}function emptyManifest(dialect,path14){return{dialect,path:path14,identity:{},skillPaths:[],mcpConfigs:[],ignored:[]}}function resolveName(identity2,all,findings){let name=identity2.identity.name;if(name===void 0){if(findings.errors.some(f5=>f5.kind==="manifest-unreadable"&&f5.path===identity2.path))return;findings.error("manifest-name-missing",{path:identity2.path});return}let valid=!0;isValidPluginName(name)||(findings.error("manifest-name-invalid",{path:identity2.path,subject:name}),valid=!1);for(let other of all){if(other===identity2)continue;let otherName=other.identity.name;otherName!==void 0&&otherName!==name&&(findings.error("manifest-name-conflict",{path:identity2.path,subject:name,detail:`'${otherName}' in '${other.path}'`}),valid=!1)}return valid?name:void 0}function isValidPluginName(name){return name.length<=NAME_MAX_LENGTH&&NAME_PATTERN.test(name)&&!name.includes("--")&&!name.includes("..")}function resolveMcpSources(index2,root5,vendors){let sources=[];root5!==void 0&&index2.has(OPEN_MCP_CONFIG)&&sources.push({kind:"file",path:OPEN_MCP_CONFIG,dialect:"agent-plugins",manifest:root5.path});for(let vendor of vendors)vendor.mcpConfigs.length>0?sources.push(...vendor.mcpConfigs):vendor.dialect!=="cursor"&&index2.has(CLAUDE_DEFAULT_MCP_CONFIG)&&sources.push({kind:"file",path:CLAUDE_DEFAULT_MCP_CONFIG,dialect:vendor.dialect,manifest:vendor.path});let seen=new Set;return sources.filter(source=>source.kind==="inline"?!0:seen.has(source.path)?!1:(seen.add(source.path),!0))}var import_yaml=__toESM(require_dist2(),1);var SKILL_NAME_PATTERN=/^[a-z0-9]+([.-][a-z0-9]+)*$/;function extractFrontmatter(content){let lines=content.split(/\r?\n/);if(lines.length===0||lines[0]?.trim()!=="---")return{ok:!1,reason:"missing"};for(let i6=1;i6<lines.length;i6++)if(lines[i6]?.trim()==="---")return{ok:!0,yaml:lines.slice(1,i6).join(`
 `),body:lines.slice(i6+1).join(`
 `)};return{ok:!1,reason:"unclosed"}}function parseFrontmatter(yaml2){let value;try{value=(0,import_yaml.parse)(yaml2)}catch(error2){return{ok:!1,detail:error2 instanceof Error?error2.message:String(error2)}}return value==null?{ok:!0,fields:{}}:isJsonObject2(value)?{ok:!0,fields:value}:{ok:!1,detail:"the frontmatter is not a mapping"}}var DEFAULT_AGENTS_DIR="agents",SUB_AGENT_INSTRUCTIONS_MIN=10,READ_FIELDS=new Set(["name","description","model","skills"]);function normaliseSubAgents(index2,set2,skills,findings){if(!set2.readsAgents)return[];let skillNames=new Set(skills.map(skill=>skill.name)),agents=[],seen=new Set;for(let path14 of discoverAgentFiles(index2,set2,findings)){let agent=readSubAgent(index2,path14,skillNames,findings);if(agent!==void 0){if(seen.has(agent.name)){findings.error("sub-agent-name-duplicate",{subject:agent.name,path:path14});continue}seen.add(agent.name),agents.push(agent)}}return agents}function discoverAgentFiles(index2,set2,findings){let files=new Set,addMarkdownUnder=dir=>{for(let name of index2.childFiles(dir))name.endsWith(".md")&&files.add(joinPath(dir,name))},declared=set2.manifests.flatMap(m3=>m3.agentPaths??[]);set2.manifests.every(m3=>m3.agentPaths===void 0)&&addMarkdownUnder(DEFAULT_AGENTS_DIR);for(let{path:path14,manifest}of declared)path14!==""&&index2.has(path14)&&path14.endsWith(".md")?files.add(path14):index2.isDirectory(path14)?addMarkdownUnder(path14):findings.warn("path-missing",{path:manifest,subject:path14===""?".":`./${path14}`});return[...files].sort(comparePaths)}function readSubAgent(index2,path14,skillNames,findings){let text=readText(index2,path14,"subAgent",findings);if(text===void 0)return;let extracted=extractFrontmatter(text),fieldsMap={},body=text;if(extracted.ok){let parsed=parseFrontmatter(extracted.yaml);if(!parsed.ok){findings.error("sub-agent-frontmatter-unreadable",{path:path14,detail:parsed.detail});return}fieldsMap=parsed.fields,body=extracted.body}else if(extracted.reason==="unclosed"){findings.error("sub-agent-frontmatter-unreadable",{path:path14,detail:"the frontmatter is not closed (missing the closing '---')"});return}let stem=basename(path14).replace(/\.md$/,""),name;typeof fieldsMap.name=="string"&&fieldsMap.name!==""?name=fieldsMap.name:(name=stem,findings.warn("sub-agent-name-defaulted",{path:path14,subject:name}));let instructions=body.trim();if(instructions.length<SUB_AGENT_INSTRUCTIONS_MIN){findings.error("sub-agent-instructions-short",{path:path14,subject:name,detail:String(SUB_AGENT_INSTRUCTIONS_MIN)});return}let description=fieldsMap.description,requested=fieldsMap.skills,matchedSkills=[];if(Array.isArray(requested))for(let skill of requested)typeof skill=="string"&&(skillNames.has(skill)?matchedSkills.push(skill):findings.warn("sub-agent-skill-unknown",{path:path14,subject:name,detail:skill}));let modelHint,model=fieldsMap.model;typeof model=="string"&&model.trim()!==""&&(modelHint=classifyModel(model),modelHint.alias==="unknown"&&findings.warn("sub-agent-model-unknown",{path:path14,subject:name,detail:model}));for(let field2 of Object.keys(fieldsMap))READ_FIELDS.has(field2)||findings.warn("sub-agent-field-ignored",{path:path14,subject:name,detail:field2});return{name,...typeof description=="string"&&description!==""&&{description},instructions,skillNames:matchedSkills,...modelHint!==void 0&&{modelHint},path:path14}}function classifyModel(raw){let value=raw.trim().toLowerCase(),alias=value==="inherit"?"inherit":value==="fast"?"fast":value.includes("haiku")?"haiku":value.includes("sonnet")?"sonnet":value.includes("opus")?"opus":"unknown";return{raw,alias}}var PLACEHOLDER_PATTERN=/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,VARIABLE_NAME_PATTERN=/^[A-Za-z_][A-Za-z0-9_]*$/,USER_CONFIG_PATTERN=/\$\{user_config\.([A-Za-z_][A-Za-z0-9_]*)\}/g,PLUGIN_ROOT_PLACEHOLDERS=new Set(["${PLUGIN_ROOT}","${PLUGIN_DATA}","${CLAUDE_PLUGIN_ROOT}","${CLAUDE_PLUGIN_DATA}","${CLAUDE_PROJECT_DIR}","${CURSOR_PLUGIN_ROOT}"]),PLUGIN_ROOT_ENV_NAMES=new Set(["PLUGIN_ROOT","PLUGIN_DATA"]);function rewriteUserConfig(value){return value.replace(USER_CONFIG_PATTERN,(_match,key)=>`\${${key}}`)}function findPluginRootPlaceholder(value){for(let placeholder of PLUGIN_ROOT_PLACEHOLDERS)if(value.includes(placeholder))return placeholder}function referencedVariables(value){let names=[];for(let match of value.matchAll(PLACEHOLDER_PATTERN)){let name=match[1];name!==void 0&&!names.includes(name)&&names.push(name)}return names}function singlePlaceholderName(value){return/^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/.exec(value)?.[1]}var IGNORED_DIRECTORIES={rules:"rules",hooks:"hooks",commands:"commands",canvases:"canvases",workflows:"workflows","output-styles":"output-styles",themes:"themes",monitors:"monitors",bin:"bin",assets:"assets",evals:"evals"},IGNORED_FILES={".lsp.json":"lsp-servers","settings.json":"settings",".app.json":"apps"};function ignoredOnDisk(index2,readsAgents){let ignored=[];for(let dir of index2.childDirectories("")){let kind=IGNORED_DIRECTORIES[dir];kind!==void 0&&ignored.push({kind,path:`${dir}/`}),dir==="agents"&&!readsAgents&&ignored.push({kind:"agents",path:`${dir}/`})}for(let file of index2.childFiles("")){let kind=IGNORED_FILES[file];kind!==void 0&&ignored.push({kind,path:file})}return ignored}function dedupeIgnored(lists){let seen=new Set,out=[];for(let list11 of lists)for(let component of list11){let key=`${component.kind}\0${component.path}`;seen.has(key)||(seen.add(key),out.push(component))}return out}var OPEN_CONFIG_FIELDS=new Set(["$schema","mcpServers"]),OPEN_STDIO_FIELDS=new Set(["type","command","args","env","cwd"]),OPEN_HTTP_FIELDS=new Set(["type","url","headers"]),VENDOR_STDIO_FIELDS=new Set(["type","command","args","env","cwd"]),VENDOR_HTTP_FIELDS=new Set(["type","url","headers"]),HEADER_NAME_PATTERN=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;function normaliseMcpServers(index2,sources,findings){let servers=[],seen=new Set,refused=0;for(let source of sources){let entries=readSource(index2,source,findings);if(entries===void 0){refused++;continue}for(let[name,raw]of fields(entries.servers)){if(seen.has(name)){findings.error("mcp-server-name-duplicate",{subject:name,path:entries.path}),refused++;continue}seen.add(name);let server=readServer(name,raw,entries.path,source.dialect==="agent-plugins",findings);server!==void 0?servers.push(server):refused++}}return{servers,refused,declaredNames:seen}}function readSource(index2,source,findings){let open=source.dialect==="agent-plugins";if(source.kind==="inline"){let wrapped=isJsonObject2(source.servers)?source.servers.mcpServers:void 0,servers2=isJsonObject2(wrapped)?wrapped:source.servers;if(!isJsonObject2(servers2)){findings.error("mcp-config-shape",{path:source.manifest});return}return{path:source.manifest,servers:servers2}}if(!index2.has(source.path)){findings.warn("path-missing",{path:source.manifest,subject:`./${source.path}`});return}let text=readText(index2,source.path,"mcpConfig",findings);if(text===void 0)return;let object=parseJsonObject(text,source.path,"mcp-config-unreadable",findings);if(object===void 0)return;if(open){let schema2=object.$schema;schema2===void 0?findings.error("mcp-config-schema-missing",{path:source.path}):schema2!==AGENT_PLUGINS_MCP_SCHEMA&&findings.error("mcp-config-schema-unsupported",{path:source.path,detail:describeValue(schema2)})}for(let[name]of fields(object))OPEN_CONFIG_FIELDS.has(name)||(open?findings.error("mcp-config-field-unknown",{path:source.path,subject:name}):findings.warn("mcp-config-field-ignored",{path:source.path,subject:name}));let servers=object.mcpServers;if(!isJsonObject2(servers)){findings.error("mcp-config-shape",{path:source.path});return}return{path:source.path,servers}}function readServer(name,raw,path14,open,findings){let ctx={subject:name,path:path14};if(!isJsonObject2(raw)){findings.error("mcp-server-shape",ctx);return}let transport=resolveTransport(raw,ctx,open,findings);if(transport===void 0)return;let known=transport==="stdio"?open?OPEN_STDIO_FIELDS:VENDOR_STDIO_FIELDS:open?OPEN_HTTP_FIELDS:VENDOR_HTTP_FIELDS,references=new Set,valid=!0;for(let[field2,value]of fields(raw))if(!known.has(field2))if(open)findings.error("mcp-server-field-unknown",{...ctx,detail:field2}),valid=!1;else if(field2==="auth"){findings.warn("mcp-server-auth-ignored",ctx);for(let text of stringsWithin(value))collectReferences(text,references)}else findings.warn("mcp-server-field-ignored",{...ctx,detail:field2});if(valid)return transport==="stdio"?readStdio(name,raw,ctx,references,findings):readHttp(name,raw,ctx,references,findings)}function resolveTransport(raw,ctx,open,findings){let type2=raw.type;if(type2!==void 0&&typeof type2!="string"){findings.error("mcp-server-field-type",{...ctx,detail:"type"});return}if(type2===void 0){if(open){findings.error("mcp-server-type-missing",ctx);return}let hasCommand=raw.command!==void 0,hasUrl=raw.url!==void 0;if(hasCommand&&hasUrl){findings.error("mcp-server-type-ambiguous",ctx);return}if(hasCommand)return"stdio";if(hasUrl)return"http";findings.error("mcp-server-transport-unknown",ctx);return}switch(type2){case"stdio":return"stdio";case"streamable-http":return"http";case"http":if(open){findings.error("mcp-server-type-unknown",{...ctx,detail:type2});return}return"http";case"sse":return findings.warn("mcp-server-sse-mapped",ctx),"http";default:findings.error("mcp-server-type-unknown",{...ctx,detail:type2});return}}function readStdio(name,raw,ctx,references,findings){let valid=!0,fail=()=>{valid=!1},command5=raw.command;if(command5===void 0)findings.error("mcp-server-command-missing",ctx),fail();else if(typeof command5!="string")findings.error("mcp-server-field-type",{...ctx,detail:"command"}),fail();else{let root5=findPluginRootPlaceholder(command5);root5!==void 0?(findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail()):command5.startsWith("./")?(findings.error("mcp-server-command-relative",{...ctx,detail:command5}),fail()):(command5===""||/\s/.test(command5)||command5.includes("/"))&&(findings.error("mcp-server-command-invalid",ctx),fail())}let args=[],rawArgs=raw.args;if(rawArgs!==void 0)if(!isStringArray(rawArgs))findings.error("mcp-server-field-type",{...ctx,detail:"args"}),fail();else for(let arg of rawArgs){let rewritten=rewriteUserConfig(arg),root5=findPluginRootPlaceholder(rewritten);if(root5!==void 0){findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail();continue}collectReferences(rewritten,references),args.push(rewritten)}let rawEnv=raw.env;if(rawEnv!==void 0)if(!isStringRecord(rawEnv))findings.error("mcp-server-field-type",{...ctx,detail:"env"}),fail();else for(let[key,value]of Object.entries(rawEnv)){if(PLUGIN_ROOT_ENV_NAMES.has(key)){findings.error("mcp-server-plugin-root-reference",{...ctx,detail:key}),fail();continue}if(!VARIABLE_NAME_PATTERN.test(key)){findings.error("variable-name-invalid",{subject:key,path:ctx.path}),fail();continue}let rewritten=rewriteUserConfig(value),root5=findPluginRootPlaceholder(rewritten);if(root5!==void 0){findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail();continue}let referenced=singlePlaceholderName(rewritten);referenced===void 0?(findings.error("mcp-server-env-literal",{...ctx,detail:key}),fail()):referenced!==key?(findings.error("mcp-server-env-rename",{...ctx,detail:key}),fail()):references.add(key)}if(raw.cwd!==void 0&&(findings.error("mcp-server-cwd-unsupported",ctx),fail()),!(!valid||typeof command5!="string"))return{name,transport:"stdio",command:command5,args,env:[...references].sort()}}function readHttp(name,raw,ctx,references,findings){let valid=!0,fail=()=>{valid=!1},url,rawUrl=raw.url;if(rawUrl===void 0)findings.error("mcp-server-url-missing",ctx),fail();else if(typeof rawUrl!="string")findings.error("mcp-server-field-type",{...ctx,detail:"url"}),fail();else{url=rewriteUserConfig(rawUrl);let root5=findPluginRootPlaceholder(url);root5!==void 0?(findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail()):referencedVariables(url).length>0?(findings.error("mcp-server-url-variable",ctx),fail()):isAcceptableServerUrl(url)||(findings.error("mcp-server-url-invalid",{...ctx,detail:url}),fail())}let headers2=[],rawHeaders=raw.headers;if(rawHeaders!==void 0)if(!isStringRecord(rawHeaders))findings.error("mcp-server-field-type",{...ctx,detail:"headers"}),fail();else{let lowered=new Set;for(let[header,value]of Object.entries(rawHeaders)){if(!HEADER_NAME_PATTERN.test(header)){findings.error("mcp-server-header-invalid",{...ctx,detail:header}),fail();continue}let key=header.toLowerCase();if(lowered.has(key)){findings.error("mcp-server-header-duplicate",{...ctx,detail:header}),fail();continue}lowered.add(key);let rewritten=rewriteUserConfig(value),root5=findPluginRootPlaceholder(rewritten);if(root5!==void 0){findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail();continue}collectReferences(rewritten,references),headers2.push([header,rewritten])}}if(!(!valid||url===void 0))return{name,transport:"http",url,headers:Object.fromEntries(headers2),env:[...references].sort()}}function isAcceptableServerUrl(value){let url;try{url=new URL(value)}catch{return!1}return url.username!==""||url.password!==""||url.hash!==""?!1:url.protocol==="https:"?!0:url.protocol!=="http:"?!1:isLoopbackHost(url.hostname)}function isLoopbackHost(hostname){return hostname==="localhost"||hostname==="[::1]"||hostname==="::1"?!0:/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname)}function collectReferences(text,into){for(let name of referencedVariables(text))into.add(name)}function stringsWithin(value){return typeof value=="string"?[rewriteUserConfig(value)]:Array.isArray(value)?value.flatMap(stringsWithin):isJsonObject2(value)?Object.values(value).flatMap(stringsWithin):[]}var OVERLAY_DIR="ai.stigmer",AGENT_DOCUMENT=`${OVERLAY_DIR}/agent.yaml`,WORKFLOWS_DIR=`${OVERLAY_DIR}/workflows`,MCP_SERVERS_DIR=`${OVERLAY_DIR}/mcp-servers`;function normaliseOverlay(index2,serverNames,findings){let overlay={workflows:[],mcpServers:[]},workflows=[],mcpServers=[];for(let path14 of index2.filesUnder(OVERLAY_DIR)){if(path14===AGENT_DOCUMENT){let bytes=readBytes(index2,path14,"overlay",findings);bytes!==void 0&&(overlay.agent={path:path14,bytes});continue}let name=yamlStem(path14);if(name!==void 0&&dirname(path14)===WORKFLOWS_DIR){let bytes=readBytes(index2,path14,"overlay",findings);bytes!==void 0&&workflows.push({path:path14,bytes,name});continue}if(name!==void 0&&dirname(path14)===MCP_SERVERS_DIR){if(!serverNames.has(name)){findings.error("overlay-server-unknown",{path:path14,subject:name});continue}let bytes=readBytes(index2,path14,"overlay",findings);bytes!==void 0&&mcpServers.push({path:path14,bytes,server:name});continue}findings.error("overlay-document-unknown",{path:path14})}return overlay.workflows=workflows,overlay.mcpServers=mcpServers,overlay}function yamlStem(path14){let name=basename(path14);return name.endsWith(".yaml")&&name.length>5?name.slice(0,-5):void 0}var SKILL_FILE="SKILL.md",DEFAULT_SKILLS_DIR="skills";function normaliseSkills(index2,set2,findings){let skills=[],seenNames=new Map;for(let dir of discoverSkillDirs(index2,set2,findings)){let skill=readSkill(index2,dir,set2,findings);if(skill===void 0)continue;if(seenNames.get(skill.name)!==void 0){findings.error("skill-name-duplicate",{subject:skill.name,path:joinPath(dir,SKILL_FILE)});continue}seenNames.set(skill.name,dir),skills.push(skill)}return skills}function discoverSkillDirs(index2,set2,findings){let dirs=new Set,addSkillsUnder=parent=>{for(let child of index2.childDirectories(parent)){let dir=joinPath(parent,child);index2.has(joinPath(dir,SKILL_FILE))&&dirs.add(dir)}};addSkillsUnder(DEFAULT_SKILLS_DIR);let declared=set2.manifests.flatMap(m3=>m3.skillPaths);for(let{path:path14,manifest}of declared)index2.has(joinPath(path14,SKILL_FILE))?dirs.add(path14):index2.isDirectory(path14)?addSkillsUnder(path14):findings.warn("path-missing",{path:manifest,subject:path14===""?".":`./${path14}`});return declared.length===0&&!index2.isDirectory(DEFAULT_SKILLS_DIR)&&index2.has(SKILL_FILE)&&dirs.add(""),[...dirs].sort(comparePaths)}function readSkill(index2,dir,set2,findings){let path14=joinPath(dir,SKILL_FILE),text=readText(index2,path14,"skillMd",findings);if(text===void 0)return;let extracted=extractFrontmatter(text);if(!extracted.ok){findings.error(extracted.reason==="missing"?"skill-frontmatter-missing":"skill-frontmatter-unclosed",{path:path14});return}let parsed=parseFrontmatter(extracted.yaml);if(!parsed.ok){findings.error("skill-frontmatter-unreadable",{path:path14,detail:parsed.detail});return}let directoryName=dir===""?set2.name??"skill":basename(dir),name;if(typeof parsed.fields.name=="string"&&parsed.fields.name!==""?name=parsed.fields.name:(name=directoryName,findings.warn("skill-name-defaulted",{path:path14,subject:name})),!SKILL_NAME_PATTERN.test(name)){findings.error("skill-name-invalid",{path:path14,subject:name});return}dir!==""&&name!==directoryName&&findings.warn("skill-name-differs-from-directory",{path:path14,subject:name,detail:directoryName});let description=parsed.fields.description;return(typeof description!="string"||description==="")&&findings.warn("skill-description-missing",{path:path14,subject:name}),{name,...typeof description=="string"&&description!==""&&{description},dir,files:index2.filesUnder(dir)}}function normaliseVariables(set2,servers,findings){let declared=new Map,declaredIn=new Map;for(let manifest of set2.manifests){let declaration=manifest.variables;if(declaration===void 0)continue;let variables=declaration.dialect==="cursor"?readCursorVariables(declaration.value,declaration.manifest,findings):readClaudeVariables(declaration.value,declaration.manifest,findings);for(let variable of variables)declared.has(variable.name)||(declared.set(variable.name,variable),declaredIn.set(variable.name,declaration.manifest))}let referencedBy=new Map;for(let server of servers.servers)for(let name of server.env)referencedBy.has(name)||referencedBy.set(name,server.name);if(servers.refused===0)for(let[name,variable]of declared)referencedBy.has(name)||findings.warn("variable-unreferenced",{subject:variable.name,path:declaredIn.get(name)});let inferred=[];for(let[name,server]of[...referencedBy].sort(([a5],[b7])=>a5<b7?-1:a5>b7?1:0))declared.has(name)||(findings.warn("variable-inferred",{subject:name,detail:server}),inferred.push({name,isSecret:!0,optional:!1,declaredBy:"inferred"}));return[...declared.values(),...inferred]}function readCursorVariables(value,manifest,findings){if(!isJsonObject2(value)||value.type!=="object")return findings.error("manifest-field-type",{path:manifest,subject:"variables",detail:"a JSON Schema object with type 'object'"}),[];let properties=value.properties??{};if(!isJsonObject2(properties))return findings.error("manifest-field-type",{path:manifest,subject:"variables.properties",detail:"an object"}),[];let required=value.required??[];if(!isStringArray(required))return findings.error("manifest-field-type",{path:manifest,subject:"variables.required",detail:"an array of strings"}),[];let variables=[];for(let[name,schema2]of fields(properties)){if(!VARIABLE_NAME_PATTERN.test(name)){findings.error("variable-name-invalid",{subject:name,path:manifest});continue}let property=isJsonObject2(schema2)?schema2:{},type2=property.type;type2!==void 0&&type2!=="string"&&findings.warn("variable-type-narrowed",{subject:name,path:manifest,detail:describeValue(type2)}),property.default!==void 0&&findings.warn("variable-default-dropped",{subject:name,path:manifest}),property.enum!==void 0&&findings.warn("variable-option-dropped",{subject:name,path:manifest,detail:"enum"});let description=describe(property);variables.push({name,...description!==void 0&&{description},isSecret:!0,optional:!required.includes(name),declaredBy:"cursor"})}return variables}function readClaudeVariables(value,manifest,findings){if(!isJsonObject2(value))return findings.error("manifest-field-type",{path:manifest,subject:"userConfig",detail:"an object"}),[];let variables=[];for(let[name,entry]of fields(value)){if(!VARIABLE_NAME_PATTERN.test(name)){findings.error("variable-name-invalid",{subject:name,path:manifest});continue}if(!isJsonObject2(entry)){findings.error("manifest-field-type",{path:manifest,subject:`userConfig.${name}`,detail:"an object"});continue}let type2=entry.type;type2!==void 0&&type2!=="string"&&findings.warn("variable-type-narrowed",{subject:name,path:manifest,detail:describeValue(type2)}),entry.default!==void 0&&findings.warn("variable-default-dropped",{subject:name,path:manifest});for(let option of["options","multiple","min","max"])entry[option]!==void 0&&findings.warn("variable-option-dropped",{subject:name,path:manifest,detail:option});let description=describe(entry);variables.push({name,...description!==void 0&&{description},isSecret:entry.sensitive===!0,optional:entry.required!==!0,declaredBy:"claude"})}return variables}function describe(entry){let parts=[entry.title,entry.description].filter(part=>typeof part=="string"&&part!=="");return parts.length===0?void 0:parts.join(": ")}function readPluginPackage(files){let findings=new Findings;for(let entry of files.entries)isContainedPath(entry.path)||findings.error("path-uncontained",{path:entry.path});let index2=new PluginFileIndex(files),set2=detectManifests(index2,findings);if(set2===void 0)return{ok:!1,errors:findings.errors,warnings:findings.warnings};let skills=normaliseSkills(index2,set2,findings),servers=normaliseMcpServers(index2,set2.mcpSources,findings),mcpServers=servers.servers,variables=normaliseVariables(set2,servers,findings),subAgents=normaliseSubAgents(index2,set2,skills,findings),overlay=normaliseOverlay(index2,servers.declaredNames,findings),ignored=dedupeIgnored([ignoredOnDisk(index2,set2.readsAgents),...set2.manifests.map(m3=>m3.ignored)]);if(findings.errors.length>0||set2.name===void 0)return{ok:!1,errors:findings.errors,warnings:findings.warnings};let identity2=set2.manifests[0]?.identity??{};return{ok:!0,plugin:{name:set2.name,...identity2.version!==void 0&&{version:identity2.version},...identity2.description!==void 0&&{description:identity2.description},...identity2.author!==void 0&&{author:identity2.author},...identity2.homepage!==void 0&&{homepage:identity2.homepage},...identity2.repository!==void 0&&{repository:identity2.repository},...identity2.license!==void 0&&{license:identity2.license},keywords:identity2.keywords??[],dialect:set2.dialect,manifestsFound:set2.manifests.map(m3=>m3.path),skills,mcpServers,subAgents,variables,overlay,ignored},warnings:findings.warnings}}var import_node_zlib=require("node:zlib");function parseZipStructure(data){let view=new DataView(data.buffer,data.byteOffset,data.byteLength),eocd=findEndOfCentralDirectory(data,view),entries=[],offset=eocd.centralDirectoryOffset;for(let i6=0;i6<eocd.entryCount;i6++){if(offset+46>data.length||view.getUint32(offset,!0)!==33639248)throw new Error(`invalid central directory record at offset ${offset}`);let versionMadeBy=view.getUint16(offset+4,!0),compressionMethod=view.getUint16(offset+10,!0),crc323=view.getUint32(offset+16,!0),compressedSize=view.getUint32(offset+20,!0),uncompressedSize=view.getUint32(offset+24,!0),fileNameLength=view.getUint16(offset+28,!0),extraFieldLength=view.getUint16(offset+30,!0),commentLength=view.getUint16(offset+32,!0),externalAttributes=view.getUint32(offset+38,!0),localHeaderOffset=view.getUint32(offset+42,!0),fileName=new TextDecoder().decode(data.subarray(offset+46,offset+46+fileNameLength)),dataStart=payloadStart(data,view,localHeaderOffset,fileName);if(dataStart+compressedSize>data.length)throw new Error(`entry "${fileName}" payload runs past end of archive`);entries.push({name:fileName,isDirectory:fileName.endsWith("/"),compressionMethod,uncompressedSize,compressedSize,crc32:crc323,versionMadeBy,externalAttributes,compressedData:data.subarray(dataStart,dataStart+compressedSize)}),offset+=46+fileNameLength+extraFieldLength+commentLength}return entries}function findEndOfCentralDirectory(data,view){let scanFloor=Math.max(0,data.length-22-65535);for(let pos=data.length-22;pos>=scanFloor;pos--){if(view.getUint32(pos,!0)!==101010256)continue;let entryCount=view.getUint16(pos+10,!0),centralDirectorySize=view.getUint32(pos+12,!0),centralDirectoryOffset=view.getUint32(pos+16,!0),directoryEndsAtRecord=centralDirectoryOffset+centralDirectorySize<=pos,directoryLooksReal=entryCount===0||centralDirectoryOffset+4<=data.length&&view.getUint32(centralDirectoryOffset,!0)===33639248;if(directoryEndsAtRecord&&directoryLooksReal)return{centralDirectoryOffset,entryCount}}throw new Error("no end-of-central-directory record found")}var CRC_TABLE=(()=>{let table2=new Uint32Array(256);for(let n3=0;n3<256;n3++){let c5=n3;for(let bit=0;bit<8;bit++)c5=c5>>>1^3988292384&-(c5&1);table2[n3]=c5}return table2})();function crc322(data){let crc2=4294967295;for(let i6=0;i6<data.length;i6++)crc2=crc2>>>8^CRC_TABLE[(crc2^data[i6])&255];return(crc2^4294967295)>>>0}function payloadStart(data,view,localHeaderOffset,fileName){if(localHeaderOffset+30>data.length||view.getUint32(localHeaderOffset,!0)!==67324752)throw new Error(`entry "${fileName}" has no local file header at offset ${localHeaderOffset}`);let localNameLength=view.getUint16(localHeaderOffset+26,!0),localExtraLength=view.getUint16(localHeaderOffset+28,!0);return localHeaderOffset+30+localNameLength+localExtraLength}var METHOD_STORED=0,METHOD_DEFLATED=8,InflateError=class extends Error{kind;detail;constructor(kind,detail){super(`${kind}: ${detail}`),this.kind=kind,this.detail=detail,this.name="InflateError"}};function inflateEntry(entry,maxSize){let content;switch(entry.compressionMethod){case METHOD_STORED:content=entry.compressedData;break;case METHOD_DEFLATED:try{content=new Uint8Array((0,import_node_zlib.inflateRawSync)(entry.compressedData,{maxOutputLength:maxSize+1}))}catch(error2){throw isOutputLengthError(error2)?new InflateError("too-large",`output exceeds ${maxSize} bytes`):new InflateError("read-failed",error2 instanceof Error?error2.message:String(error2))}break;default:throw new InflateError("unsupported-method","zip: unsupported compression algorithm")}if(content.length>maxSize)throw new InflateError("too-large",`output exceeds ${maxSize} bytes`);if(crc322(content)!==entry.crc32)throw new InflateError("checksum","zip: checksum error");return content}function isOutputLengthError(error2){return error2 instanceof Error&&("code"in error2&&error2.code==="ERR_BUFFER_TOO_LARGE"||error2.message.includes("maxOutputLength"))}var import_node_crypto23=require("node:crypto");function sanitizePath(input){let sanitized=sanitizeCore(input);return input.length>0&&(input.endsWith("/")||input.endsWith("\\"))&&sanitized.length>0?`${sanitized}/`:sanitized}function sanitizeCore(input){let segments=`/${input.replaceAll("\\","/")}`.split("/"),resolved=[];for(let segment of segments)if(!(segment===""||segment===".")){if(segment===".."){resolved.pop();continue}resolved.push(segment)}return resolved.join("/")}var WINDOWS_SHORT_FILENAME_PATTERN=/~\d+\.?/;function hasWindowsShortFilenames(input){return input.replaceAll("\\","/").split("/").some(part=>WINDOWS_SHORT_FILENAME_PATTERN.test(part))}var CREATOR_UNIX=3,CREATOR_MACOSX=19,S_IFMT=61440,S_IFBLK=24576,S_IFCHR=8192,S_IFIFO=4096,S_IFLNK=40960,S_IFSOCK=49152;function entryTypeBits(entry){let creator=entry.versionMadeBy>>8;if(creator!==CREATOR_UNIX&&creator!==CREATOR_MACOSX)return{isSymlink:!1,isSpecial:!1};let fileType=entry.externalAttributes>>>16&65535&S_IFMT;return{isSymlink:fileType===S_IFLNK,isSpecial:fileType===S_IFBLK||fileType===S_IFCHR||fileType===S_IFIFO||fileType===S_IFSOCK}}function applyEntryPrefilter(entries){let symlinks=new Set,result=[];for(let entry of entries){let name=sanitizePath(entry.name);if(hasWindowsShortFilenames(name))continue;let shadowKey=trimTrailingSlash2(sanitizePath(name)).toLowerCase(),parts=shadowKey.split("/"),traversal=!1;for(let i6=1;i6<=parts.length;i6++)if(symlinks.has(parts.slice(0,i6).join("/"))){traversal=!0;break}if(traversal)continue;let typeBits=entryTypeBits(entry);typeBits.isSymlink&&symlinks.add(shadowKey),!typeBits.isSpecial&&result.push({name,entry})}return result}function trimTrailingSlash2(path14){return path14.endsWith("/")?path14.slice(0,-1):path14}function openArchive(bytes,maxZipSize=104857600){if(bytes.length>maxZipSize)throw new Error(`ZIP file too large: ${bytes.length} bytes (max: ${maxZipSize})`);let hash=calculateHash(bytes),entries;try{entries=parseZipStructure(bytes)}catch{throw new Error("invalid ZIP file: zip: not a valid zip file")}return{hash,entries:applyEntryPrefilter(entries)}}function validateArchiveStructure(entries,limits,onEntry){if(entries.length===0)throw new Error("ZIP file is empty");if(entries.length>limits.maxFiles)throw new Error(`too many files in ZIP: ${entries.length} (max: ${limits.maxFiles})`);let totalUncompressedSize=0;for(let{name,entry}of entries){onEntry?.(name);for(let ch of name){let codePoint=ch.codePointAt(0);if(codePoint<32||codePoint===127)throw new Error(`invalid character in filename: ${name}`)}if(totalUncompressedSize+=entry.uncompressedSize,totalUncompressedSize>limits.maxUncompressedSize)throw new Error(`total uncompressed size too large: ${totalUncompressedSize} bytes (max: ${limits.maxUncompressedSize})`);if(entry.compressedSize>0){let ratio=Math.floor(entry.uncompressedSize/entry.compressedSize);if(ratio>limits.maxCompressionRatio)throw new Error(`suspicious compression ratio in ${name}: ${ratio}:1 (max: ${limits.maxCompressionRatio}:1)`)}}}function calculateHash(data){return(0,import_node_crypto23.createHash)("sha256").update(data).digest("hex")}function openPluginArchive(bytes){let{hash,entries}=openArchive(bytes,104857600);validateArchiveStructure(entries,PLATFORM_ARCHIVE_LIMITS);let byPath=new Map;for(let prefiltered of entries){let{name}=prefiltered;name.endsWith("/")||!isContainedPath(name)||byPath.has(name)||byPath.set(name,prefiltered)}let files={entries:[...byPath.values()].map(({name,entry})=>({path:name,size:entry.uncompressedSize})).sort((a5,b7)=>comparePaths(a5.path,b7.path)),read(path14){let prefiltered=byPath.get(path14);if(prefiltered===void 0)throw new Error(`plugin file '${path14}' is not listed`);try{return inflateEntry(prefiltered.entry,prefiltered.entry.uncompressedSize)}catch(error2){throw error2 instanceof InflateError?new Error(`failed to read '${path14}' from the plugin archive: ${error2.detail}`):error2}}};return{digest:hash,files}}function memberLabels(identity2){return{[PLUGIN_LABEL]:identity2.id,[PLUGIN_VERSION_LABEL]:identity2.digest}}function memberMetadata(identity2,member2,authored){let metadata=authored===void 0?create2(ApiResourceMetadataSchema,{}):authored;return metadata.org=identity2.org,metadata.name=member2.name,metadata.slug=member2.slug,metadata.id="",identity2.visibility!==ApiResourceVisibility.api_resource_visibility_unspecified&&(metadata.visibility=identity2.visibility),metadata.labels={...metadata.labels,...memberLabels(identity2)},metadata}var McpServerOverlayError=class extends Error{constructor(server,reason){super(`overlay for MCP server '${server}': ${reason}`),this.name="McpServerOverlayError"}};function mcpServerSlugOf(server){return generateSlug(server.name)}function planMcpServers(plugin2,overlays,identity2){let env2=declaredVariables(plugin2);return plugin2.mcpServers.map(server=>{let overlay=overlays.get(server.name),spec=create2(McpServerSpecSchema,{description:plugin2.description??"",env:Object.fromEntries(server.env.map(name=>[name,env2.get(name)??inferredSecret()]))});switch(server.transport){case"http":spec.serverType={case:"http",value:create2(HttpServerConfigSchema,{url:server.url,headers:{...server.headers}})};break;case"stdio":spec.serverType={case:"stdio",value:create2(StdioServerConfigSchema,{command:server.command,args:[...server.args]})};break;default:{let exhaustive=server;throw new Error(`unknown transport ${JSON.stringify(exhaustive)}`)}}overlay!==void 0&&layerOverlay(server.name,spec,overlay);let slug=mcpServerSlugOf(server);return{name:server.name,slug,resource:create2(McpServerSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"McpServer",metadata:memberMetadata(identity2,{name:server.name,slug},overlay?.metadata),spec})}})}function declaredVariables(plugin2){return new Map(plugin2.variables.map(variable=>[variable.name,create2(EnvVarDeclarationSchema,{isSecret:variable.isSecret,description:variable.description??"",optional:variable.optional})]))}function inferredSecret(){return create2(EnvVarDeclarationSchema,{isSecret:!0,optional:!1})}function layerOverlay(serverName,spec,overlay){let authored=overlay.spec;if(authored!==void 0){if(authored.serverType.case!==void 0)throw new McpServerOverlayError(serverName,"the transport (http or stdio) lives in mcp.json, where every client reads it; the overlay may not redefine it");if(Object.keys(authored.env).length>0)throw new McpServerOverlayError(serverName,"variables are declared where mcp.json references them (the plugin's variables or userConfig); the overlay may not declare env");authored.description!==""&&(spec.description=authored.description),authored.iconUrl!==""&&(spec.iconUrl=authored.iconUrl),authored.tags.length>0&&(spec.tags=[...authored.tags]),authored.defaultEnabledTools.length>0&&(spec.defaultEnabledTools=[...authored.defaultEnabledTools]),authored.pinnedToolApprovals.length>0&&(spec.pinnedToolApprovals=[...authored.pinnedToolApprovals]),authored.repositoryUrl!==""&&(spec.repositoryUrl=authored.repositoryUrl),authored.auth!==void 0&&(spec.auth=authored.auth)}}function renderDefaultAgentInstructions(plugin2){let lines=[],description=plugin2.description?.trim()??"";if(lines.push(description===""?`You are ${plugin2.name}, an agent installed from the ${plugin2.name} plugin.`:`You are ${plugin2.name}: ${description}`),plugin2.skills.length>0){lines.push(""),lines.push("Your skills:");for(let skill of plugin2.skills){let summary=skill.description?.trim()??"";lines.push(summary===""?`- ${skill.name}`:`- ${skill.name}: ${summary}`)}}if(plugin2.mcpServers.length>0){lines.push(""),lines.push("Your tools come from these MCP servers:");for(let server of plugin2.mcpServers)lines.push(`- ${server.name}`)}return lines.push(""),lines.push("Before acting on a task a skill covers, read that skill and follow it. Use the tools your servers provide rather than guessing at their results. When you finish, state what you did and what you could not do."),lines.join(`
-`)}var file_ai_stigmer_agentic_skill_v1_io=fileDesc("CiRhaS9zdGlnbWVyL2FnZW50aWMvc2tpbGwvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MSIgCgdTa2lsbElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEijgQKEFB1c2hTa2lsbFJlcXVlc3QSEwoDb3JnGAEgASgJQga6SAPIAQESEAoIYXJ0aWZhY3QYAiABKAwSKAoDdGFnGAMgASgJQhu6SBhyFjIUXiR8XlthLXpBLVowLTkuXy1dKyQSQgoOZ2l0X3Byb3ZlbmFuY2UYBCABKAsyKi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuR2l0UHJvdmVuYW5jZRIPCgdtZXNzYWdlGAYgASgJEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYByABKAkSSQoGbGFiZWxzGAggAygLMjkuYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlB1c2hTa2lsbFJlcXVlc3QuTGFiZWxzRW50cnkaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ATq2AbpIsgEarwEKInB1c2hfc2tpbGxfcmVxdWVzdC5hcnRpZmFjdF9zb3VyY2USSWV4YWN0bHkgb25lIG9mIGFydGlmYWN0IChpbmxpbmUgYnl0ZXMpIG9yIGFydGlmYWN0X3VwbG9hZF9yZWYgbXVzdCBiZSBzZXQaPih0aGlzLmFydGlmYWN0LnNpemUoKSA+IDApICE9ICh0aGlzLmFydGlmYWN0X3VwbG9hZF9yZWYgIT0gJycpSgQIBRAGIlcKI0NyZWF0ZVNraWxsQXJ0aWZhY3RVcGxvYWRVcmxSZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhsKCnNpemVfYnl0ZXMYAiABKANCB7pIBCICIAAiVwoWU2tpbGxBcnRpZmFjdFVwbG9hZFVybBILCgN1cmwYASABKAkSGwoTYXJ0aWZhY3RfdXBsb2FkX3JlZhgCIAEoCRITCgt0dGxfc2Vjb25kcxgDIAEoBSJQChhTa2lsbEFydGlmYWN0RG93bmxvYWRVcmwSCwoDdXJsGAEgASgJEhMKC3R0bF9zZWNvbmRzGAIgASgFEhIKCnNpemVfYnl0ZXMYAyABKAMiowEKJVB1c2hTa2lsbEZyb21FeGVjdXRpb25BcnRpZmFjdFJlcXVlc3QSEwoDb3JnGAEgASgJQga6SAPIAQESHQoMZXhlY3V0aW9uX2lkGAIgASgJQge6SARyAhABEhwKC3N0b3JhZ2Vfa2V5GAMgASgJQge6SARyAhABEigKA3RhZxgEIAEoCUIbukgYchYyFF4kfF5bYS16QS1aMC05Ll8tXSskIjoKEkdldEFydGlmYWN0UmVxdWVzdBIkChRhcnRpZmFjdF9zdG9yYWdlX2tleRgBIAEoCUIGukgDyAEBIicKE0dldEFydGlmYWN0UmVzcG9uc2USEAoIYXJ0aWZhY3QYASABKAwiagoWTGlzdFNraWxsVmVyc2lvbnNJbnB1dBITCgNvcmcYASABKAlCBrpIA8gBARIUCgRzbHVnGAIgASgJQga6SAPIAQESEgoKcGFnZV90b2tlbhgDIAEoCRIRCglwYWdlX3NpemUYBCABKAUitgIKEVNraWxsVmVyc2lvbkVudHJ5EhQKDHZlcnNpb25faGFzaBgBIAEoCRItCglwdXNoZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkgKCXB1c2hlZF9ieRgDIAEoCzI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0QWN0b3ISCwoDdGFnGAQgASgJEhIKCmlzX2N1cnJlbnQYBSABKAgSQgoOZ2l0X3Byb3ZlbmFuY2UYBiABKAsyKi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuR2l0UHJvdmVuYW5jZRIPCgdtZXNzYWdlGAcgASgJEhwKFGFydGlmYWN0X3N0b3JhZ2Vfa2V5GAggASgJIosBChlMaXN0U2tpbGxWZXJzaW9uc1Jlc3BvbnNlEkAKCHZlcnNpb25zGAEgAygLMi4uYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlNraWxsVmVyc2lvbkVudHJ5EhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRITCgt0b3RhbF9jb3VudBgDIAEoBWIGcHJvdG8z",[file_ai_stigmer_agentic_skill_v1_status,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_timestamp]),SkillIdSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,0),PushSkillRequestSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,1);var SkillArtifactUploadUrlSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,3),SkillArtifactDownloadUrlSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,4);var GetArtifactResponseSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,7);var SkillVersionEntrySchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,9),ListSkillVersionsResponseSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,10);var DETERMINISTIC_ZIP_MTIME=new Date(1980,0,1),DEFLATE_LEVEL=6;function writeArchive(files){let sorted=[...files].sort((a5,b7)=>a5.path<b7.path?-1:a5.path>b7.path?1:0),tree={};for(let file of sorted){if(file.path in tree)throw new Error(`archive path '${file.path}' listed twice`);tree[file.path]=file.bytes}return zipSync(tree,{level:DEFLATE_LEVEL,mtime:DETERMINISTIC_ZIP_MTIME})}function skillSlugOf(skill){return generateSlug(skill.name)}function planSkills(plugin2,files,identity2,tag2,message6){return plugin2.skills.map(skill=>{let prefix=skill.dir===""?"":`${skill.dir}/`,archive=writeArchive(skill.files.map(path14=>({path:path14.startsWith(prefix)?path14.slice(prefix.length):path14,bytes:files.read(path14)})));return{name:skill.name,slug:skillSlugOf(skill),request:create2(PushSkillRequestSchema,{org:identity2.org,artifact:archive,tag:tag2,message:message6,labels:memberLabels(identity2)})}})}function carriesAgent(plugin2){return plugin2.skills.length>0||plugin2.subAgents.length>0||plugin2.overlay.agent!==void 0}function planAgent(plugin2,overlayAgent,mcpServers,identity2,warnings){if(!carriesAgent(plugin2))return;let member2={name:identity2.name,slug:identity2.slug};if(overlayAgent!==void 0)return{...member2,resource:create2(AgentSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Agent",metadata:memberMetadata(identity2,member2,overlayAgent.metadata),spec:overlayAgent.spec})};let serverSlugs=plugin2.mcpServers.map(mcpServerSlugOf),skillSlugByName=new Map(plugin2.skills.map(skill=>[skill.name,skillSlugOf(skill)])),spec=create2(AgentSpecSchema,{description:plugin2.description??"",instructions:renderDefaultAgentInstructions(plugin2),env:toolVariables(mcpServers),skillRefs:[...skillSlugByName.values()].map(slug=>create2(ApiResourceReferenceSchema,{org:identity2.org,kind:ApiResourceKind.skill,slug})),mcpServerUsages:serverSlugs.map(slug=>create2(McpServerUsageSchema,{mcpServerRef:create2(ApiResourceReferenceSchema,{org:identity2.org,kind:ApiResourceKind.mcp_server,slug})})),subAgents:plugin2.subAgents.map(subAgent=>planSubAgent(subAgent,identity2,serverSlugs,skillSlugByName,warnings))});return{...member2,resource:create2(AgentSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Agent",metadata:memberMetadata(identity2,member2),spec})}}function toolVariables(mcpServers){let declarations={};for(let server of mcpServers){let spec=server.resource.spec;if(spec===void 0)continue;let oauthTarget=spec.auth?.targetEnvVar??"";for(let[name,declaration]of Object.entries(spec.env))name===oauthTarget||name in declarations||(declarations[name]=declaration)}return declarations}function planSubAgent(subAgent,identity2,serverSlugs,skillSlugByName,warnings){BUILT_IN_SUB_AGENT_NAMES.has(subAgent.name)&&warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.subAgentNameBuiltin,path:subAgent.path,message:`sub-agent '${subAgent.name}' shares its name with a built-in sub-agent; the runner warns and runs the plugin's`}));let hint=subAgent.modelHint;return hint!==void 0&&hint.alias!=="inherit"&&hint.alias!=="unknown"&&warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.modelHintUnresolved,path:subAgent.path,message:`sub-agent '${subAgent.name}' names model '${hint.raw}'; Stigmer does not pin a model from a plugin, so it runs on the session's model`})),create2(SubAgentSchema,{name:subAgent.name,description:subAgent.description??"",instructions:subAgent.instructions,mcpAccess:serverSlugs.map(slug=>create2(McpAccessSchema,{mcpServer:slug})),skillRefs:subAgent.skillNames.flatMap(name=>{let slug=skillSlugByName.get(name);return slug===void 0?[]:[create2(ApiResourceReferenceSchema,{org:identity2.org,kind:ApiResourceKind.skill,slug})]})})}function workflowSlugOf(name){return generateSlug(name)}function planWorkflows(overlays,identity2){return overlays.map(({name,resource})=>{let slug=workflowSlugOf(name);return{name,slug,resource:create2(WorkflowSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Workflow",metadata:memberMetadata(identity2,{name,slug},resource.metadata),spec:resource.spec})}})}function versionTag(version,warnings){return version===void 0||version===""?"":VERSION_TAG_PATTERN.test(version)?version:(warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.versionNotTaggable,message:`version '${version}' cannot be a tag (letters, digits, '.', '_' and '-' only); this version is reachable by its digest but not by name`})),"")}function planMaterialization(plugin2,files,overlays,identity2,message6){let warnings=[];for(let ignored of plugin2.ignored)warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.componentIgnored,path:ignored.path,message:`${ignored.kind} at '${ignored.path}' is not installed; Stigmer reads skills, MCP servers, sub-agents and the ai.stigmer/ overlay`}));let tag2=versionTag(plugin2.version,warnings),skills=planSkills(plugin2,files,identity2,tag2,message6),mcpServers=planMcpServers(plugin2,new Map(overlays.mcpServers.map(document2=>[document2.server,document2.resource])),identity2),agent=planAgent(plugin2,overlays.agent?.resource,mcpServers,identity2,warnings),workflows=planWorkflows(overlays.workflows,identity2),members=[...skills.map(skill=>({kind:ApiResourceKind.skill,slug:skill.slug,name:skill.name})),...mcpServers.map(server=>({kind:ApiResourceKind.mcp_server,slug:server.slug,name:server.name})),...agent===void 0?[]:[{kind:ApiResourceKind.agent,slug:agent.slug,name:agent.name}],...workflows.map(workflow=>({kind:ApiResourceKind.workflow,slug:workflow.slug,name:workflow.name}))];return{skills,mcpServers,agent,workflows,members,tag:tag2,warnings}}function getDefaultExportFromCjs(x2){return x2&&x2.__esModule&&Object.prototype.hasOwnProperty.call(x2,"default")?x2.default:x2}var jsYaml={},loader={},common={},hasRequiredCommon;function requireCommon(){if(hasRequiredCommon)return common;hasRequiredCommon=1;function isNothing(subject){return typeof subject>"u"||subject===null}function isObject4(subject){return typeof subject=="object"&&subject!==null}function toArray(sequence){return Array.isArray(sequence)?sequence:isNothing(sequence)?[]:[sequence]}function extend(target,source){if(source){let sourceKeys=Object.keys(source);for(let index2=0,length=sourceKeys.length;index2<length;index2+=1){let key=sourceKeys[index2];target[key]=source[key]}}return target}function repeat(string,count){let result="";for(let cycle=0;cycle<count;cycle+=1)result+=string;return result}function isNegativeZero(number){return number===0&&Number.NEGATIVE_INFINITY===1/number}return common.isNothing=isNothing,common.isObject=isObject4,common.toArray=toArray,common.repeat=repeat,common.isNegativeZero=isNegativeZero,common.extend=extend,common}var exception,hasRequiredException;function requireException(){if(hasRequiredException)return exception;hasRequiredException=1;function formatError2(exception2,compact){let where="",message6=exception2.reason||"(unknown reason)";return exception2.mark?(exception2.mark.name&&(where+='in "'+exception2.mark.name+'" '),where+="("+(exception2.mark.line+1)+":"+(exception2.mark.column+1)+")",!compact&&exception2.mark.snippet&&(where+=`
+`)}var file_ai_stigmer_agentic_skill_v1_io=fileDesc("CiRhaS9zdGlnbWVyL2FnZW50aWMvc2tpbGwvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MSIgCgdTa2lsbElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEijgQKEFB1c2hTa2lsbFJlcXVlc3QSEwoDb3JnGAEgASgJQga6SAPIAQESEAoIYXJ0aWZhY3QYAiABKAwSKAoDdGFnGAMgASgJQhu6SBhyFjIUXiR8XlthLXpBLVowLTkuXy1dKyQSQgoOZ2l0X3Byb3ZlbmFuY2UYBCABKAsyKi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuR2l0UHJvdmVuYW5jZRIPCgdtZXNzYWdlGAYgASgJEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYByABKAkSSQoGbGFiZWxzGAggAygLMjkuYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlB1c2hTa2lsbFJlcXVlc3QuTGFiZWxzRW50cnkaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ATq2AbpIsgEarwEKInB1c2hfc2tpbGxfcmVxdWVzdC5hcnRpZmFjdF9zb3VyY2USSWV4YWN0bHkgb25lIG9mIGFydGlmYWN0IChpbmxpbmUgYnl0ZXMpIG9yIGFydGlmYWN0X3VwbG9hZF9yZWYgbXVzdCBiZSBzZXQaPih0aGlzLmFydGlmYWN0LnNpemUoKSA+IDApICE9ICh0aGlzLmFydGlmYWN0X3VwbG9hZF9yZWYgIT0gJycpSgQIBRAGIlcKI0NyZWF0ZVNraWxsQXJ0aWZhY3RVcGxvYWRVcmxSZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhsKCnNpemVfYnl0ZXMYAiABKANCB7pIBCICIAAiVwoWU2tpbGxBcnRpZmFjdFVwbG9hZFVybBILCgN1cmwYASABKAkSGwoTYXJ0aWZhY3RfdXBsb2FkX3JlZhgCIAEoCRITCgt0dGxfc2Vjb25kcxgDIAEoBSJQChhTa2lsbEFydGlmYWN0RG93bmxvYWRVcmwSCwoDdXJsGAEgASgJEhMKC3R0bF9zZWNvbmRzGAIgASgFEhIKCnNpemVfYnl0ZXMYAyABKAMiowEKJVB1c2hTa2lsbEZyb21FeGVjdXRpb25BcnRpZmFjdFJlcXVlc3QSEwoDb3JnGAEgASgJQga6SAPIAQESHQoMZXhlY3V0aW9uX2lkGAIgASgJQge6SARyAhABEhwKC3N0b3JhZ2Vfa2V5GAMgASgJQge6SARyAhABEigKA3RhZxgEIAEoCUIbukgYchYyFF4kfF5bYS16QS1aMC05Ll8tXSskIjoKEkdldEFydGlmYWN0UmVxdWVzdBIkChRhcnRpZmFjdF9zdG9yYWdlX2tleRgBIAEoCUIGukgDyAEBIicKE0dldEFydGlmYWN0UmVzcG9uc2USEAoIYXJ0aWZhY3QYASABKAwiagoWTGlzdFNraWxsVmVyc2lvbnNJbnB1dBITCgNvcmcYASABKAlCBrpIA8gBARIUCgRzbHVnGAIgASgJQga6SAPIAQESEgoKcGFnZV90b2tlbhgDIAEoCRIRCglwYWdlX3NpemUYBCABKAUitgIKEVNraWxsVmVyc2lvbkVudHJ5EhQKDHZlcnNpb25faGFzaBgBIAEoCRItCglwdXNoZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkgKCXB1c2hlZF9ieRgDIAEoCzI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0QWN0b3ISCwoDdGFnGAQgASgJEhIKCmlzX2N1cnJlbnQYBSABKAgSQgoOZ2l0X3Byb3ZlbmFuY2UYBiABKAsyKi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuR2l0UHJvdmVuYW5jZRIPCgdtZXNzYWdlGAcgASgJEhwKFGFydGlmYWN0X3N0b3JhZ2Vfa2V5GAggASgJIosBChlMaXN0U2tpbGxWZXJzaW9uc1Jlc3BvbnNlEkAKCHZlcnNpb25zGAEgAygLMi4uYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlNraWxsVmVyc2lvbkVudHJ5EhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRITCgt0b3RhbF9jb3VudBgDIAEoBWIGcHJvdG8z",[file_ai_stigmer_agentic_skill_v1_status,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_timestamp]),SkillIdSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,0),PushSkillRequestSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,1);var SkillArtifactUploadUrlSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,3),SkillArtifactDownloadUrlSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,4);var GetArtifactResponseSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,7);var SkillVersionEntrySchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,9),ListSkillVersionsResponseSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,10);var DETERMINISTIC_ZIP_MTIME=new Date(1980,0,1),DEFLATE_LEVEL=6;function writeArchive(files){let sorted=[...files].sort((a5,b7)=>a5.path<b7.path?-1:a5.path>b7.path?1:0),tree={};for(let file of sorted){if(file.path in tree)throw new Error(`archive path '${file.path}' listed twice`);tree[file.path]=file.bytes}return zipSync(tree,{level:DEFLATE_LEVEL,mtime:DETERMINISTIC_ZIP_MTIME})}function skillSlugOf(skill){return generateSlug(skill.name)}function planSkills(plugin2,files,identity2,tag2,message6){return plugin2.skills.map(skill=>{let prefix=skill.dir===""?"":`${skill.dir}/`,archive=writeArchive(skill.files.map(path14=>({path:path14.startsWith(prefix)?path14.slice(prefix.length):path14,bytes:files.read(path14)})));return{name:skill.name,slug:skillSlugOf(skill),request:create2(PushSkillRequestSchema,{org:identity2.org,artifact:archive,tag:tag2,message:message6,labels:memberLabels(identity2)})}})}function carriesAgent(plugin2){return plugin2.skills.length>0||plugin2.subAgents.length>0||plugin2.overlay.agent!==void 0}function planAgent(plugin2,overlayAgent,mcpServers,identity2,warnings){if(!carriesAgent(plugin2))return;let member2={name:identity2.name,slug:identity2.slug};if(overlayAgent!==void 0)return{...member2,resource:create2(AgentSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Agent",metadata:memberMetadata(identity2,member2,overlayAgent.metadata),spec:overlayAgent.spec})};let serverSlugs=plugin2.mcpServers.map(mcpServerSlugOf),skillSlugByName=new Map(plugin2.skills.map(skill=>[skill.name,skillSlugOf(skill)])),spec=create2(AgentSpecSchema,{description:plugin2.description??"",instructions:renderDefaultAgentInstructions(plugin2),env:toolVariables(mcpServers),skillRefs:[...skillSlugByName.values()].map(slug=>create2(ApiResourceReferenceSchema,{org:identity2.org,kind:ApiResourceKind.skill,slug})),mcpServerUsages:serverSlugs.map(slug=>create2(McpServerUsageSchema,{mcpServerRef:create2(ApiResourceReferenceSchema,{org:identity2.org,kind:ApiResourceKind.mcp_server,slug})})),subAgents:plugin2.subAgents.map(subAgent=>planSubAgent(subAgent,identity2,serverSlugs,skillSlugByName,warnings))});return{...member2,resource:create2(AgentSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Agent",metadata:memberMetadata(identity2,member2),spec})}}function toolVariables(mcpServers){let declarations={};for(let server of mcpServers){let spec=server.resource.spec;if(spec===void 0)continue;let oauthTarget=spec.auth?.targetEnvVar??"";for(let[name,declaration]of Object.entries(spec.env))name===oauthTarget||name in declarations||(declarations[name]=declaration)}return declarations}function planSubAgent(subAgent,identity2,serverSlugs,skillSlugByName,warnings){BUILT_IN_SUB_AGENT_NAMES.has(subAgent.name)&&warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.subAgentNameBuiltin,path:subAgent.path,message:`sub-agent '${subAgent.name}' shares its name with a built-in sub-agent; the runner warns and runs the plugin's`}));let hint=subAgent.modelHint;return hint!==void 0&&hint.alias!=="inherit"&&hint.alias!=="unknown"&&warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.modelHintUnresolved,path:subAgent.path,message:`sub-agent '${subAgent.name}' names model '${hint.raw}'; Stigmer does not pin a model from a plugin, so it runs on the session's model`})),create2(SubAgentSchema,{name:subAgent.name,description:subAgent.description??"",instructions:subAgent.instructions,mcpAccess:serverSlugs.map(slug=>create2(McpAccessSchema,{mcpServer:slug})),skillRefs:subAgent.skillNames.flatMap(name=>{let slug=skillSlugByName.get(name);return slug===void 0?[]:[create2(ApiResourceReferenceSchema,{org:identity2.org,kind:ApiResourceKind.skill,slug})]})})}function workflowSlugOf(name){return generateSlug(name)}function planWorkflows(overlays,identity2){return overlays.map(({name,resource})=>{let slug=workflowSlugOf(name);return{name,slug,resource:create2(WorkflowSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Workflow",metadata:memberMetadata(identity2,{name,slug},resource.metadata),spec:resource.spec})}})}function versionTag(version,warnings){return version===void 0||version===""?"":VERSION_TAG_PATTERN.test(version)?version:(warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.versionNotTaggable,message:`version '${version}' cannot be a tag (letters, digits, '.', '_' and '-' only); this version is reachable by its digest but not by name`})),"")}function planMaterialization(plugin2,files,overlays,identity2,message6){let warnings=[];for(let ignored of plugin2.ignored)warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.componentIgnored,path:ignored.path,message:`${ignored.kind} at '${ignored.path}' is not installed; Stigmer reads skills, MCP servers, sub-agents and the ai.stigmer/ overlay`}));let tag2=versionTag(plugin2.version,warnings),skills=planSkills(plugin2,files,identity2,tag2,message6),mcpServers=planMcpServers(plugin2,new Map(overlays.mcpServers.map(document2=>[document2.server,document2.resource])),identity2),agent=planAgent(plugin2,overlays.agent?.resource,mcpServers,identity2,warnings),workflows=planWorkflows(overlays.workflows,identity2),members=[...skills.map(skill=>({kind:ApiResourceKind.skill,slug:skill.slug,name:skill.name,system:skill.request.labels[SYSTEM_LABEL]===RESERVED_LABEL_TRUE})),...mcpServers.map(server=>({kind:ApiResourceKind.mcp_server,slug:server.slug,name:server.name,system:isSystemContent(server.resource.metadata)})),...agent===void 0?[]:[{kind:ApiResourceKind.agent,slug:agent.slug,name:agent.name,system:isSystemContent(agent.resource.metadata)}],...workflows.map(workflow=>({kind:ApiResourceKind.workflow,slug:workflow.slug,name:workflow.name,system:isSystemContent(workflow.resource.metadata)}))];return{skills,mcpServers,agent,workflows,members,tag:tag2,warnings}}function getDefaultExportFromCjs(x2){return x2&&x2.__esModule&&Object.prototype.hasOwnProperty.call(x2,"default")?x2.default:x2}var jsYaml={},loader={},common={},hasRequiredCommon;function requireCommon(){if(hasRequiredCommon)return common;hasRequiredCommon=1;function isNothing(subject){return typeof subject>"u"||subject===null}function isObject4(subject){return typeof subject=="object"&&subject!==null}function toArray(sequence){return Array.isArray(sequence)?sequence:isNothing(sequence)?[]:[sequence]}function extend(target,source){if(source){let sourceKeys=Object.keys(source);for(let index2=0,length=sourceKeys.length;index2<length;index2+=1){let key=sourceKeys[index2];target[key]=source[key]}}return target}function repeat(string,count){let result="";for(let cycle=0;cycle<count;cycle+=1)result+=string;return result}function isNegativeZero(number){return number===0&&Number.NEGATIVE_INFINITY===1/number}return common.isNothing=isNothing,common.isObject=isObject4,common.toArray=toArray,common.repeat=repeat,common.isNegativeZero=isNegativeZero,common.extend=extend,common}var exception,hasRequiredException;function requireException(){if(hasRequiredException)return exception;hasRequiredException=1;function formatError2(exception2,compact){let where="",message6=exception2.reason||"(unknown reason)";return exception2.mark?(exception2.mark.name&&(where+='in "'+exception2.mark.name+'" '),where+="("+(exception2.mark.line+1)+":"+(exception2.mark.column+1)+")",!compact&&exception2.mark.snippet&&(where+=`
 
 `+exception2.mark.snippet),message6+" "+where):message6}function YAMLException22(reason,mark){Error.call(this),this.name="YAMLException",this.reason=reason,this.mark=mark,this.message=formatError2(this,!1),Error.captureStackTrace?Error.captureStackTrace(this,this.constructor):this.stack=new Error().stack||""}return YAMLException22.prototype=Object.create(Error.prototype),YAMLException22.prototype.constructor=YAMLException22,YAMLException22.prototype.toString=function(compact){return this.name+": "+formatError2(this,compact)},exception=YAMLException22,exception}var snippet,hasRequiredSnippet;function requireSnippet(){if(hasRequiredSnippet)return snippet;hasRequiredSnippet=1;let common2=requireCommon();function getLine2(buffer,lineStart,lineEnd,position,maxLineLength){let head="",tail="",maxHalfLength=Math.floor(maxLineLength/2)-1;return position-lineStart>maxHalfLength&&(head=" ... ",lineStart=position-maxHalfLength+head.length),lineEnd-position>maxHalfLength&&(tail=" ...",lineEnd=position+maxHalfLength-tail.length),{str:head+buffer.slice(lineStart,lineEnd).replace(/\t/g,"\u2192")+tail,pos:position-lineStart+head.length}}function padStart2(string,max2){return common2.repeat(" ",max2-string.length)+string}function makeSnippet2(mark,options){if(options=Object.create(options||null),!mark.buffer)return null;options.maxLength||(options.maxLength=79),typeof options.indent!="number"&&(options.indent=1),typeof options.linesBefore!="number"&&(options.linesBefore=3),typeof options.linesAfter!="number"&&(options.linesAfter=2);let re2=/\r?\n|\r|\0/g,lineStarts=[0],lineEnds=[],match,foundLineNo=-1;for(;match=re2.exec(mark.buffer);)lineEnds.push(match.index),lineStarts.push(match.index+match[0].length),mark.position<=match.index&&foundLineNo<0&&(foundLineNo=lineStarts.length-2);foundLineNo<0&&(foundLineNo=lineStarts.length-1);let result="",lineNoLength=Math.min(mark.line+options.linesAfter,lineEnds.length).toString().length,maxLineLength=options.maxLength-(options.indent+lineNoLength+3);for(let i6=1;i6<=options.linesBefore&&!(foundLineNo-i6<0);i6++){let line2=getLine2(mark.buffer,lineStarts[foundLineNo-i6],lineEnds[foundLineNo-i6],mark.position-(lineStarts[foundLineNo]-lineStarts[foundLineNo-i6]),maxLineLength);result=common2.repeat(" ",options.indent)+padStart2((mark.line-i6+1).toString(),lineNoLength)+" | "+line2.str+`
 `+result}let line=getLine2(mark.buffer,lineStarts[foundLineNo],lineEnds[foundLineNo],mark.position,maxLineLength);result+=common2.repeat(" ",options.indent)+padStart2((mark.line+1).toString(),lineNoLength)+" | "+line.str+`
@@ -522,7 +522,7 @@ caused by: ${_Layerr.fullStack(cause)}`:err2.stack??""}static info(err2){assertE
 `+line.slice(curr+1):result+=line.slice(start),result.slice(1)}function escapeString(string){let result="",char=0;for(let i6=0;i6<string.length;char>=65536?i6+=2:i6++){char=codePointAt(string,i6);let escapeSeq=ESCAPE_SEQUENCES[char];!escapeSeq&&isPrintable(char)?(result+=string[i6],char>=65536&&(result+=string[i6+1])):result+=escapeSeq||encodeHex(char)}return result}function writeFlowSequence(state2,level,object){let _result="",_tag=state2.tag;for(let index2=0,length=object.length;index2<length;index2+=1){let value=object[index2];state2.replacer&&(value=state2.replacer.call(object,String(index2),value)),(writeNode(state2,level,value,!1,!1)||typeof value>"u"&&writeNode(state2,level,null,!1,!1))&&(_result!==""&&(_result+=","+(state2.condenseFlow?"":" ")),_result+=state2.dump)}state2.tag=_tag,state2.dump="["+_result+"]"}function writeBlockSequence(state2,level,object,compact){let _result="",_tag=state2.tag;for(let index2=0,length=object.length;index2<length;index2+=1){let value=object[index2];state2.replacer&&(value=state2.replacer.call(object,String(index2),value)),(writeNode(state2,level+1,value,!0,!0,!1,!0)||typeof value>"u"&&writeNode(state2,level+1,null,!0,!0,!1,!0))&&((!compact||_result!=="")&&(_result+=generateNextLine(state2,level)),state2.dump&&CHAR_LINE_FEED===state2.dump.charCodeAt(0)?_result+="-":_result+="- ",_result+=state2.dump)}state2.tag=_tag,state2.dump=_result||"[]"}function writeFlowMapping(state2,level,object){let _result="",_tag=state2.tag,objectKeyList=Object.keys(object);for(let index2=0,length=objectKeyList.length;index2<length;index2+=1){let pairBuffer="";_result!==""&&(pairBuffer+=", "),state2.condenseFlow&&(pairBuffer+='"');let objectKey=objectKeyList[index2],objectValue=object[objectKey];state2.replacer&&(objectValue=state2.replacer.call(object,objectKey,objectValue)),writeNode(state2,level,objectKey,!1,!1)&&(state2.dump.length>1024&&(pairBuffer+="? "),pairBuffer+=state2.dump+(state2.condenseFlow?'"':"")+":"+(state2.condenseFlow?"":" "),writeNode(state2,level,objectValue,!1,!1)&&(pairBuffer+=state2.dump,_result+=pairBuffer))}state2.tag=_tag,state2.dump="{"+_result+"}"}function writeBlockMapping(state2,level,object,compact){let _result="",_tag=state2.tag,objectKeyList=Object.keys(object);if(state2.sortKeys===!0)objectKeyList.sort();else if(typeof state2.sortKeys=="function")objectKeyList.sort(state2.sortKeys);else if(state2.sortKeys)throw new YAMLException22("sortKeys must be a boolean or a function");for(let index2=0,length=objectKeyList.length;index2<length;index2+=1){let pairBuffer="";(!compact||_result!=="")&&(pairBuffer+=generateNextLine(state2,level));let objectKey=objectKeyList[index2],objectValue=object[objectKey];if(state2.replacer&&(objectValue=state2.replacer.call(object,objectKey,objectValue)),!writeNode(state2,level+1,objectKey,!0,!0,!0))continue;let explicitPair=state2.tag!==null&&state2.tag!=="?"||state2.dump&&state2.dump.length>1024;explicitPair&&(state2.dump&&CHAR_LINE_FEED===state2.dump.charCodeAt(0)?pairBuffer+="?":pairBuffer+="? "),pairBuffer+=state2.dump,explicitPair&&(pairBuffer+=generateNextLine(state2,level)),writeNode(state2,level+1,objectValue,!0,explicitPair)&&(state2.dump&&CHAR_LINE_FEED===state2.dump.charCodeAt(0)?pairBuffer+=":":pairBuffer+=": ",pairBuffer+=state2.dump,_result+=pairBuffer)}state2.tag=_tag,state2.dump=_result||"{}"}function detectType(state2,object,explicit){let typeList=explicit?state2.explicitTypes:state2.implicitTypes;for(let index2=0,length=typeList.length;index2<length;index2+=1){let type2=typeList[index2];if((type2.instanceOf||type2.predicate)&&(!type2.instanceOf||typeof object=="object"&&object instanceof type2.instanceOf)&&(!type2.predicate||type2.predicate(object))){if(explicit?type2.multi&&type2.representName?state2.tag=type2.representName(object):state2.tag=type2.tag:state2.tag="?",type2.represent){let style=state2.styleMap[type2.tag]||type2.defaultStyle,_result;if(_toString.call(type2.represent)==="[object Function]")_result=type2.represent(object,style);else if(_hasOwnProperty.call(type2.represent,style))_result=type2.represent[style](object,style);else throw new YAMLException22("!<"+type2.tag+'> tag resolver accepts not "'+style+'" style');state2.dump=_result}return!0}}return!1}function writeNode(state2,level,object,block,compact,iskey,isblockseq){state2.tag=null,state2.dump=object,detectType(state2,object,!1)||detectType(state2,object,!0);let type2=_toString.call(state2.dump),inblock=block;block&&(block=state2.flowLevel<0||state2.flowLevel>level);let objectOrArray=type2==="[object Object]"||type2==="[object Array]",duplicateIndex,duplicate;if(objectOrArray&&(duplicateIndex=state2.duplicates.indexOf(object),duplicate=duplicateIndex!==-1),(state2.tag!==null&&state2.tag!=="?"||duplicate||state2.indent!==2&&level>0)&&(compact=!1),duplicate&&state2.usedDuplicates[duplicateIndex])state2.dump="*ref_"+duplicateIndex;else{if(objectOrArray&&duplicate&&!state2.usedDuplicates[duplicateIndex]&&(state2.usedDuplicates[duplicateIndex]=!0),type2==="[object Object]")block&&Object.keys(state2.dump).length!==0?(writeBlockMapping(state2,level,state2.dump,compact),duplicate&&(state2.dump="&ref_"+duplicateIndex+state2.dump)):(writeFlowMapping(state2,level,state2.dump),duplicate&&(state2.dump="&ref_"+duplicateIndex+" "+state2.dump));else if(type2==="[object Array]")block&&state2.dump.length!==0?(state2.noArrayIndent&&!isblockseq&&level>0?writeBlockSequence(state2,level-1,state2.dump,compact):writeBlockSequence(state2,level,state2.dump,compact),duplicate&&(state2.dump="&ref_"+duplicateIndex+state2.dump)):(writeFlowSequence(state2,level,state2.dump),duplicate&&(state2.dump="&ref_"+duplicateIndex+" "+state2.dump));else if(type2==="[object String]")state2.tag!=="?"&&writeScalar2(state2,state2.dump,level,iskey,inblock);else{if(type2==="[object Undefined]")return!1;if(state2.skipInvalid)return!1;throw new YAMLException22("unacceptable kind of an object to dump "+type2)}if(state2.tag!==null&&state2.tag!=="?"){let tagStr=encodeURI(state2.tag[0]==="!"?state2.tag.slice(1):state2.tag).replace(/!/g,"%21");state2.tag[0]==="!"?tagStr="!"+tagStr:tagStr.slice(0,18)==="tag:yaml.org,2002:"?tagStr="!!"+tagStr.slice(18):tagStr="!<"+tagStr+">",state2.dump=tagStr+" "+state2.dump}}return!0}function getDuplicateReferences(object,state2){let objects=[],duplicatesIndexes=[];inspectNode(object,objects,duplicatesIndexes);let length=duplicatesIndexes.length;for(let index2=0;index2<length;index2+=1)state2.duplicates.push(objects[duplicatesIndexes[index2]]);state2.usedDuplicates=new Array(length)}function inspectNode(object,objects,duplicatesIndexes){if(object!==null&&typeof object=="object"){let index2=objects.indexOf(object);if(index2!==-1)duplicatesIndexes.indexOf(index2)===-1&&duplicatesIndexes.push(index2);else if(objects.push(object),Array.isArray(object))for(let i6=0,length=object.length;i6<length;i6+=1)inspectNode(object[i6],objects,duplicatesIndexes);else{let objectKeyList=Object.keys(object);for(let i6=0,length=objectKeyList.length;i6<length;i6+=1)inspectNode(object[objectKeyList[i6]],objects,duplicatesIndexes)}}}function dump22(input,options){options=options||{};let state2=new State(options);state2.noRefs||getDuplicateReferences(input,state2);let value=input;return state2.replacer&&(value=state2.replacer.call({"":value},"",value)),writeNode(state2,0,value,!0,!0)?state2.dump+`
 `:""}return dumper.dump=dump22,dumper}var hasRequiredJsYaml;function requireJsYaml(){if(hasRequiredJsYaml)return jsYaml;hasRequiredJsYaml=1;let loader2=requireLoader(),dumper2=requireDumper();function renamed(from3,to){return function(){throw new Error("Function yaml."+from3+" is removed in js-yaml 4. Use yaml."+to+" instead, which is now safe by default.")}}return jsYaml.Type=requireType(),jsYaml.Schema=requireSchema(),jsYaml.FAILSAFE_SCHEMA=requireFailsafe(),jsYaml.JSON_SCHEMA=requireJson(),jsYaml.CORE_SCHEMA=requireCore(),jsYaml.DEFAULT_SCHEMA=require_default(),jsYaml.load=loader2.load,jsYaml.loadAll=loader2.loadAll,jsYaml.dump=dumper2.dump,jsYaml.YAMLException=requireException(),jsYaml.types={binary:requireBinary(),float:requireFloat(),map:requireMap(),null:require_null2(),pairs:requirePairs(),set:requireSet(),timestamp:requireTimestamp(),bool:requireBool(),int:requireInt(),merge:requireMerge(),omap:requireOmap(),seq:requireSeq(),str:requireStr()},jsYaml.safeLoad=renamed("safeLoad","load"),jsYaml.safeLoadAll=renamed("safeLoadAll","loadAll"),jsYaml.safeDump=renamed("safeDump","dump"),jsYaml}var jsYamlExports=requireJsYaml(),yaml=getDefaultExportFromCjs(jsYamlExports),{Type,Schema:Schema2,FAILSAFE_SCHEMA,JSON_SCHEMA,CORE_SCHEMA,DEFAULT_SCHEMA,load,loadAll,dump,YAMLException,types,safeLoad,safeLoadAll,safeDump}=yaml;var OverlayParseError=class extends Error{path;constructor(path14,reason){super(`overlay document '${path14}': ${reason}`),this.path=path14,this.name="OverlayParseError"}};function parseOverlayDocument(path14,bytes,expectation){let text=new TextDecoder("utf-8",{fatal:!1}).decode(bytes);if(text.trim()==="")throw new OverlayParseError(path14,"the document is empty");let value;try{value=load(text)}catch(error2){throw new OverlayParseError(path14,`invalid YAML: ${error2 instanceof Error?error2.message:String(error2)}`)}if(value===null||typeof value!="object"||Array.isArray(value))throw new OverlayParseError(path14,"expected a mapping document with apiVersion, kind, metadata, and spec");let kind=value.kind;if(kind!==expectation.yamlKind)throw new OverlayParseError(path14,kind===void 0||kind===""?`missing the required 'kind' field (expected kind: ${expectation.yamlKind})`:`kind '${String(kind)}' is not the ${expectation.yamlKind} this location holds`);let message6;try{message6=fromJson(expectation.schema,value,{ignoreUnknownFields:!1})}catch(error2){throw new OverlayParseError(path14,`invalid ${expectation.yamlKind}: ${error2 instanceof Error?error2.message:String(error2)}`)}let metadata=metadataOf(message6);if(metadata!==void 0&&metadata.org!==""&&metadata.org!==expectation.org)throw new OverlayParseError(path14,`metadata.org '${metadata.org}' is not the organization the plugin is installed into ('${expectation.org}')`);return message6}function parseOverlays(overlay,org){return{...overlay.agent!==void 0&&{agent:{path:overlay.agent.path,resource:parseOverlayDocument(overlay.agent.path,overlay.agent.bytes,{schema:AgentSchema,yamlKind:"Agent",org})}},workflows:overlay.workflows.map(document2=>({path:document2.path,name:document2.name,resource:parseOverlayDocument(document2.path,document2.bytes,{schema:WorkflowSchema,yamlKind:"Workflow",org})})),mcpServers:overlay.mcpServers.map(document2=>({path:document2.path,server:document2.server,resource:parseOverlayDocument(document2.path,document2.bytes,{schema:McpServerSchema,yamlKind:"McpServer",org})}))}}async function sanitizeOverlays(overlays,subject,authorizer,caller){let reservedKeys=new Map,judge=(path14,metadata,expectedName)=>{if(metadata===void 0)return;if(metadata.id!=="")throw invalidArgumentError(`overlay document '${path14}' sets metadata.id; a plugin's resources take their ids from the server`);if(metadata.name!==""&&metadata.name!==expectedName)throw invalidArgumentError(`overlay document '${path14}' names '${metadata.name}' but describes '${expectedName}'; leave metadata.name empty or make them agree`);if(metadata.slug!==""&&metadata.slug!==generateSlug(expectedName))throw invalidArgumentError(`overlay document '${path14}' sets slug '${metadata.slug}' but describes '${expectedName}'; leave metadata.slug empty or make them agree`);let reserved=Object.keys(metadata.labels).filter(key=>key.startsWith(RESERVED_LABEL_PREFIX2)).sort();reserved.length>0&&reservedKeys.set(path14,reserved)};overlays.agent!==void 0&&judge(overlays.agent.path,overlays.agent.resource.metadata,subject.pluginName);for(let document2 of overlays.mcpServers)judge(document2.path,document2.resource.metadata,document2.server);for(let document2 of overlays.workflows)judge(document2.path,document2.resource.metadata,document2.name);if(reservedKeys.size===0)return;let decision;try{decision=await authorizer.authorize(caller,{permission:IamPermission.can_write_reserved_labels,resourceKind:ApiResourceKind.platform,resourceId:"stigmer"})}catch(error2){throw internalError(error2 instanceof Error?error2:new Error(String(error2)),"reserved-label validation could not be completed")}switch(decision.kind){case"allow":return;case"deny":case"not-found":{let listed=[...reservedKeys.entries()].map(([path14,keys])=>`${path14}: ${keys.join(", ")}`).join("; ");throw new ConnectError(`Labels in the reserved '${RESERVED_LABEL_PREFIX2}' namespace are platform-managed and cannot be set by a plugin (${listed}). Remove them from the plugin's ai.stigmer/ documents.`,Code.InvalidArgument)}case"unavailable":throw internalError(decision.cause,"reserved-label validation could not be completed");default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),"reserved-label validation could not be completed")}}}var pluginSearchExtractor={kind:ApiResourceKind.plugin,schema:PluginSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let plugin2=resource;return buildSearchResult({kind:ApiResourceKind.plugin,metadata:plugin2.metadata,summary:plugin2.spec?.description??"",score,createdAt:plugin2.status?.audit?.specAudit?.createdAt,updatedAt:plugin2.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let plugin2=resource,metadata=plugin2.metadata;if(metadata!==void 0)return{name:metadata.name,description:plugin2.spec?.description??"",tags:[...metadata.tags,...plugin2.spec?.keywords??[]].join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(plugin2.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var PLUGIN_KEY="plugin",PLUGIN_ARCHIVE_KEY="pluginArchive",PLUGIN_PACKAGE_KEY="pluginPackage",PLUGIN_LIBRARY_WARNINGS_KEY="pluginLibraryWarnings",EXISTING_PLUGIN_KEY="existingPlugin",SHOULD_CREATE_PLUGIN_KEY="shouldCreatePlugin",PLUGIN_OVERLAYS_KEY="pluginOverlays",PLUGIN_PLAN_KEY="pluginPlan",EXISTING_MEMBERS_KEY="pluginExistingMembers",PLUGIN_CONVERGED_KEY="pluginConverged",ARTIFACT_STORAGE_KEY_KEY="artifactStorageKey";function newGateAndHashArchiveStep(){return{name:"GateAndHashArchive",execute(ctx){let bytes=ctx.get(ARTIFACT_BYTES_KEY),archive;try{archive=openPluginArchive(bytes)}catch(error2){throw invalidArgumentError(`failed to read plugin archive: ${error2 instanceof Error?error2.message:String(error2)}`)}ctx.set(PLUGIN_ARCHIVE_KEY,archive)}}}function newReadPluginPackageStep(){return{name:"ReadPluginPackage",execute(ctx){let archive=ctx.get(PLUGIN_ARCHIVE_KEY),outcome;try{outcome=readPluginPackage(archive.files)}catch(error2){throw invalidArgumentError(`failed to read plugin archive: ${error2 instanceof Error?error2.message:String(error2)}`)}if(!outcome.ok){let count=outcome.errors.length;throw invalidArgumentError(`plugin cannot be installed, ${count} problem${count===1?"":"s"} found:
 `+outcome.errors.map(finding=>`  - ${finding.message}`).join(`
-`))}ctx.set(PLUGIN_PACKAGE_KEY,outcome.plugin),ctx.set(PLUGIN_LIBRARY_WARNINGS_KEY,outcome.warnings)}}}function newBuildInitialPluginStep(){return{name:"BuildInitialPlugin",execute(ctx){let pkg=ctx.get(PLUGIN_PACKAGE_KEY),slug=generateSlug(pkg.name);if(slug==="")throw invalidArgumentError(`invalid plugin name: ${pkg.name}`);let plugin2=create2(PluginSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Plugin",metadata:create2(ApiResourceMetadataSchema,{org:ctx.input.org,name:pkg.name,slug}),spec:create2(PluginSpecSchema,{}),status:create2(PluginStatusSchema,{})});ctx.set(PLUGIN_KEY,plugin2)}}}function newFindExistingPluginBySlugStep(store){return{name:"FindExistingBySlug",async execute(ctx){let plugin2=ctx.get(PLUGIN_KEY),existing;try{existing=await findResourceBySlug(store,ctx.apiResourceKind,PluginSchema,plugin2.metadata.slug,plugin2.metadata.org)}catch(error2){throw internalError(error2,"failed to search for existing plugin")}existing!==void 0?(plugin2.metadata.id=existing.metadata.id,ctx.set(EXISTING_PLUGIN_KEY,existing),ctx.set(SHOULD_CREATE_PLUGIN_KEY,!1)):(ctx.set(EXISTING_PLUGIN_KEY,void 0),ctx.set(SHOULD_CREATE_PLUGIN_KEY,!0))}}}function newGeneratePluginIdIfNeededStep(){return{name:"GenerateIDIfNeeded",execute(ctx){let plugin2=ctx.get(PLUGIN_KEY);ctx.get(SHOULD_CREATE_PLUGIN_KEY)&&(plugin2.metadata.id=generateId(getIdPrefix(ctx.apiResourceKind)))}}}function newParseOverlayDocumentsStep(){return{name:"ParseOverlayDocuments",execute(ctx){let pkg=ctx.get(PLUGIN_PACKAGE_KEY);try{ctx.set(PLUGIN_OVERLAYS_KEY,parseOverlays(pkg.overlay,ctx.input.org))}catch(error2){throw error2 instanceof OverlayParseError?invalidArgumentError(error2.message):error2}}}}function newSanitizePluginMetadataStep(authorizer){return{name:"SanitizePluginMetadata",async execute(ctx){let pkg=ctx.get(PLUGIN_PACKAGE_KEY),overlays=ctx.get(PLUGIN_OVERLAYS_KEY);await sanitizeOverlays(overlays,{pluginName:pkg.name},authorizer,ctx.callerIdentity)}}}var MEMBER_CREATE_PERMISSIONS=new Map([[ApiResourceKind.skill,IamPermission.can_create_skill],[ApiResourceKind.agent,IamPermission.can_create_agent],[ApiResourceKind.workflow,IamPermission.can_create_workflow]]);function identityOf(plugin2,digest3,visibility){return{org:plugin2.metadata.org,id:plugin2.metadata.id,slug:plugin2.metadata.slug,name:plugin2.metadata.name,digest:digest3,visibility}}function requestedVisibility(ctx){return ctx.input.visibility===ApiResourceVisibility.api_resource_visibility_unspecified?defaultVisibilityFor(ctx.apiResourceKind):ctx.input.visibility}function newPlanMaterializationStep(store,authorizer){return{name:"PlanMaterialization",async execute(ctx){let plugin2=ctx.get(PLUGIN_KEY),pkg=ctx.get(PLUGIN_PACKAGE_KEY),archive=ctx.get(PLUGIN_ARCHIVE_KEY),overlays=ctx.get(PLUGIN_OVERLAYS_KEY),identity2=identityOf(plugin2,archive.digest,requestedVisibility(ctx)),plan2;try{plan2=planMaterialization(pkg,archive.files,overlays,identity2,ctx.input.message)}catch(error2){throw error2 instanceof McpServerOverlayError?invalidArgumentError(error2.message):error2}for(let member2 of plan2.members){let holder;try{holder=await slugHolder(store,member2,identity2.org)}catch(error2){throw internalError(error2,"failed to check a member slug")}if(!holder.held||holder.byPlugin===identity2.id)continue;let noun=memberNoun(member2.kind);throw holder.byPlugin===void 0?alreadyExistsError(noun,`'${member2.slug}' exists in org '${identity2.org}' and is not managed by a plugin; rename or delete it first`):alreadyExistsError(noun,`'${member2.slug}' is held by plugin '${await pluginSlugOf(store,holder.byPlugin)}'`)}let missing=[];for(let kind of new Set(plan2.members.map(member2=>member2.kind))){let permission=MEMBER_CREATE_PERMISSIONS.get(kind);if(permission===void 0)continue;let decision;try{decision=await authorizer.authorize(ctx.callerIdentity,{permission,resourceKind:ApiResourceKind.organization,resourceId:identity2.org})}catch(error2){throw internalError(error2,"plugin install authorization could not be completed")}switch(decision.kind){case"allow":break;case"deny":case"not-found":missing.push(IamPermission[permission]??String(permission));break;case"unavailable":throw internalError(decision.cause,"plugin install authorization could not be completed");default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),"plugin install authorization could not be completed")}}}if(missing.length>0)throw new ConnectError(`installing plugin '${identity2.slug}' needs ${missing.join(", ")} in organization '${identity2.org}'`,Code.PermissionDenied);let members;try{members=await findMembers(store,identity2.id,identity2.org)}catch(error2){throw internalError(error2,"failed to list plugin members")}ctx.set(PLUGIN_PLAN_KEY,plan2),ctx.set(EXISTING_MEMBERS_KEY,members)}}}function newGuardPluginVisibilityStep(authorizer){return{name:"GuardPluginVisibility",async execute(ctx){let level=requestedVisibility(ctx),plan2=ctx.get(PLUGIN_PLAN_KEY);rejectUnsupportedVisibility(ctx.apiResourceKind,level);for(let kind of new Set(plan2.members.map(member2=>member2.kind)))rejectUnsupportedVisibility(kind,level);level===ApiResourceVisibility.visibility_public&&ctx.callerIdentity.callerClass!=="internal"&&await requireOperatorMaySetPublic(authorizer,ctx.callerIdentity)}}}function newResolveConvergenceStep(){return{name:"ResolveConvergence",execute(ctx){let existing=ctx.get(EXISTING_PLUGIN_KEY),archive=ctx.get(PLUGIN_ARCHIVE_KEY),plan2=ctx.get(PLUGIN_PLAN_KEY),members=ctx.get(EXISTING_MEMBERS_KEY),converged=existing!==void 0&&existing.status?.digest===archive.digest&&existing.status.state===PluginState.READY&&(existing.metadata?.visibility??ApiResourceVisibility.api_resource_visibility_unspecified)===requestedVisibility(ctx)&&membersConverge(members,plan2.members,archive.digest);ctx.set(PLUGIN_CONVERGED_KEY,converged)}}}function newCheckAndStoreArtifactStep(artifactStorage){return{name:"CheckAndStoreArtifact",async execute(ctx){let bytes=ctx.get(ARTIFACT_BYTES_KEY),archive=ctx.get(PLUGIN_ARCHIVE_KEY),exists;try{exists=await artifactStorage.exists(archive.digest)}catch(error2){throw internalError(error2,"failed to check artifact existence")}let storageKey;if(exists)storageKey=artifactStorage.getStorageKey(archive.digest);else try{storageKey=await artifactStorage.store(archive.digest,bytes)}catch(error2){throw internalError(error2,"failed to store artifact")}ctx.set(ARTIFACT_STORAGE_KEY_KEY,storageKey)}}}function newPopulatePluginFieldsStep(){return{name:"PopulatePluginFields",execute(ctx){let plugin2=ctx.get(PLUGIN_KEY),pkg=ctx.get(PLUGIN_PACKAGE_KEY),archive=ctx.get(PLUGIN_ARCHIVE_KEY),storageKey=ctx.get(ARTIFACT_STORAGE_KEY_KEY),shouldCreate=ctx.get(SHOULD_CREATE_PLUGIN_KEY),existing=ctx.get(EXISTING_PLUGIN_KEY);plugin2.spec=create2(PluginSpecSchema,{name:pkg.name,version:pkg.version??"",description:pkg.description??"",homepage:pkg.homepage??"",repository:pkg.repository??"",license:pkg.license??"",keywords:[...pkg.keywords],dialect:dialectOf(pkg.dialect)}),pkg.author!==void 0&&(plugin2.spec.author=create2(PluginAuthorSchema,{name:pkg.author.name??"",email:pkg.author.email??"",url:pkg.author.url??""})),plugin2.metadata.visibility=requestedVisibility(ctx),plugin2.metadata.version=create2(ApiResourceMetadataVersionSchema,{id:archive.digest,message:ctx.input.message,previousVersionId:existing?.status?.digest??""});let status=plugin2.status;status.digest=archive.digest,status.artifactStorageKey=storageKey,status.state=PluginState.INSTALLING,status.error="",shouldCreate?setAuditFieldsForCreate(PluginSchema,plugin2,ctx.callerIdentity):(existing?.status?.audit!==void 0&&(status.audit??=create2(ApiResourceAuditSchema,{}),status.audit.specAudit=existing.status.audit.specAudit,status.audit.statusAudit=existing.status.audit.statusAudit),setAuditFieldsForUpdate(PluginSchema,plugin2,"spec_audit",ctx.callerIdentity))}}}function newArchiveCurrentPluginStep(store,logger2){return newArchiveCurrentVersionStep(store,logger2,{stepName:"ArchiveCurrentPlugin",resourceKey:PLUGIN_KEY,schema:PluginSchema,noun:"plugin",headHashOf:plugin2=>plugin2.status?.digest??"",clearHeadHash:plugin2=>{plugin2.status.digest="",plugin2.metadata?.version!==void 0&&(plugin2.metadata.version.id="")},liveTagOf:pluginLiveTag,clearLiveTag:()=>{}})}function pluginLiveTag(plugin2){let version=plugin2.spec?.version??"";return VERSION_TAG_PATTERN.test(version)?version:""}function newStorePluginStep(store,stepName){return{name:stepName,async execute(ctx){let plugin2=ctx.get(PLUGIN_KEY);try{await store.saveResource(ctx.apiResourceKind,plugin2.metadata.id,PluginSchema,plugin2)}catch(error2){throw internalError(error2,"failed to save plugin")}}}}function newMaterializeMembersStep(store,materializerProvider,logger2){return{name:"MaterializeMembers",async execute(ctx){let plugin2=ctx.get(PLUGIN_KEY),plan2=ctx.get(PLUGIN_PLAN_KEY),materializer=materializerProvider(),caller=ctx.callerIdentity,level=requestedVisibility(ctx),reconcileLevel=async(kind,applied)=>{let metadata=applied.metadata;metadata!==void 0&&metadata.visibility!==level&&await materializer.updateVisibility(kind,metadata.id,level,caller)},materialize=async(kind,slug,write2)=>{try{return await write2()}catch(error2){throw await recordFailure(store,ctx,plugin2,kind,slug,error2)}};for(let skill of plan2.skills){let pushed=await materialize(ApiResourceKind.skill,skill.slug,()=>materializer.pushSkill(skill.request,caller));await materialize(ApiResourceKind.skill,skill.slug,()=>reconcileLevel(ApiResourceKind.skill,pushed))}for(let server of plan2.mcpServers){let applied=await materialize(ApiResourceKind.mcp_server,server.slug,()=>materializer.applyMcpServer(server.resource,caller));await materialize(ApiResourceKind.mcp_server,server.slug,()=>reconcileLevel(ApiResourceKind.mcp_server,applied))}if(plan2.agent!==void 0){let agent=plan2.agent,applied=await materialize(ApiResourceKind.agent,agent.slug,()=>materializer.applyAgent(agent.resource,caller));await materialize(ApiResourceKind.agent,agent.slug,()=>reconcileLevel(ApiResourceKind.agent,applied))}for(let workflow of plan2.workflows){let applied=await materialize(ApiResourceKind.workflow,workflow.slug,()=>materializer.applyWorkflow(workflow.resource,caller));await materialize(ApiResourceKind.workflow,workflow.slug,()=>reconcileLevel(ApiResourceKind.workflow,applied))}logger2.info("Materialized plugin members",{pluginId:plugin2.metadata.id,skills:plan2.skills.length,mcpServers:plan2.mcpServers.length,agents:plan2.agent===void 0?0:1,workflows:plan2.workflows.length})}}}function newRemoveDroppedMembersStep(store,materializerProvider,logger2){return{name:"RemoveDroppedMembers",async execute(ctx){let plugin2=ctx.get(PLUGIN_KEY),plan2=ctx.get(PLUGIN_PLAN_KEY),existing=ctx.get(EXISTING_MEMBERS_KEY),dropped=droppedMembers(existing,plan2.members);if(dropped.length===0)return;let materializer=materializerProvider();for(let member2 of orderForDeletion(dropped))try{await materializer.deleteByKind(member2.kind,member2.id,ctx.callerIdentity)}catch(error2){throw await recordFailure(store,ctx,plugin2,member2.kind,member2.slug,error2,"remove")}logger2.info("Removed members the new archive dropped",{pluginId:plugin2.metadata.id,dropped:dropped.map(member2=>`${ApiResourceKind[member2.kind]}:${member2.slug}`)})}}}function orderForDeletion(members){let rank=new Map([[ApiResourceKind.agent,0],[ApiResourceKind.workflow,1],[ApiResourceKind.mcp_server,2],[ApiResourceKind.skill,3]]);return[...members].sort((a5,b7)=>(rank.get(a5.kind)??9)-(rank.get(b7.kind)??9))}function newFinalizePluginStatusStep(){return{name:"FinalizePluginStatus",execute(ctx){let plugin2=ctx.get(PLUGIN_KEY),plan2=ctx.get(PLUGIN_PLAN_KEY),libraryWarnings=ctx.get(PLUGIN_LIBRARY_WARNINGS_KEY),status=plugin2.status;status.state=PluginState.READY,status.error="",status.materialized=create2(PluginMaterializationSchema,{skills:plan2.skills.length,mcpServers:plan2.mcpServers.length,agents:plan2.agent===void 0?0:1,workflows:plan2.workflows.length}),status.warnings=[...libraryWarnings.map(finding=>create2(PluginWarningSchema,{kind:finding.kind,message:finding.message,path:finding.path??""})),...plan2.warnings]}}}function newPluginPushAuthorizationTuplesStep(lifecycle,logger2){return{name:"PluginPushAuthorizationTuples",async execute(ctx){if(lifecycle===void 0)return;let plugin2=ctx.get(PLUGIN_KEY);if(ctx.get(SHOULD_CREATE_PLUGIN_KEY)){let event=resolveResourceCreatedEvent(ctx.apiResourceKind,plugin2,ctx.callerIdentity,logger2);if(event===void 0)return;try{await lifecycle.onResourceCreated(event)}catch(error2){throw internalError(error2,"failed to create authorization tuples")}return}let oldLevel=ctx.get(EXISTING_PLUGIN_KEY)?.metadata?.visibility??ApiResourceVisibility.api_resource_visibility_unspecified,newLevel=plugin2.metadata?.visibility??ApiResourceVisibility.api_resource_visibility_unspecified,{shapesToCreate,shapesToDelete}=diffVisibilityShapes(ctx.apiResourceKind,oldLevel,newLevel);if(!(shapesToCreate.length===0&&shapesToDelete.length===0))try{await lifecycle.onVisibilityChanged({kind:ctx.apiResourceKind,resourceId:plugin2.metadata?.id??"",orgId:plugin2.metadata?.org??"",shapesToCreate,shapesToDelete})}catch(error2){throw internalError(error2,"failed to update visibility tuples")}}}}function newIndexPluginSearchStep(store,logger2){return{name:"IndexPluginSearch",async execute(ctx){let plugin2=ctx.get(PLUGIN_KEY),entry=pluginSearchExtractor.getSearchIndexEntry(plugin2);if(entry!==void 0)try{await store.upsertSearchIndex(ctx.apiResourceKind,plugin2.metadata.id,entry)}catch(error2){logger2.warn("IndexPluginSearch: failed to update search index (best-effort)",{id:plugin2.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}var MEMBER_NOUNS=new Map([[ApiResourceKind.skill,"skill"],[ApiResourceKind.mcp_server,"MCP server"],[ApiResourceKind.agent,"agent"],[ApiResourceKind.workflow,"workflow"]]);function memberNoun(kind){return MEMBER_NOUNS.get(kind)??ApiResourceKind[kind]??String(kind)}async function pluginSlugOf(store,pluginId){try{return(await store.getResource(ApiResourceKind.plugin,pluginId,PluginSchema)).metadata?.slug??pluginId}catch(error2){if(error2 instanceof ResourceNotFoundError)return pluginId;throw internalError(error2,"failed to load the holding plugin")}}async function recordFailure(store,ctx,plugin2,kind,slug,error2,verb="materialize"){let cause=error2 instanceof ConnectError?error2.rawMessage:error2 instanceof Error?error2.message:String(error2),sentence=`failed to ${verb} ${memberNoun(kind)} '${slug}' from plugin '${plugin2.metadata?.slug??""}': ${cause}`,status=plugin2.status;status.state=PluginState.FAILED,status.error=sentence;try{await store.saveResource(ctx.apiResourceKind,plugin2.metadata.id,PluginSchema,plugin2)}catch{}return error2 instanceof ConnectError?new ConnectError(sentence,error2.code,void 0,void 0,error2):internalError(error2,sentence)}function dialectOf(dialect){switch(dialect){case"agent-plugins":return PluginDialect.AGENT_PLUGINS;case"claude":return PluginDialect.CLAUDE;case"cursor":return PluginDialect.CURSOR;case"codex":return PluginDialect.CODEX;default:{let exhaustive=dialect;throw new Error(`unknown dialect ${String(exhaustive)}`)}}}function registerPluginServices(router,deps){router.service(PluginCommandController,{push:(req,ctx)=>push(deps,req,ctx),createArtifactUploadUrl:(req,ctx)=>createArtifactUploadUrl(deps,req,ctx),updateVisibility:(input,ctx)=>updateVisibility5(deps,input,ctx),delete:(id,ctx)=>deletePlugin(deps,id,ctx)}),router.service(PluginQueryController,{get:(id,ctx)=>get21(deps,id,ctx),getByReference:(ref,ctx)=>getByReference12(deps,ref,ctx),listMembers:(id,ctx)=>listMembers(deps,id,ctx),listVersions:(req,ctx)=>listVersions(deps,req,ctx)})}function kindOf20(ctx){return ctx.values.get(apiResourceKindKey)}async function push(deps,req,ctx){let reqCtx=new RequestContext(PushPluginRequestSchema,req,callerIdentityOf(ctx),kindOf20(ctx));return await newPipeline("plugin-push-plan",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.push,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveArtifactSourceStep(deps.transferLane?.slots,{source:input=>({artifact:input.artifact,artifactUploadRef:input.artifactUploadRef}),laneNotConfigured:TRANSFER_LANE_NOT_CONFIGURED2})).addStep(newGateAndHashArchiveStep()).addStep(newReadPluginPackageStep()).addStep(newBuildInitialPluginStep()).addStep(newFindExistingPluginBySlugStep(deps.store)).addStep(newGeneratePluginIdIfNeededStep()).addStep(newParseOverlayDocumentsStep()).addStep(newSanitizePluginMetadataStep(deps.authorizer)).addStep(newPlanMaterializationStep(deps.store,deps.authorizer)).addStep(newGuardPluginVisibilityStep(deps.authorizer)).addStep(newResolveConvergenceStep()).build().execute(reqCtx),reqCtx.get(PLUGIN_CONVERGED_KEY)===!0?reqCtx.get(EXISTING_PLUGIN_KEY):(await newPipeline("plugin-push-install",deps.logger).addStep(newCheckAndStoreArtifactStep(deps.artifactStorage)).addStep(newPopulatePluginFieldsStep()).addStep(newArchiveCurrentPluginStep(deps.store,deps.logger)).addStep(newStorePluginStep(deps.store,"StorePlugin")).addStep(newMaterializeMembersStep(deps.store,deps.materializerProvider,deps.logger)).addStep(newRemoveDroppedMembersStep(deps.store,deps.materializerProvider,deps.logger)).addStep(newFinalizePluginStatusStep()).addStep(newStorePluginStep(deps.store,"StorePluginReady")).addStep(newPluginPushAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexPluginSearchStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(PLUGIN_KEY))}async function createArtifactUploadUrl(deps,req,ctx){let lane=deps.transferLane;if(lane===void 0)throw failedPreconditionError(TRANSFER_LANE_NOT_CONFIGURED2);let reqCtx=new RequestContext(PluginCommandController.method.createArtifactUploadUrl.input,req,callerIdentityOf(ctx),kindOf20(ctx));if(await newPipeline("plugin-create-artifact-upload-url",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.createArtifactUploadUrl,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx),req.sizeBytes>BigInt(104857600))throw invalidArgumentError(`plugin archive size ${req.sizeBytes} bytes exceeds the ${104857600}-byte (100MB) archive limit`);let minted;try{minted=lane.slots.mint(Number(req.sizeBytes))}catch(error2){throw internalError(error2,"failed to mint upload reference")}return create2(PluginArtifactUploadUrlSchema,{url:uploadUrl(lane.baseUrl,minted.ref),artifactUploadRef:minted.ref,ttlSeconds:Math.trunc(minted.ttlMs/1e3)})}var UPDATE_VISIBILITY_PLUGIN_KEY="updateVisibilityPlugin";async function updateVisibility5(deps,input,ctx){let reqCtx=new RequestContext(PluginCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf20(ctx));return await newPipeline("plugin-update-visibility",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadPluginByIdStep(deps.store,UPDATE_VISIBILITY_PLUGIN_KEY)).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_PLUGIN_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newAuthorizeVisibilityTransitionStep(UPDATE_VISIBILITY_PLUGIN_KEY,deps.authorizer)).addStep(newSetPluginVisibilityStep()).addStep(newPersistPluginStep(deps.store,UPDATE_VISIBILITY_PLUGIN_KEY,"PersistPluginForVisibilityUpdate")).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_PLUGIN_KEY)).addStep(newFanOutVisibilityToMembersStep(deps.store,deps.materializerProvider)).addStep(newIndexPluginStep(deps.store,deps.logger,UPDATE_VISIBILITY_PLUGIN_KEY,"IndexPluginAfterVisibilityUpdate")).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_PLUGIN_KEY)}function newLoadPluginByIdStep(store,key){return{name:"LoadPluginForVisibilityUpdate",async execute(ctx){let plugin2;try{plugin2=await store.getResource(ctx.apiResourceKind,ctx.input.resourceId,PluginSchema)}catch{throw notFoundError("plugin",ctx.input.resourceId)}ctx.set(key,plugin2)}}}function newSetPluginVisibilityStep(){return{name:"SetPluginVisibility",execute(ctx){let plugin2=ctx.get(UPDATE_VISIBILITY_PLUGIN_KEY);plugin2.metadata!==void 0&&(plugin2.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(PluginSchema,plugin2,"status_audit",ctx.callerIdentity)}}}function newFanOutVisibilityToMembersStep(store,materializerProvider){return{name:"FanOutVisibilityToMembers",async execute(ctx){let plugin2=ctx.get(UPDATE_VISIBILITY_PLUGIN_KEY),members=await membersOf(store,plugin2),materializer=materializerProvider();for(let member2 of members)await materializer.updateVisibility(member2.kind,member2.id,ctx.input.visibility,ctx.callerIdentity)}}}var DELETE_MEMBERS_KEY="deletePluginMembers";async function deletePlugin(deps,id,ctx){let reqCtx=new RequestContext(PluginCommandController.method.delete.input,id,callerIdentityOf(ctx),kindOf20(ctx));await newPipeline("plugin-delete",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,PluginSchema)).addStep(newGuardMembersUnreferencedStep(deps.store)).addStep(newCascadeDeleteMembersStep(deps.materializerProvider,deps.logger)).addStep(newDeleteVersionArchivesStep(deps.store,deps.logger,{stepName:"DeletePluginArchives",noun:"plugin"})).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted plugin not found in context"),"deleted plugin not found in context");return deleted}function newGuardMembersUnreferencedStep(store){return{name:"GuardMembersUnreferenced",async execute(ctx){let plugin2=ctx.get(EXISTING_RESOURCE_KEY),members=await membersOf(store,plugin2);if(ctx.set(DELETE_MEMBERS_KEY,members),members.length===0)return;let org=plugin2.metadata?.org??"",memberKeys=new Set(members.map(member2=>`${member2.kind}:${member2.slug}`)),memberIds=new Set(members.map(member2=>member2.id)),referrers=[];for(let{kind,schema:schema2,noun}of[{kind:ApiResourceKind.agent,schema:AgentSchema,noun:"agent"},{kind:ApiResourceKind.workflow,schema:WorkflowSchema,noun:"workflow"}]){let rows;try{rows=await store.listResources(kind)}catch(error2){throw internalError(error2,`failed to list ${noun}s for the plugin reference check`)}for(let raw of rows){let resource=fromBinary2(schema2,raw),metadata=metadataOf(resource);if(metadata===void 0||metadata.org!==org||memberIds.has(metadata.id))continue;collectSpecReferences(schema2,resource).some(ref=>(ref.org===""||ref.org===org)&&memberKeys.has(`${ref.kind}:${ref.slug}`))&&referrers.push(`${noun} '${metadata.slug}'`)}}if(referrers.length>0)throw failedPreconditionError(`plugin '${plugin2.metadata?.slug??""}' is still used by ${referrers.sort().join(", ")}; detach them from the plugin's skills and servers first`)}}}function newCascadeDeleteMembersStep(materializerProvider,logger2){return{name:"CascadeDeleteMembers",async execute(ctx){let plugin2=ctx.get(EXISTING_RESOURCE_KEY),members=ctx.get(DELETE_MEMBERS_KEY),materializer=materializerProvider();for(let member2 of orderForDeletion(members))await materializer.deleteByKind(member2.kind,member2.id,ctx.callerIdentity);members.length>0&&logger2.info("Deleted plugin members",{pluginId:plugin2.metadata?.id??"",members:members.map(member2=>`${ApiResourceKind[member2.kind]}:${member2.slug}`)})}}}async function get21(deps,id,ctx){let reqCtx=new RequestContext(PluginQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf20(ctx));return await newPipeline("plugin-get",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,PluginSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var pluginVersionBinding={kind:ApiResourceKind.plugin,schema:PluginSchema,noun:"plugin",headHashOf:plugin2=>plugin2.status?.digest??"",liveTagOf:pluginLiveTag,input:req=>req,mapEntry:(plugin2,isCurrent,tag2)=>{let entry=create2(PluginVersionEntrySchema,{isCurrent,tag:tag2});if(plugin2.status!==void 0){entry.digest=plugin2.status.digest,entry.artifactStorageKey=plugin2.status.artifactStorageKey;let specAudit=plugin2.status.audit?.specAudit;specAudit!==void 0&&(entry.pushedAt=specAudit.updatedAt??specAudit.createdAt,entry.pushedBy=specAudit.updatedBy??specAudit.createdBy)}return plugin2.metadata?.version!==void 0&&(entry.message=plugin2.metadata.version.message),entry},response:(versions2,nextPageToken,totalCount)=>create2(ListPluginVersionsResponseSchema,{versions:versions2,nextPageToken,totalCount})};async function getByReference12(deps,ref,ctx){let reqCtx=new RequestContext(PluginQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf20(ctx));return await newPipeline("plugin-get-by-reference",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceWithVersionStep(deps.store,pluginVersionBinding,"LoadPluginByReference")).addStep({name:"AuthorizeResolvedPlugin",async execute(stepCtx){let resolved=stepCtx.get(TARGET_RESOURCE_KEY);await authorizeResolvedResource(deps.authorizer,stepCtx.callerIdentity,{permission:IamPermission.can_view,resourceKind:ApiResourceKind.plugin,resourceId:resolved.metadata?.id??""},"unauthorized to get plugin")}}).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var LIST_MEMBERS_RESPONSE_KEY="listMembersResponse";async function listMembers(deps,id,ctx){let reqCtx=new RequestContext(PluginQueryController.method.listMembers.input,id,callerIdentityOf(ctx),kindOf20(ctx));return await newPipeline("plugin-list-members",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.listMembers,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,PluginSchema)).addStep({name:"ListPluginMembers",async execute(stepCtx){let plugin2=stepCtx.get(TARGET_RESOURCE_KEY),members=await membersOf(deps.store,plugin2);stepCtx.set(LIST_MEMBERS_RESPONSE_KEY,create2(ListPluginMembersResponseSchema,{members:members.map(member2=>create2(PluginMemberSchema,{kind:member2.kind,id:member2.id,slug:member2.slug,name:member2.name}))}))}}).build().execute(reqCtx),reqCtx.get(LIST_MEMBERS_RESPONSE_KEY)}async function listVersions(deps,req,ctx){let reqCtx=new RequestContext(PluginQueryController.method.listVersions.input,req,callerIdentityOf(ctx),kindOf20(ctx));return await newPipeline("plugin-list-versions",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.listVersions,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveBySlugForVersionsStep(deps.store,pluginVersionBinding,"ResolvePluginBySlug")).addStep({name:"AuthorizeResolvedPlugin",async execute(stepCtx){await authorizeResolvedResource(deps.authorizer,stepCtx.callerIdentity,{permission:IamPermission.can_view,resourceKind:ApiResourceKind.plugin,resourceId:stepCtx.get(LIST_VERSIONS_RESOURCE_ID_KEY)},"unauthorized to view plugin version history")}}).addStep(newLoadAndMapVersionsStep(deps.store,pluginVersionBinding,"LoadAndMapVersions")).build().execute(reqCtx),reqCtx.get(LIST_VERSIONS_RESPONSE_KEY)}async function membersOf(store,plugin2){try{return await findMembers(store,plugin2.metadata?.id??"",plugin2.metadata?.org??"")}catch(error2){throw internalError(error2,"failed to list plugin members")}}function newPersistPluginStep(store,key,stepName){return{name:stepName,async execute(ctx){let plugin2=ctx.get(key);try{await store.saveResource(ctx.apiResourceKind,plugin2.metadata?.id??"",PluginSchema,plugin2)}catch(error2){throw internalError(error2,"failed to save plugin")}}}}function newIndexPluginStep(store,logger2,key,stepName){return{name:stepName,async execute(ctx){let plugin2=ctx.get(key),entry=pluginSearchExtractor.getSearchIndexEntry(plugin2);if(entry!==void 0)try{await store.upsertSearchIndex(ctx.apiResourceKind,plugin2.metadata?.id??"",entry)}catch(error2){logger2.warn(`${stepName}: failed (best-effort)`,{id:plugin2.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}var file_ai_stigmer_agentic_skill_v1_command=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvc2tpbGwvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxMocHChZTa2lsbENvbW1hbmRDb250cm9sbGVyEpkBCgRwdXNoEi0uYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlB1c2hTa2lsbFJlcXVlc3QaIi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGwiPsK4GDoICRAeIgNvcmcqL3VuYXV0aG9yaXplZCB0byBwdXNoIHNraWxsIGluIHRoaXMgb3JnYW5pemF0aW9uEtABChdjcmVhdGVBcnRpZmFjdFVwbG9hZFVybBJALmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5DcmVhdGVTa2lsbEFydGlmYWN0VXBsb2FkVXJsUmVxdWVzdBozLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5Ta2lsbEFydGlmYWN0VXBsb2FkVXJsIj7CuBg6CAkQHiIDb3JnKi91bmF1dGhvcml6ZWQgdG8gcHVzaCBza2lsbCBpbiB0aGlzIG9yZ2FuaXphdGlvbhLDAQoZcHVzaEZyb21FeGVjdXRpb25BcnRpZmFjdBJCLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5QdXNoU2tpbGxGcm9tRXhlY3V0aW9uQXJ0aWZhY3RSZXF1ZXN0GiIuYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlNraWxsIj7CuBg6CAkQHiIDb3JnKi91bmF1dGhvcml6ZWQgdG8gcHVzaCBza2lsbCBpbiB0aGlzIG9yZ2FuaXphdGlvbhKtAQoQdXBkYXRlVmlzaWJpbGl0eRI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5VcGRhdGVWaXNpYmlsaXR5SW5wdXQaIi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGwiPsK4GDoIAhArIgtyZXNvdXJjZV9pZCondW5hdXRob3JpemVkIHRvIHVwZGF0ZSBza2lsbCB2aXNpYmlsaXR5EoEBCgZkZWxldGUSJC5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGxJZBoiLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5Ta2lsbCItwrgYKQgDECsiBXZhbHVlKhx1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIHNraWxsGgSg/ysrYgZwcm90bzM",[file_ai_stigmer_agentic_skill_v1_api,file_ai_stigmer_agentic_skill_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SkillCommandController=serviceDesc(file_ai_stigmer_agentic_skill_v1_command,0);var file_ai_stigmer_agentic_skill_v1_query=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvc2tpbGwvdjEvcXVlcnkucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MTKQBQoUU2tpbGxRdWVyeUNvbnRyb2xsZXISewoDZ2V0EiQuYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlNraWxsSWQaIi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGwiKsK4GCYIARArIgV2YWx1ZSoZdW5hdXRob3JpemVkIHRvIGdldCBza2lsbBJwCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRoiLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5Ta2lsbCIE0LgYARJ2CgtnZXRBcnRpZmFjdBIvLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5HZXRBcnRpZmFjdFJlcXVlc3QaMC5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuR2V0QXJ0aWZhY3RSZXNwb25zZSIE0LgYARKGAQoWZ2V0QXJ0aWZhY3REb3dubG9hZFVybBIvLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5HZXRBcnRpZmFjdFJlcXVlc3QaNS5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGxBcnRpZmFjdERvd25sb2FkVXJsIgTQuBgBEoEBCgxsaXN0VmVyc2lvbnMSMy5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuTGlzdFNraWxsVmVyc2lvbnNJbnB1dBo2LmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5MaXN0U2tpbGxWZXJzaW9uc1Jlc3BvbnNlIgTQuBgBGgSg/ysrYgZwcm90bzM",[file_ai_stigmer_agentic_skill_v1_api,file_ai_stigmer_agentic_skill_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SkillQueryController=serviceDesc(file_ai_stigmer_agentic_skill_v1_query,0);var skillSearchExtractor={kind:ApiResourceKind.skill,schema:SkillSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let skill=resource;return buildSearchResult({kind:ApiResourceKind.skill,metadata:skill.metadata,summary:skill.spec?.description??"",score,createdAt:skill.status?.audit?.specAudit?.createdAt,updatedAt:skill.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let skill=resource,metadata=skill.metadata;if(metadata!==void 0)return{name:metadata.name,description:skill.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(skill.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var GO_SPACE_CLASS="\\t\\n\\v\\f\\r \\u0085\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000",GO_TRIM_PATTERN=new RegExp(`^[${GO_SPACE_CLASS}]+|[${GO_SPACE_CLASS}]+$`,"g"),GO_FIELDS_PATTERN=new RegExp(`[${GO_SPACE_CLASS}]+`);function goTrimSpace(value){return value.replace(GO_TRIM_PATTERN,"")}function goFields(value){let trimmed=goTrimSpace(value);return trimmed===""?[]:trimmed.split(GO_FIELDS_PATTERN)}var SKILL_NAME_PATTERN2=/^[a-z0-9]+([.-][a-z0-9]+)*$/,MAX_SCAN_TOKEN_SIZE=64*1024;function lineTooLong(line){return Buffer.byteLength(line,"utf8")>MAX_SCAN_TOKEN_SIZE}function parseFrontmatter2(content){let frontmatterYaml=extractFrontmatterYaml(content),parsed;try{parsed=yaml.load(frontmatterYaml)}catch(error2){throw new Error(`failed to parse YAML frontmatter: ${error2 instanceof Error?error2.message:String(error2)}`)}let record=typeof parsed=="object"&&parsed!==null?parsed:{},frontmatter={name:typeof record.name=="string"?record.name:"",description:typeof record.description=="string"?record.description:"",version:typeof record.version=="string"?record.version:""};return validateFrontmatter(frontmatter),frontmatter}function extractFrontmatterYaml(content){if(content==="")throw new Error("SKILL.md is empty");let lines=content.split(/\r?\n/);if(lineTooLong(lines[0]))throw new Error("SKILL.md is empty");if(goTrimSpace(lines[0])!=="---")throw new Error(`SKILL.md must start with YAML frontmatter (---)
+`))}ctx.set(PLUGIN_PACKAGE_KEY,outcome.plugin),ctx.set(PLUGIN_LIBRARY_WARNINGS_KEY,outcome.warnings)}}}function newBuildInitialPluginStep(){return{name:"BuildInitialPlugin",execute(ctx){let pkg=ctx.get(PLUGIN_PACKAGE_KEY),slug=generateSlug(pkg.name);if(slug==="")throw invalidArgumentError(`invalid plugin name: ${pkg.name}`);let plugin2=create2(PluginSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Plugin",metadata:create2(ApiResourceMetadataSchema,{org:ctx.input.org,name:pkg.name,slug}),spec:create2(PluginSpecSchema,{}),status:create2(PluginStatusSchema,{})});ctx.set(PLUGIN_KEY,plugin2)}}}function newFindExistingPluginBySlugStep(store){return{name:"FindExistingBySlug",async execute(ctx){let plugin2=ctx.get(PLUGIN_KEY),existing;try{existing=await findResourceBySlug(store,ctx.apiResourceKind,PluginSchema,plugin2.metadata.slug,plugin2.metadata.org)}catch(error2){throw internalError(error2,"failed to search for existing plugin")}existing!==void 0?(plugin2.metadata.id=existing.metadata.id,ctx.set(EXISTING_PLUGIN_KEY,existing),ctx.set(SHOULD_CREATE_PLUGIN_KEY,!1)):(ctx.set(EXISTING_PLUGIN_KEY,void 0),ctx.set(SHOULD_CREATE_PLUGIN_KEY,!0))}}}function newGeneratePluginIdIfNeededStep(){return{name:"GenerateIDIfNeeded",execute(ctx){let plugin2=ctx.get(PLUGIN_KEY);ctx.get(SHOULD_CREATE_PLUGIN_KEY)&&(plugin2.metadata.id=generateId(getIdPrefix(ctx.apiResourceKind)))}}}function newParseOverlayDocumentsStep(){return{name:"ParseOverlayDocuments",execute(ctx){let pkg=ctx.get(PLUGIN_PACKAGE_KEY);try{ctx.set(PLUGIN_OVERLAYS_KEY,parseOverlays(pkg.overlay,ctx.input.org))}catch(error2){throw error2 instanceof OverlayParseError?invalidArgumentError(error2.message):error2}}}}function newSanitizePluginMetadataStep(authorizer){return{name:"SanitizePluginMetadata",async execute(ctx){let pkg=ctx.get(PLUGIN_PACKAGE_KEY),overlays=ctx.get(PLUGIN_OVERLAYS_KEY);await sanitizeOverlays(overlays,{pluginName:pkg.name},authorizer,ctx.callerIdentity)}}}var MEMBER_CREATE_PERMISSIONS=new Map([[ApiResourceKind.skill,IamPermission.can_create_skill],[ApiResourceKind.agent,IamPermission.can_create_agent],[ApiResourceKind.workflow,IamPermission.can_create_workflow]]);function identityOf(plugin2,digest3,visibility){return{org:plugin2.metadata.org,id:plugin2.metadata.id,slug:plugin2.metadata.slug,name:plugin2.metadata.name,digest:digest3,visibility}}function requestedVisibility(ctx){return ctx.input.visibility===ApiResourceVisibility.api_resource_visibility_unspecified?defaultVisibilityFor(ctx.apiResourceKind):ctx.input.visibility}function newPlanMaterializationStep(store,authorizer){return{name:"PlanMaterialization",async execute(ctx){let plugin2=ctx.get(PLUGIN_KEY),pkg=ctx.get(PLUGIN_PACKAGE_KEY),archive=ctx.get(PLUGIN_ARCHIVE_KEY),overlays=ctx.get(PLUGIN_OVERLAYS_KEY),identity2=identityOf(plugin2,archive.digest,requestedVisibility(ctx)),plan2;try{plan2=planMaterialization(pkg,archive.files,overlays,identity2,ctx.input.message)}catch(error2){throw error2 instanceof McpServerOverlayError?invalidArgumentError(error2.message):error2}let adopted=[];for(let member2 of plan2.members){let holder;try{holder=await slugHolder(store,member2,identity2.org)}catch(error2){throw internalError(error2,"failed to check a member slug")}let decision=judgeSlug(holder,member2,identity2.id),noun=memberNoun(member2.kind);switch(decision.kind){case"free":case"ours":break;case"adopt":adopted.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.memberAdopted,path:declaringDocumentOf(overlays,member2),message:`${noun} '${member2.slug}' (${decision.holder.id}) was seeded by the platform before this plugin and is now managed by it; its definition is the plugin's, and its instances and conversations continue`}));break;case"held-unmanaged":throw alreadyExistsError(noun,`'${member2.slug}' exists in org '${identity2.org}' and is not managed by a plugin; rename or delete it first`);case"held-by-plugin":throw alreadyExistsError(noun,`'${member2.slug}' is held by plugin '${await pluginSlugOf(store,decision.pluginId)}'`);default:{let exhaustive=decision;throw internalError(new Error(`unknown slug decision ${JSON.stringify(exhaustive)}`),"failed to check a member slug")}}}let missing=[];for(let kind of new Set(plan2.members.map(member2=>member2.kind))){let permission=MEMBER_CREATE_PERMISSIONS.get(kind);if(permission===void 0)continue;let decision;try{decision=await authorizer.authorize(ctx.callerIdentity,{permission,resourceKind:ApiResourceKind.organization,resourceId:identity2.org})}catch(error2){throw internalError(error2,"plugin install authorization could not be completed")}switch(decision.kind){case"allow":break;case"deny":case"not-found":missing.push(IamPermission[permission]??String(permission));break;case"unavailable":throw internalError(decision.cause,"plugin install authorization could not be completed");default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),"plugin install authorization could not be completed")}}}if(missing.length>0)throw new ConnectError(`installing plugin '${identity2.slug}' needs ${missing.join(", ")} in organization '${identity2.org}'`,Code.PermissionDenied);let members;try{members=await findMembers(store,identity2.id,identity2.org)}catch(error2){throw internalError(error2,"failed to list plugin members")}ctx.set(PLUGIN_PLAN_KEY,{...plan2,warnings:[...plan2.warnings,...adopted]}),ctx.set(EXISTING_MEMBERS_KEY,members)}}}function newGuardPluginVisibilityStep(authorizer){return{name:"GuardPluginVisibility",async execute(ctx){let level=requestedVisibility(ctx),plan2=ctx.get(PLUGIN_PLAN_KEY);rejectUnsupportedVisibility(ctx.apiResourceKind,level);for(let kind of new Set(plan2.members.map(member2=>member2.kind)))rejectUnsupportedVisibility(kind,level);level===ApiResourceVisibility.visibility_public&&ctx.callerIdentity.callerClass!=="internal"&&await requireOperatorMaySetPublic(authorizer,ctx.callerIdentity)}}}function newResolveConvergenceStep(){return{name:"ResolveConvergence",execute(ctx){let existing=ctx.get(EXISTING_PLUGIN_KEY),archive=ctx.get(PLUGIN_ARCHIVE_KEY),plan2=ctx.get(PLUGIN_PLAN_KEY),members=ctx.get(EXISTING_MEMBERS_KEY),converged=existing!==void 0&&existing.status?.digest===archive.digest&&existing.status.state===PluginState.READY&&(existing.metadata?.visibility??ApiResourceVisibility.api_resource_visibility_unspecified)===requestedVisibility(ctx)&&membersConverge(members,plan2.members,archive.digest);ctx.set(PLUGIN_CONVERGED_KEY,converged)}}}function newCheckAndStoreArtifactStep(artifactStorage){return{name:"CheckAndStoreArtifact",async execute(ctx){let bytes=ctx.get(ARTIFACT_BYTES_KEY),archive=ctx.get(PLUGIN_ARCHIVE_KEY),exists;try{exists=await artifactStorage.exists(archive.digest)}catch(error2){throw internalError(error2,"failed to check artifact existence")}let storageKey;if(exists)storageKey=artifactStorage.getStorageKey(archive.digest);else try{storageKey=await artifactStorage.store(archive.digest,bytes)}catch(error2){throw internalError(error2,"failed to store artifact")}ctx.set(ARTIFACT_STORAGE_KEY_KEY,storageKey)}}}function newPopulatePluginFieldsStep(){return{name:"PopulatePluginFields",execute(ctx){let plugin2=ctx.get(PLUGIN_KEY),pkg=ctx.get(PLUGIN_PACKAGE_KEY),archive=ctx.get(PLUGIN_ARCHIVE_KEY),storageKey=ctx.get(ARTIFACT_STORAGE_KEY_KEY),shouldCreate=ctx.get(SHOULD_CREATE_PLUGIN_KEY),existing=ctx.get(EXISTING_PLUGIN_KEY);plugin2.spec=create2(PluginSpecSchema,{name:pkg.name,version:pkg.version??"",description:pkg.description??"",homepage:pkg.homepage??"",repository:pkg.repository??"",license:pkg.license??"",keywords:[...pkg.keywords],dialect:dialectOf(pkg.dialect)}),pkg.author!==void 0&&(plugin2.spec.author=create2(PluginAuthorSchema,{name:pkg.author.name??"",email:pkg.author.email??"",url:pkg.author.url??""})),plugin2.metadata.visibility=requestedVisibility(ctx),plugin2.metadata.version=create2(ApiResourceMetadataVersionSchema,{id:archive.digest,message:ctx.input.message,previousVersionId:existing?.status?.digest??""});let status=plugin2.status;status.digest=archive.digest,status.artifactStorageKey=storageKey,status.state=PluginState.INSTALLING,status.error="",shouldCreate?setAuditFieldsForCreate(PluginSchema,plugin2,ctx.callerIdentity):(existing?.status?.audit!==void 0&&(status.audit??=create2(ApiResourceAuditSchema,{}),status.audit.specAudit=existing.status.audit.specAudit,status.audit.statusAudit=existing.status.audit.statusAudit),setAuditFieldsForUpdate(PluginSchema,plugin2,"spec_audit",ctx.callerIdentity))}}}function newArchiveCurrentPluginStep(store,logger2){return newArchiveCurrentVersionStep(store,logger2,{stepName:"ArchiveCurrentPlugin",resourceKey:PLUGIN_KEY,schema:PluginSchema,noun:"plugin",headHashOf:plugin2=>plugin2.status?.digest??"",clearHeadHash:plugin2=>{plugin2.status.digest="",plugin2.metadata?.version!==void 0&&(plugin2.metadata.version.id="")},liveTagOf:pluginLiveTag,clearLiveTag:()=>{}})}function pluginLiveTag(plugin2){let version=plugin2.spec?.version??"";return VERSION_TAG_PATTERN.test(version)?version:""}function newStorePluginStep(store,stepName){return{name:stepName,async execute(ctx){let plugin2=ctx.get(PLUGIN_KEY);try{await store.saveResource(ctx.apiResourceKind,plugin2.metadata.id,PluginSchema,plugin2)}catch(error2){throw internalError(error2,"failed to save plugin")}}}}function newMaterializeMembersStep(store,materializerProvider,logger2){return{name:"MaterializeMembers",async execute(ctx){let plugin2=ctx.get(PLUGIN_KEY),plan2=ctx.get(PLUGIN_PLAN_KEY),materializer=materializerProvider(),caller=ctx.callerIdentity,level=requestedVisibility(ctx),reconcileLevel=async(kind,applied)=>{let metadata=applied.metadata;metadata!==void 0&&metadata.visibility!==level&&await materializer.updateVisibility(kind,metadata.id,level,caller)},materialize=async(kind,slug,write2)=>{try{return await write2()}catch(error2){throw await recordFailure(store,ctx,plugin2,kind,slug,error2)}};for(let skill of plan2.skills){let pushed=await materialize(ApiResourceKind.skill,skill.slug,()=>materializer.pushSkill(skill.request,caller));await materialize(ApiResourceKind.skill,skill.slug,()=>reconcileLevel(ApiResourceKind.skill,pushed))}for(let server of plan2.mcpServers){let applied=await materialize(ApiResourceKind.mcp_server,server.slug,()=>materializer.applyMcpServer(server.resource,caller));await materialize(ApiResourceKind.mcp_server,server.slug,()=>reconcileLevel(ApiResourceKind.mcp_server,applied))}if(plan2.agent!==void 0){let agent=plan2.agent,applied=await materialize(ApiResourceKind.agent,agent.slug,()=>materializer.applyAgent(agent.resource,caller));await materialize(ApiResourceKind.agent,agent.slug,()=>reconcileLevel(ApiResourceKind.agent,applied))}for(let workflow of plan2.workflows){let applied=await materialize(ApiResourceKind.workflow,workflow.slug,()=>materializer.applyWorkflow(workflow.resource,caller));await materialize(ApiResourceKind.workflow,workflow.slug,()=>reconcileLevel(ApiResourceKind.workflow,applied))}logger2.info("Materialized plugin members",{pluginId:plugin2.metadata.id,skills:plan2.skills.length,mcpServers:plan2.mcpServers.length,agents:plan2.agent===void 0?0:1,workflows:plan2.workflows.length})}}}function newRemoveDroppedMembersStep(store,materializerProvider,logger2){return{name:"RemoveDroppedMembers",async execute(ctx){let plugin2=ctx.get(PLUGIN_KEY),plan2=ctx.get(PLUGIN_PLAN_KEY),existing=ctx.get(EXISTING_MEMBERS_KEY),dropped=droppedMembers(existing,plan2.members);if(dropped.length===0)return;let materializer=materializerProvider();for(let member2 of orderForDeletion(dropped))try{await materializer.deleteByKind(member2.kind,member2.id,ctx.callerIdentity)}catch(error2){throw await recordFailure(store,ctx,plugin2,member2.kind,member2.slug,error2,"remove")}logger2.info("Removed members the new archive dropped",{pluginId:plugin2.metadata.id,dropped:dropped.map(member2=>`${ApiResourceKind[member2.kind]}:${member2.slug}`)})}}}function orderForDeletion(members){let rank=new Map([[ApiResourceKind.agent,0],[ApiResourceKind.workflow,1],[ApiResourceKind.mcp_server,2],[ApiResourceKind.skill,3]]);return[...members].sort((a5,b7)=>(rank.get(a5.kind)??9)-(rank.get(b7.kind)??9))}function newFinalizePluginStatusStep(){return{name:"FinalizePluginStatus",execute(ctx){let plugin2=ctx.get(PLUGIN_KEY),plan2=ctx.get(PLUGIN_PLAN_KEY),libraryWarnings=ctx.get(PLUGIN_LIBRARY_WARNINGS_KEY),status=plugin2.status;status.state=PluginState.READY,status.error="",status.materialized=create2(PluginMaterializationSchema,{skills:plan2.skills.length,mcpServers:plan2.mcpServers.length,agents:plan2.agent===void 0?0:1,workflows:plan2.workflows.length}),status.warnings=[...libraryWarnings.map(finding=>create2(PluginWarningSchema,{kind:finding.kind,message:finding.message,path:finding.path??""})),...plan2.warnings]}}}function newPluginPushAuthorizationTuplesStep(lifecycle,logger2){return{name:"PluginPushAuthorizationTuples",async execute(ctx){if(lifecycle===void 0)return;let plugin2=ctx.get(PLUGIN_KEY);if(ctx.get(SHOULD_CREATE_PLUGIN_KEY)){let event=resolveResourceCreatedEvent(ctx.apiResourceKind,plugin2,ctx.callerIdentity,logger2);if(event===void 0)return;try{await lifecycle.onResourceCreated(event)}catch(error2){throw internalError(error2,"failed to create authorization tuples")}return}let oldLevel=ctx.get(EXISTING_PLUGIN_KEY)?.metadata?.visibility??ApiResourceVisibility.api_resource_visibility_unspecified,newLevel=plugin2.metadata?.visibility??ApiResourceVisibility.api_resource_visibility_unspecified,{shapesToCreate,shapesToDelete}=diffVisibilityShapes(ctx.apiResourceKind,oldLevel,newLevel);if(!(shapesToCreate.length===0&&shapesToDelete.length===0))try{await lifecycle.onVisibilityChanged({kind:ctx.apiResourceKind,resourceId:plugin2.metadata?.id??"",orgId:plugin2.metadata?.org??"",shapesToCreate,shapesToDelete})}catch(error2){throw internalError(error2,"failed to update visibility tuples")}}}}function newIndexPluginSearchStep(store,logger2){return{name:"IndexPluginSearch",async execute(ctx){let plugin2=ctx.get(PLUGIN_KEY),entry=pluginSearchExtractor.getSearchIndexEntry(plugin2);if(entry!==void 0)try{await store.upsertSearchIndex(ctx.apiResourceKind,plugin2.metadata.id,entry)}catch(error2){logger2.warn("IndexPluginSearch: failed to update search index (best-effort)",{id:plugin2.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}var MEMBER_NOUNS=new Map([[ApiResourceKind.skill,"skill"],[ApiResourceKind.mcp_server,"MCP server"],[ApiResourceKind.agent,"agent"],[ApiResourceKind.workflow,"workflow"]]);function memberNoun(kind){return MEMBER_NOUNS.get(kind)??ApiResourceKind[kind]??String(kind)}function declaringDocumentOf(overlays,member2){switch(member2.kind){case ApiResourceKind.agent:return overlays.agent?.path??"";case ApiResourceKind.mcp_server:return overlays.mcpServers.find(document2=>document2.server===member2.name)?.path??"";case ApiResourceKind.workflow:return overlays.workflows.find(document2=>document2.name===member2.name)?.path??"";default:return""}}async function pluginSlugOf(store,pluginId){try{return(await store.getResource(ApiResourceKind.plugin,pluginId,PluginSchema)).metadata?.slug??pluginId}catch(error2){if(error2 instanceof ResourceNotFoundError)return pluginId;throw internalError(error2,"failed to load the holding plugin")}}async function recordFailure(store,ctx,plugin2,kind,slug,error2,verb="materialize"){let cause=error2 instanceof ConnectError?error2.rawMessage:error2 instanceof Error?error2.message:String(error2),sentence=`failed to ${verb} ${memberNoun(kind)} '${slug}' from plugin '${plugin2.metadata?.slug??""}': ${cause}`,status=plugin2.status;status.state=PluginState.FAILED,status.error=sentence;try{await store.saveResource(ctx.apiResourceKind,plugin2.metadata.id,PluginSchema,plugin2)}catch{}return error2 instanceof ConnectError?new ConnectError(sentence,error2.code,void 0,void 0,error2):internalError(error2,sentence)}function dialectOf(dialect){switch(dialect){case"agent-plugins":return PluginDialect.AGENT_PLUGINS;case"claude":return PluginDialect.CLAUDE;case"cursor":return PluginDialect.CURSOR;case"codex":return PluginDialect.CODEX;default:{let exhaustive=dialect;throw new Error(`unknown dialect ${String(exhaustive)}`)}}}function registerPluginServices(router,deps){router.service(PluginCommandController,{push:(req,ctx)=>push(deps,req,ctx),createArtifactUploadUrl:(req,ctx)=>createArtifactUploadUrl(deps,req,ctx),updateVisibility:(input,ctx)=>updateVisibility5(deps,input,ctx),delete:(id,ctx)=>deletePlugin(deps,id,ctx)}),router.service(PluginQueryController,{get:(id,ctx)=>get21(deps,id,ctx),getByReference:(ref,ctx)=>getByReference12(deps,ref,ctx),listMembers:(id,ctx)=>listMembers(deps,id,ctx),listVersions:(req,ctx)=>listVersions(deps,req,ctx)})}function kindOf20(ctx){return ctx.values.get(apiResourceKindKey)}async function push(deps,req,ctx){let reqCtx=new RequestContext(PushPluginRequestSchema,req,callerIdentityOf(ctx),kindOf20(ctx));return await newPipeline("plugin-push-plan",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.push,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveArtifactSourceStep(deps.transferLane?.slots,{source:input=>({artifact:input.artifact,artifactUploadRef:input.artifactUploadRef}),laneNotConfigured:TRANSFER_LANE_NOT_CONFIGURED2})).addStep(newGateAndHashArchiveStep()).addStep(newReadPluginPackageStep()).addStep(newBuildInitialPluginStep()).addStep(newFindExistingPluginBySlugStep(deps.store)).addStep(newGeneratePluginIdIfNeededStep()).addStep(newParseOverlayDocumentsStep()).addStep(newSanitizePluginMetadataStep(deps.authorizer)).addStep(newPlanMaterializationStep(deps.store,deps.authorizer)).addStep(newGuardPluginVisibilityStep(deps.authorizer)).addStep(newResolveConvergenceStep()).build().execute(reqCtx),reqCtx.get(PLUGIN_CONVERGED_KEY)===!0?reqCtx.get(EXISTING_PLUGIN_KEY):(await newPipeline("plugin-push-install",deps.logger).addStep(newCheckAndStoreArtifactStep(deps.artifactStorage)).addStep(newPopulatePluginFieldsStep()).addStep(newArchiveCurrentPluginStep(deps.store,deps.logger)).addStep(newStorePluginStep(deps.store,"StorePlugin")).addStep(newMaterializeMembersStep(deps.store,deps.materializerProvider,deps.logger)).addStep(newRemoveDroppedMembersStep(deps.store,deps.materializerProvider,deps.logger)).addStep(newFinalizePluginStatusStep()).addStep(newStorePluginStep(deps.store,"StorePluginReady")).addStep(newPluginPushAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexPluginSearchStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(PLUGIN_KEY))}async function createArtifactUploadUrl(deps,req,ctx){let lane=deps.transferLane;if(lane===void 0)throw failedPreconditionError(TRANSFER_LANE_NOT_CONFIGURED2);let reqCtx=new RequestContext(PluginCommandController.method.createArtifactUploadUrl.input,req,callerIdentityOf(ctx),kindOf20(ctx));if(await newPipeline("plugin-create-artifact-upload-url",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.createArtifactUploadUrl,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx),req.sizeBytes>BigInt(104857600))throw invalidArgumentError(`plugin archive size ${req.sizeBytes} bytes exceeds the ${104857600}-byte (100MB) archive limit`);let minted;try{minted=lane.slots.mint(Number(req.sizeBytes))}catch(error2){throw internalError(error2,"failed to mint upload reference")}return create2(PluginArtifactUploadUrlSchema,{url:uploadUrl(lane.baseUrl,minted.ref),artifactUploadRef:minted.ref,ttlSeconds:Math.trunc(minted.ttlMs/1e3)})}var UPDATE_VISIBILITY_PLUGIN_KEY="updateVisibilityPlugin";async function updateVisibility5(deps,input,ctx){let reqCtx=new RequestContext(PluginCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf20(ctx));return await newPipeline("plugin-update-visibility",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadPluginByIdStep(deps.store,UPDATE_VISIBILITY_PLUGIN_KEY)).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_PLUGIN_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newAuthorizeVisibilityTransitionStep(UPDATE_VISIBILITY_PLUGIN_KEY,deps.authorizer)).addStep(newSetPluginVisibilityStep()).addStep(newPersistPluginStep(deps.store,UPDATE_VISIBILITY_PLUGIN_KEY,"PersistPluginForVisibilityUpdate")).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_PLUGIN_KEY)).addStep(newFanOutVisibilityToMembersStep(deps.store,deps.materializerProvider)).addStep(newIndexPluginStep(deps.store,deps.logger,UPDATE_VISIBILITY_PLUGIN_KEY,"IndexPluginAfterVisibilityUpdate")).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_PLUGIN_KEY)}function newLoadPluginByIdStep(store,key){return{name:"LoadPluginForVisibilityUpdate",async execute(ctx){let plugin2;try{plugin2=await store.getResource(ctx.apiResourceKind,ctx.input.resourceId,PluginSchema)}catch{throw notFoundError("plugin",ctx.input.resourceId)}ctx.set(key,plugin2)}}}function newSetPluginVisibilityStep(){return{name:"SetPluginVisibility",execute(ctx){let plugin2=ctx.get(UPDATE_VISIBILITY_PLUGIN_KEY);plugin2.metadata!==void 0&&(plugin2.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(PluginSchema,plugin2,"status_audit",ctx.callerIdentity)}}}function newFanOutVisibilityToMembersStep(store,materializerProvider){return{name:"FanOutVisibilityToMembers",async execute(ctx){let plugin2=ctx.get(UPDATE_VISIBILITY_PLUGIN_KEY),members=await membersOf(store,plugin2),materializer=materializerProvider();for(let member2 of members)await materializer.updateVisibility(member2.kind,member2.id,ctx.input.visibility,ctx.callerIdentity)}}}var DELETE_MEMBERS_KEY="deletePluginMembers";async function deletePlugin(deps,id,ctx){let reqCtx=new RequestContext(PluginCommandController.method.delete.input,id,callerIdentityOf(ctx),kindOf20(ctx));await newPipeline("plugin-delete",deps.logger).addStep(newAuthorizeStep(PluginCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,PluginSchema)).addStep(newGuardMembersUnreferencedStep(deps.store)).addStep(newCascadeDeleteMembersStep(deps.materializerProvider,deps.logger)).addStep(newDeleteVersionArchivesStep(deps.store,deps.logger,{stepName:"DeletePluginArchives",noun:"plugin"})).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted plugin not found in context"),"deleted plugin not found in context");return deleted}function newGuardMembersUnreferencedStep(store){return{name:"GuardMembersUnreferenced",async execute(ctx){let plugin2=ctx.get(EXISTING_RESOURCE_KEY),members=await membersOf(store,plugin2);if(ctx.set(DELETE_MEMBERS_KEY,members),members.length===0)return;let org=plugin2.metadata?.org??"",memberKeys=new Set(members.map(member2=>`${member2.kind}:${member2.slug}`)),memberIds=new Set(members.map(member2=>member2.id)),referrers=[];for(let{kind,schema:schema2,noun}of[{kind:ApiResourceKind.agent,schema:AgentSchema,noun:"agent"},{kind:ApiResourceKind.workflow,schema:WorkflowSchema,noun:"workflow"}]){let rows;try{rows=await store.listResources(kind)}catch(error2){throw internalError(error2,`failed to list ${noun}s for the plugin reference check`)}for(let raw of rows){let resource=fromBinary2(schema2,raw),metadata=metadataOf(resource);if(metadata===void 0||metadata.org!==org||memberIds.has(metadata.id))continue;collectSpecReferences(schema2,resource).some(ref=>(ref.org===""||ref.org===org)&&memberKeys.has(`${ref.kind}:${ref.slug}`))&&referrers.push(`${noun} '${metadata.slug}'`)}}if(referrers.length>0)throw failedPreconditionError(`plugin '${plugin2.metadata?.slug??""}' is still used by ${referrers.sort().join(", ")}; detach them from the plugin's skills and servers first`)}}}function newCascadeDeleteMembersStep(materializerProvider,logger2){return{name:"CascadeDeleteMembers",async execute(ctx){let plugin2=ctx.get(EXISTING_RESOURCE_KEY),members=ctx.get(DELETE_MEMBERS_KEY),materializer=materializerProvider();for(let member2 of orderForDeletion(members))await materializer.deleteByKind(member2.kind,member2.id,ctx.callerIdentity);members.length>0&&logger2.info("Deleted plugin members",{pluginId:plugin2.metadata?.id??"",members:members.map(member2=>`${ApiResourceKind[member2.kind]}:${member2.slug}`)})}}}async function get21(deps,id,ctx){let reqCtx=new RequestContext(PluginQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf20(ctx));return await newPipeline("plugin-get",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,PluginSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var pluginVersionBinding={kind:ApiResourceKind.plugin,schema:PluginSchema,noun:"plugin",headHashOf:plugin2=>plugin2.status?.digest??"",liveTagOf:pluginLiveTag,input:req=>req,mapEntry:(plugin2,isCurrent,tag2)=>{let entry=create2(PluginVersionEntrySchema,{isCurrent,tag:tag2});if(plugin2.status!==void 0){entry.digest=plugin2.status.digest,entry.artifactStorageKey=plugin2.status.artifactStorageKey;let specAudit=plugin2.status.audit?.specAudit;specAudit!==void 0&&(entry.pushedAt=specAudit.updatedAt??specAudit.createdAt,entry.pushedBy=specAudit.updatedBy??specAudit.createdBy)}return plugin2.metadata?.version!==void 0&&(entry.message=plugin2.metadata.version.message),entry},response:(versions2,nextPageToken,totalCount)=>create2(ListPluginVersionsResponseSchema,{versions:versions2,nextPageToken,totalCount})};async function getByReference12(deps,ref,ctx){let reqCtx=new RequestContext(PluginQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf20(ctx));return await newPipeline("plugin-get-by-reference",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceWithVersionStep(deps.store,pluginVersionBinding,"LoadPluginByReference")).addStep({name:"AuthorizeResolvedPlugin",async execute(stepCtx){let resolved=stepCtx.get(TARGET_RESOURCE_KEY);await authorizeResolvedResource(deps.authorizer,stepCtx.callerIdentity,{permission:IamPermission.can_view,resourceKind:ApiResourceKind.plugin,resourceId:resolved.metadata?.id??""},"unauthorized to get plugin")}}).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var LIST_MEMBERS_RESPONSE_KEY="listMembersResponse";async function listMembers(deps,id,ctx){let reqCtx=new RequestContext(PluginQueryController.method.listMembers.input,id,callerIdentityOf(ctx),kindOf20(ctx));return await newPipeline("plugin-list-members",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.listMembers,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,PluginSchema)).addStep({name:"ListPluginMembers",async execute(stepCtx){let plugin2=stepCtx.get(TARGET_RESOURCE_KEY),members=await membersOf(deps.store,plugin2);stepCtx.set(LIST_MEMBERS_RESPONSE_KEY,create2(ListPluginMembersResponseSchema,{members:members.map(member2=>create2(PluginMemberSchema,{kind:member2.kind,id:member2.id,slug:member2.slug,name:member2.name}))}))}}).build().execute(reqCtx),reqCtx.get(LIST_MEMBERS_RESPONSE_KEY)}async function listVersions(deps,req,ctx){let reqCtx=new RequestContext(PluginQueryController.method.listVersions.input,req,callerIdentityOf(ctx),kindOf20(ctx));return await newPipeline("plugin-list-versions",deps.logger).addStep(newAuthorizeStep(PluginQueryController.method.listVersions,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveBySlugForVersionsStep(deps.store,pluginVersionBinding,"ResolvePluginBySlug")).addStep({name:"AuthorizeResolvedPlugin",async execute(stepCtx){await authorizeResolvedResource(deps.authorizer,stepCtx.callerIdentity,{permission:IamPermission.can_view,resourceKind:ApiResourceKind.plugin,resourceId:stepCtx.get(LIST_VERSIONS_RESOURCE_ID_KEY)},"unauthorized to view plugin version history")}}).addStep(newLoadAndMapVersionsStep(deps.store,pluginVersionBinding,"LoadAndMapVersions")).build().execute(reqCtx),reqCtx.get(LIST_VERSIONS_RESPONSE_KEY)}async function membersOf(store,plugin2){try{return await findMembers(store,plugin2.metadata?.id??"",plugin2.metadata?.org??"")}catch(error2){throw internalError(error2,"failed to list plugin members")}}function newPersistPluginStep(store,key,stepName){return{name:stepName,async execute(ctx){let plugin2=ctx.get(key);try{await store.saveResource(ctx.apiResourceKind,plugin2.metadata?.id??"",PluginSchema,plugin2)}catch(error2){throw internalError(error2,"failed to save plugin")}}}}function newIndexPluginStep(store,logger2,key,stepName){return{name:stepName,async execute(ctx){let plugin2=ctx.get(key),entry=pluginSearchExtractor.getSearchIndexEntry(plugin2);if(entry!==void 0)try{await store.upsertSearchIndex(ctx.apiResourceKind,plugin2.metadata?.id??"",entry)}catch(error2){logger2.warn(`${stepName}: failed (best-effort)`,{id:plugin2.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}var file_ai_stigmer_agentic_skill_v1_command=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvc2tpbGwvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxMocHChZTa2lsbENvbW1hbmRDb250cm9sbGVyEpkBCgRwdXNoEi0uYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlB1c2hTa2lsbFJlcXVlc3QaIi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGwiPsK4GDoICRAeIgNvcmcqL3VuYXV0aG9yaXplZCB0byBwdXNoIHNraWxsIGluIHRoaXMgb3JnYW5pemF0aW9uEtABChdjcmVhdGVBcnRpZmFjdFVwbG9hZFVybBJALmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5DcmVhdGVTa2lsbEFydGlmYWN0VXBsb2FkVXJsUmVxdWVzdBozLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5Ta2lsbEFydGlmYWN0VXBsb2FkVXJsIj7CuBg6CAkQHiIDb3JnKi91bmF1dGhvcml6ZWQgdG8gcHVzaCBza2lsbCBpbiB0aGlzIG9yZ2FuaXphdGlvbhLDAQoZcHVzaEZyb21FeGVjdXRpb25BcnRpZmFjdBJCLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5QdXNoU2tpbGxGcm9tRXhlY3V0aW9uQXJ0aWZhY3RSZXF1ZXN0GiIuYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlNraWxsIj7CuBg6CAkQHiIDb3JnKi91bmF1dGhvcml6ZWQgdG8gcHVzaCBza2lsbCBpbiB0aGlzIG9yZ2FuaXphdGlvbhKtAQoQdXBkYXRlVmlzaWJpbGl0eRI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5VcGRhdGVWaXNpYmlsaXR5SW5wdXQaIi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGwiPsK4GDoIAhArIgtyZXNvdXJjZV9pZCondW5hdXRob3JpemVkIHRvIHVwZGF0ZSBza2lsbCB2aXNpYmlsaXR5EoEBCgZkZWxldGUSJC5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGxJZBoiLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5Ta2lsbCItwrgYKQgDECsiBXZhbHVlKhx1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIHNraWxsGgSg/ysrYgZwcm90bzM",[file_ai_stigmer_agentic_skill_v1_api,file_ai_stigmer_agentic_skill_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SkillCommandController=serviceDesc(file_ai_stigmer_agentic_skill_v1_command,0);var file_ai_stigmer_agentic_skill_v1_query=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvc2tpbGwvdjEvcXVlcnkucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MTKQBQoUU2tpbGxRdWVyeUNvbnRyb2xsZXISewoDZ2V0EiQuYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlNraWxsSWQaIi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGwiKsK4GCYIARArIgV2YWx1ZSoZdW5hdXRob3JpemVkIHRvIGdldCBza2lsbBJwCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRoiLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5Ta2lsbCIE0LgYARJ2CgtnZXRBcnRpZmFjdBIvLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5HZXRBcnRpZmFjdFJlcXVlc3QaMC5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuR2V0QXJ0aWZhY3RSZXNwb25zZSIE0LgYARKGAQoWZ2V0QXJ0aWZhY3REb3dubG9hZFVybBIvLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5HZXRBcnRpZmFjdFJlcXVlc3QaNS5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGxBcnRpZmFjdERvd25sb2FkVXJsIgTQuBgBEoEBCgxsaXN0VmVyc2lvbnMSMy5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuTGlzdFNraWxsVmVyc2lvbnNJbnB1dBo2LmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5MaXN0U2tpbGxWZXJzaW9uc1Jlc3BvbnNlIgTQuBgBGgSg/ysrYgZwcm90bzM",[file_ai_stigmer_agentic_skill_v1_api,file_ai_stigmer_agentic_skill_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SkillQueryController=serviceDesc(file_ai_stigmer_agentic_skill_v1_query,0);var skillSearchExtractor={kind:ApiResourceKind.skill,schema:SkillSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let skill=resource;return buildSearchResult({kind:ApiResourceKind.skill,metadata:skill.metadata,summary:skill.spec?.description??"",score,createdAt:skill.status?.audit?.specAudit?.createdAt,updatedAt:skill.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let skill=resource,metadata=skill.metadata;if(metadata!==void 0)return{name:metadata.name,description:skill.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(skill.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var GO_SPACE_CLASS="\\t\\n\\v\\f\\r \\u0085\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000",GO_TRIM_PATTERN=new RegExp(`^[${GO_SPACE_CLASS}]+|[${GO_SPACE_CLASS}]+$`,"g"),GO_FIELDS_PATTERN=new RegExp(`[${GO_SPACE_CLASS}]+`);function goTrimSpace(value){return value.replace(GO_TRIM_PATTERN,"")}function goFields(value){let trimmed=goTrimSpace(value);return trimmed===""?[]:trimmed.split(GO_FIELDS_PATTERN)}var SKILL_NAME_PATTERN2=/^[a-z0-9]+([.-][a-z0-9]+)*$/,MAX_SCAN_TOKEN_SIZE=64*1024;function lineTooLong(line){return Buffer.byteLength(line,"utf8")>MAX_SCAN_TOKEN_SIZE}function parseFrontmatter2(content){let frontmatterYaml=extractFrontmatterYaml(content),parsed;try{parsed=yaml.load(frontmatterYaml)}catch(error2){throw new Error(`failed to parse YAML frontmatter: ${error2 instanceof Error?error2.message:String(error2)}`)}let record=typeof parsed=="object"&&parsed!==null?parsed:{},frontmatter={name:typeof record.name=="string"?record.name:"",description:typeof record.description=="string"?record.description:"",version:typeof record.version=="string"?record.version:""};return validateFrontmatter(frontmatter),frontmatter}function extractFrontmatterYaml(content){if(content==="")throw new Error("SKILL.md is empty");let lines=content.split(/\r?\n/);if(lineTooLong(lines[0]))throw new Error("SKILL.md is empty");if(goTrimSpace(lines[0])!=="---")throw new Error(`SKILL.md must start with YAML frontmatter (---)
 
 Expected format:
 ---
@@ -1410,7 +1410,7 @@ Headers: `+JSON.stringify(headers2)),this.code=code,this.body=body,this.headers=
 \r
 SM\r
 \r
-`,"latin1");function createProtocolDemuxServer(targets){return(0,import_node_net2.createServer)({noDelay:!0},socket=>{routeByPreface(socket,targets)})}function routeByPreface(socket,targets){let peeked=[],peekedLength=0,cleanup=()=>{socket.removeListener("data",onData),socket.removeListener("error",onPeekError),socket.removeListener("close",cleanup)},onPeekError=()=>{cleanup(),socket.destroy()},onData=chunk=>{peeked.push(chunk),peekedLength+=chunk.length;let seen=Buffer.concat(peeked,Math.min(peekedLength,HTTP2_CONNECTION_PREFACE.length)),comparable=seen.subarray(0,Math.min(seen.length,HTTP2_CONNECTION_PREFACE.length));if(!HTTP2_CONNECTION_PREFACE.subarray(0,comparable.length).equals(comparable)){handoffHttp1();return}if(peekedLength>=HTTP2_CONNECTION_PREFACE.length){handoffHttp2();return}};function handoffHttp1(){cleanup(),socket.pause(),socket.unshift(Buffer.concat(peeked,peekedLength)),targets.http1.emit("connection",socket),socket.resume()}function handoffHttp2(){cleanup(),socket.pause();let replay=createReplayDuplex(socket,Buffer.concat(peeked,peekedLength));targets.http2.emit("connection",replay)}socket.on("data",onData),socket.on("error",onPeekError),socket.on("close",cleanup)}function createReplayDuplex(socket,head){let replay=new import_node_stream13.Duplex({read(){socket.resume()},write(chunk,encoding,callback){socket.write(chunk,encoding,callback)},final(callback){socket.end(callback)},destroy(error2,callback){socket.destroy(),callback(error2)}});return socket.on("data",chunk=>{replay.push(chunk)||socket.pause()}),socket.on("end",()=>{replay.push(null)}),socket.on("error",error2=>{replay.destroy(error2)}),replay.push(head),replay}function createUnifiedPortServer(options){let rpcHandler=connectNodeAdapter({routes:options.routes,interceptors:options.interceptors,readMaxBytes:10485760,writeMaxBytes:10485760}),laneRouter=(request,response)=>{let path14=(request.url??"").split("?",1)[0]??"";if(path14===TASK_KIND_REGISTRY_PATH){options.taskKindRegistryLane(request,response);return}if(path14===MODEL_REGISTRY_PATH){options.modelRegistryLane(request,response);return}if(options.skillTransferLane!==void 0&&path14.startsWith(SKILL_ARTIFACTS_PATH_PREFIX)){options.skillTransferLane(request,response);return}if(options.consoleLane!==void 0&&consoleLaneEligible(request)){options.consoleLane(request,response);return}if(isRpcPreflight(request)){handleRpcPreflight(request,response);return}applyRpcCorsHeaders(request,response),rpcHandler(request,response)},http1=(0,import_node_http4.createServer)(laneRouter),http22=(0,import_node_http22.createServer)(laneRouter),liveSessions=new Set;http22.on("session",session=>{liveSessions.add(session),session.on("close",()=>liveSessions.delete(session)),armKeepalivePings(session,options.logger)}),http22.on("sessionError",error2=>{options.logger.debug("http2 session error",{error:String(error2)})});let demux=createProtocolDemuxServer({http1,http2:http22}),liveSockets=new Set;return demux.on("connection",socket=>{liveSockets.add(socket),socket.on("close",()=>liveSockets.delete(socket))}),{listen(port,host="0.0.0.0"){return new Promise((resolve,reject2)=>{demux.once("error",reject2),demux.listen(port,host,()=>{let address=demux.address();if(address===null||typeof address=="string"){reject2(new Error("unified port bound without a TCP address"));return}resolve(address.port)})})},async shutdown(){let closed=new Promise(resolve=>demux.close(()=>resolve()));http1.close(),http1.closeIdleConnections(),http22.close();for(let session of liveSessions)session.close();await Promise.race([closed.then(()=>!0),new Promise(resolve=>setTimeout(()=>resolve(!1),1e4).unref())])||options.logger.warn("shutdown drain budget exhausted; destroying remaining connections",{remaining:liveSockets.size});for(let socket of liveSockets)socket.destroy();await closed}}}function armKeepalivePings(session,logger2){let interval=setInterval(()=>{let acked=!1,deadline=setTimeout(()=>{!acked&&!session.destroyed&&(logger2.debug("closing http2 session: keepalive ping unacknowledged"),session.destroy())},5e3);deadline.unref();try{session.ping(()=>{acked=!0,clearTimeout(deadline)})}catch{clearTimeout(deadline),session.destroyed||session.destroy()}},15e3);interval.unref(),session.on("close",()=>clearInterval(interval))}function createInProcessClients(routes,logger2){let transport=createRouterTransport(routes,{router:{interceptors:buildInterceptorChain(logger2,createInProcessCallerInterceptor())}}),agentInstanceCommand=createClient(AgentInstanceCommandController,transport),agentInstanceQuery=createClient(AgentInstanceQueryController,transport),agentQuery=createClient(AgentQueryController,transport),sessionCommand=createClient(SessionCommandController,transport),sessionQuery=createClient(SessionQueryController,transport),environmentCommand=createClient(EnvironmentCommandController,transport),environmentQuery=createClient(EnvironmentQueryController,transport),executionContextCommand=createClient(ExecutionContextCommandController,transport),workflowInstanceCommand=createClient(WorkflowInstanceCommandController,transport),workflowInstanceQuery=createClient(WorkflowInstanceQueryController,transport),workflowQuery=createClient(WorkflowQueryController,transport),agentExecutionCommand=createClient(AgentExecutionCommandController,transport),agentCommand=createClient(AgentCommandController,transport),workflowCommand=createClient(WorkflowCommandController,transport),mcpServerCommand=createClient(McpServerCommandController,transport),skillCommand=createClient(SkillCommandController,transport),asCaller=caller=>({headers:{[IN_PROCESS_CALLER_HEADER]:encodeInProcessCaller(caller)}}),clients={agentInstanceApplier:{applyAsCaller:(instance,caller)=>agentInstanceCommand.apply(instance,asCaller(caller))},agentInstanceCreator:{createAsCaller:(instance,caller)=>agentInstanceCommand.create(instance,asCaller(caller))},parentAgentLoader:{get:agentId=>agentQuery.get(create2(AgentIdSchema,{value:agentId}))},workflowInstanceCreator:{createAsCaller:(instance,caller)=>workflowInstanceCommand.create(instance,asCaller(caller))},parentWorkflowLoader:{get:workflowId=>workflowQuery.get(create2(WorkflowIdSchema,{value:workflowId}))},executionAgentLoader:{get:agentId=>agentQuery.get(create2(AgentIdSchema,{value:agentId}))},executionAgentInstanceLoader:{get:instanceId=>agentInstanceQuery.get(create2(AgentInstanceIdSchema,{value:instanceId}))},executionAgentInstanceCreator:{createAsCaller:(instance,caller)=>agentInstanceCommand.create(instance,asCaller(caller))},executionSessionLoader:{get:sessionId=>sessionQuery.get(create2(SessionIdSchema,{value:sessionId}))},executionSessionCreator:{createAsCaller:(session,caller)=>sessionCommand.create(session,asCaller(caller))},executionEnvironmentReader:{list:request=>environmentQuery.list(request),getSecretValue:input=>environmentQuery.getSecretValue(input),updateVariables:request=>environmentCommand.updateVariables(request),create:(environment,caller)=>environmentCommand.create(environment,caller===void 0?void 0:asCaller(caller)),delete:input=>environmentCommand.delete(input)},executionContextCreator:{create:ec2=>executionContextCommand.create(ec2)},connectExecutionContextClient:{create:(ec2,caller)=>executionContextCommand.create(ec2,asCaller(caller)),delete:input=>executionContextCommand.delete(input)},workflowExecutionInstanceCreator:{createAsCaller:(instance,caller)=>workflowInstanceCommand.create(instance,asCaller(caller))},workflowExecutionInstanceLoader:{get:instanceId=>workflowInstanceQuery.get(create2(WorkflowInstanceIdSchema,{value:instanceId}))},workflowExecutionContextCreator:{create:ec2=>executionContextCommand.create(ec2)},workflowExecutionApprovalForwarder:{submitApproval:input=>agentExecutionCommand.submitApproval(input)},workflowExecutionFileDecisionForwarder:{submitFileDecision:input=>agentExecutionCommand.submitFileDecision(input)},scheduleExecutionCreator:{create:(execution,fireCaller)=>agentExecutionCommand.create(execution,fireCaller===void 0?void 0:asCaller(fireCaller))},executionStatusWriter:{updateStatus:input=>agentExecutionCommand.updateStatus(input)},projectOrphanDeleter:{delete:(kind,resourceId)=>deleteByKind(kind,resourceId)},pluginMaterializer:{pushSkill:(request,caller)=>skillCommand.push(request,asCaller(caller)),applyMcpServer:(server,caller)=>mcpServerCommand.apply(server,asCaller(caller)),applyAgent:(agent,caller)=>agentCommand.apply(agent,asCaller(caller)),applyWorkflow:(workflow,caller)=>workflowCommand.apply(workflow,asCaller(caller)),updateVisibility:(kind,resourceId,visibility,caller)=>updateVisibilityByKind(kind,resourceId,visibility,asCaller(caller)),deleteByKind:(kind,resourceId,caller)=>deleteByKind(kind,resourceId,asCaller(caller))}};async function deleteByKind(kind,resourceId,options){switch(kind){case ApiResourceKind.agent:await agentCommand.delete(create2(AgentIdSchema,{value:resourceId}),options);return;case ApiResourceKind.workflow:await workflowCommand.delete(create2(WorkflowIdSchema,{value:resourceId}),options);return;case ApiResourceKind.mcp_server:await mcpServerCommand.delete(create2(ApiResourceDeleteInputSchema,{resourceId}),options);return;case ApiResourceKind.skill:await skillCommand.delete(create2(SkillIdSchema,{value:resourceId}),options);return;default:throw new Error(`unsupported resource kind for delete: ${ApiResourceKind[kind]??String(kind)}`)}}async function updateVisibilityByKind(kind,resourceId,visibility,options){let input=create2(UpdateVisibilityInputSchema,{resourceId,visibility});switch(kind){case ApiResourceKind.agent:await agentCommand.updateVisibility(input,options);return;case ApiResourceKind.workflow:await workflowCommand.updateVisibility(input,options);return;case ApiResourceKind.mcp_server:await mcpServerCommand.updateVisibility(input,options);return;case ApiResourceKind.skill:await skillCommand.updateVisibility(input,options);return;default:throw new Error(`unsupported resource kind for updateVisibility: ${ApiResourceKind[kind]??String(kind)}`)}}return{clients,transport}}async function composeServer(options){let{config:config2,logger:logger2}=options,extensions=resolveExtensions(options.extensions);extensions.unitNames.length>0&&logger2.info("extension units composed",{units:extensions.unitNames.join(", ")});let store;config2.databaseUrl!==""?(store=await PostgresStore.open(config2.databaseUrl,logger2),logger2.info("storage driver selected",{driver:"postgres"})):(store=SqliteStore.open(config2.dbPath,logger2),logger2.info("storage driver selected",{driver:"sqlite",dbPath:config2.dbPath}));let authEnabled=config2.oidcIssuer!=="",requireAuthentication=authEnabled||extensions.requireAuthentication!==void 0,authorizationPosture=authorizationPostureOf({unitAuthorizer:extensions.authorizer!==void 0,requireAuthentication}),builtInAuthorization=authorizationPosture!=="unit-authorizer";if(authorizationPosture==="built-in"&&extensions.edition!==ServerEdition.oss)throw new Error(`the composition serves edition '${ServerEdition[extensions.edition]}' under the require-authentication posture but registers no Authorizer \u2014 the built-in authorizer enforces the open-source kinds only; register an Authorizer or serve the open-source edition`);let identityAccounts=extensions.drivers.identityAccountStore??newResourceIdentityAccountStore(store),iamPolicies=extensions.drivers.iamPolicyStore??newResourceIamPolicyStore(store),iamPolicyGrantPath=newIamPolicyGrantPath({policies:iamPolicies,lifecycle:extensions.drivers.resourceAuthorizationLifecycle,logger:logger2}),authorizationLifecycle=extensions.drivers.resourceAuthorizationLifecycle,roleLifecycle=authorizationLifecycle??(builtInAuthorization?newBuiltInRoleLifecycle({grantPath:iamPolicyGrantPath,accounts:identityAccounts}):void 0),operatorIdentity=operatorIdentitySnapshot(),membership=builtInAuthorization?newMembershipRules({grantPath:iamPolicyGrantPath,policies:iamPolicies,store,operatorEmail:operatorIdentity.email}):void 0,runnerAuthService=RunnerAuthService.fromEnv(),runnerCredentials=extensions.drivers.runnerCredentialProvider??(authorizationPosture==="built-in"?newBuiltInRunnerCredentialProvider({service:runnerAuthService,store,accounts:identityAccounts}):newExecutionScopedRunnerCredentialProvider(runnerAuthService)),authorizer=extensions.authorizer??(authorizationPosture==="built-in"?newLaneAdmittedAuthorizer(newBuiltInAuthorizer({store,policies:iamPolicies,accounts:identityAccounts,edition:extensions.edition,logger:logger2}),caller=>isWorkflowBoundRunner(runnerAuthService,caller)):newPermissiveSingleTeamAuthorizer()),organizationDirectory=extensions.drivers.organizationDirectory??(authorizationPosture==="built-in"?newBuiltInOrganizationDirectory({store,policies:iamPolicies,accounts:identityAccounts}):void 0),scheduleFireCaller=extensions.drivers.scheduleFireCaller??(authorizationPosture==="built-in"?newBuiltInScheduleFireCaller({store,accounts:identityAccounts}):void 0),listReadScope=extensions.drivers.listReadScope??(authorizationPosture==="built-in"?newBuiltInListReadScope({store,policies:iamPolicies,accounts:identityAccounts,logger:logger2}):void 0);logger2.info("authorization posture resolved",{posture:authorizationPosture,authorizer:extensions.authorizer!==void 0?"extension":authorizationPosture==="built-in"?"built-in":"permissive",listReadScope:extensions.drivers.listReadScope!==void 0?"extension":authorizationPosture==="built-in"?"built-in":"none"});let identityAccountPath={accounts:identityAccounts,logger:logger2,authorizer,authorizationLifecycle:roleLifecycle},createIdentityAccount=newCreateAccountPath(identityAccountPath,ApiResourceKind.identity_account),issuerDiscovery=newIssuerDiscovery(),identityAccountProvisioner=newDirectAccountProvisioner({accounts:identityAccounts,createAccount:createIdentityAccount,userInfo:newOidcUserInfoClient(issuerDiscovery)});if(!requireAuthentication){let operator=await ensureOperatorAccount({accounts:identityAccounts,createAccount:createIdentityAccount},operatorIdentity);logger2.info("trusted-local operator account ensured",{accountId:operator.metadata?.id??""}),membership!==void 0&&(await membership.ensureOperatorOwnership(operator),logger2.info("trusted-local operator ownership ensured",{accountId:operator.metadata?.id??""}))}authorizationPosture==="built-in"&&membership!==void 0&&(await membership.ensureRolesForExistingAccounts(),logger2.info("built-in posture role reconciliation ensured"));let v1Key;try{v1Key=getOrCreateNamedKey(ENCRYPTION_KEY_ENV_VAR,ENCRYPTION_KEY_FILE_NAME)}catch(error2){logger2.warn("Failed to initialize encryption - secret values will be stored in plaintext",{error:error2 instanceof Error?error2.message:String(error2)}),v1Key=void 0}let secretCodecs=new Map([[V1_VERSION,new StaticKeySecretCodec(v1Key)],...extensions.drivers.secretCodecs]),writeVersionValue=process.env[ENCRYPTION_WRITE_VERSION_ENV_VAR]??"",secretService=SecretService.withCodecs({codecs:secretCodecs,writeVersion:writeVersionValue===""?DEFAULT_WRITE_VERSION:writeVersionValue});logger2.info("secret encryption configured",{writeVersion:writeVersionValue===""?DEFAULT_WRITE_VERSION:writeVersionValue,registeredCodecs:[...secretCodecs.keys()].sort()});let temporalConfig=newConfigFromEnv(),workflowExecutionTemporalConfig=newWorkflowExecutionConfigFromEnv(),sandboxProvisioner=newSandboxProvisioner(config2.sandboxProvisionerType,{config:{backendEndpoint:config2.sandboxBackendEndpoint,temporalAddress:config2.sandboxTemporalAddress,runnerImage:config2.sandboxRunnerImage,runnerCommand:config2.sandboxRunnerCommand,kubernetesNamespace:config2.sandboxKubernetesNamespace},logger:logger2},builtInSandboxProvisionerFactories(),extensions.drivers.sandboxProvisionerDrivers);if(sandboxProvisioner!==void 0&&temporalConfig.activityRouting!==ROUTING_SESSION&&workflowExecutionTemporalConfig.workflowActivityRouting!==WORKFLOW_ROUTING_EXECUTION)throw new Error(`SANDBOX_PROVISIONER_TYPE='${config2.sandboxProvisionerType}' requires a per-queue routing mode \u2014 set STIGMER_ACTIVITY_ROUTING=session and/or STIGMER_WORKFLOW_ACTIVITY_ROUTING=execution (a provisioner no dispatch can reach must fail loudly, not sit dark)`);let sandboxLane=newSandboxLane(sandboxProvisioner,runnerCredentials);sandboxLane.enabled&&logger2.info("sandbox provisioner composed",{type:config2.sandboxProvisionerType});let workflowSandboxTerminalObserver=newWorkflowSandboxTerminalObserver(sandboxLane,logger2),healthState=new HealthState,modelCatalog,ossModelRegistryStore;extensions.drivers.modelCatalogProvider!==void 0?modelCatalog=extensions.drivers.modelCatalogProvider:(ossModelRegistryStore=new ModelRegistryStore({bundledDocument:bundledModelRegistryDocument(),upstreamOrigin:config2.modelRegistryUpstream,refreshEnabled:config2.modelRegistryRefreshEnabled,logger:logger2,fetchImpl:options.fetchImpl}),modelCatalog=ossModelRegistryStore);let registryLanes=createRegistryLanes({taskKindRegistryDocument:bundledTaskKindRegistryDocument(),modelRegistryStore:modelCatalog}),workflowValidator=new InProcessValidator(modelCatalog,logger2),agentExecutionStreamBroker=new StreamBroker(logger2),workflowExecutionStreamBroker=new StreamBroker2(logger2),scheduleTemporalConfig=newScheduleConfigFromEnv(),scheduleClientProvider=()=>temporalManager.getClient(),scheduleArtifact=new ScheduleArtifact(scheduleTemporalConfig),scheduleSyncer=new ScheduleSyncer(scheduleClientProvider,store,scheduleArtifact,logger2),scheduleRunStarter=new RunStarter({store,config:scheduleTemporalConfig,executions:{create:(execution,fireCaller)=>requireInProcess().scheduleExecutionCreator.create(execution,fireCaller)},fireCallerMint:scheduleFireCaller,logger:logger2}),scheduleReconciler=new ScheduleReconciler(scheduleClientProvider,store,scheduleSyncer,scheduleTemporalConfig,logger2),temporalManager=new TemporalManager({hostPort:config2.temporalHostPort,namespace:config2.temporalNamespace,logger:logger2,payloadCodecs:loadServerPayloadCodecs(runnerCredentials.resolvePayloadKey?.bind(runnerCredentials)),workerFactories:[newAgentExecutionWorkerFactory({store,logger:logger2,statusWriter:()=>requireInProcess().executionStatusWriter,temporalConfig}),newWorkflowExecutionWorkerFactory({store,logger:logger2,broker:workflowExecutionStreamBroker,temporalConfig:workflowExecutionTemporalConfig,sandboxTerminalObserver:workflowSandboxTerminalObserver}),newScheduleWorkerFactory({store,config:scheduleTemporalConfig,syncer:scheduleSyncer,runStarter:scheduleRunStarter,logger:logger2}),...extensions.workers]}),executionEngineState=newExecutionEngineStateProvider({manager:temporalManager,config:temporalConfig,store,runnerCredentials,logger:logger2}),workflowExecutionEngineState=newWorkflowExecutionEngineStateProvider({manager:temporalManager,config:workflowExecutionTemporalConfig,runnerCredentials,logger:logger2}),artifactStorage=newArtifactStorage({type:config2.artifactStorageType,localBasePath:config2.artifactLocalBasePath,localServeUrl:config2.artifactLocalServeUrl,r2Bucket:config2.r2Bucket,r2Endpoint:config2.r2Endpoint,r2AccessKeyId:config2.r2AccessKeyId,r2SecretAccessKey:config2.r2SecretAccessKey,r2Region:config2.r2Region},extensions.drivers.artifactStorageDrivers),artifactFileServer=config2.artifactStorageType==="local"?createArtifactFileServer({basePath:config2.artifactLocalBasePath,logger:logger2}):void 0,skillUploadSlots=new UploadSlots(import_node_path18.default.join(config2.storagePath,"skills-staging"),DEFAULT_SLOT_TTL_MS,104857600),skillStorageDriver=(()=>{let skillType=config2.skillArtifactStorageType===""?"local":config2.skillArtifactStorageType;return skillType==="local"?((0,import_node_fs15.mkdirSync)(import_node_path18.default.join(config2.storagePath,"skills"),{recursive:!0,mode:493}),new LocalArtifactStorage(config2.storagePath,"",{mint:declaredSizeBytes=>skillUploadSlots.mint(declaredSizeBytes),uploadUrl:ref=>uploadUrl(config2.skillTransferBaseUrl,ref),stagedKey:ref=>`skills-staging/${skillUploadSlots.stagedFileName(ref)}`})):newArtifactStorage({type:skillType,localBasePath:config2.storagePath,localServeUrl:"",r2Bucket:config2.r2Bucket,r2Endpoint:config2.r2Endpoint,r2AccessKeyId:config2.r2AccessKeyId,r2SecretAccessKey:config2.r2SecretAccessKey,r2Region:config2.r2Region},extensions.drivers.artifactStorageDrivers)})(),skillArtifactStorage=newSkillArtifactStorage(skillStorageDriver),pluginArtifactStorage=newContentAddressedArchiveStore(skillStorageDriver,PLUGIN_ARTIFACT_KEY_PREFIX),skillTransferLane=newSkillTransferLane(skillUploadSlots,skillArtifactStorage,logger2),consoleAssets=resolveConsoleAssets(config2.consoleDir,logger2);consoleAssets!==void 0?logger2.info("web console serving from unified port",{dir:consoleAssets.root,files:consoleAssets.fileCount}):logger2.debug("no web console export bundled; console lane disabled");let consoleSignIn=authEnabled?{posture:"oidc",issuer:config2.oidcIssuer,audience:config2.oidcAudience,consoleClientId:config2.oidcConsoleClientId}:{posture:"trusted-local"};consoleAssets!==void 0&&consoleSignIn.posture==="oidc"&&consoleSignIn.consoleClientId===""&&logger2.warn("STIGMER_OIDC_ISSUER is set but STIGMER_OIDC_CONSOLE_CLIENT_ID is not \u2014 the web console this server serves cannot sign in; register a public PKCE client for the console at the issuer and set it");let consoleLane=consoleAssets!==void 0?createConsoleLane({assets:consoleAssets,signIn:consoleSignIn,logger:logger2}):void 0,searchRegistry=newSearchableResourceRegistry();searchRegistry.validateExpectedKinds(logger2);let searchQueryStore=new SqliteSearchQueryStore(store,searchRegistry,logger2),searchHandler=new SearchHandler(searchQueryStore,logger2,listReadScope),activityHandler=new ActivityHandler(store,logger2,listReadScope),environmentResolution=new RuntimeResolutionService(store,secretService,logger2),managedEnvService=new ManagedEnvironmentService({getSecretValue:input=>requireInProcess().executionEnvironmentReader.getSecretValue(input),updateVariables:request=>requireInProcess().executionEnvironmentReader.updateVariables(request),create:(environment,caller)=>requireInProcess().executionEnvironmentReader.create(environment,caller),delete:input=>requireInProcess().executionEnvironmentReader.delete(input)},logger2),mcpServerEngineState=newMcpServerEngineStateProvider({manager:temporalManager,config:temporalConfig,logger:logger2});config2.oauthRedirectUri===""&&logger2.warn("STIGMER_OAUTH_REDIRECT_URI is not set \u2014 OAuth Connect flows for MCP servers are unavailable (initiateOAuthConnect will refuse)");let inProcess;function requireInProcess(){if(inProcess===void 0)throw new Error("in-process clients not wired (boot ordering bug)");return inProcess}let routes=router=>{registerHealthService(router,healthState),registerOrganizationServices(router,{store,logger:logger2,authorizer,gateSteps:extensions.gateSteps,authorizationLifecycle:roleLifecycle,organizationDirectory}),registerApiKeyServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope}),registerIdentityAccountServices(router,{...identityAccountPath,provisioner:identityAccountProvisioner,federation:extensions.drivers.identityFederation,gateSteps:extensions.gateSteps,membership}),registerIamPolicyServices(router,{grantPath:iamPolicyGrantPath,policies:iamPolicies,accounts:identityAccounts,authorizer,grantScope:extensions.drivers.policyGrantScope??newOrganizationOnlyGrantScope(),queries:extensions.drivers.authorizationQueries,edition:extensions.edition,logger:logger2}),registerEnvironmentServices(router,{store,logger:logger2,authorizer,secretService,authorizationLifecycle,listReadScope}),registerOAuthAppServices(router,{store,secretService,logger:logger2,authorizer,authorizationLifecycle}),registerExecutionContextServices(router,{store,logger:logger2,authorizer,secretService,runnerAuthService:runnerCredentials,authorizationLifecycle}),registerAgentServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,agentInstanceApplier:()=>requireInProcess().agentInstanceApplier}),registerAgentInstanceServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,parentAgentLoader:()=>requireInProcess().parentAgentLoader,listReadScope}),registerSessionServices(router,{store,logger:logger2,authorizer,temporalConfig,agentInstanceCreator:()=>requireInProcess().agentInstanceCreator,gateSteps:extensions.gateSteps,sandboxLane,authorizationLifecycle,listReadScope}),registerAgentShareServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope}),registerAgentChannelServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,modelRegistry:modelCatalog,channelRuntime:extensions.drivers.channelRuntime}),registerChannelMessageServices(router,extensions.drivers.channelRuntime),registerChannelConversationServices(router,extensions.drivers.channelRuntime),registerChannelAppServices(router,{store,logger:logger2,authorizer,secretService,authorizationLifecycle}),registerScheduleServices(router,{store,logger:logger2,authorizer,modelRegistry:modelCatalog,clock:()=>scheduleSyncer,runner:()=>scheduleRunStarter,authorizationLifecycle,listReadScope}),registerMemoryServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,runnerCredentialProvider:runnerCredentials}),registerAgentExecutionServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,runnerCredentialProvider:runnerCredentials,broker:agentExecutionStreamBroker,engineState:executionEngineState,modelRegistry:modelCatalog,artifactStorage,gateSteps:extensions.gateSteps,statusObservers:extensions.statusObservers,responseDecorators:extensions.responseDecorators,sandboxLane,temporalConfig,agentLoader:()=>requireInProcess().executionAgentLoader,agentInstanceCreator:()=>requireInProcess().executionAgentInstanceCreator,sessionCreator:()=>requireInProcess().executionSessionCreator,executionContextBuilder:{store,logger:logger2,agentLoader:()=>requireInProcess().executionAgentLoader,agentInstanceLoader:()=>requireInProcess().executionAgentInstanceLoader,sessionLoader:()=>requireInProcess().executionSessionLoader,environmentReader:()=>requireInProcess().executionEnvironmentReader,environmentResolution,executionContextCreator:()=>requireInProcess().executionContextCreator,managedEnvService}}),registerWorkflowServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,validator:workflowValidator,workflowInstanceCreator:()=>requireInProcess().workflowInstanceCreator}),registerWorkflowInstanceServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,parentWorkflowLoader:()=>requireInProcess().parentWorkflowLoader,listReadScope}),registerWorkflowExecutionServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,gateSteps:extensions.gateSteps,engineState:workflowExecutionEngineState,broker:workflowExecutionStreamBroker,sandboxLane,temporalConfig:workflowExecutionTemporalConfig,sandboxTerminalObserver:workflowSandboxTerminalObserver,workflowInstanceCreator:()=>requireInProcess().workflowExecutionInstanceCreator,approvalForwarder:()=>requireInProcess().workflowExecutionApprovalForwarder,fileDecisionForwarder:()=>requireInProcess().workflowExecutionFileDecisionForwarder,executionContextBuilder:{store,logger:logger2,workflowInstanceLoader:()=>requireInProcess().workflowExecutionInstanceLoader,environmentResolution,executionContextCreator:()=>requireInProcess().workflowExecutionContextCreator}}),registerMcpServerServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,connect:{store,logger:logger2,authorizer,engineState:mcpServerEngineState,environmentReader:{list:request=>requireInProcess().executionEnvironmentReader.list(request),getSecretValue:input=>requireInProcess().executionEnvironmentReader.getSecretValue(input)},executionContext:{create:(ec2,caller)=>requireInProcess().connectExecutionContextClient.create(ec2,caller),delete:input=>requireInProcess().connectExecutionContextClient.delete(input)},runnerAuth:runnerCredentials,managedEnv:managedEnvService,oauthGrants:store.oauthGrants,pendingOAuthStates:store.pendingOAuthStates,secretService,oauthRedirectUri:config2.oauthRedirectUri}}),registerSkillServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,artifactStorage:skillArtifactStorage,executionArtifactStorage:artifactStorage,transferLane:{slots:skillUploadSlots,baseUrl:config2.skillTransferBaseUrl}}),registerPluginServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,artifactStorage:pluginArtifactStorage,materializerProvider:()=>requireInProcess().pluginMaterializer,transferLane:{slots:skillUploadSlots,baseUrl:config2.skillTransferBaseUrl}}),registerArtifactServices(router,{store,artifactStorage,logger:logger2,authorizer}),registerProjectServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,orphanDeleter:()=>requireInProcess().projectOrphanDeleter}),registerSearchServices(router,{handler:searchHandler,logger:logger2}),registerActivityServices(router,{handler:activityHandler,logger:logger2}),registerGitHubServices(router,{clientId:config2.gitHubOAuthClientId,clientSecret:config2.gitHubOAuthClientSecret,logger:logger2,fetchImpl:options.fetchImpl}),registerPlatformServices(router,{temporalHostPort:config2.temporalHostPort,temporalNamespace:config2.temporalNamespace,runnerAuthService:runnerCredentials,edition:extensions.edition,licenseStatus:extensions.drivers.licenseStatus??ABSENT_LICENSE_STATUS,now:()=>new Date,logger:logger2});for(let registerExtensionServices of extensions.services)registerExtensionServices(router)},inProcessWiring=createInProcessClients(routes,logger2);inProcess=inProcessWiring.clients;let identityVerifiers=[...requireAuthentication?[newApiKeyIdentityVerifier({store,accounts:identityAccounts})]:[],...authorizationPosture==="built-in"?[newRunnerSubjectIdentityVerifier({store,accounts:identityAccounts,credentials:runnerCredentials})]:[],...authEnabled?[newOidcIdentityVerifier({issuer:config2.oidcIssuer,audience:config2.oidcAudience,accounts:identityAccounts,discovery:issuerDiscovery})]:[],...extensions.identityVerifiers];if(extensions.requireAuthentication!==void 0&&extensions.identityVerifiers.length===0)throw new Error(`extension '${extensions.requireAuthentication.declaredBy}' declares the require-authentication posture, but registers no identity verifier of its own \u2014 the OSS API-key lane alone cannot admit the first caller (nobody could mint a key), so every non-public request would be refused; register a verifier or omit the declaration`);let postureSources=[...authEnabled?["oidc-issuer"]:[],...extensions.requireAuthentication!==void 0?[`extension '${extensions.requireAuthentication.declaredBy}'`]:[]];logger2.info("authentication posture resolved",{posture:requireAuthentication?"required":"trusted-local",source:postureSources.length>0?postureSources.join(" + "):"none",verifiers:identityVerifiers.map(v=>v.name).join(", ")});let server=createUnifiedPortServer({logger:logger2,routes,interceptors:buildInterceptorChain(logger2,createVerifierChainInterceptor(identityVerifiers,extensions.callerGuards,logger2,requireAuthentication),{errorBoundary:createErrorBoundaryInterceptor(logger2,extensions.drivers.visitorErrorPolicy),requestMetrics:createRequestMetricsInterceptor()}),taskKindRegistryLane:registryLanes.taskKindRegistryLane,modelRegistryLane:registryLanes.modelRegistryLane,skillTransferLane,consoleLane});return{healthState,store,secrets:secretService,temporalManager,runnerAuthService,agentExecutionStreamBroker,workflowExecutionStreamBroker,inProcessTransport:inProcessWiring.transport,identityVerifiers,routes,async start(){await temporalManager.initialConnect()&&await temporalManager.startWorkers(),temporalManager.startHealthMonitor();let kickScheduleReconcile=scheduleReconciler.startReconciliation();temporalManager.addReconnectHook(kickScheduleReconcile),await artifactStorage.health();try{let indexed=await searchQueryStore.rebuildIndex();logger2.info("Search index rebuilt at startup",{indexed})}catch(error2){logger2.warn("Failed to rebuild search index at startup",{error:error2 instanceof Error?error2.message:String(error2)})}await initRpcMetrics(),logger2.info("request metrics",{posture:await metricsExportPosture(),instruments:"stigmer.grpc.request.count, stigmer.grpc.request.duration"}),healthState.setOverall(HealthCheckResponse_ServingStatus.SERVING),ossModelRegistryStore?.startRefresh();let port=await server.listen(options.portOverride??config2.grpcPort,options.host);if(logger2.info("stigmer-server listening",{port}),artifactFileServer!==void 0){await warnOnLegacyArtifactLayout(config2.artifactLocalBasePath,logger2);try{await artifactFileServer.listen(config2.artifactHttpPort,config2.artifactHttpHost)}catch(error2){logger2.error("Artifact HTTP file server failed",{error:error2 instanceof Error?error2.message:String(error2)})}}return port},async shutdown(){healthState.setOverall(HealthCheckResponse_ServingStatus.NOT_SERVING),ossModelRegistryStore?.stopRefresh(),await artifactFileServer?.shutdown(),await scheduleReconciler.stop(),await temporalManager.close(),await server.shutdown(),await store.close(),logger2.info("stigmer-server stopped")}}}var LEVEL_RANK={debug:10,info:20,warn:30,error:40};function createLogger(options){let threshold=LEVEL_RANK[options.level]??LEVEL_RANK.info,write2=options.write??(line=>process.stderr.write(line+`
+`,"latin1");function createProtocolDemuxServer(targets){return(0,import_node_net2.createServer)({noDelay:!0},socket=>{routeByPreface(socket,targets)})}function routeByPreface(socket,targets){let peeked=[],peekedLength=0,cleanup=()=>{socket.removeListener("data",onData),socket.removeListener("error",onPeekError),socket.removeListener("close",cleanup)},onPeekError=()=>{cleanup(),socket.destroy()},onData=chunk=>{peeked.push(chunk),peekedLength+=chunk.length;let seen=Buffer.concat(peeked,Math.min(peekedLength,HTTP2_CONNECTION_PREFACE.length)),comparable=seen.subarray(0,Math.min(seen.length,HTTP2_CONNECTION_PREFACE.length));if(!HTTP2_CONNECTION_PREFACE.subarray(0,comparable.length).equals(comparable)){handoffHttp1();return}if(peekedLength>=HTTP2_CONNECTION_PREFACE.length){handoffHttp2();return}};function handoffHttp1(){cleanup(),socket.pause(),socket.unshift(Buffer.concat(peeked,peekedLength)),targets.http1.emit("connection",socket),socket.resume()}function handoffHttp2(){cleanup(),socket.pause();let replay=createReplayDuplex(socket,Buffer.concat(peeked,peekedLength));targets.http2.emit("connection",replay)}socket.on("data",onData),socket.on("error",onPeekError),socket.on("close",cleanup)}function createReplayDuplex(socket,head){let replay=new import_node_stream13.Duplex({read(){socket.resume()},write(chunk,encoding,callback){socket.write(chunk,encoding,callback)},final(callback){socket.end(callback)},destroy(error2,callback){socket.destroy(),callback(error2)}});return socket.on("data",chunk=>{replay.push(chunk)||socket.pause()}),socket.on("end",()=>{replay.push(null)}),socket.on("error",error2=>{replay.destroy(error2)}),replay.push(head),replay}function createUnifiedPortServer(options){let rpcHandler=connectNodeAdapter({routes:options.routes,interceptors:options.interceptors,readMaxBytes:10485760,writeMaxBytes:10485760}),laneRouter=(request,response)=>{let path14=(request.url??"").split("?",1)[0]??"";if(path14===TASK_KIND_REGISTRY_PATH){options.taskKindRegistryLane(request,response);return}if(path14===MODEL_REGISTRY_PATH){options.modelRegistryLane(request,response);return}if(options.skillTransferLane!==void 0&&path14.startsWith(SKILL_ARTIFACTS_PATH_PREFIX)){options.skillTransferLane(request,response);return}if(options.consoleLane!==void 0&&consoleLaneEligible(request)){options.consoleLane(request,response);return}if(isRpcPreflight(request)){handleRpcPreflight(request,response);return}applyRpcCorsHeaders(request,response),rpcHandler(request,response)},http1=(0,import_node_http4.createServer)(laneRouter),http22=(0,import_node_http22.createServer)(laneRouter),liveSessions=new Set;http22.on("session",session=>{liveSessions.add(session),session.on("close",()=>liveSessions.delete(session)),armKeepalivePings(session,options.logger)}),http22.on("sessionError",error2=>{options.logger.debug("http2 session error",{error:String(error2)})});let demux=createProtocolDemuxServer({http1,http2:http22}),liveSockets=new Set;return demux.on("connection",socket=>{liveSockets.add(socket),socket.on("close",()=>liveSockets.delete(socket))}),{listen(port,host="0.0.0.0"){return new Promise((resolve,reject2)=>{demux.once("error",reject2),demux.listen(port,host,()=>{let address=demux.address();if(address===null||typeof address=="string"){reject2(new Error("unified port bound without a TCP address"));return}resolve(address.port)})})},async shutdown(){let closed=new Promise(resolve=>demux.close(()=>resolve()));http1.close(),http1.closeIdleConnections(),http22.close();for(let session of liveSessions)session.close();await Promise.race([closed.then(()=>!0),new Promise(resolve=>setTimeout(()=>resolve(!1),1e4).unref())])||options.logger.warn("shutdown drain budget exhausted; destroying remaining connections",{remaining:liveSockets.size});for(let socket of liveSockets)socket.destroy();await closed}}}function armKeepalivePings(session,logger2){let interval=setInterval(()=>{let acked=!1,deadline=setTimeout(()=>{!acked&&!session.destroyed&&(logger2.debug("closing http2 session: keepalive ping unacknowledged"),session.destroy())},5e3);deadline.unref();try{session.ping(()=>{acked=!0,clearTimeout(deadline)})}catch{clearTimeout(deadline),session.destroyed||session.destroy()}},15e3);interval.unref(),session.on("close",()=>clearInterval(interval))}function createInProcessClients(routes,logger2){let transport=createRouterTransport(routes,{router:{interceptors:buildInterceptorChain(logger2,createInProcessCallerInterceptor())}}),agentInstanceCommand=createClient(AgentInstanceCommandController,transport),agentInstanceQuery=createClient(AgentInstanceQueryController,transport),agentQuery=createClient(AgentQueryController,transport),sessionCommand=createClient(SessionCommandController,transport),sessionQuery=createClient(SessionQueryController,transport),environmentCommand=createClient(EnvironmentCommandController,transport),environmentQuery=createClient(EnvironmentQueryController,transport),executionContextCommand=createClient(ExecutionContextCommandController,transport),workflowInstanceCommand=createClient(WorkflowInstanceCommandController,transport),workflowInstanceQuery=createClient(WorkflowInstanceQueryController,transport),workflowQuery=createClient(WorkflowQueryController,transport),agentExecutionCommand=createClient(AgentExecutionCommandController,transport),agentCommand=createClient(AgentCommandController,transport),workflowCommand=createClient(WorkflowCommandController,transport),mcpServerCommand=createClient(McpServerCommandController,transport),skillCommand=createClient(SkillCommandController,transport),asCaller=caller=>({headers:{[IN_PROCESS_CALLER_HEADER]:encodeInProcessCaller(caller)}}),clients={agentInstanceApplier:{applyAsCaller:(instance,caller)=>agentInstanceCommand.apply(instance,asCaller(caller))},agentInstanceCreator:{createAsCaller:(instance,caller)=>agentInstanceCommand.create(instance,asCaller(caller))},parentAgentLoader:{get:agentId=>agentQuery.get(create2(AgentIdSchema,{value:agentId}))},workflowInstanceCreator:{createAsCaller:(instance,caller)=>workflowInstanceCommand.create(instance,asCaller(caller))},parentWorkflowLoader:{get:workflowId=>workflowQuery.get(create2(WorkflowIdSchema,{value:workflowId}))},executionAgentLoader:{get:agentId=>agentQuery.get(create2(AgentIdSchema,{value:agentId}))},executionAgentInstanceLoader:{get:instanceId=>agentInstanceQuery.get(create2(AgentInstanceIdSchema,{value:instanceId}))},executionAgentInstanceCreator:{createAsCaller:(instance,caller)=>agentInstanceCommand.create(instance,asCaller(caller))},executionSessionLoader:{get:sessionId=>sessionQuery.get(create2(SessionIdSchema,{value:sessionId}))},executionSessionCreator:{createAsCaller:(session,caller)=>sessionCommand.create(session,asCaller(caller))},executionEnvironmentReader:{list:request=>environmentQuery.list(request),getSecretValue:input=>environmentQuery.getSecretValue(input),updateVariables:request=>environmentCommand.updateVariables(request),create:(environment,caller)=>environmentCommand.create(environment,caller===void 0?void 0:asCaller(caller)),delete:input=>environmentCommand.delete(input)},executionContextCreator:{create:ec2=>executionContextCommand.create(ec2)},connectExecutionContextClient:{create:(ec2,caller)=>executionContextCommand.create(ec2,asCaller(caller)),delete:input=>executionContextCommand.delete(input)},workflowExecutionInstanceCreator:{createAsCaller:(instance,caller)=>workflowInstanceCommand.create(instance,asCaller(caller))},workflowExecutionInstanceLoader:{get:instanceId=>workflowInstanceQuery.get(create2(WorkflowInstanceIdSchema,{value:instanceId}))},workflowExecutionContextCreator:{create:ec2=>executionContextCommand.create(ec2)},workflowExecutionApprovalForwarder:{submitApproval:input=>agentExecutionCommand.submitApproval(input)},workflowExecutionFileDecisionForwarder:{submitFileDecision:input=>agentExecutionCommand.submitFileDecision(input)},scheduleExecutionCreator:{create:(execution,fireCaller)=>agentExecutionCommand.create(execution,fireCaller===void 0?void 0:asCaller(fireCaller))},executionStatusWriter:{updateStatus:input=>agentExecutionCommand.updateStatus(input)},projectOrphanDeleter:{delete:(kind,resourceId)=>deleteByKind(kind,resourceId)},pluginMaterializer:{pushSkill:(request,caller)=>skillCommand.push(request,asCaller(caller)),applyMcpServer:(server,caller)=>mcpServerCommand.apply(server,asCaller(caller)),applyAgent:(agent,caller)=>agentCommand.apply(agent,asCaller(caller)),applyWorkflow:(workflow,caller)=>workflowCommand.apply(workflow,asCaller(caller)),updateVisibility:(kind,resourceId,visibility,caller)=>updateVisibilityByKind(kind,resourceId,visibility,asCaller(caller)),deleteByKind:(kind,resourceId,caller)=>deleteByKind(kind,resourceId,asCaller(caller))}};async function deleteByKind(kind,resourceId,options){switch(kind){case ApiResourceKind.agent:await agentCommand.delete(create2(AgentIdSchema,{value:resourceId}),options);return;case ApiResourceKind.workflow:await workflowCommand.delete(create2(WorkflowIdSchema,{value:resourceId}),options);return;case ApiResourceKind.mcp_server:await mcpServerCommand.delete(create2(ApiResourceDeleteInputSchema,{resourceId}),options);return;case ApiResourceKind.skill:await skillCommand.delete(create2(SkillIdSchema,{value:resourceId}),options);return;default:throw new Error(`unsupported resource kind for delete: ${ApiResourceKind[kind]??String(kind)}`)}}async function updateVisibilityByKind(kind,resourceId,visibility,options){let input=create2(UpdateVisibilityInputSchema,{resourceId,visibility});switch(kind){case ApiResourceKind.agent:await agentCommand.updateVisibility(input,options);return;case ApiResourceKind.workflow:await workflowCommand.updateVisibility(input,options);return;case ApiResourceKind.mcp_server:await mcpServerCommand.updateVisibility(input,options);return;case ApiResourceKind.skill:await skillCommand.updateVisibility(input,options);return;default:throw new Error(`unsupported resource kind for updateVisibility: ${ApiResourceKind[kind]??String(kind)}`)}}return{clients,transport}}async function composeServer(options){let{config:config2,logger:logger2}=options,extensions=resolveExtensions(options.extensions);extensions.unitNames.length>0&&logger2.info("extension units composed",{units:extensions.unitNames.join(", ")});let store;config2.databaseUrl!==""?(store=await PostgresStore.open(config2.databaseUrl,logger2),logger2.info("storage driver selected",{driver:"postgres"})):(store=SqliteStore.open(config2.dbPath,logger2),logger2.info("storage driver selected",{driver:"sqlite",dbPath:config2.dbPath}));let authEnabled=config2.oidcIssuer!=="",requireAuthentication=authEnabled||extensions.requireAuthentication!==void 0,authorizationPosture=authorizationPostureOf({unitAuthorizer:extensions.authorizer!==void 0,requireAuthentication}),builtInAuthorization=authorizationPosture!=="unit-authorizer";if(authorizationPosture==="built-in"&&extensions.edition!==ServerEdition.oss)throw new Error(`the composition serves edition '${ServerEdition[extensions.edition]}' under the require-authentication posture but registers no Authorizer \u2014 the built-in authorizer enforces the open-source kinds only; register an Authorizer or serve the open-source edition`);let identityAccounts=extensions.drivers.identityAccountStore??newResourceIdentityAccountStore(store),iamPolicies=extensions.drivers.iamPolicyStore??newResourceIamPolicyStore(store),iamPolicyGrantPath=newIamPolicyGrantPath({policies:iamPolicies,lifecycle:extensions.drivers.resourceAuthorizationLifecycle,logger:logger2}),authorizationLifecycle=extensions.drivers.resourceAuthorizationLifecycle,roleLifecycle=authorizationLifecycle??(builtInAuthorization?newBuiltInRoleLifecycle({grantPath:iamPolicyGrantPath,accounts:identityAccounts}):void 0),operatorIdentity=operatorIdentitySnapshot(),membership=builtInAuthorization?newMembershipRules({grantPath:iamPolicyGrantPath,policies:iamPolicies,store,operatorEmail:operatorIdentity.email}):void 0,runnerAuthService=RunnerAuthService.fromEnv(),runnerCredentials=extensions.drivers.runnerCredentialProvider??(authorizationPosture==="built-in"?newBuiltInRunnerCredentialProvider({service:runnerAuthService,store,accounts:identityAccounts}):newExecutionScopedRunnerCredentialProvider(runnerAuthService)),authorizer=extensions.authorizer??(authorizationPosture==="built-in"?newLaneAdmittedAuthorizer(newBuiltInAuthorizer({store,policies:iamPolicies,accounts:identityAccounts,edition:extensions.edition,logger:logger2}),caller=>isWorkflowBoundRunner(runnerAuthService,caller)):newPermissiveSingleTeamAuthorizer()),organizationDirectory=extensions.drivers.organizationDirectory??(authorizationPosture==="built-in"?newBuiltInOrganizationDirectory({store,policies:iamPolicies,accounts:identityAccounts}):void 0),scheduleFireCaller=extensions.drivers.scheduleFireCaller??(authorizationPosture==="built-in"?newBuiltInScheduleFireCaller({store,accounts:identityAccounts}):void 0),listReadScope=extensions.drivers.listReadScope??(authorizationPosture==="built-in"?newBuiltInListReadScope({store,policies:iamPolicies,accounts:identityAccounts,logger:logger2}):void 0);logger2.info("authorization posture resolved",{posture:authorizationPosture,authorizer:extensions.authorizer!==void 0?"extension":authorizationPosture==="built-in"?"built-in":"permissive",listReadScope:extensions.drivers.listReadScope!==void 0?"extension":authorizationPosture==="built-in"?"built-in":"none"});let identityAccountPath={accounts:identityAccounts,logger:logger2,authorizer,authorizationLifecycle:roleLifecycle},createIdentityAccount=newCreateAccountPath(identityAccountPath,ApiResourceKind.identity_account),issuerDiscovery=newIssuerDiscovery(),identityAccountProvisioner=newDirectAccountProvisioner({accounts:identityAccounts,createAccount:createIdentityAccount,userInfo:newOidcUserInfoClient(issuerDiscovery)});if(!requireAuthentication){let operator=await ensureOperatorAccount({accounts:identityAccounts,createAccount:createIdentityAccount},operatorIdentity);logger2.info("trusted-local operator account ensured",{accountId:operator.metadata?.id??""}),membership!==void 0&&(await membership.ensureOperatorOwnership(operator),logger2.info("trusted-local operator ownership ensured",{accountId:operator.metadata?.id??""}))}authorizationPosture==="built-in"&&membership!==void 0&&(await membership.ensureRolesForExistingAccounts(),logger2.info("built-in posture role reconciliation ensured"));let v1Key;try{v1Key=getOrCreateNamedKey(ENCRYPTION_KEY_ENV_VAR,ENCRYPTION_KEY_FILE_NAME)}catch(error2){logger2.warn("Failed to initialize encryption - secret values will be stored in plaintext",{error:error2 instanceof Error?error2.message:String(error2)}),v1Key=void 0}let secretCodecs=new Map([[V1_VERSION,new StaticKeySecretCodec(v1Key)],...extensions.drivers.secretCodecs]),writeVersionValue=process.env[ENCRYPTION_WRITE_VERSION_ENV_VAR]??"",secretService=SecretService.withCodecs({codecs:secretCodecs,writeVersion:writeVersionValue===""?DEFAULT_WRITE_VERSION:writeVersionValue});logger2.info("secret encryption configured",{writeVersion:writeVersionValue===""?DEFAULT_WRITE_VERSION:writeVersionValue,registeredCodecs:[...secretCodecs.keys()].sort()});let temporalConfig=newConfigFromEnv(),workflowExecutionTemporalConfig=newWorkflowExecutionConfigFromEnv(),sandboxProvisioner=newSandboxProvisioner(config2.sandboxProvisionerType,{config:{backendEndpoint:config2.sandboxBackendEndpoint,temporalAddress:config2.sandboxTemporalAddress,runnerImage:config2.sandboxRunnerImage,runnerCommand:config2.sandboxRunnerCommand,kubernetesNamespace:config2.sandboxKubernetesNamespace},logger:logger2},builtInSandboxProvisionerFactories(),extensions.drivers.sandboxProvisionerDrivers);if(sandboxProvisioner!==void 0&&temporalConfig.activityRouting!==ROUTING_SESSION&&workflowExecutionTemporalConfig.workflowActivityRouting!==WORKFLOW_ROUTING_EXECUTION)throw new Error(`SANDBOX_PROVISIONER_TYPE='${config2.sandboxProvisionerType}' requires a per-queue routing mode \u2014 set STIGMER_ACTIVITY_ROUTING=session and/or STIGMER_WORKFLOW_ACTIVITY_ROUTING=execution (a provisioner no dispatch can reach must fail loudly, not sit dark)`);let sandboxLane=newSandboxLane(sandboxProvisioner,runnerCredentials);sandboxLane.enabled&&logger2.info("sandbox provisioner composed",{type:config2.sandboxProvisionerType});let workflowSandboxTerminalObserver=newWorkflowSandboxTerminalObserver(sandboxLane,logger2),healthState=new HealthState,modelCatalog,ossModelRegistryStore;extensions.drivers.modelCatalogProvider!==void 0?modelCatalog=extensions.drivers.modelCatalogProvider:(ossModelRegistryStore=new ModelRegistryStore({bundledDocument:bundledModelRegistryDocument(),upstreamOrigin:config2.modelRegistryUpstream,refreshEnabled:config2.modelRegistryRefreshEnabled,logger:logger2,fetchImpl:options.fetchImpl}),modelCatalog=ossModelRegistryStore);let registryLanes=createRegistryLanes({taskKindRegistryDocument:bundledTaskKindRegistryDocument(),modelRegistryStore:modelCatalog}),workflowValidator=new InProcessValidator(modelCatalog,logger2),agentExecutionStreamBroker=new StreamBroker(logger2),workflowExecutionStreamBroker=new StreamBroker2(logger2),scheduleTemporalConfig=newScheduleConfigFromEnv(),scheduleClientProvider=()=>temporalManager.getClient(),scheduleArtifact=new ScheduleArtifact(scheduleTemporalConfig),scheduleSyncer=new ScheduleSyncer(scheduleClientProvider,store,scheduleArtifact,logger2),scheduleRunStarter=new RunStarter({store,config:scheduleTemporalConfig,executions:{create:(execution,fireCaller)=>requireInProcess().scheduleExecutionCreator.create(execution,fireCaller)},fireCallerMint:scheduleFireCaller,logger:logger2}),scheduleReconciler=new ScheduleReconciler(scheduleClientProvider,store,scheduleSyncer,scheduleTemporalConfig,logger2),temporalManager=new TemporalManager({hostPort:config2.temporalHostPort,namespace:config2.temporalNamespace,logger:logger2,payloadCodecs:loadServerPayloadCodecs(runnerCredentials.resolvePayloadKey?.bind(runnerCredentials)),workerFactories:[newAgentExecutionWorkerFactory({store,logger:logger2,statusWriter:()=>requireInProcess().executionStatusWriter,temporalConfig}),newWorkflowExecutionWorkerFactory({store,logger:logger2,broker:workflowExecutionStreamBroker,temporalConfig:workflowExecutionTemporalConfig,sandboxTerminalObserver:workflowSandboxTerminalObserver}),newScheduleWorkerFactory({store,config:scheduleTemporalConfig,syncer:scheduleSyncer,runStarter:scheduleRunStarter,logger:logger2}),...extensions.workers]}),executionEngineState=newExecutionEngineStateProvider({manager:temporalManager,config:temporalConfig,store,runnerCredentials,logger:logger2}),workflowExecutionEngineState=newWorkflowExecutionEngineStateProvider({manager:temporalManager,config:workflowExecutionTemporalConfig,runnerCredentials,logger:logger2}),artifactStorage=newArtifactStorage({type:config2.artifactStorageType,localBasePath:config2.artifactLocalBasePath,localServeUrl:config2.artifactLocalServeUrl,r2Bucket:config2.r2Bucket,r2Endpoint:config2.r2Endpoint,r2AccessKeyId:config2.r2AccessKeyId,r2SecretAccessKey:config2.r2SecretAccessKey,r2Region:config2.r2Region},extensions.drivers.artifactStorageDrivers),artifactFileServer=config2.artifactStorageType==="local"?createArtifactFileServer({basePath:config2.artifactLocalBasePath,logger:logger2}):void 0,skillUploadSlots=new UploadSlots(import_node_path18.default.join(config2.storagePath,"skills-staging"),DEFAULT_SLOT_TTL_MS,104857600),skillStorageDriver=(()=>{let skillType=config2.skillArtifactStorageType===""?"local":config2.skillArtifactStorageType;return skillType==="local"?((0,import_node_fs15.mkdirSync)(import_node_path18.default.join(config2.storagePath,"skills"),{recursive:!0,mode:493}),new LocalArtifactStorage(config2.storagePath,"",{mint:declaredSizeBytes=>skillUploadSlots.mint(declaredSizeBytes),uploadUrl:ref=>uploadUrl(config2.skillTransferBaseUrl,ref),stagedKey:ref=>`skills-staging/${skillUploadSlots.stagedFileName(ref)}`})):newArtifactStorage({type:skillType,localBasePath:config2.storagePath,localServeUrl:"",r2Bucket:config2.r2Bucket,r2Endpoint:config2.r2Endpoint,r2AccessKeyId:config2.r2AccessKeyId,r2SecretAccessKey:config2.r2SecretAccessKey,r2Region:config2.r2Region},extensions.drivers.artifactStorageDrivers)})(),skillArtifactStorage=newSkillArtifactStorage(skillStorageDriver),pluginArtifactStorage=newContentAddressedArchiveStore(skillStorageDriver,PLUGIN_ARTIFACT_KEY_PREFIX),skillTransferLane=newSkillTransferLane(skillUploadSlots,skillArtifactStorage,logger2),consoleAssets=resolveConsoleAssets(config2.consoleDir,logger2);consoleAssets!==void 0?logger2.info("web console serving from unified port",{dir:consoleAssets.root,files:consoleAssets.fileCount}):logger2.debug("no web console export bundled; console lane disabled");let consoleSignIn=authEnabled?{posture:"oidc",issuer:config2.oidcIssuer,audience:config2.oidcAudience,consoleClientId:config2.oidcConsoleClientId}:{posture:"trusted-local"};consoleAssets!==void 0&&consoleSignIn.posture==="oidc"&&consoleSignIn.consoleClientId===""&&logger2.warn("STIGMER_OIDC_ISSUER is set but STIGMER_OIDC_CONSOLE_CLIENT_ID is not \u2014 the web console this server serves cannot sign in; register a public PKCE client for the console at the issuer and set it");let consoleLane=consoleAssets!==void 0?createConsoleLane({assets:consoleAssets,signIn:consoleSignIn,logger:logger2}):void 0,searchRegistry=newSearchableResourceRegistry();searchRegistry.validateExpectedKinds(logger2);let searchQueryStore=new SqliteSearchQueryStore(store,searchRegistry,logger2),searchHandler=new SearchHandler(searchQueryStore,logger2,listReadScope),activityHandler=new ActivityHandler(store,logger2,listReadScope),environmentResolution=new RuntimeResolutionService(store,secretService,logger2),managedEnvService=new ManagedEnvironmentService({getSecretValue:input=>requireInProcess().executionEnvironmentReader.getSecretValue(input),updateVariables:request=>requireInProcess().executionEnvironmentReader.updateVariables(request),create:(environment,caller)=>requireInProcess().executionEnvironmentReader.create(environment,caller),delete:input=>requireInProcess().executionEnvironmentReader.delete(input)},logger2),mcpServerEngineState=newMcpServerEngineStateProvider({manager:temporalManager,config:temporalConfig,logger:logger2});config2.oauthRedirectUri===""&&logger2.warn("STIGMER_OAUTH_REDIRECT_URI is not set \u2014 OAuth Connect flows for MCP servers are unavailable (initiateOAuthConnect will refuse)");let inProcess;function requireInProcess(){if(inProcess===void 0)throw new Error("in-process clients not wired (boot ordering bug)");return inProcess}let routes=router=>{registerHealthService(router,healthState),registerOrganizationServices(router,{store,logger:logger2,authorizer,gateSteps:extensions.gateSteps,authorizationLifecycle:roleLifecycle,organizationDirectory}),registerApiKeyServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope}),registerIdentityAccountServices(router,{...identityAccountPath,provisioner:identityAccountProvisioner,federation:extensions.drivers.identityFederation,gateSteps:extensions.gateSteps,membership}),registerIamPolicyServices(router,{grantPath:iamPolicyGrantPath,policies:iamPolicies,accounts:identityAccounts,authorizer,grantScope:extensions.drivers.policyGrantScope??newOrganizationOnlyGrantScope(),queries:extensions.drivers.authorizationQueries,edition:extensions.edition,logger:logger2}),registerEnvironmentServices(router,{store,logger:logger2,authorizer,secretService,authorizationLifecycle,listReadScope}),registerOAuthAppServices(router,{store,secretService,logger:logger2,authorizer,authorizationLifecycle}),registerExecutionContextServices(router,{store,logger:logger2,authorizer,secretService,runnerAuthService:runnerCredentials,authorizationLifecycle}),registerAgentServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,agentInstanceApplier:()=>requireInProcess().agentInstanceApplier}),registerAgentInstanceServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,parentAgentLoader:()=>requireInProcess().parentAgentLoader,listReadScope}),registerSessionServices(router,{store,logger:logger2,authorizer,temporalConfig,agentInstanceCreator:()=>requireInProcess().agentInstanceCreator,gateSteps:extensions.gateSteps,sandboxLane,authorizationLifecycle,listReadScope}),registerAgentShareServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope}),registerAgentChannelServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,modelRegistry:modelCatalog,channelRuntime:extensions.drivers.channelRuntime}),registerChannelMessageServices(router,extensions.drivers.channelRuntime),registerChannelConversationServices(router,extensions.drivers.channelRuntime),registerChannelAppServices(router,{store,logger:logger2,authorizer,secretService,authorizationLifecycle}),registerScheduleServices(router,{store,logger:logger2,authorizer,modelRegistry:modelCatalog,clock:()=>scheduleSyncer,runner:()=>scheduleRunStarter,authorizationLifecycle,listReadScope}),registerMemoryServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,runnerCredentialProvider:runnerCredentials}),registerAgentExecutionServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,runnerCredentialProvider:runnerCredentials,broker:agentExecutionStreamBroker,engineState:executionEngineState,modelRegistry:modelCatalog,artifactStorage,gateSteps:extensions.gateSteps,statusObservers:extensions.statusObservers,responseDecorators:extensions.responseDecorators,sandboxLane,temporalConfig,agentLoader:()=>requireInProcess().executionAgentLoader,agentInstanceCreator:()=>requireInProcess().executionAgentInstanceCreator,sessionCreator:()=>requireInProcess().executionSessionCreator,executionContextBuilder:{store,logger:logger2,agentLoader:()=>requireInProcess().executionAgentLoader,agentInstanceLoader:()=>requireInProcess().executionAgentInstanceLoader,sessionLoader:()=>requireInProcess().executionSessionLoader,environmentReader:()=>requireInProcess().executionEnvironmentReader,environmentResolution,executionContextCreator:()=>requireInProcess().executionContextCreator,managedEnvService}}),registerWorkflowServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,validator:workflowValidator,workflowInstanceCreator:()=>requireInProcess().workflowInstanceCreator}),registerWorkflowInstanceServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,parentWorkflowLoader:()=>requireInProcess().parentWorkflowLoader,listReadScope}),registerWorkflowExecutionServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,gateSteps:extensions.gateSteps,engineState:workflowExecutionEngineState,broker:workflowExecutionStreamBroker,sandboxLane,temporalConfig:workflowExecutionTemporalConfig,sandboxTerminalObserver:workflowSandboxTerminalObserver,workflowInstanceCreator:()=>requireInProcess().workflowExecutionInstanceCreator,approvalForwarder:()=>requireInProcess().workflowExecutionApprovalForwarder,fileDecisionForwarder:()=>requireInProcess().workflowExecutionFileDecisionForwarder,executionContextBuilder:{store,logger:logger2,workflowInstanceLoader:()=>requireInProcess().workflowExecutionInstanceLoader,environmentResolution,executionContextCreator:()=>requireInProcess().workflowExecutionContextCreator}}),registerMcpServerServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,connect:{store,logger:logger2,authorizer,engineState:mcpServerEngineState,environmentReader:{list:request=>requireInProcess().executionEnvironmentReader.list(request),getSecretValue:input=>requireInProcess().executionEnvironmentReader.getSecretValue(input)},executionContext:{create:(ec2,caller)=>requireInProcess().connectExecutionContextClient.create(ec2,caller),delete:input=>requireInProcess().connectExecutionContextClient.delete(input)},runnerAuth:runnerCredentials,managedEnv:managedEnvService,oauthGrants:store.oauthGrants,pendingOAuthStates:store.pendingOAuthStates,secretService,oauthRedirectUri:config2.oauthRedirectUri}}),registerSkillServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,artifactStorage:skillArtifactStorage,executionArtifactStorage:artifactStorage,transferLane:{slots:skillUploadSlots,baseUrl:config2.skillTransferBaseUrl}}),registerPluginServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,artifactStorage:pluginArtifactStorage,materializerProvider:()=>requireInProcess().pluginMaterializer,transferLane:{slots:skillUploadSlots,baseUrl:config2.skillTransferBaseUrl}}),registerArtifactServices(router,{store,artifactStorage,logger:logger2,authorizer}),registerProjectServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,orphanDeleter:()=>requireInProcess().projectOrphanDeleter}),registerSearchServices(router,{handler:searchHandler,logger:logger2}),registerActivityServices(router,{handler:activityHandler,logger:logger2}),registerGitHubServices(router,{clientId:config2.gitHubOAuthClientId,clientSecret:config2.gitHubOAuthClientSecret,logger:logger2,fetchImpl:options.fetchImpl}),registerPlatformServices(router,{temporalHostPort:config2.temporalHostPort,temporalNamespace:config2.temporalNamespace,runnerAuthService:runnerCredentials,edition:extensions.edition,version:options.version??SERVER_VERSION,licenseStatus:extensions.drivers.licenseStatus??ABSENT_LICENSE_STATUS,now:()=>new Date,logger:logger2});for(let registerExtensionServices of extensions.services)registerExtensionServices(router)},inProcessWiring=createInProcessClients(routes,logger2);inProcess=inProcessWiring.clients;let identityVerifiers=[...requireAuthentication?[newApiKeyIdentityVerifier({store,accounts:identityAccounts})]:[],...authorizationPosture==="built-in"?[newRunnerSubjectIdentityVerifier({store,accounts:identityAccounts,credentials:runnerCredentials})]:[],...authEnabled?[newOidcIdentityVerifier({issuer:config2.oidcIssuer,audience:config2.oidcAudience,accounts:identityAccounts,discovery:issuerDiscovery})]:[],...extensions.identityVerifiers];if(extensions.requireAuthentication!==void 0&&extensions.identityVerifiers.length===0)throw new Error(`extension '${extensions.requireAuthentication.declaredBy}' declares the require-authentication posture, but registers no identity verifier of its own \u2014 the OSS API-key lane alone cannot admit the first caller (nobody could mint a key), so every non-public request would be refused; register a verifier or omit the declaration`);let postureSources=[...authEnabled?["oidc-issuer"]:[],...extensions.requireAuthentication!==void 0?[`extension '${extensions.requireAuthentication.declaredBy}'`]:[]];logger2.info("authentication posture resolved",{posture:requireAuthentication?"required":"trusted-local",source:postureSources.length>0?postureSources.join(" + "):"none",verifiers:identityVerifiers.map(v=>v.name).join(", ")});let server=createUnifiedPortServer({logger:logger2,routes,interceptors:buildInterceptorChain(logger2,createVerifierChainInterceptor(identityVerifiers,extensions.callerGuards,logger2,requireAuthentication),{errorBoundary:createErrorBoundaryInterceptor(logger2,extensions.drivers.visitorErrorPolicy),requestMetrics:createRequestMetricsInterceptor()}),taskKindRegistryLane:registryLanes.taskKindRegistryLane,modelRegistryLane:registryLanes.modelRegistryLane,skillTransferLane,consoleLane});return{healthState,store,secrets:secretService,temporalManager,runnerAuthService,agentExecutionStreamBroker,workflowExecutionStreamBroker,inProcessTransport:inProcessWiring.transport,identityVerifiers,routes,async start(){await temporalManager.initialConnect()&&await temporalManager.startWorkers(),temporalManager.startHealthMonitor();let kickScheduleReconcile=scheduleReconciler.startReconciliation();temporalManager.addReconnectHook(kickScheduleReconcile),await artifactStorage.health();try{let indexed=await searchQueryStore.rebuildIndex();logger2.info("Search index rebuilt at startup",{indexed})}catch(error2){logger2.warn("Failed to rebuild search index at startup",{error:error2 instanceof Error?error2.message:String(error2)})}await initRpcMetrics(),logger2.info("request metrics",{posture:await metricsExportPosture(),instruments:"stigmer.grpc.request.count, stigmer.grpc.request.duration"}),healthState.setOverall(HealthCheckResponse_ServingStatus.SERVING),ossModelRegistryStore?.startRefresh();let port=await server.listen(options.portOverride??config2.grpcPort,options.host);if(logger2.info("stigmer-server listening",{port}),artifactFileServer!==void 0){await warnOnLegacyArtifactLayout(config2.artifactLocalBasePath,logger2);try{await artifactFileServer.listen(config2.artifactHttpPort,config2.artifactHttpHost)}catch(error2){logger2.error("Artifact HTTP file server failed",{error:error2 instanceof Error?error2.message:String(error2)})}}return port},async shutdown(){healthState.setOverall(HealthCheckResponse_ServingStatus.NOT_SERVING),ossModelRegistryStore?.stopRefresh(),await artifactFileServer?.shutdown(),await scheduleReconciler.stop(),await temporalManager.close(),await server.shutdown(),await store.close(),logger2.info("stigmer-server stopped")}}}var LEVEL_RANK={debug:10,info:20,warn:30,error:40};function createLogger(options){let threshold=LEVEL_RANK[options.level]??LEVEL_RANK.info,write2=options.write??(line=>process.stderr.write(line+`
 `)),sink=options.sink,emit=(level,message6,fields2)=>{if(LEVEL_RANK[level]<threshold)return;let time2=new Date;if(options.pretty){let suffix=fields2===void 0||Object.keys(fields2).length===0?"":" "+JSON.stringify(fields2);write2(`${time2.toISOString()} ${level.toUpperCase().padEnd(5)} ${message6}${suffix}`)}else write2(JSON.stringify({level,time:time2.toISOString(),message:message6,...fields2}));sink?.({level,time:time2,message:message6,fields:fields2})};return{debug:(message6,fields2)=>emit("debug",message6,fields2),info:(message6,fields2)=>emit("info",message6,fields2),warn:(message6,fields2)=>emit("warn",message6,fields2),error:(message6,fields2)=>emit("error",message6,fields2)}}async function main(){let config2=loadConfig(),logger2=createLogger({level:config2.logLevel,pretty:config2.env==="local"});setOperatorIdentity(config2.operatorEmail,config2.operatorName);let server=await composeServer({config:config2,logger:logger2}),shuttingDown=!1,shutdown=signal3=>{shuttingDown||(shuttingDown=!0,logger2.info("shutting down",{signal:signal3}),server.shutdown().then(()=>process.exit(0)).catch(error2=>{logger2.error("shutdown failed",{error:String(error2)}),process.exit(1)}))};process.on("SIGTERM",()=>shutdown("SIGTERM")),process.on("SIGINT",()=>shutdown("SIGINT"));try{await server.start()}catch(error2){logger2.error("boot failed",{error:error2 instanceof Error?error2.message:String(error2)}),process.exit(1)}}main().catch(error2=>{console.error("boot failed:",error2 instanceof Error?error2.message:String(error2)),process.exit(1)});
 /*! Bundled license information: