@stigmer/server-slim 3.34.0 → 3.35.0

package/main.js

@@ -473,7 +473,7 @@ ${captureLines}`:capture.stack}module2.exports.fetch=function(init,options=void
 `);for(let line of lines){if(line==="")continue;let i6=line.indexOf(":");if(i6>0){let name=line.substring(0,i6).trim(),value=line.substring(i6+1).trim();headers2.append(name,value)}}return headers2}function trailerSerialize(trailer){let lines=[];return trailer.forEach((value,key)=>{lines.push(`${key}: ${value}\r
 `)}),new TextEncoder().encode(lines.join(""))}function createTrailerSerialization(){return{serialize:trailerSerialize,parse:trailerParse}}var headerContentType="Content-Type",headerEncoding="Grpc-Encoding",headerAcceptEncoding="Grpc-Accept-Encoding",headerTimeout="Grpc-Timeout",headerGrpcStatus="Grpc-Status",headerGrpcMessage="Grpc-Message",headerStatusDetailsBin="Grpc-Status-Details-Bin";var contentTypeRegExp=/^application\/grpc-web(-text)?(?:\+(?:(json)(?:; ?charset=utf-?8)?|proto))?$/i,contentTypeProto="application/grpc-web+proto",contentTypeJson="application/grpc-web+json";function parseContentType(contentType){let match=contentType?.match(contentTypeRegExp);if(!match)return;let text2=!!match[1],binary2=!match[2];return{text:text2,binary:binary2}}function parseTimeout(value,maxTimeoutMs){if(value===null)return{};let results=/^(\d{1,8})([HMSmun])$/.exec(value);if(results===null)return{error:new ConnectError(`protocol error: invalid grpc timeout value: ${value}`,Code.InvalidArgument)};let timeoutMs={H:3600*1e3,M:60*1e3,S:1e3,m:1,u:.001,n:1e-6}[results[2]]*parseInt(results[1]);return timeoutMs>maxTimeoutMs?{timeoutMs,error:new ConnectError(`timeout ${timeoutMs}ms must be <= ${maxTimeoutMs}`,Code.InvalidArgument)}:{timeoutMs}}var file_status=fileDesc2("CgxzdGF0dXMucHJvdG8SCmdvb2dsZS5ycGMiTgoGU3RhdHVzEgwKBGNvZGUYASABKAUSDwoHbWVzc2FnZRgCIAEoCRIlCgdkZXRhaWxzGAMgAygLMhQuZ29vZ2xlLnByb3RvYnVmLkFueUJeCg5jb20uZ29vZ2xlLnJwY0ILU3RhdHVzUHJvdG9QAVo3Z29vZ2xlLmdvbGFuZy5vcmcvZ2VucHJvdG8vZ29vZ2xlYXBpcy9ycGMvc3RhdHVzO3N0YXR1c6ICA1JQQ2IGcHJvdG8z",[file_google_protobuf_any]),StatusSchema=messageDesc3(file_status,0);var grpcStatusOk="0";function setTrailerStatus(target,error2){if(error2){if(error2.metadata.forEach((value,key)=>{target.append(key,value)}),target.set(headerGrpcStatus,error2.code.toString(10)),target.set(headerGrpcMessage,encodeURIComponent(error2.rawMessage)),error2.details.length>0){let status=create2(StatusSchema,{code:error2.code,message:error2.rawMessage,details:error2.details.map(detail=>"desc"in detail?anyPack(detail.desc,create2(detail.desc,detail.value)):{typeUrl:`type.googleapis.com/${detail.type}`,value:detail.value})});target.set(headerStatusDetailsBin,encodeBinaryHeader(status,StatusSchema))}}else target.set(headerGrpcStatus,grpcStatusOk.toString());return target}function contentTypeMatcher(...supported){let cache7=new Map,source=supported.reduce((previousValue,currentValue)=>previousValue.concat("supported"in currentValue?currentValue.supported:currentValue),[]);function match(contentType){if(contentType===null||contentType.length==0)return!1;let cached2=cache7.get(contentType);if(cached2!==void 0)return cached2;let ok=source.some(re2=>re2.test(contentType));return cache7.size<1024&&cache7.set(contentType,ok),ok}return match.supported=source,match}function createMethodUrl(baseUrl,method){return baseUrl.toString().replace(/\/?$/,`/${method.parent.typeName}/${method.name}`)}function normalize(desc,message6){return create2(desc,message6)}function normalizeIterable(desc,input){function transform(result){return result.done===!0?result:{done:result.done,value:normalize(desc,result.value)}}return{[Symbol.asyncIterator](){let it=input[Symbol.asyncIterator](),res={next:()=>it.next().then(transform)};return it.throw!==void 0&&(res.throw=e6=>it.throw(e6).then(transform)),it.return!==void 0&&(res.return=v=>it.return(v).then(transform)),res}}}function applyInterceptors(next,interceptors){if(!interceptors)return next;for(let i6 of interceptors.concat().reverse())next=i6(next);return next}var __await3=function(v){return this instanceof __await3?(this.v=v,this):new __await3(v)},__asyncGenerator3=function(thisArg,_arguments,generator){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var g5=generator.apply(thisArg,_arguments||[]),i6,q4=[];return i6=Object.create((typeof AsyncIterator=="function"?AsyncIterator:Object).prototype),verb("next"),verb("throw"),verb("return",awaitReturn),i6[Symbol.asyncIterator]=function(){return this},i6;function awaitReturn(f5){return function(v){return Promise.resolve(v).then(f5,reject2)}}function verb(n3,f5){g5[n3]&&(i6[n3]=function(v){return new Promise(function(a5,b7){q4.push([n3,v,a5,b7])>1||resume2(n3,v)})},f5&&(i6[n3]=f5(i6[n3])))}function resume2(n3,v){try{step(g5[n3](v))}catch(e6){settle(q4[0][3],e6)}}function step(r5){r5.value instanceof __await3?Promise.resolve(r5.value.v).then(fulfill,reject2):settle(q4[0][2],r5)}function fulfill(value){resume2("next",value)}function reject2(value){resume2("throw",value)}function settle(f5,v){f5(v),q4.shift(),q4.length&&resume2(q4[0][0],q4[0][1])}},__asyncValues3=function(o3){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var m3=o3[Symbol.asyncIterator],i6;return m3?m3.call(o3):(o3=typeof __values=="function"?__values(o3):o3[Symbol.iterator](),i6={},verb("next"),verb("throw"),verb("return"),i6[Symbol.asyncIterator]=function(){return this},i6);function verb(n3){i6[n3]=o3[n3]&&function(v){return new Promise(function(resolve,reject2){v=o3[n3](v),settle(resolve,reject2,v.done,v.value)})}}function settle(resolve,reject2,d5,v){Promise.resolve(v).then(function(v2){resolve({value:v2,done:d5})},reject2)}},__asyncDelegator3=function(o3){var i6,p3;return i6={},verb("next"),verb("throw",function(e6){throw e6}),verb("return"),i6[Symbol.iterator]=function(){return this},i6;function verb(n3,f5){i6[n3]=o3[n3]?function(v){return(p3=!p3)?{value:__await3(o3[n3](v)),done:!1}:f5?f5(v):v}:f5}};async function invokeUnaryImplementation(spec,context2,input,interceptors){let next=applyInterceptors(async req=>Object.assign({message:normalize(spec.method.output,await spec.impl(req.message,mergeRequest(context2,req))),stream:!1,method:spec.method},responseCommon(context2,spec)),interceptors),{message:message6,header,trailer}=await next(Object.assign({stream:!1,message:input,method:spec.method},requestCommon(context2,spec)));return copyHeaders(header,context2.responseHeader),copyHeaders(trailer,context2.responseTrailer),message6}function transformInvokeImplementation(spec,context2,interceptors){switch(spec.kind){case"unary":return function(input){return __asyncGenerator3(this,arguments,function*(){yield yield __await3(yield __await3(invokeUnaryImplementation(spec,context2,yield __await3(ensureSingle(input,"unary")),interceptors)))})};case"server_streaming":return function(input){return invokeStreamImplementation(spec,context2,input,interceptors,async req=>{let output=normalizeIterable(spec.method.output,spec.impl(await ensureSingle(req.message,"server-streaming"),mergeRequest(context2,req)));return Object.assign({stream:!0,message:output,method:spec.method},responseCommon(context2,spec))})};case"client_streaming":return function(input){return invokeStreamImplementation(spec,context2,input,interceptors,async req=>Object.assign({message:createAsyncIterable([normalize(spec.method.output,await spec.impl(req.message,mergeRequest(context2,req)))]),stream:!0,method:spec.method},responseCommon(context2,spec)))};case"bidi_streaming":return function(input){return invokeStreamImplementation(spec,context2,input,interceptors,req=>Promise.resolve(Object.assign({message:normalizeIterable(spec.method.output,spec.impl(req.message,mergeRequest(context2,req))),stream:!0,method:spec.method},responseCommon(context2,spec))))}}}function invokeStreamImplementation(spec,context2,input,interceptors,anyFn){return __asyncGenerator3(this,arguments,function*(){let next=applyInterceptors(anyFn,interceptors),{message:message6,header,trailer}=yield __await3(next(Object.assign({stream:!0,message:input,method:spec.method},requestCommon(context2,spec))));copyHeaders(header,context2.responseHeader),yield __await3(yield*__asyncDelegator3(__asyncValues3(message6))),copyHeaders(trailer,context2.responseTrailer)})}async function ensureSingle(iterable,method){let it=iterable[Symbol.asyncIterator](),first=await it.next();if(first.done===!0)throw new ConnectError(`protocol error: missing input message for ${method} method`,Code.Unimplemented);if((await it.next()).done!==!0)throw new ConnectError(`protocol error: received extra input message for ${method} method`,Code.Unimplemented);return first.value}function requestCommon(context2,spec){return{requestMethod:context2.requestMethod,url:context2.url,signal:context2.signal,header:context2.requestHeader,service:spec.method.parent,contextValues:context2.values}}function responseCommon(context2,spec){return{service:spec.method.parent,header:context2.responseHeader,trailer:context2.responseTrailer}}function mergeRequest(context2,req){return Object.assign(Object.assign({},context2),{service:req.service,requestHeader:req.header,signal:req.signal,values:req.contextValues})}function copyHeaders(from2,to){from2!==to&&(to.forEach((_,key)=>{to.delete(key)}),from2.forEach((value,key)=>{to.set(key,value)}))}function getJsonOptions(options){var _a3;let o3=Object.assign({},options);return(_a3=o3.ignoreUnknownFields)!==null&&_a3!==void 0||(o3.ignoreUnknownFields=!0),o3}function createMethodSerializationLookup(method,binaryOptions,jsonOptions,limitOptions){let inputBinary=limitSerialization(createBinarySerialization(method.input,binaryOptions),limitOptions),inputJson=limitSerialization(createJsonSerialization(method.input,jsonOptions),limitOptions),outputBinary=limitSerialization(createBinarySerialization(method.output,binaryOptions),limitOptions),outputJson=limitSerialization(createJsonSerialization(method.output,jsonOptions),limitOptions);return{getI(useBinaryFormat){return useBinaryFormat?inputBinary:inputJson},getO(useBinaryFormat){return useBinaryFormat?outputBinary:outputJson}}}function limitSerialization(serialization,limitOptions){return{serialize(data){let bytes=serialization.serialize(data);return assertWriteMaxBytes(limitOptions.writeMaxBytes,bytes.byteLength),bytes},parse(data){return assertReadMaxBytes(limitOptions.readMaxBytes,data.byteLength,!0),serialization.parse(data)}}}function createBinarySerialization(desc,options){return{parse(data){try{return fromBinary2(desc,data,options)}catch(e6){let m3=e6 instanceof Error?e6.message:String(e6);throw new ConnectError(`parse binary: ${m3}`,Code.Internal)}},serialize(data){try{return toBinary(desc,data,options)}catch(e6){let m3=e6 instanceof Error?e6.message:String(e6);throw new ConnectError(`serialize binary: ${m3}`,Code.Internal)}}}}function createJsonSerialization(desc,options){var _a3,_b2;let textEncoder=(_a3=options?.textEncoder)!==null&&_a3!==void 0?_a3:new TextEncoder,textDecoder=(_b2=options?.textDecoder)!==null&&_b2!==void 0?_b2:new TextDecoder,o3=getJsonOptions(options);return{parse(data){try{let json2=textDecoder.decode(data);return fromJsonString(desc,json2,o3)}catch(e6){throw ConnectError.from(e6,Code.InvalidArgument)}},serialize(data){try{let json2=toJsonString(desc,data,o3);return textEncoder.encode(json2)}catch(e6){throw ConnectError.from(e6,Code.Internal)}}}}function assertByteStreamRequest(req){if(!(typeof req.body=="object"&&req.body!==null&&Symbol.asyncIterator in req.body))throw new Error("byte stream required, but received JSON")}var uResponseOk={status:200},uResponseNotFound={status:404},uResponseUnsupportedMediaType={status:415},uResponseMethodNotAllowed={status:405},uResponseVersionNotSupported={status:505};function validateUniversalHandlerOptions(opt){var _a3,_b2,_c5;opt??(opt={});let acceptCompression=opt.acceptCompression?[...opt.acceptCompression]:[],requireConnectProtocolHeader=(_a3=opt.requireConnectProtocolHeader)!==null&&_a3!==void 0?_a3:!1,maxTimeoutMs=(_b2=opt.maxTimeoutMs)!==null&&_b2!==void 0?_b2:Number.MAX_SAFE_INTEGER;return Object.assign(Object.assign({acceptCompression},validateReadWriteMaxBytes(opt.readMaxBytes,opt.writeMaxBytes,opt.compressMinBytes)),{jsonOptions:opt.jsonOptions,binaryOptions:opt.binaryOptions,maxTimeoutMs,shutdownSignal:opt.shutdownSignal,requireConnectProtocolHeader,interceptors:(_c5=opt.interceptors)!==null&&_c5!==void 0?_c5:[]})}function createUniversalServiceHandlers(spec,protocols2){return Object.entries(spec.methods).map(([,implSpec])=>createUniversalMethodHandler(implSpec,protocols2))}function createUniversalMethodHandler(spec,protocols2){return negotiateProtocol(protocols2.map(f5=>f5(spec)))}function negotiateProtocol(protocolHandlers){if(protocolHandlers.length==0)throw new ConnectError("at least one protocol is required",Code.Internal);let service=protocolHandlers[0].service,method=protocolHandlers[0].method,requestPath=protocolHandlers[0].requestPath;if(protocolHandlers.some(h5=>h5.service!==service||h5.method!==method))throw new ConnectError("cannot negotiate protocol for different RPCs",Code.Internal);if(protocolHandlers.some(h5=>h5.requestPath!==requestPath))throw new ConnectError("cannot negotiate protocol for different requestPaths",Code.Internal);async function protocolNegotiatingHandler(request){var _a3;if(method.methodKind=="bidi_streaming"&&request.httpVersion.startsWith("1."))return Object.assign(Object.assign({},uResponseVersionNotSupported),{header:new Headers({Connection:"close"})});let contentType=(_a3=request.header.get("Content-Type"))!==null&&_a3!==void 0?_a3:"",matchingMethod=protocolHandlers.filter(h5=>h5.allowedMethods.includes(request.method));if(matchingMethod.length==0)return uResponseMethodNotAllowed;if(matchingMethod.length==1&&contentType===""){let onlyMatch=matchingMethod[0];return onlyMatch(request)}let matchingContentTypes=matchingMethod.filter(h5=>h5.supportedContentType(contentType));if(matchingContentTypes.length==0)return uResponseUnsupportedMediaType;let firstMatch=matchingContentTypes[0];return firstMatch(request)}return Object.assign(protocolNegotiatingHandler,{service,method,requestPath,supportedContentType:contentTypeMatcher(...protocolHandlers.map(h5=>h5.supportedContentType)),protocolNames:protocolHandlers.flatMap(h5=>h5.protocolNames).filter((value,index2,array)=>array.indexOf(value)===index2),allowedMethods:protocolHandlers.flatMap(h5=>h5.allowedMethods).filter((value,index2,array)=>array.indexOf(value)===index2)})}var protocolName="grpc-web",methodPost="POST";function createHandlerFactory(options){let opt=validateUniversalHandlerOptions(options),trailerSerialization=createTrailerSerialization();function fact(spec){let h5=createHandler(opt,trailerSerialization,spec);return Object.assign(h5,{protocolNames:[protocolName],allowedMethods:[methodPost],supportedContentType:contentTypeMatcher(contentTypeRegExp),requestPath:createMethodUrl("/",spec.method),service:spec.method.parent,method:spec.method})}return fact.protocolName=protocolName,fact}function createHandler(opt,trailerSerialization,spec){let serialization=createMethodSerializationLookup(spec.method,opt.binaryOptions,opt.jsonOptions,opt);return async function(req){assertByteStreamRequest(req);let type2=parseContentType(req.header.get(headerContentType));if(type2==null||type2.text)return uResponseUnsupportedMediaType;if(req.method!==methodPost)return uResponseMethodNotAllowed;let timeout=parseTimeout(req.header.get(headerTimeout),opt.maxTimeoutMs),context2=createHandlerContext(Object.assign(Object.assign({},spec),{service:spec.method.parent,requestMethod:req.method,protocolName,timeoutMs:timeout.timeoutMs,shutdownSignal:opt.shutdownSignal,requestSignal:req.signal,requestHeader:req.header,url:req.url,responseHeader:{[headerContentType]:type2.binary?contentTypeProto:contentTypeJson},responseTrailer:{[headerGrpcStatus]:grpcStatusOk},contextValues:req.contextValues})),compression=compressionNegotiate(opt.acceptCompression,req.header.get(headerEncoding),req.header.get(headerAcceptEncoding),headerAcceptEncoding);compression.response&&context2.responseHeader.set(headerEncoding,compression.response.name);let inputIt=pipe(req.body,transformPrepend(()=>{if(compression.error)throw compression.error;if(timeout.error)throw timeout.error}),transformSplitEnvelope(opt.readMaxBytes),transformDecompressEnvelope(compression.request,opt.readMaxBytes),transformParseEnvelope(serialization.getI(type2.binary),128)),it=transformInvokeImplementation(spec,context2,opt.interceptors)(inputIt)[Symbol.asyncIterator](),outputIt=pipe({[Symbol.asyncIterator](){return{next:()=>it.next(),throw:e6=>{var _a3,_b2;return context2.abort(e6),(_b2=(_a3=it.throw)===null||_a3===void 0?void 0:_a3.call(it,e6))!==null&&_b2!==void 0?_b2:Promise.reject({done:!0})},return:v=>{var _a3,_b2;return context2.abort(),(_b2=(_a3=it.return)===null||_a3===void 0?void 0:_a3.call(it,v))!==null&&_b2!==void 0?_b2:Promise.resolve({done:!0,value:v})}}}},transformSerializeEnvelope(serialization.getO(type2.binary)),transformCatchFinally(e6=>(context2.abort(e6),e6 instanceof ConnectError?setTrailerStatus(context2.responseTrailer,e6):e6!==void 0&&setTrailerStatus(context2.responseTrailer,new ConnectError("internal error",Code.Internal,void 0,void 0,e6)),{flags:128,data:trailerSerialization.serialize(context2.responseTrailer)})),transformCompressEnvelope(compression.response,opt.compressMinBytes),transformJoinEnvelopes(),{propagateDownStreamError:!0});return Object.assign(Object.assign({},uResponseOk),{body:await untilFirst(outputIt),header:context2.responseHeader})}}var contentTypeRegExp2=/^application\/grpc(?:\+(?:(json)(?:; ?charset=utf-?8)?|proto))?$/i,contentTypeProto2="application/grpc+proto",contentTypeJson2="application/grpc+json";function parseContentType2(contentType){let match=contentType?.match(contentTypeRegExp2);return match?{binary:!match[1]}:void 0}var protocolName2="grpc",methodPost2="POST";function createHandlerFactory2(options){let opt=validateUniversalHandlerOptions(options);function fact(spec){let h5=createHandler2(opt,spec);return Object.assign(h5,{protocolNames:[protocolName2],allowedMethods:[methodPost2],supportedContentType:contentTypeMatcher(contentTypeRegExp2),requestPath:createMethodUrl("/",spec.method),service:spec.method.parent,method:spec.method})}return fact.protocolName=protocolName2,fact}function createHandler2(opt,spec){let serialization=createMethodSerializationLookup(spec.method,opt.binaryOptions,opt.jsonOptions,opt);return async function(req){assertByteStreamRequest(req);let type2=parseContentType2(req.header.get(headerContentType));if(type2==null)return uResponseUnsupportedMediaType;if(req.method!==methodPost2)return uResponseMethodNotAllowed;let timeout=parseTimeout(req.header.get(headerTimeout),opt.maxTimeoutMs),context2=createHandlerContext(Object.assign(Object.assign({},spec),{service:spec.method.parent,requestMethod:req.method,protocolName:protocolName2,timeoutMs:timeout.timeoutMs,shutdownSignal:opt.shutdownSignal,requestSignal:req.signal,requestHeader:req.header,url:req.url,responseHeader:{[headerContentType]:type2.binary?contentTypeProto2:contentTypeJson2},responseTrailer:{[headerGrpcStatus]:grpcStatusOk},contextValues:req.contextValues})),compression=compressionNegotiate(opt.acceptCompression,req.header.get(headerEncoding),req.header.get(headerAcceptEncoding),headerAcceptEncoding);compression.response&&context2.responseHeader.set(headerEncoding,compression.response.name);let inputIt=pipe(req.body,transformPrepend(()=>{if(compression.error)throw compression.error;if(timeout.error)throw timeout.error}),transformSplitEnvelope(opt.readMaxBytes),transformDecompressEnvelope(compression.request,opt.readMaxBytes),transformParseEnvelope(serialization.getI(type2.binary))),it=transformInvokeImplementation(spec,context2,opt.interceptors)(inputIt)[Symbol.asyncIterator](),outputIt=pipe({[Symbol.asyncIterator](){return{next:()=>it.next(),throw:e6=>{var _a3,_b2;return context2.abort(e6),(_b2=(_a3=it.throw)===null||_a3===void 0?void 0:_a3.call(it,e6))!==null&&_b2!==void 0?_b2:Promise.reject({done:!0})},return:v=>{var _a3,_b2;return context2.abort(),(_b2=(_a3=it.return)===null||_a3===void 0?void 0:_a3.call(it,v))!==null&&_b2!==void 0?_b2:Promise.resolve({done:!0,value:v})}}}},transformSerializeEnvelope(serialization.getO(type2.binary)),transformCompressEnvelope(compression.response,opt.compressMinBytes),transformJoinEnvelopes(),transformCatchFinally(e6=>{context2.abort(e6),e6 instanceof ConnectError?setTrailerStatus(context2.responseTrailer,e6):e6!==void 0&&setTrailerStatus(context2.responseTrailer,new ConnectError("internal error",Code.Internal,void 0,void 0,e6))}),{propagateDownStreamError:!0});return Object.assign(Object.assign({},uResponseOk),{body:await untilFirst(outputIt),header:context2.responseHeader,trailer:context2.responseTrailer})}}var contentTypeRegExp3=/^application\/(connect\+)?(?:(json)(?:; ?charset=utf-?8)?|(proto))$/i,contentTypeUnaryRegExp=/^application\/(?:json(?:; ?charset=utf-?8)?|proto)$/i,contentTypeStreamRegExp=/^application\/connect\+?(?:json(?:; ?charset=utf-?8)?|proto)$/i,contentTypeUnaryProto="application/proto",contentTypeUnaryJson="application/json",contentTypeStreamProto="application/connect+proto",contentTypeStreamJson="application/connect+json",encodingProto="proto",encodingJson="json";function parseContentType3(contentType){let match=contentType?.match(contentTypeRegExp3);if(!match)return;let stream=!!match[1],binary2=!!match[3];return{stream,binary:binary2}}function parseEncodingQuery(encoding){switch(encoding){case encodingProto:return{stream:!1,binary:!0};case encodingJson:return{stream:!1,binary:!1};default:return}}var __rest=function(s2,e6){var t={};for(var p3 in s2)Object.prototype.hasOwnProperty.call(s2,p3)&&e6.indexOf(p3)<0&&(t[p3]=s2[p3]);if(s2!=null&&typeof Object.getOwnPropertySymbols=="function")for(var i6=0,p3=Object.getOwnPropertySymbols(s2);i6<p3.length;i6++)e6.indexOf(p3[i6])<0&&Object.prototype.propertyIsEnumerable.call(s2,p3[i6])&&(t[p3[i6]]=s2[p3[i6]]);return t};function errorFromJson(jsonValue,metadata,fallback3){var _a3;if(metadata&&new Headers(metadata).forEach((value,key)=>fallback3.metadata.append(key,value)),typeof jsonValue!="object"||jsonValue==null||Array.isArray(jsonValue))throw fallback3;let code=fallback3.code;"code"in jsonValue&&typeof jsonValue.code=="string"&&(code=(_a3=codeFromString(jsonValue.code))!==null&&_a3!==void 0?_a3:code);let message6=jsonValue.message;if(message6!=null&&typeof message6!="string")throw fallback3;let error2=new ConnectError(message6??"",code,metadata);if("details"in jsonValue&&Array.isArray(jsonValue.details))for(let detail of jsonValue.details){if(detail===null||typeof detail!="object"||Array.isArray(detail)||typeof detail.type!="string"||typeof detail.value!="string")throw fallback3;try{error2.details.push({type:detail.type,value:base64Decode2(detail.value),debug:detail.debug})}catch{throw fallback3}}return error2}function errorFromJsonBytes(bytes,metadata,fallback3){let jsonValue;try{jsonValue=JSON.parse(new TextDecoder().decode(bytes))}catch{throw fallback3}return errorFromJson(jsonValue,metadata,fallback3)}function errorToJson(error2,jsonWriteOptions){let o3={code:codeToString(error2.code)};return error2.rawMessage.length>0&&(o3.message=error2.rawMessage),error2.details.length>0&&(o3.details=error2.details.map(detail=>{if("desc"in detail){let msg=create2(detail.desc,detail.value),i6={type:detail.desc.typeName,value:toBinary(detail.desc,msg)};try{i6.debug=toJson(detail.desc,msg,jsonWriteOptions)}catch{}return i6}return detail}).map(_a3=>{var{value}=_a3,rest=__rest(_a3,["value"]);return Object.assign(Object.assign({},rest),{value:base64Encode(value,"std_raw")})})),o3}function errorToJsonBytes(error2,jsonWriteOptions){let textEncoder=new TextEncoder;try{let jsonObject=errorToJson(error2,jsonWriteOptions),jsonString=JSON.stringify(jsonObject);return textEncoder.encode(jsonString)}catch(e6){let m3=e6 instanceof Error?e6.message:String(e6);throw new ConnectError(`failed to serialize Connect Error: ${m3}`,Code.Internal)}}var endStreamFlag=2;function endStreamFromJson(data){let parseErr=new ConnectError("invalid end stream",Code.Unknown),jsonValue;try{jsonValue=JSON.parse(typeof data=="string"?data:new TextDecoder().decode(data))}catch{throw parseErr}if(typeof jsonValue!="object"||jsonValue==null||Array.isArray(jsonValue))throw parseErr;let metadata=new Headers;if("metadata"in jsonValue){if(typeof jsonValue.metadata!="object"||jsonValue.metadata==null||Array.isArray(jsonValue.metadata))throw parseErr;for(let[key,values]of Object.entries(jsonValue.metadata)){if(!Array.isArray(values)||values.some(value=>typeof value!="string"))throw parseErr;for(let value of values)metadata.append(key,value)}}let error2="error"in jsonValue&&jsonValue.error!=null?errorFromJson(jsonValue.error,metadata,parseErr):void 0;return{metadata,error:error2}}function endStreamToJson(metadata,error2,jsonWriteOptions){let es={};error2!==void 0&&(es.error=errorToJson(error2,jsonWriteOptions),metadata=appendHeaders(metadata,error2.metadata));let hasMetadata=!1,md={};return metadata.forEach((value,key)=>{hasMetadata=!0,md[key]=[value]}),hasMetadata&&(es.metadata=md),es}function createEndStreamSerialization(options){let textEncoder=new TextEncoder;return{serialize(data){try{let jsonObject=endStreamToJson(data.metadata,data.error,options),jsonString=JSON.stringify(jsonObject);return textEncoder.encode(jsonString)}catch(e6){let m3=e6 instanceof Error?e6.message:String(e6);throw new ConnectError(`failed to serialize EndStreamResponse: ${m3}`,Code.Internal)}},parse(data){try{return endStreamFromJson(data)}catch(e6){let m3=e6 instanceof Error?e6.message:String(e6);throw new ConnectError(`failed to parse EndStreamResponse: ${m3}`,Code.InvalidArgument)}}}}var headerContentType2="Content-Type",headerUnaryContentLength="Content-Length",headerUnaryEncoding="Content-Encoding",headerStreamEncoding="Connect-Content-Encoding",headerUnaryAcceptEncoding="Accept-Encoding",headerStreamAcceptEncoding="Connect-Accept-Encoding",headerTimeout2="Connect-Timeout-Ms",headerProtocolVersion="Connect-Protocol-Version",headerUserAgent2="User-Agent";function codeFromHttpStatus(httpStatus){switch(httpStatus){case 400:return Code.Internal;case 401:return Code.Unauthenticated;case 403:return Code.PermissionDenied;case 404:return Code.Unimplemented;case 429:return Code.Unavailable;case 502:return Code.Unavailable;case 503:return Code.Unavailable;case 504:return Code.Unavailable;default:return Code.Unknown}}function codeToHttpStatus(code){switch(code){case Code.Canceled:return 499;case Code.Unknown:return 500;case Code.InvalidArgument:return 400;case Code.DeadlineExceeded:return 504;case Code.NotFound:return 404;case Code.AlreadyExists:return 409;case Code.PermissionDenied:return 403;case Code.ResourceExhausted:return 429;case Code.FailedPrecondition:return 400;case Code.Aborted:return 409;case Code.OutOfRange:return 400;case Code.Unimplemented:return 501;case Code.Internal:return 500;case Code.Unavailable:return 503;case Code.DataLoss:return 500;case Code.Unauthenticated:return 401;default:return 500}}function parseTimeout2(value,maxTimeoutMs){if(value===null)return{};let results=/^\d{1,10}$/.exec(value);if(results===null)return{error:new ConnectError(`protocol error: invalid connect timeout value: ${value}`,Code.InvalidArgument)};let timeoutMs=parseInt(results[0]);return timeoutMs>maxTimeoutMs?{timeoutMs,error:new ConnectError(`timeout ${timeoutMs}ms must be <= ${maxTimeoutMs}`,Code.InvalidArgument)}:{timeoutMs:parseInt(results[0])}}var paramConnectVersion="connect",paramEncoding="encoding",paramCompression="compression",paramBase64="base64",paramMessage="message";function trailerDemux(header){let h5=new Headers,t=new Headers;return header.forEach((value,key)=>{key.toLowerCase().startsWith("trailer-")?t.append(key.substring(8),value):h5.append(key,value)}),[h5,t]}function trailerMux(header,trailer){let h5=new Headers(header);return trailer.forEach((value,key)=>{h5.append(`trailer-${key}`,value)}),h5}var protocolVersion="1";function requireProtocolVersionHeader(requestHeader2){let v=requestHeader2.get(headerProtocolVersion);if(v===null)throw new ConnectError(`missing required header: set ${headerProtocolVersion} to "${protocolVersion}"`,Code.InvalidArgument);if(v!==protocolVersion)throw new ConnectError(`${headerProtocolVersion} must be "${protocolVersion}": got "${v}"`,Code.InvalidArgument)}function requireProtocolVersionParam(queryParams){let v=queryParams.get(paramConnectVersion);if(v===null)throw new ConnectError(`missing required parameter: set ${paramConnectVersion} to "v${protocolVersion}"`,Code.InvalidArgument);if(v!==`v${protocolVersion}`)throw new ConnectError(`${paramConnectVersion} must be "v${protocolVersion}": got "${v}"`,Code.InvalidArgument)}var protocolName3="connect",methodPost3="POST",methodGet="GET";function createHandlerFactory3(options){let opt=validateUniversalHandlerOptions(options),endStreamSerialization=createEndStreamSerialization(opt.jsonOptions);function fact(spec){let h5,contentTypeRegExp4,serialization=createMethodSerializationLookup(spec.method,opt.binaryOptions,opt.jsonOptions,opt);spec.kind==="unary"?(contentTypeRegExp4=contentTypeUnaryRegExp,h5=createUnaryHandler(opt,spec,serialization)):(contentTypeRegExp4=contentTypeStreamRegExp,h5=createStreamHandler(opt,spec,serialization,endStreamSerialization));let allowedMethods=[methodPost3];return spec.method.idempotency===MethodOptions_IdempotencyLevel2.NO_SIDE_EFFECTS&&allowedMethods.push(methodGet),Object.assign(h5,{protocolNames:[protocolName3],supportedContentType:contentTypeMatcher(contentTypeRegExp4),allowedMethods,requestPath:createMethodUrl("/",spec.method),service:spec.method.parent,method:spec.method})}return fact.protocolName=protocolName3,fact}function createUnaryHandler(opt,spec,serialization){return async function(req){let isGet=req.method==methodGet;if(isGet&&spec.method.idempotency!=MethodOptions_IdempotencyLevel2.NO_SIDE_EFFECTS)return uResponseMethodNotAllowed;let queryParams=new URL(req.url).searchParams,compressionRequested=isGet?queryParams.get(paramCompression):req.header.get(headerUnaryEncoding),type2=isGet?parseEncodingQuery(queryParams.get(paramEncoding)):parseContentType3(req.header.get(headerContentType2));if(type2==null||type2.stream)return uResponseUnsupportedMediaType;let timeout=parseTimeout2(req.header.get(headerTimeout2),opt.maxTimeoutMs),context2=createHandlerContext(Object.assign(Object.assign({},spec),{service:spec.method.parent,requestMethod:req.method,protocolName:protocolName3,timeoutMs:timeout.timeoutMs,shutdownSignal:opt.shutdownSignal,requestSignal:req.signal,requestHeader:req.header,url:req.url,responseHeader:{[headerContentType2]:type2.binary?contentTypeUnaryProto:contentTypeUnaryJson},contextValues:req.contextValues})),compression=compressionNegotiate(opt.acceptCompression,compressionRequested,req.header.get(headerUnaryAcceptEncoding),headerUnaryAcceptEncoding),status=uResponseOk.status,body;try{if(opt.requireConnectProtocolHeader&&(isGet?requireProtocolVersionParam(queryParams):requireProtocolVersionHeader(req.header)),compression.error)throw compression.error;if(timeout.error)throw timeout.error;let reqBody;isGet?reqBody=await readUnaryMessageFromQuery(opt.readMaxBytes,compression.request,queryParams):reqBody=await readUnaryMessageFromBody(opt.readMaxBytes,compression.request,req);let input=parseUnaryMessage(spec.method,type2.binary,serialization,reqBody),output=await invokeUnaryImplementation(spec,context2,input,opt.interceptors);body=serialization.getO(type2.binary).serialize(output)}catch(e6){context2.abort(e6);let error2;e6 instanceof ConnectError?error2=e6:error2=new ConnectError("internal error",Code.Internal,void 0,void 0,e6),status=codeToHttpStatus(error2.code),context2.responseHeader.set(headerContentType2,contentTypeUnaryJson),error2.metadata.forEach((value,key)=>{context2.responseHeader.set(key,value)}),body=errorToJsonBytes(error2,opt.jsonOptions)}finally{context2.abort()}compression.response&&body.byteLength>=opt.compressMinBytes&&(body=await compression.response.compress(body),context2.responseHeader.set(headerUnaryEncoding,compression.response.name));let header=trailerMux(context2.responseHeader,context2.responseTrailer);return header.set(headerUnaryContentLength,body.byteLength.toString(10)),{status,body:createAsyncIterable([body]),header}}}async function readUnaryMessageFromBody(readMaxBytes,compression,request){if(typeof request.body=="object"&&request.body!==null&&Symbol.asyncIterator in request.body){let reqBytes=await readAllBytes(request.body,readMaxBytes,request.header.get(headerUnaryContentLength));return compression&&(reqBytes=await compression.decompress(reqBytes,readMaxBytes)),reqBytes}return request.body}async function readUnaryMessageFromQuery(readMaxBytes,compression,queryParams){var _a3;let base64=queryParams.get(paramBase64),message6=(_a3=queryParams.get(paramMessage))!==null&&_a3!==void 0?_a3:"",decoded;return base64==="1"?decoded=base64Decode2(message6):decoded=new TextEncoder().encode(message6),compression&&(decoded=await compression.decompress(decoded,readMaxBytes)),decoded}function parseUnaryMessage(method,useBinaryFormat,serialization,input){if(input instanceof Uint8Array)return serialization.getI(useBinaryFormat).parse(input);if(useBinaryFormat)throw new ConnectError("received parsed JSON request body, but content-type indicates binary format",Code.Internal);try{return fromJson(method.input,input)}catch(e6){throw ConnectError.from(e6,Code.InvalidArgument)}}function createStreamHandler(opt,spec,serialization,endStreamSerialization){return async function(req){assertByteStreamRequest(req);let type2=parseContentType3(req.header.get(headerContentType2));if(type2==null||!type2.stream)return uResponseUnsupportedMediaType;if(req.method!==methodPost3)return uResponseMethodNotAllowed;let timeout=parseTimeout2(req.header.get(headerTimeout2),opt.maxTimeoutMs),context2=createHandlerContext(Object.assign(Object.assign({},spec),{service:spec.method.parent,requestMethod:req.method,protocolName:protocolName3,timeoutMs:timeout.timeoutMs,shutdownSignal:opt.shutdownSignal,requestSignal:req.signal,requestHeader:req.header,url:req.url,responseHeader:{[headerContentType2]:type2.binary?contentTypeStreamProto:contentTypeStreamJson},contextValues:req.contextValues})),compression=compressionNegotiate(opt.acceptCompression,req.header.get(headerStreamEncoding),req.header.get(headerStreamAcceptEncoding),headerStreamAcceptEncoding);compression.response&&context2.responseHeader.set(headerStreamEncoding,compression.response.name);let inputIt=pipe(req.body,transformPrepend(()=>{if(opt.requireConnectProtocolHeader&&requireProtocolVersionHeader(req.header),compression.error)throw compression.error;if(timeout.error)throw timeout.error}),transformSplitEnvelope(opt.readMaxBytes),transformDecompressEnvelope(compression.request,opt.readMaxBytes),transformParseEnvelope(serialization.getI(type2.binary),endStreamFlag)),it=transformInvokeImplementation(spec,context2,opt.interceptors)(inputIt)[Symbol.asyncIterator](),outputIt=pipe({[Symbol.asyncIterator](){return{next:()=>it.next(),throw:e6=>{var _a3,_b2;return context2.abort(e6),(_b2=(_a3=it.throw)===null||_a3===void 0?void 0:_a3.call(it,e6))!==null&&_b2!==void 0?_b2:Promise.reject({done:!0})},return:v=>{var _a3,_b2;return context2.abort(),(_b2=(_a3=it.return)===null||_a3===void 0?void 0:_a3.call(it,v))!==null&&_b2!==void 0?_b2:Promise.resolve({done:!0,value:v})}}}},transformSerializeEnvelope(serialization.getO(type2.binary)),transformCatchFinally(e6=>{context2.abort(e6);let end={metadata:context2.responseTrailer};return e6 instanceof ConnectError?end.error=e6:e6!==void 0&&(end.error=new ConnectError("internal error",Code.Internal,void 0,void 0,e6)),{flags:endStreamFlag,data:endStreamSerialization.serialize(end)}}),transformCompressEnvelope(compression.response,opt.compressMinBytes),transformJoinEnvelopes(),{propagateDownStreamError:!0});return Object.assign(Object.assign({},uResponseOk),{body:await untilFirst(outputIt),header:context2.responseHeader})}}function createConnectRouter(routerOptions){let base=whichProtocols(routerOptions),handlers=[],router={handlers,service:(service,implementation,options)=>{let{protocols:protocols2}=whichProtocols(options,base);return handlers.push(...createUniversalServiceHandlers(createServiceImplSpec(service,implementation),protocols2)),router},rpc:(method,impl,opt)=>{let{protocols:protocols2}=whichProtocols(opt,base);return handlers.push(createUniversalMethodHandler(createMethodImplSpec(method,impl),protocols2)),router}};return router}function whichProtocols(options,base){if(base&&!options)return base;let opt=base?Object.assign(Object.assign({},validateUniversalHandlerOptions(base.options)),options):Object.assign(Object.assign({},options),validateUniversalHandlerOptions(options??{})),protocols2=[];if(options?.grpc!==!1&&protocols2.push(createHandlerFactory2(opt)),options?.grpcWeb!==!1&&protocols2.push(createHandlerFactory(opt)),options?.connect!==!1&&protocols2.push(createHandlerFactory3(opt)),protocols2.length===0)throw new ConnectError("cannot create handler, all protocols are disabled",Code.InvalidArgument);return{options:opt,protocols:protocols2}}function requestHeader(methodKind,useBinaryFormat,timeoutMs,userProvidedHeaders,setUserAgent){let result=new Headers(userProvidedHeaders??{});return timeoutMs!==void 0&&result.set(headerTimeout2,`${timeoutMs}`),result.set(headerContentType2,methodKind=="unary"?useBinaryFormat?contentTypeUnaryProto:contentTypeUnaryJson:useBinaryFormat?contentTypeStreamProto:contentTypeStreamJson),result.set(headerProtocolVersion,protocolVersion),!result.has(headerUserAgent2)&&setUserAgent&&result.set(headerUserAgent2,"connect-es/2.1.2"),result}function requestHeaderWithCompression(methodKind,useBinaryFormat,timeoutMs,userProvidedHeaders,acceptCompression,sendCompression,setUserAgent){let result=requestHeader(methodKind,useBinaryFormat,timeoutMs,userProvidedHeaders,setUserAgent);if(sendCompression!=null){let name=methodKind=="unary"?headerUnaryEncoding:headerStreamEncoding;result.set(name,sendCompression.name)}if(acceptCompression.length>0){let name=methodKind=="unary"?headerUnaryAcceptEncoding:headerStreamAcceptEncoding;result.set(name,acceptCompression.map(c5=>c5.name).join(","))}return result}function validateResponse(methodKind,useBinaryFormat,status,headers2){let mimeType=headers2.get(headerContentType2),parsedType=parseContentType3(mimeType);if(status!==200){let errorFromStatus=new ConnectError(`HTTP ${status}`,codeFromHttpStatus(status),headers2);if(methodKind=="unary"&&parsedType&&!parsedType.binary)return{isUnaryError:!0,unaryError:errorFromStatus};throw errorFromStatus}let allowedContentType={binary:useBinaryFormat,stream:methodKind!=="unary"};if(parsedType?.binary!==allowedContentType.binary||parsedType.stream!==allowedContentType.stream)throw new ConnectError(`unsupported content type ${mimeType}`,parsedType===void 0?Code.Unknown:Code.Internal,headers2);return{isUnaryError:!1}}function validateResponseWithCompression(methodKind,acceptCompression,useBinaryFormat,status,headers2){let compression,encoding=headers2.get(methodKind=="unary"?headerUnaryEncoding:headerStreamEncoding);if(encoding!=null&&encoding.toLowerCase()!=="identity"&&(compression=acceptCompression.find(c5=>c5.name===encoding),!compression))throw new ConnectError(`unsupported response encoding "${encoding}"`,Code.Internal,headers2);return Object.assign({compression},validateResponse(methodKind,useBinaryFormat,status,headers2))}var contentTypePrefix="application/";function encodeMessageForUrl(message6,useBase64){return useBase64?base64Encode(message6,"url"):encodeURIComponent(new TextDecoder().decode(message6))}function transformConnectPostToGetRequest(request,message6,useBase64){let query=`?connect=v${protocolVersion}`,compressionQuery="",compression=request.header.get(headerUnaryEncoding);compression!==null&&compression!=="identity"&&(compressionQuery="&compression="+encodeURIComponent(compression),useBase64=!0),useBase64&&(query+="&base64=1"),query+=compressionQuery;let contentType=request.header.get(headerContentType2);contentType?.indexOf(contentTypePrefix)===0&&(query+="&encoding="+encodeURIComponent(contentType.slice(contentTypePrefix.length))),query+="&message="+encodeMessageForUrl(message6,useBase64);let url=request.url+query,header=new Headers(request.header);for(let h5 of[headerProtocolVersion,headerContentType2,headerUnaryContentLength,headerUnaryEncoding,headerUnaryAcceptEncoding])header.delete(h5);return Object.assign(Object.assign({},request),{requestMethod:"GET",url,header})}function runUnaryCall(opt){let next=applyInterceptors(opt.next,opt.interceptors),[signal3,abort,done]=setupSignal(opt),req=Object.assign(Object.assign({},opt.req),{message:normalize(opt.req.method.input,opt.req.message),signal:signal3});return next(req).then(res=>(done(),res),abort)}function runStreamingCall(opt){let next=applyInterceptors(opt.next,opt.interceptors),[signal3,abort,done]=setupSignal(opt),req=Object.assign(Object.assign({},opt.req),{message:normalizeIterable(opt.req.method.input,opt.req.message),signal:signal3}),doneCalled=!1;return signal3.addEventListener("abort",function(){var _a3,_b2;let it=opt.req.message[Symbol.asyncIterator]();doneCalled||(_a3=it.throw)===null||_a3===void 0||_a3.call(it,this.reason).catch(()=>{}),(_b2=it.return)===null||_b2===void 0||_b2.call(it).catch(()=>{})}),next(req).then(res=>Object.assign(Object.assign({},res),{message:{[Symbol.asyncIterator](){let it=res.message[Symbol.asyncIterator]();return{next(){return it.next().then(r5=>(r5.done==!0&&(doneCalled=!0,done()),r5),abort)}}}}}),abort)}function setupSignal(opt){let{signal:signal3,cleanup}=createDeadlineSignal(opt.timeoutMs),controller=createLinkedAbortController(opt.signal,signal3);return[controller.signal,function(reason){let e6=controller.signal.aborted?ConnectError.from(getAbortSignalReason(controller.signal),Code.Canceled):ConnectError.from(reason);return controller.abort(e6),cleanup(),Promise.reject(e6)},function(){cleanup(),controller.abort()}]}var __asyncValues4=function(o3){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var m3=o3[Symbol.asyncIterator],i6;return m3?m3.call(o3):(o3=typeof __values=="function"?__values(o3):o3[Symbol.iterator](),i6={},verb("next"),verb("throw"),verb("return"),i6[Symbol.asyncIterator]=function(){return this},i6);function verb(n3){i6[n3]=o3[n3]&&function(v){return new Promise(function(resolve,reject2){v=o3[n3](v),settle(resolve,reject2,v.done,v.value)})}}function settle(resolve,reject2,d5,v){Promise.resolve(v).then(function(v2){resolve({value:v2,done:d5})},reject2)}},__await4=function(v){return this instanceof __await4?(this.v=v,this):new __await4(v)},__asyncGenerator4=function(thisArg,_arguments,generator){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var g5=generator.apply(thisArg,_arguments||[]),i6,q4=[];return i6=Object.create((typeof AsyncIterator=="function"?AsyncIterator:Object).prototype),verb("next"),verb("throw"),verb("return",awaitReturn),i6[Symbol.asyncIterator]=function(){return this},i6;function awaitReturn(f5){return function(v){return Promise.resolve(v).then(f5,reject2)}}function verb(n3,f5){g5[n3]&&(i6[n3]=function(v){return new Promise(function(a5,b7){q4.push([n3,v,a5,b7])>1||resume2(n3,v)})},f5&&(i6[n3]=f5(i6[n3])))}function resume2(n3,v){try{step(g5[n3](v))}catch(e6){settle(q4[0][3],e6)}}function step(r5){r5.value instanceof __await4?Promise.resolve(r5.value.v).then(fulfill,reject2):settle(q4[0][2],r5)}function fulfill(value){resume2("next",value)}function reject2(value){resume2("throw",value)}function settle(f5,v){f5(v),q4.shift(),q4.length&&resume2(q4[0][0],q4[0][1])}};function createTransport(opt){return{async unary(method,signal3,timeoutMs,header,message6,contextValues){let serialization=createMethodSerializationLookup(method,opt.binaryOptions,opt.jsonOptions,opt);return timeoutMs=timeoutMs===void 0?opt.defaultTimeoutMs:timeoutMs<=0?void 0:timeoutMs,await runUnaryCall({interceptors:opt.interceptors,signal:signal3,timeoutMs,req:{stream:!1,service:method.parent,method,requestMethod:"POST",url:createMethodUrl(opt.baseUrl,method),header:requestHeaderWithCompression(method.methodKind,opt.useBinaryFormat,timeoutMs,header,opt.acceptCompression,opt.sendCompression,!0),contextValues:contextValues??createContextValues(),message:message6},next:async req=>{let requestBody=serialization.getI(opt.useBinaryFormat).serialize(req.message);opt.sendCompression&&requestBody.byteLength>opt.compressMinBytes?(requestBody=await opt.sendCompression.compress(requestBody),req.header.set(headerUnaryEncoding,opt.sendCompression.name)):req.header.delete(headerUnaryEncoding);let useGet=opt.useHttpGet===!0&&method.idempotency===MethodOptions_IdempotencyLevel2.NO_SIDE_EFFECTS,body;useGet?req=transformConnectPostToGetRequest(req,requestBody,opt.useBinaryFormat):body=createAsyncIterable([requestBody]);let universalResponse=await opt.httpClient({url:req.url,method:req.requestMethod,header:req.header,signal:req.signal,body}),{compression,isUnaryError,unaryError}=validateResponseWithCompression(method.methodKind,opt.acceptCompression,opt.useBinaryFormat,universalResponse.status,universalResponse.header),[header2,trailer]=trailerDemux(universalResponse.header),responseBody=await pipeTo(universalResponse.body,sinkAllBytes(opt.readMaxBytes,universalResponse.header.get(headerUnaryContentLength)),{propagateDownStreamError:!1});if(compression&&(responseBody=await compression.decompress(responseBody,opt.readMaxBytes)),isUnaryError)throw errorFromJsonBytes(responseBody,appendHeaders(header2,trailer),unaryError);return{stream:!1,service:method.parent,method,header:header2,message:serialization.getO(opt.useBinaryFormat).parse(responseBody),trailer}}})},async stream(method,signal3,timeoutMs,header,input,contextValues){let serialization=createMethodSerializationLookup(method,opt.binaryOptions,opt.jsonOptions,opt),endStreamSerialization=createEndStreamSerialization(opt.jsonOptions);return timeoutMs=timeoutMs===void 0?opt.defaultTimeoutMs:timeoutMs<=0?void 0:timeoutMs,runStreamingCall({interceptors:opt.interceptors,signal:signal3,timeoutMs,req:{stream:!0,service:method.parent,method,requestMethod:"POST",url:createMethodUrl(opt.baseUrl,method),header:requestHeaderWithCompression(method.methodKind,opt.useBinaryFormat,timeoutMs,header,opt.acceptCompression,opt.sendCompression,!0),contextValues:contextValues??createContextValues(),message:input},next:async req=>{let uRes=await opt.httpClient({url:req.url,method:"POST",header:req.header,signal:req.signal,body:pipe(req.message,transformSerializeEnvelope(serialization.getI(opt.useBinaryFormat)),transformCompressEnvelope(opt.sendCompression,opt.compressMinBytes),transformJoinEnvelopes(),{propagateDownStreamError:!0})}),{compression}=validateResponseWithCompression(method.methodKind,opt.acceptCompression,opt.useBinaryFormat,uRes.status,uRes.header),res=Object.assign(Object.assign({},req),{header:uRes.header,trailer:new Headers,message:pipe(uRes.body,transformSplitEnvelope(opt.readMaxBytes),transformDecompressEnvelope(compression??null,opt.readMaxBytes),transformParseEnvelope(serialization.getO(opt.useBinaryFormat),endStreamFlag,endStreamSerialization),function(iterable){return __asyncGenerator4(this,arguments,function*(){var _a3,e_1,_b2,_c5;let endStreamReceived=!1;try{for(var _d=!0,iterable_1=__asyncValues4(iterable),iterable_1_1;iterable_1_1=yield __await4(iterable_1.next()),_a3=iterable_1_1.done,!_a3;_d=!0){_c5=iterable_1_1.value,_d=!1;let chunk=_c5;if(chunk.end){if(endStreamReceived)throw new ConnectError("protocol error: received extra EndStreamResponse",Code.InvalidArgument);if(endStreamReceived=!0,chunk.value.error){let error2=chunk.value.error;throw uRes.header.forEach((value,key)=>{error2.metadata.append(key,value)}),error2}chunk.value.metadata.forEach((value,key)=>res.trailer.set(key,value));continue}if(endStreamReceived)throw new ConnectError("protocol error: received extra message after EndStreamResponse",Code.InvalidArgument);yield yield __await4(chunk.value)}}catch(e_1_1){e_1={error:e_1_1}}finally{try{!_d&&!_a3&&(_b2=iterable_1.return)&&(yield __await4(_b2.call(iterable_1)))}finally{if(e_1)throw e_1.error}}if(!endStreamReceived)throw new ConnectError("protocol error: missing EndStreamResponse",Code.InvalidArgument)})},{propagateDownStreamError:!0})});return res}})}}}function createUniversalHandlerClient(uHandlers){let handlerMap=new Map;for(let handler of uHandlers)handlerMap.set(handler.requestPath,handler);return async uClientReq=>{var _a3,_b2,_c5;let pathname=new URL(uClientReq.url).pathname,handler=handlerMap.get(pathname);if(!handler)throw new ConnectError(`RouterHttpClient: no handler registered for ${pathname}`,Code.Unimplemented);let reqSignal=(_a3=uClientReq.signal)!==null&&_a3!==void 0?_a3:new AbortController().signal,uServerRes=await raceSignal(reqSignal,handler({body:(_b2=uClientReq.body)!==null&&_b2!==void 0?_b2:createAsyncIterable([]),httpVersion:"2.0",method:uClientReq.method,url:uClientReq.url,header:uClientReq.header,signal:reqSignal})),body=(_c5=uServerRes.body)!==null&&_c5!==void 0?_c5:createAsyncIterable([]);return{body:pipe(body,iterable=>({[Symbol.asyncIterator](){let it=iterable[Symbol.asyncIterator](),w={next(){return raceSignal(reqSignal,it.next())}};return it.throw!==void 0&&(w.throw=e6=>it.throw(e6)),it.return!==void 0&&(w.return=value=>it.return(value)),w}})),header:new Headers(uServerRes.header),status:uServerRes.status,trailer:new Headers(uServerRes.trailer)}}}function raceSignal(signal3,promise){let cleanup,signalPromise=new Promise((_,reject2)=>{let onAbort=()=>reject2(getAbortSignalReason(signal3));if(signal3.aborted)return onAbort();signal3.addEventListener("abort",onAbort),cleanup=()=>signal3.removeEventListener("abort",onAbort)});return Promise.race([signalPromise,promise]).finally(cleanup)}function createRouterTransport(routes,options){var _a3,_b2;let router=createConnectRouter(Object.assign(Object.assign({},(_a3=options?.router)!==null&&_a3!==void 0?_a3:{}),{connect:!0}));return routes(router),createTransport(Object.assign({httpClient:createUniversalHandlerClient(router.handlers),baseUrl:"https://in-memory",useBinaryFormat:!0,interceptors:[],acceptCompression:[],sendCompression:null,compressMinBytes:Number.MAX_SAFE_INTEGER,readMaxBytes:Number.MAX_SAFE_INTEGER,writeMaxBytes:Number.MAX_SAFE_INTEGER},(_b2=options?.transport)!==null&&_b2!==void 0?_b2:{}))}function notFoundError(resource,id){return new ConnectError(`${resource} not found: ${id}`,Code.NotFound)}function invalidArgumentError(message6){return new ConnectError(message6,Code.InvalidArgument)}function alreadyExistsError(resource,id){return new ConnectError(`${resource} already exists: ${id}`,Code.AlreadyExists)}function failedPreconditionError(message6){return new ConnectError(message6,Code.FailedPrecondition)}function abortedError(message6){return new ConnectError(message6,Code.Aborted)}function unavailableError(message6){return new ConnectError(message6,Code.Unavailable)}function internalError(cause,message6){return new ConnectError(message6,Code.Internal,void 0,void 0,cause)}var GRPC_CODE_NAMES={[Code.Canceled]:"Canceled",[Code.Unknown]:"Unknown",[Code.InvalidArgument]:"InvalidArgument",[Code.DeadlineExceeded]:"DeadlineExceeded",[Code.NotFound]:"NotFound",[Code.AlreadyExists]:"AlreadyExists",[Code.PermissionDenied]:"PermissionDenied",[Code.ResourceExhausted]:"ResourceExhausted",[Code.FailedPrecondition]:"FailedPrecondition",[Code.Aborted]:"Aborted",[Code.OutOfRange]:"OutOfRange",[Code.Unimplemented]:"Unimplemented",[Code.Internal]:"Internal",[Code.Unavailable]:"Unavailable",[Code.DataLoss]:"DataLoss",[Code.Unauthenticated]:"Unauthenticated"};function grpcCodeName(code){return GRPC_CODE_NAMES[code]}function goWrappedStatusError(prefix,error2){return new ConnectError(`${prefix}: ${goGrpcErrorText(error2)}`,error2.code)}function goGrpcErrorText(error2){return`rpc error: code = ${GRPC_CODE_NAMES[error2.code]} desc = ${error2.rawMessage}`}function rethrownStatusError(error2){return new ConnectError(error2.rawMessage,error2.code)}var import_node_crypto3=require("node:crypto");function buildPath(schema2){return new PathBuilderImpl(schema2,schema2,[])}function pathToString(path14){let str2=[];for(let ele of path14)switch(ele.kind){case"field":case"oneof":str2.length>0&&str2.push("."),str2.push(ele.name);break;case"extension":str2.push("[",ele.typeName,"]");break;case"list_sub":str2.push("[",ele.index,"]");break;case"map_sub":typeof ele.key=="string"?str2.push('["',ele.key.split("\\").join("\\\\").split('"').join('\\"').split("\r").join("\\r").split(`
 `).join("\\n"),'"]'):str2.push("[",ele.key,"]");break}return str2.join("")}var InvalidPathError=class extends Error{constructor(schema2,message6,path14){super(message6),this.name="InvalidPathError",this.schema=schema2,this.path=path14,Object.setPrototypeOf(this,new.target.prototype)}},PathBuilderImpl=class _PathBuilderImpl{constructor(schema2,left,path14){this.schema=schema2,this.left=left,this.path=path14}getLeft(){return this.left}field(field3){return this.push(field3)}oneof(oneof2){return this.push(oneof2)}extension(extension){return this.push(extension)}list(index2){return this.push({kind:"list_sub",index:index2})}map(key){return this.push({kind:"map_sub",key})}add(pathOrBuilder){let path14=Array.isArray(pathOrBuilder)?pathOrBuilder:pathOrBuilder.toPath(),l3=this.path.length;try{for(let ele of path14)this.push(ele)}catch(e6){throw this.path.splice(l3),e6}return this}toPath(){return this.path.concat()}clone(){return new _PathBuilderImpl(this.schema,this.left,this.path.concat())}push(ele){switch(ele.kind){case"field":if(!this.left||this.left.kind!="message"||this.left.typeName!=ele.parent.typeName)throw this.err("field access");return this.path.push(ele),this.left=ele.fieldKind=="message"?ele.message:ele.fieldKind=="list"||ele.fieldKind=="map"?ele:void 0,this;case"oneof":if(!this.left||this.left.kind!="message"||this.left.typeName!=ele.parent.typeName)throw this.err("oneof access");return this.path.push(ele),this.left=void 0,this;case"extension":if(!this.left||this.left.kind!="message"||this.left.typeName!=ele.extendee.typeName)throw this.err("extension access");return this.path.push(ele),this.left=ele.fieldKind=="message"?ele.message:void 0,this;case"list_sub":if(!this.left||this.left.kind!="field"||this.left.fieldKind!="list")throw this.err("list access");if(ele.index<0||!Number.isInteger(ele.index))throw this.err("list index");return this.path.push(ele),this.left=this.left.listKind=="message"?this.left.message:void 0,this;case"map_sub":if(!this.left||this.left.kind!="field"||this.left.fieldKind!="map")throw this.err("map access");if(!checkKeyType(ele.key,this.left.mapKey))throw this.err("map key");return this.path.push(ele),this.left=this.left.mapKind=="message"?this.left.message:void 0,this}}err(what){return new InvalidPathError(this.schema,"Invalid "+what,this.path)}};function checkKeyType(key,type2){switch(type2){case ScalarType2.STRING:return typeof key=="string";case ScalarType2.INT32:case ScalarType2.UINT32:case ScalarType2.SINT32:case ScalarType2.SFIXED32:case ScalarType2.FIXED32:return typeof key=="number";case ScalarType2.UINT64:case ScalarType2.INT64:case ScalarType2.FIXED64:case ScalarType2.SFIXED64:case ScalarType2.SINT64:return typeof key=="bigint";case ScalarType2.BOOL:return typeof key=="boolean"}}var import_node_crypto2=__toESM(require("node:crypto"),1);function assertError(err2){if(!isError(err2))throw new Error("Parameter was not an error")}function isError(err2){return!!err2&&typeof err2=="object"&&objectToString(err2)==="[object Error]"||err2 instanceof Error}function objectToString(obj){return Object.prototype.toString.call(obj)}var NAME="Layerr",__name=NAME;function getGlobalName(){return __name}function parseArguments(args){let options,shortMessage="";if(args.length===0)options={};else if(isError(args[0]))options={cause:args[0]},shortMessage=args.slice(1).join(" ")||"";else if(args[0]&&typeof args[0]=="object")options=Object.assign({},args[0]),shortMessage=args.slice(1).join(" ")||"";else if(typeof args[0]=="string")options={},shortMessage=shortMessage=args.join(" ")||"";else throw new Error("Invalid arguments passed to Layerr");return{options,shortMessage}}var Layerr=class _Layerr extends Error{constructor(errorOptionsOrMessage,messageText){let args=[...arguments],{options,shortMessage}=parseArguments(args),message6=shortMessage;if(options.cause&&(message6=`${message6}: ${options.cause.message}`),super(message6),this.message=message6,options.name&&typeof options.name=="string"?this.name=options.name:this.name=getGlobalName(),options.cause&&Object.defineProperty(this,"_cause",{value:options.cause}),Object.defineProperty(this,"_info",{value:{}}),options.info&&typeof options.info=="object"&&Object.assign(this._info,options.info),Error.captureStackTrace){let ctor=options.constructorOpt||this.constructor;Error.captureStackTrace(this,ctor)}}static cause(err2){return assertError(err2),err2._cause&&isError(err2._cause)?err2._cause:null}static fullStack(err2){assertError(err2);let cause=_Layerr.cause(err2);return cause?`${err2.stack}
-caused by: ${_Layerr.fullStack(cause)}`:err2.stack??""}static info(err2){assertError(err2);let output={},cause=_Layerr.cause(err2);return cause&&Object.assign(output,_Layerr.info(cause)),err2._info&&Object.assign(output,err2._info),output}toString(){let output=this.name||this.constructor.name||this.constructor.prototype.name;return this.message&&(output=`${output}: ${this.message}`),output}};var ENCODING="0123456789ABCDEFGHJKMNPQRSTVWXYZ",ENCODING_LEN=32,TIME_MAX=0xffffffffffff,TIME_LEN=10,RANDOM_LEN=16,ERROR_INFO=Object.freeze({source:"ulid"});function detectPRNG(root5){let rootLookup=root5||detectRoot(),globalCrypto=rootLookup&&(rootLookup.crypto||rootLookup.msCrypto)||(typeof import_node_crypto2.default<"u"?import_node_crypto2.default:null);if(typeof globalCrypto?.getRandomValues=="function")return()=>{let buffer=new Uint8Array(1);return globalCrypto.getRandomValues(buffer),buffer[0]/255};if(typeof globalCrypto?.randomBytes=="function")return()=>globalCrypto.randomBytes(1).readUInt8()/255;if(import_node_crypto2.default?.randomBytes)return()=>import_node_crypto2.default.randomBytes(1).readUInt8()/255;throw new Layerr({info:{code:"PRNG_DETECT",...ERROR_INFO}},"Failed to find a reliable PRNG")}function detectRoot(){return inWebWorker()?self:typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:null}function encodeRandom(len,prng){let str2="";for(;len>0;len--)str2=randomChar(prng)+str2;return str2}function encodeTime(now,len){if(isNaN(now))throw new Layerr({info:{code:"ENC_TIME_NAN",...ERROR_INFO}},`Time must be a number: ${now}`);if(now>TIME_MAX)throw new Layerr({info:{code:"ENC_TIME_SIZE_EXCEED",...ERROR_INFO}},`Cannot encode a time larger than ${TIME_MAX}: ${now}`);if(now<0)throw new Layerr({info:{code:"ENC_TIME_NEG",...ERROR_INFO}},`Time must be positive: ${now}`);if(Number.isInteger(now)===!1)throw new Layerr({info:{code:"ENC_TIME_TYPE",...ERROR_INFO}},`Time must be an integer: ${now}`);let mod2,str2="";for(let currentLen=len;currentLen>0;currentLen--)mod2=now%ENCODING_LEN,str2=ENCODING.charAt(mod2)+str2,now=(now-mod2)/ENCODING_LEN;return str2}function inWebWorker(){return typeof WorkerGlobalScope<"u"&&self instanceof WorkerGlobalScope}function randomChar(prng){let rand=Math.floor(prng()*ENCODING_LEN);return rand===ENCODING_LEN&&(rand=ENCODING_LEN-1),ENCODING.charAt(rand)}function ulid(seedTime,prng){let currentPRNG=prng||detectPRNG(),seed=isNaN(seedTime)?Date.now():seedTime;return encodeTime(seed,TIME_LEN)+encodeRandom(RANDOM_LEN,currentPRNG)}function metadataOf(msg){return msg.metadata}function idValueOf(msg){let value=msg.value;return typeof value=="string"?value:""}function camelCaseFieldName(specField){return specField.replace(/_([a-z0-9])/g,(_,ch)=>ch.toUpperCase())}function parentIdOf(resource,specField){let spec=resource.spec;if(spec===void 0)return"";let value=spec[camelCaseFieldName(specField)];return typeof value=="string"?value:""}function messageFieldByName(msg,name){let field3=msg.fields.find(f5=>f5.name===name);return field3!==void 0&&field3.fieldKind==="message"?field3:void 0}function getStatusField(schema2,msg){let root5=reflect2(schema2,msg),field3=messageFieldByName(root5,"status");if(!(field3===void 0||!root5.isSet(field3)))return root5.get(field3)}function getOrCreateStatusField(schema2,msg){let root5=reflect2(schema2,msg),field3=messageFieldByName(root5,"status");if(field3!==void 0)return root5.isSet(field3)||root5.set(field3,reflect2(field3.message)),root5.get(field3)}function hasStatusField(schema2){return schema2.fields.some(f5=>f5.name==="status"&&f5.fieldKind==="message")}function newBuildNewStateStep(){return{name:"BuildNewState",execute(ctx){let resource=ctx.newState,metadata=metadataOf(resource);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"build new state");hasStatusField(ctx.schema)&&clearStatusField(ctx.schema,resource),metadata.id===""&&(metadata.id=generateId(getIdPrefix(ctx.apiResourceKind))),hasStatusField(ctx.schema)&&setAuditFieldsForCreate(ctx.schema,resource,ctx.callerIdentity),metadata.visibility===ApiResourceVisibility.api_resource_visibility_unspecified&&(metadata.visibility=defaultVisibilityFor(ctx.apiResourceKind))}}}function clearStatusField(schema2,msg){let root5=reflect2(schema2,msg),field3=root5.fields.find(f5=>f5.name==="status"&&f5.fieldKind==="message");field3!==void 0&&root5.isSet(field3)&&root5.clear(field3)}function setAuditFieldsForCreate(schema2,resource,identity2){let now=timestampNow(),actor=auditActorFor(identity2),info=create2(ApiResourceAuditInfoSchema,{createdBy:actor,createdAt:now,updatedBy:actor,updatedAt:now,event:"created"});setAuditReflect(schema2,resource,create2(ApiResourceAuditSchema,{specAudit:info,statusAudit:info}))}function setAuditFieldsForUpdate(schema2,resource,slot,identity2){let now=timestampNow(),actor=auditActorFor(identity2),{createdBy,createdAt}=creationAuditOf(schema2,resource,slot);setAuditSlotReflect(schema2,resource,slot,updatedAuditInfo(createdBy,createdAt,actor,now))}function bumpStatusAudit(status){status.audit===void 0&&(status.audit=create2(ApiResourceAuditSchema));let prior=status.audit.statusAudit,next=prior===void 0?create2(ApiResourceAuditInfoSchema):clone(ApiResourceAuditInfoSchema,prior);next.updatedAt=timestampNow(),next.event="updated",status.audit.statusAudit=next}var operatorEmail="",operatorName="",operatorIdentityInstalled=!1;function setOperatorIdentity(email,displayName){if(operatorIdentityInstalled)throw new Error("operator identity already installed (boot wiring bug)");operatorIdentityInstalled=!0,operatorEmail=email,operatorName=displayName}function operatorIdentitySnapshot(){return{email:operatorEmail,displayName:operatorName}}function auditActorFor(identity2){return create2(ApiResourceAuditActorSchema,{id:identity2.identityId,email:identity2.email??"",displayName:identity2.displayName??"",platformClientId:identity2.platformClientId??""})}function updatedAuditInfo(createdBy,createdAt,actor,now){return create2(ApiResourceAuditInfoSchema,{createdBy:createdBy??actor,createdAt:createdAt??now,updatedBy:actor,updatedAt:now,event:"updated"})}function creationAuditOf(schema2,resource,slot){let audit=auditOf(schema2,resource),info=slot==="spec_audit"?audit?.specAudit:audit?.statusAudit;return{createdBy:info?.createdBy!==void 0?clone(ApiResourceAuditActorSchema,info.createdBy):void 0,createdAt:info?.createdAt!==void 0?{...info.createdAt}:void 0}}function auditOf(schema2,resource){let status=getStatusField(schema2,resource);if(status===void 0)return;let auditField=messageFieldByName(status,"audit");if(!(auditField===void 0||!status.isSet(auditField)))return status.get(auditField).message}function setAuditReflect(schema2,resource,audit){let status=getOrCreateStatusField(schema2,resource);if(status===void 0)return;let auditField=messageFieldByName(status,"audit");auditField!==void 0&&status.set(auditField,reflect2(ApiResourceAuditSchema,audit))}function setAuditSlotReflect(schema2,resource,slot,info){let status=getOrCreateStatusField(schema2,resource);if(status===void 0)return;let auditField=messageFieldByName(status,"audit");if(auditField===void 0)return;status.isSet(auditField)||status.set(auditField,reflect2(auditField.message));let auditMsg=status.get(auditField),slotField=messageFieldByName(auditMsg,slot);slotField!==void 0&&auditMsg.set(slotField,reflect2(ApiResourceAuditInfoSchema,info))}function generateId(prefix){return`${prefix}_${ulid().toLowerCase()}`}var CROCKFORD_ALPHABET="0123456789abcdefghjkmnpqrstvwxyz",DERIVED_ID_CHARS=26,DERIVED_ID_BITS=BigInt(DERIVED_ID_CHARS*5),SHA256_BITS=256n;function derivedId(prefix,canonicalText){let digest3=(0,import_node_crypto3.createHash)("sha256").update(canonicalText,"utf8").digest(),bits2=0n;for(let byte of digest3)bits2=bits2<<8n|BigInt(byte);let top=bits2>>SHA256_BITS-DERIVED_ID_BITS,encoded="";for(let i6=0;i6<DERIVED_ID_CHARS;i6++)encoded=CROCKFORD_ALPHABET[Number(top&31n)]+encoded,top>>=5n;return`${prefix}_${encoded}`}var AUTHENTICATION_TOKEN_MISSING_MESSAGE="authentication token missing",AUTHENTICATION_EXEMPT_SERVICES=new Set(["grpc.health.v1.Health"]);function isAuthenticationExempt(method){return getOption(method,is_public)||AUTHENTICATION_EXEMPT_SERVICES.has(method.parent.typeName)}var callerIdentityKey=createContextKey(void 0,{description:"caller identity produced at chain position 1"});function callerIdentityOf(ctx){let identity2=ctx.values.get(callerIdentityKey);if(identity2===void 0)throw internalError(new Error("no caller identity in context (chain wiring bug)"),"internal server error");return identity2}function trustedLocalIdentity(){return trustedLocalIdentityFor(operatorIdentitySnapshot())}var SYSTEM_OPERATOR_IDENTITY_ID="system";function trustedLocalIdentityFor(operator){return operator.email===""?{identityId:SYSTEM_OPERATOR_IDENTITY_ID,callerClass:"user",issuer:"",rawToken:""}:{identityId:operator.email,callerClass:"user",issuer:"",rawToken:"",email:operator.email,displayName:operator.displayName}}function serverActingFor(principalId){if(principalId==="")throw new Error("the server acts for a named principal \u2014 refusing to build an internal caller with none");return{identityId:principalId,callerClass:"internal",issuer:"",rawToken:""}}function createVerifierChainInterceptor(verifiers,guards,logger2,requireAuthentication=!1){return next=>async request=>{request.header.delete(IN_PROCESS_CALLER_HEADER);let token=parseBearerToken(request.header.get("authorization")??""),identity2;if(token!==""){if(identity2=await authenticateBearerToken(verifiers,token,logger2),identity2===void 0&&verifiers.length>0)throw logger2.warn("presented token not claimed by any identity verifier",{verifiers:verifiers.map(v=>v.name).join(", ")}),new ConnectError("the presented token was not accepted by any configured identity verifier",Code.Unauthenticated)}else if(requireAuthentication&&!isAuthenticationExempt(request.method))throw new ConnectError(AUTHENTICATION_TOKEN_MISSING_MESSAGE,Code.Unauthenticated);let stamped=identity2??trustedLocalIdentity();return request.contextValues.set(callerIdentityKey,stamped),await runCallerGuards(guards,stamped,request,logger2),next(request)}}async function runCallerGuards(guards,caller,request,logger2){for(let guard of guards)try{await guard.guard(caller,request.method,request.header)}catch(error2){let procedure=`/${request.service.typeName}/${request.method.name}`;throw error2 instanceof ConnectError?(logger2.warn("caller guard refused the request",{guard:guard.name,procedure,code:Code[error2.code]}),error2):(logger2.error("caller guard failed",{guard:guard.name,procedure,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"internal server error"))}}var IN_PROCESS_CALLER_HEADER="x-stigmer-inprocess-caller";function encodeInProcessCaller(caller){return Buffer.from(JSON.stringify(caller)).toString("base64url")}function createInProcessCallerInterceptor(){return next=>request=>{let encoded=request.header.get(IN_PROCESS_CALLER_HEADER),identity2;if(encoded!==null){request.header.delete(IN_PROCESS_CALLER_HEADER);try{identity2={...JSON.parse(Buffer.from(encoded,"base64url").toString("utf8")),origin:"in-process"}}catch(error2){throw internalError(error2 instanceof Error?error2:new Error(String(error2)),"internal server error")}}else identity2={...trustedLocalIdentity(),callerClass:"internal",origin:"in-process"};return request.contextValues.set(callerIdentityKey,identity2),next(request)}}async function authenticateBearerToken(verifiers,token,logger2){for(let verifier of verifiers){let claimed;try{claimed=await verifier.verify(token)}catch(error2){throw error2 instanceof ConnectError?error2:(logger2.error("identity verifier failed",{verifier:verifier.name,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"internal server error"))}if(claimed!==null)return claimed}}function parseBearerToken(joinedHeaderValue){let header=joinedHeaderValue.split(",")[0]??"",prefix="bearer ";return header.length<=prefix.length||header.slice(0,prefix.length).toLowerCase()!==prefix?"":header.slice(prefix.length).trim()}function rfc3339Seconds(date2){return date2.toISOString().replace(/\.\d{3}Z$/,"Z")}function accountAsCaller(account2){return{...principalOf(account2),callerClass:"user",issuer:"",rawToken:""}}function accountAsRunnerCaller(account2,rawToken){if(rawToken==="")throw new Error("a runner caller carries the credential it presented \u2014 refusing to build one with none");return{...principalOf(account2),callerClass:"runner",issuer:"",rawToken}}function principalOf(account2){let accountId=account2.metadata?.id??"";if(accountId==="")throw new Error("identity account carries no id \u2014 refusing to build a caller for an empty principal");let email=account2.spec?.email??"",displayName=account2.metadata?.name??"";return{identityId:accountId,...email!==""?{email}:{},...displayName!==""?{displayName}:{}}}var POLICY_ID_PREFIX="iamp",IAM_POLICY_API_VERSION="iam.stigmer.ai/v1",IAM_POLICY_KIND="IamPolicy",TRIPLE_DELIMITERS=[":","#","@"];function completeTriple(spec){if(spec.principal===void 0||spec.resource===void 0)throw new Error("policy spec must carry principal and resource");return{principal:spec.principal,resource:spec.resource,relation:spec.relation}}function canonicalTripleText(spec){let{principal,resource,relation}=completeTriple(spec);return`${principal.kind}:${principal.id}#${principal.relation}@${resource.kind}:${resource.id}#${relation}`}function malformedTripleField(spec){let fields2=[["principal.kind",spec.principal?.kind??""],["principal.id",spec.principal?.id??""],["principal.relation",spec.principal?.relation??""],["resource.kind",spec.resource?.kind??""],["resource.id",spec.resource?.id??""],["relation",spec.relation]];for(let[path14,value]of fields2)if(TRIPLE_DELIMITERS.some(delimiter=>value.includes(delimiter)))return path14}function policyIdFor(spec){let text2=canonicalTripleText(spec),malformed=malformedTripleField(spec);if(malformed!==void 0)throw new Error(malformedTripleMessage(malformed));return derivedId(POLICY_ID_PREFIX,text2)}var BLUEPRINT_KINDS=[ApiResourceKind.agent,ApiResourceKind.workflow,ApiResourceKind.skill,ApiResourceKind.mcp_server,ApiResourceKind.environment,ApiResourceKind.schedule],ROLES_RECONCILED_KEY="membership_rules_reconciled",USER_GRANT_PRINCIPAL_KINDS=[ApiResourceKind.identity_account,ApiResourceKind.team],TEAM_MEMBERS_RELATION="member";function policyNotFoundMessage(id){return`IAM policy not found: ${id}`}function noGrantableRolesMessage(kind){return`No roles can be granted on resource kind '${kind}'. Role assignments for this resource kind are system-managed.`}function roleNotGrantableMessage(role,kind,grantable){return`Role '${role}' cannot be granted on resource kind '${kind}'. Grantable roles: [${grantable.join(", ")}]`}var AUTHENTICATION_REQUIRED_MESSAGE="Authentication required to check permissions";function unknownResourceKindMessage(kind){return`Unknown resource kind: '${kind}'`}var PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE="per-resource access grants are served by the Enterprise and Cloud editions",AUTHORIZATION_QUERIES_UNIMPLEMENTED_MESSAGE="authorization queries are served by the Enterprise and Cloud editions";function unknownPermissionMessage(relation){return`unknown permission '${relation}'`}function unknownPrincipalKindMessage(kind){return`Unknown principal kind: '${kind}'`}function principalNotGrantableMessage(kind){let grantable=USER_GRANT_PRINCIPAL_KINDS.map(k5=>kindEnumName(k5));return`Principal kind '${kind}' cannot be granted a role. Grantable principal kinds: [${grantable.join(", ")}]`}function personQualifierMessage(relation){return`Principal kind 'identity_account' takes no relation; got '${relation}'`}function teamQualifierMessage(relation){return`A team principal must name the relation '${TEAM_MEMBERS_RELATION}' (the team's members); got '${relation}'`}function teamNotGrantableMessage(kind){return`A team cannot be granted access to resource kind '${kind}'.`}function teamRoleNotGrantableMessage(role,kind,grantable){return`Role '${role}' cannot be granted to a team on resource kind '${kind}'. Roles a team can hold: [${grantable.join(", ")}]`}function malformedTripleMessage(field3){return`policy ${field3} must not contain ':', '#' or '@'`}var OWNER_ASSIGNMENT_DENIED_MESSAGE="only an owner of the organization can grant, revoke or remove the owner role",LAST_OWNER_MESSAGE="an organization must keep at least one owner; make another member an owner first";var file_ai_stigmer_iam_iampolicy_v1_spec=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvc3BlYy5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxIr4BCg1JYW1Qb2xpY3lTcGVjEkYKCXByaW5jaXBhbBgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEkUKCHJlc291cmNlGAIgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmQga6SAPIAQESHgoIcmVsYXRpb24YAyABKAlCDLpICcgBAXIEEAEYQCJkCg5BcGlSZXNvdXJjZVJlZhIbCgRraW5kGAEgASgJQg26SArIAQFyBRABGIACEhkKAmlkGAIgASgJQg26SArIAQFyBRABGIACEhoKCHJlbGF0aW9uGAMgASgJQgi6SAVyAxiAAmIGcHJvdG8z",[file_buf_validate_validate]),IamPolicySpecSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_spec,0),ApiResourceRefSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_spec,1);function relationOf(role){if(role===IamRole.iam_role_unspecified)throw new Error("iam_role_unspecified is not a relation");return IamRole[role]}function organizationRole(accountId,role,organizationId){return create2(IamPolicySpecSchema,{principal:{kind:kindEnumName(ApiResourceKind.identity_account),id:accountId},relation:relationOf(role),resource:{kind:kindEnumName(ApiResourceKind.organization),id:organizationId}})}var CREATOR_SCAN_SCHEMAS=new Map([[ApiResourceKind.organization,OrganizationSchema],[ApiResourceKind.agent,AgentSchema],[ApiResourceKind.workflow,WorkflowSchema],[ApiResourceKind.skill,SkillSchema],[ApiResourceKind.mcp_server,McpServerSchema],[ApiResourceKind.environment,EnvironmentSchema],[ApiResourceKind.schedule,ScheduleSchema]]),ORGANIZATION=kindEnumName(ApiResourceKind.organization),IDENTITY_ACCOUNT=kindEnumName(ApiResourceKind.identity_account);function isPersonStamp(stamp2){return stamp2!==""&&stamp2!==SYSTEM_OPERATOR_IDENTITY_ID}function isPersonAccount(account2){let spec=account2.spec;return spec!==void 0&&!spec.isMachineAccount&&spec.provisioningMode!==IdentityAccountProvisioningMode.machine&&spec.provisioningMode!==IdentityAccountProvisioningMode.platform_client}function roleFor(question){let{accountId,subject,email,operatorEmail:operatorEmail2,organization,blueprintsInOrganization,organizationHasRows}=question,isMine=stamp2=>stamp2!==""&&(stamp2===subject||stamp2===accountId);return isMine(organization.createdBy)?IamRole.owner:blueprintsInOrganization.some(b7=>isMine(b7.createdBy))?IamRole.admin:operatorEmail2!==""&&email===operatorEmail2?IamRole.admin:![organization.createdBy,...blueprintsInOrganization.map(b7=>b7.createdBy)].some(stamp2=>isPersonStamp(stamp2)&&!isMine(stamp2))&&!organizationHasRows?IamRole.admin:IamRole.member}function createdAtMillisOf(account2){let stamp2=account2.status?.audit?.specAudit?.createdAt;return stamp2===void 0?Number.NEGATIVE_INFINITY:Number(stamp2.seconds)*1e3+Math.floor(stamp2.nanos/1e6)}function newMembershipRules(deps){let{grantPath,policies,store,operatorEmail:operatorEmail2}=deps;async function scan2(kind){let schema2=CREATOR_SCAN_SCHEMAS.get(kind);if(schema2===void 0)throw new Error(`no schema to decode ${kindEnumName(kind)} rows for the creator scan`);return(await store.listResources(kind)).map(bytes=>{let resource=fromBinary2(schema2,bytes),metadata=metadataOf(resource);return{id:metadata?.id??"",org:metadata?.org??"",createdBy:auditOf(schema2,resource)?.specAudit?.createdBy?.id??""}})}async function scanBlueprints(){let scanned=[];for(let kind of BLUEPRINT_KINDS)scanned.push(...await scan2(kind));return scanned}async function organizationsHeldBy(accountId){let rows=await policies.findByPrincipal(IDENTITY_ACCOUNT,accountId);return new Set(rows.filter(row=>row.spec?.resource?.kind===ORGANIZATION).map(row=>row.spec?.resource?.id??""))}async function scanWorld(){return{organizations:await scan2(ApiResourceKind.organization),blueprints:await scanBlueprints()}}async function applyRulesTo(account2,caller,world){let accountId=account2.metadata?.id??"";if(accountId==="")throw new Error("membership rules: the account carries no id");let subject=account2.spec?.idpId??"",email=account2.spec?.email??"",held=await organizationsHeldBy(accountId);for(let organization of world.organizations){if(held.has(organization.id))continue;let blueprintsInOrganization=world.blueprints.filter(blueprint=>blueprint.org===organization.id),role=roleFor({accountId,subject,email,operatorEmail:operatorEmail2,organization,blueprintsInOrganization,organizationHasRows:(await policies.findByResource(ORGANIZATION,organization.id)).length>0});await grantPath.grant(organizationRole(accountId,role,organization.id),caller)}}async function scanPersonAccounts(){return(await store.listResources(ApiResourceKind.identity_account)).map(bytes=>fromBinary2(IdentityAccountSchema,bytes)).filter(isPersonAccount).sort((a5,b7)=>{let byCreation=createdAtMillisOf(a5)-createdAtMillisOf(b7);return byCreation!==0?byCreation:(a5.metadata?.id??"").localeCompare(b7.metadata?.id??"")})}return{async onAccountCreated(account2,caller){if(caller.callerClass!=="user")return;if((account2.metadata?.id??"")==="")throw new Error("membership rules: the provisioned account carries no id");let organizations=await scan2(ApiResourceKind.organization);organizations.length!==0&&await applyRulesTo(account2,caller,{organizations,blueprints:await scanBlueprints()})},async ensureRolesForExistingAccounts(){if(await store.bootstrapState.get(ROLES_RECONCILED_KEY)!=="")return;let accounts=await scanPersonAccounts();if(accounts.length>0){let world=await scanWorld();for(let account2 of accounts)await applyRulesTo(account2,accountAsCaller(account2),world)}await store.bootstrapState.set(ROLES_RECONCILED_KEY,rfc3339Seconds(new Date))},async ensureOperatorOwnership(operator){let accountId=operator.metadata?.id??"";if(accountId==="")throw new Error("membership rules: the operator account carries no id");let actor=accountAsCaller(operator);for(let organization of await scan2(ApiResourceKind.organization))(await policies.findByResourceWithRelations(ORGANIZATION,organization.id,[relationOf(IamRole.owner)])).length>0||await grantPath.grant(organizationRole(accountId,IamRole.owner,organization.id),actor)}}}var ResourceNotFoundError=class extends Error{constructor(detail){super(`resource not found: ${detail}`),this.name="ResourceNotFoundError"}},AuditNotFoundError=class extends Error{constructor(detail){super(`audit record not found: ${detail}`),this.name="AuditNotFoundError"}},IN_FLIGHT_CLAIM_TTL_MS=300*1e3,DELIVERED_SIGNAL_DEDUPE_TTL_MS=1440*60*1e3,PENDING_OAUTH_STATE_TTL_MS=600*1e3;async function findResourceBySlug(store,kind,schema2,slug,org){let rows=await store.listResources(kind);for(let data of rows){let resource;try{resource=fromBinary2(schema2,data)}catch{continue}let metadata=metadataOf(resource);if(!(metadata===void 0||metadata.slug!==slug)&&!(org!==""&&metadata.org!==org))return resource}}async function findResourceByLabelAndOrg(store,kind,schema2,labelKey,labelValue,org){let rows=await store.listResources(kind);for(let data of rows){let resource;try{resource=fromBinary2(schema2,data)}catch{continue}let metadata=metadataOf(resource);if(metadata!==void 0&&metadata.labels[labelKey]===labelValue&&metadata.org===org)return resource}}function requireOrgForReference(kind,org){if(org!=="")return;let kindName;try{kindName=getKindMeta(kind).name}catch(error2){throw internalError(error2,"failed to resolve kind metadata for reference org check")}throw invalidArgumentError(`org is required for ${kindName} lookup`)}function compareCreatedAtDesc(a5,b7){return a5===void 0||b7===void 0?a5===void 0&&b7===void 0?0:a5!==void 0?-1:1:a5.seconds!==b7.seconds?a5.seconds>b7.seconds?-1:1:a5.nanos!==b7.nanos?a5.nanos>b7.nanos?-1:1:0}function matchesAllLabels(resourceLabels,filterLabels){return Object.entries(filterLabels).every(([key,value])=>resourceLabels[key]===value)}var EXISTING_RESOURCE_KEY="existingResource";function newLoadExistingStep(store){return{name:"LoadExisting",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"load existing");let existing;if(metadata.id!=="")try{existing=await store.getResource(ctx.apiResourceKind,metadata.id,ctx.schema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError(getKindName(ctx.apiResourceKind),metadata.id):error2}else if(metadata.slug!==""){let found=await findResourceBySlug(store,ctx.apiResourceKind,ctx.schema,metadata.slug,metadata.org);if(found===void 0)throw notFoundError(getKindName(ctx.apiResourceKind),metadata.slug);existing=found,metadata.id=metadataOf(existing)?.id??""}else throw invalidArgumentError("resource id or slug is required for update");ctx.set(EXISTING_RESOURCE_KEY,existing)}}}async function notifyDefaultInstanceLinked(lifecycle,event){lifecycle?.onDefaultInstanceLinked!==void 0&&await lifecycle.onDefaultInstanceLinked(event)}function visibilityShapesFor(kind,level){let config2=getKindMeta(kind).authorization?.visibility,shapes=new Set,orgFloor=config2?.defaultsToOrgVisibility===!0&&config2.supportsOrg===!0;switch(level){case ApiResourceVisibility.visibility_org:config2?.supportsOrg===!0&&shapes.add("org-viewer");break;case ApiResourceVisibility.visibility_platform:config2?.supportsPlatform===!0&&(shapes.add("platform-viewer"),orgFloor&&shapes.add("org-viewer"));break;default:break}return shapes}function diffVisibilityShapes(kind,oldLevel,newLevel){if(oldLevel===newLevel)return{shapesToCreate:[],shapesToDelete:[]};let oldShapes=visibilityShapesFor(kind,oldLevel),newShapes=visibilityShapesFor(kind,newLevel);return{shapesToCreate:[...newShapes].filter(shape=>!oldShapes.has(shape)),shapesToDelete:[...oldShapes].filter(shape=>!newShapes.has(shape))}}function resolveParentLink(kind,resource,parentConfig){let parentId=parentIdOf(resource,parentConfig.specField);if(parentId==="")throw internalError(new Error(`parent id for relation '${parentConfig.relation}' (spec field '${parentConfig.specField}') is missing on ${getKindName(kind)}`),"failed to create authorization tuples");return{relation:parentConfig.relation,parentKind:getKindEnum(parentConfig.kind),parentId}}function resolveParentLinks(kind,config2,resource,orgId,logger2){let links=[];switch(config2.scopeType){case AuthorizationScopeType.ORGANIZATION:{if(orgId==="")throw internalError(new Error(`organization id is required to create authorization tuples for ${getKindName(kind)}`),"failed to create authorization tuples");links.push({relation:"organization",parentKind:getKindEnum("organization"),parentId:orgId});break}case AuthorizationScopeType.PARENT:{if(config2.parent===void 0)throw internalError(new Error(`${getKindName(kind)} declares PARENT scope without a parent config`),"failed to create authorization tuples");links.push(resolveParentLink(kind,resource,config2.parent));break}case AuthorizationScopeType.OWNER_ONLY:break;case AuthorizationScopeType.PLATFORM:logger2.warn("unhandled PLATFORM authorization scope \u2014 no scope link",{kind:getKindName(kind)});break;default:break}for(let parent of config2.additionalParents)links.push(resolveParentLink(kind,resource,parent));return links}function resolveResourceCreatedEvent(kind,resource,caller,logger2){let config2=getKindMeta(kind).authorization;if(config2===void 0||config2.scopeType===AuthorizationScopeType.NONE||config2.scopeType===AuthorizationScopeType.UNSPECIFIED)return;let metadata=metadataOf(resource);if(metadata===void 0||metadata.id==="")throw internalError(new Error("resource metadata missing after persist"),"failed to create authorization tuples");return{kind,resourceId:metadata.id,orgId:metadata.org,caller,ownerAttribution:config2.ownerType,requiresCreatorTuple:config2.requiresCreatorTuple,parentLinks:resolveParentLinks(kind,config2,resource,metadata.org,logger2),visibilityShapes:[...visibilityShapesFor(kind,metadata.visibility)]}}function newCreateAuthorizationTuplesStep(lifecycle,logger2){return{name:"CreateAuthorizationTuples",async execute(ctx){if(lifecycle===void 0)return;let event=resolveResourceCreatedEvent(ctx.apiResourceKind,ctx.newState,ctx.callerIdentity,logger2);if(event!==void 0)try{await lifecycle.onResourceCreated(event)}catch(error2){throw internalError(error2,"failed to create authorization tuples")}}}}function newCleanupIamPoliciesStep(lifecycle,logger2){return{name:"CleanupIamPolicies",async execute(ctx){if(lifecycle===void 0)return;let metadata=ctx.get(EXISTING_RESOURCE_KEY)?.metadata;if(!(metadata===void 0||metadata.id===""))try{await lifecycle.onResourceDeleted({kind:ctx.apiResourceKind,resourceId:metadata.id,orgId:metadata.org,caller:ctx.callerIdentity})}catch(error2){logger2.warn("authorization cleanup failed \u2014 orphaned IAM policies may remain",{kind:getKindName(ctx.apiResourceKind),resourceId:metadata.id,error:error2 instanceof Error?error2.message:String(error2)})}}}}var OLD_VISIBILITY_KEY="authorizationOldVisibility";function newRecordVisibilityBeforeUpdateStep(resourceKey){return{name:"RecordVisibilityBeforeUpdate",execute(ctx){let resource=ctx.get(resourceKey);ctx.set(OLD_VISIBILITY_KEY,resource?.metadata?.visibility??ApiResourceVisibility.api_resource_visibility_unspecified)}}}function newUpdateVisibilityTuplesStep(lifecycle,resourceKey){return{name:"UpdateVisibilityTuples",async execute(ctx){if(lifecycle===void 0)return;let metadata=ctx.get(resourceKey)?.metadata;if(metadata===void 0||metadata.id==="")return;let oldLevel=ctx.get(OLD_VISIBILITY_KEY)??ApiResourceVisibility.api_resource_visibility_unspecified,{shapesToCreate,shapesToDelete}=diffVisibilityShapes(ctx.apiResourceKind,oldLevel,metadata.visibility);if(!(shapesToCreate.length===0&&shapesToDelete.length===0))try{await lifecycle.onVisibilityChanged({kind:ctx.apiResourceKind,resourceId:metadata.id,orgId:metadata.org,shapesToCreate,shapesToDelete})}catch(error2){throw internalError(error2,"failed to update visibility tuples")}}}}function rowAuthorizationFactsOf(kind,resource){let metadata=resource.metadata,org=metadata?.org??"";return{id:metadata?.id??"",org,visibility:metadata?.visibility??ApiResourceVisibility.api_resource_visibility_unspecified,createdBy:createdByOf(resource),parentLinks:parentLinksOf(kind,resource,org)}}function createdByOf(resource){return resource.status?.audit?.specAudit?.createdBy?.id??""}function parentLinksOf(kind,resource,org){let config2=getKindMeta(kind).authorization;if(config2===void 0)return[];let links=[];switch(config2.scopeType){case AuthorizationScopeType.ORGANIZATION:org!==""&&links.push({relation:"organization",parentKind:getKindEnum("organization"),parentId:org});break;case AuthorizationScopeType.PARENT:config2.parent!==void 0&&pushLink(links,resource,config2.parent);break;case AuthorizationScopeType.OWNER_ONLY:case AuthorizationScopeType.PLATFORM:case AuthorizationScopeType.NONE:case AuthorizationScopeType.UNSPECIFIED:break;default:{let exhaustive=config2.scopeType;throw new Error(`unknown scope type: ${String(exhaustive)}`)}}for(let parent of config2.additionalParents)pushLink(links,resource,parent);return links}function pushLink(links,resource,parent){let parentId=parentIdOf(resource,parent.specField);parentId!==""&&links.push({relation:parent.relation,parentKind:getKindEnum(parent.kind),parentId})}function rowFactsOf(kind,row){return{kind,...rowAuthorizationFactsOf(kind,row)}}function rowFactsOfEntry(kind,entry){return{kind,id:entry.id,org:entry.org,visibility:entry.visibility,createdBy:entry.createdBy,parentLinks:entry.parentLinks}}var file_ai_stigmer_agentic_agentchannel_v1_spec=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL3NwZWMucHJvdG8SImFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEi+AYKEEFnZW50Q2hhbm5lbFNwZWMSrAEKCWFnZW50X3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUJjukhcugFWCg5hZ2VudF9yZWYua2luZBIzYWdlbnRfcmVmIG11c3QgcmVmZXJlbmNlIGEgcmVzb3VyY2Ugd2l0aCBraW5kPWFnZW50Gg90aGlzLmtpbmQgPT0gNDDIAQHghSwoEg8KB2VuYWJsZWQYAiABKAgSRwoFc2xhY2sYAyABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLlNsYWNrQ2hhbm5lbENvbmZpZ0gAEk0KCHdoYXRzYXBwGAYgASgLMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5XaGF0c0FwcENoYW5uZWxDb25maWdIABLIAQoQZW52aXJvbm1lbnRfcmVmcxgEIAMoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUJ4ukhxkgFuImy6AWkKFWVudmlyb25tZW50X3JlZnMua2luZBI/ZW52aXJvbm1lbnRfcmVmcyBtdXN0IHJlZmVyZW5jZSByZXNvdXJjZXMgd2l0aCBraW5kPWVudmlyb25tZW50Gg90aGlzLmtpbmQgPT0gNTPghSw1ErwBCgdhcHBfcmVmGAUgASgLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlQnW6SG66AWsKDGFwcF9yZWYua2luZBI3YXBwX3JlZiBtdXN0IHJlZmVyZW5jZSBhIHJlc291cmNlIHdpdGgga2luZD1jaGFubmVsX2FwcBoidGhpcy5zbHVnID09ICcnIHx8IHRoaXMua2luZCA9PSA0OOCFLDASIwobcHJvYWN0aXZlX21lc3NhZ2luZ19lbmFibGVkGAcgASgIEkMKCnJ1bl9jb25maWcYCCABKAsyLy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUnVuQ29uZmlnQhgKD3Byb3ZpZGVyX2NvbmZpZxIFukgCCAEiFAoSU2xhY2tDaGFubmVsQ29uZmlnIjkKFVdoYXRzQXBwQ2hhbm5lbENvbmZpZxIgCg9waG9uZV9udW1iZXJfaWQYASABKAlCB7pIBHICEAFiBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_invocation,file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]),AgentChannelSpecSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_spec,0);var file_ai_stigmer_agentic_agentchannel_v1_status=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL3N0YXR1cy5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MSL5AgoSQWdlbnRDaGFubmVsU3RhdHVzElMKDWluc3RhbGxfc3RhdGUYASABKA4yPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbEluc3RhbGxTdGF0ZRJHCgVzbGFjaxgCIAEoCzI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuU2xhY2tJbnN0YWxsU3RhdHVzSAASTQoId2hhdHNhcHAYBCABKAsyOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLldoYXRzQXBwSW5zdGFsbFN0YXR1c0gAEiIKGmNyZWRlbnRpYWxzX2Vudmlyb25tZW50X2lkGAMgASgJEj8KBWF1ZGl0GGMgASgLMjAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRCEQoPcHJvdmlkZXJfc3RhdHVzItABChJTbGFja0luc3RhbGxTdGF0dXMSDwoHdGVhbV9pZBgBIAEoCRIRCgl0ZWFtX25hbWUYAiABKAkSEwoLYm90X3VzZXJfaWQYAyABKAkSFgoOZ3JhbnRlZF9zY29wZXMYBCADKAkSHwoXaW5zdGFsbGVyX3NsYWNrX3VzZXJfaWQYBSABKAkSMAoMaW5zdGFsbGVkX2F0GAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIWCg5jaGFubmVsX2FwcF9pZBgHIAEoCSKvAQoVV2hhdHNBcHBJbnN0YWxsU3RhdHVzEhcKD3Bob25lX251bWJlcl9pZBgBIAEoCRIcChRkaXNwbGF5X3Bob25lX251bWJlchgCIAEoCRIVCg12ZXJpZmllZF9uYW1lGAMgASgJEhYKDmNoYW5uZWxfYXBwX2lkGAQgASgJEjAKDGluc3RhbGxlZF9hdBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAqeAoYQWdlbnRDaGFubmVsSW5zdGFsbFN0YXRlEisKJ2FnZW50X2NoYW5uZWxfaW5zdGFsbF9zdGF0ZV91bnNwZWNpZmllZBAAEhMKD3BlbmRpbmdfaW5zdGFsbBABEg0KCWluc3RhbGxlZBACEgsKB3Jldm9rZWQQA2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_status,file_google_protobuf_timestamp]),AgentChannelStatusSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_status,0);var AgentChannelInstallState;(function(AgentChannelInstallState2){AgentChannelInstallState2[AgentChannelInstallState2.agent_channel_install_state_unspecified=0]="agent_channel_install_state_unspecified",AgentChannelInstallState2[AgentChannelInstallState2.pending_install=1]="pending_install",AgentChannelInstallState2[AgentChannelInstallState2.installed=2]="installed",AgentChannelInstallState2[AgentChannelInstallState2.revoked=3]="revoked"})(AgentChannelInstallState||(AgentChannelInstallState={}));var file_ai_stigmer_agentic_agentchannel_v1_api=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2FwaS5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MSK/AgoMQWdlbnRDaGFubmVsEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiEKBGtpbmQYAiABKAlCE7pIEHIOCgxBZ2VudENoYW5uZWwSTQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YUIGukgDyAEBEkIKBHNwZWMYBCABKAsyNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbFNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5BZ2VudENoYW5uZWxTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_agentchannel_v1_spec,file_ai_stigmer_agentic_agentchannel_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),AgentChannelSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_api,0);var file_ai_stigmer_agentic_agentexecution_v1_approval=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvYXBwcm92YWwucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSLLAwoPUGVuZGluZ0FwcHJvdmFsEhQKDHRvb2xfY2FsbF9pZBgBIAEoCRIRCgl0b29sX25hbWUYAiABKAkSDwoHbWVzc2FnZRgDIAEoCRIUCgxhcmdzX3ByZXZpZXcYBCABKAkSFAoMcmVxdWVzdGVkX2F0GAUgASgJEhYKDmZyb21fc3ViX2FnZW50GAYgASgIEhYKDnN1Yl9hZ2VudF9uYW1lGAcgASgJEhcKD21jcF9zZXJ2ZXJfc2x1ZxgIIAEoCRIZChFzdWJfYWdlbnRfc3ViamVjdBgJIAEoCRIXCg9hZ2VudF9yYXRpb25hbGUYCiABKAkSFgoOYnJhbmNoX2F0X2RlbnkYCyABKAkSGAoQaGVhZF9zaGFfYXRfZGVueRgMIAEoCRJBCgl0b29sX2tpbmQYDSABKA4yLi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVG9vbEtpbmQSWgoWYXBwcm92YWxfcG9saWN5X3NvdXJjZRgPIAEoDjI6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFBvbGljeVNvdXJjZUoECA4QDyKDAQoZQ2hpbGRBcHByb3ZhbE5vdGlmaWNhdGlvbhIUCgxleGVjdXRpb25faWQYASABKAkSUAoRcGVuZGluZ19hcHByb3ZhbHMYAiADKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUGVuZGluZ0FwcHJvdmFsIp0DCg9BcHByb3ZhbFJlcXVlc3QSGwoTYXBwcm92YWxfcmVxdWVzdF9pZBgBIAEoCRIUCgx0b29sX2NhbGxfaWQYAiABKAkSFAoMcmVxdWVzdGVkX2F0GAMgASgJEhEKCXRvb2xfbmFtZRgEIAEoCRIPCgdtZXNzYWdlGAUgASgJEhQKDGFyZ3NfcHJldmlldxgGIAEoCRIWCg5mcm9tX3N1Yl9hZ2VudBgHIAEoCBIWCg5zdWJfYWdlbnRfbmFtZRgIIAEoCRIZChFzdWJfYWdlbnRfc3ViamVjdBgJIAEoCRIXCg9tY3Bfc2VydmVyX3NsdWcYCiABKAkSQQoJdG9vbF9raW5kGAsgASgOMi4uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xLaW5kEloKFmFwcHJvdmFsX3BvbGljeV9zb3VyY2UYDSABKA4yOi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXBwcm92YWxQb2xpY3lTb3VyY2VKBAgMEA0ilwEKEkFwcHJvdmFsUmV0cmFjdGlvbhIbChNhcHByb3ZhbF9yZXF1ZXN0X2lkGAEgASgJEk4KBnJlYXNvbhgCIAEoDjI+LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFJldHJhY3Rpb25SZWFzb24SFAoMcmV0cmFjdGVkX2F0GAMgASgJIq4BChBBcHByb3ZhbERlY2lzaW9uEhsKE2FwcHJvdmFsX3JlcXVlc3RfaWQYASABKAkSRAoGYWN0aW9uGAIgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsQWN0aW9uEhIKCmRlY2lkZWRfYXQYAyABKAkSEgoKZGVjaWRlZF9ieRgEIAEoCRIPCgdjb21tZW50GAUgASgJIp4DCg1BcHByb3ZhbEV2ZW50EhAKCGV2ZW50X2lkGAEgASgJEhsKE2FwcHJvdmFsX3JlcXVlc3RfaWQYAiABKAkSSwoKZXZlbnRfdHlwZRgDIAEoDjI3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbEV2ZW50VHlwZRIRCgl0aW1lc3RhbXAYBCABKAkSDQoFYWN0b3IYBSABKAkSSgoJcmVxdWVzdGVkGAYgASgLMjUuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsUmVxdWVzdEgAEkkKB2RlY2lkZWQYByABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXBwcm92YWxEZWNpc2lvbkgAEk0KCXJldHJhY3RlZBgIIAEoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFJldHJhY3Rpb25IAEIJCgdwYXlsb2FkInAKE0FwcHJvdmFsRXZlbnRTdHJlYW0SFAoMZXhlY3V0aW9uX2lkGAEgASgJEkMKBmV2ZW50cxgCIAMoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbEV2ZW50YgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum]),PendingApprovalSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_approval,0);var ApprovalEventSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_approval,5),ApprovalEventStreamSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_approval,6);var file_ai_stigmer_agentic_agentexecution_v1_artifact=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvYXJ0aWZhY3QucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSKEAgoRRXhlY3V0aW9uQXJ0aWZhY3QSDAoEbmFtZRgBIAEoCRIUCgxzYW5kYm94X3BhdGgYAiABKAkSUwoEa2luZBgDIAEoDjI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25BcnRpZmFjdEtpbmRCCLpIBYIBAhABEhIKCnNpemVfYnl0ZXMYBCABKAMSEwoLc3RvcmFnZV9rZXkYBSABKAkSEgoKY3JlYXRlZF9hdBgHIAEoCRISCgpleHBpcmVzX2F0GAggASgJEg8KB2VudHJpZXMYCSADKAkSFAoMY29udGVudF9oYXNoGAogASgJYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_buf_validate_validate]);var file_ai_stigmer_agentic_agentexecution_v1_context=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvY29udGV4dC5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIoYDChJTdW1tYXJpemF0aW9uRXZlbnQSEQoJdGltZXN0YW1wGAEgASgJEhUKDXRva2Vuc19iZWZvcmUYAiABKAUSFAoMdG9rZW5zX2FmdGVyGAMgASgFEhkKEWNvbXByZXNzaW9uX3JhdGlvGAQgASgCEhMKC2R1cmF0aW9uX21zGAUgASgFEhsKE3N1bW1hcml6YXRpb25fbW9kZWwYBiABKAkSFwoPbWVzc2FnZXNfYmVmb3JlGAcgASgFEhYKDm1lc3NhZ2VzX2FmdGVyGAggASgFEkkKBnNvdXJjZRgJIAEoDjI5LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5TdW1tYXJpemF0aW9uU291cmNlEiIKGnN1bW1hcml6YXRpb25faW5wdXRfdG9rZW5zGAogASgFEiMKG3N1bW1hcml6YXRpb25fb3V0cHV0X3Rva2VucxgLIAEoBRIeChZzdW1tYXJpemF0aW9uX2Nvc3RfdXNkGAwgASgBIqoCCgtDb250ZXh0SW5mbxIbChNjdXJyZW50X3Rva2VuX2NvdW50GAEgASgFEhwKFGNvbnRleHRfd2luZG93X2xpbWl0GAIgASgFEicKH3N1bW1hcml6YXRpb25fdHJpZ2dlcl90aHJlc2hvbGQYAyABKAUSIwobc3VtbWFyaXphdGlvbl90YXJnZXRfdG9rZW5zGAQgASgFEh0KFXN1bW1hcml6YXRpb25fZW5hYmxlZBgFIAEoCBJWChRzdW1tYXJpemF0aW9uX2V2ZW50cxgGIAMoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5TdW1tYXJpemF0aW9uRXZlbnQSGwoTdXRpbGl6YXRpb25fcGVyY2VudBgHIAEoAmIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_enum]);var file_ai_stigmer_agentic_agentexecution_v1_message=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvbWVzc2FnZS5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIoICCgxBZ2VudE1lc3NhZ2USSQoEdHlwZRgBIAEoDjIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5NZXNzYWdlVHlwZUIIukgFggECEAESDwoHY29udGVudBgCIAEoCRIRCgl0aW1lc3RhbXAYAyABKAkSQgoKdG9vbF9jYWxscxgEIAMoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub29sQ2FsbBIpCghtZXRhZGF0YRgFIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSFAoMaXNfc3RyZWFtaW5nGAYgASgIIqUHCghUb29sQ2FsbBIKCgJpZBgBIAEoCRIMCgRuYW1lGAIgASgJEiUKBGFyZ3MYAyABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0Eg4KBnJlc3VsdBgEIAEoCRJOCgZzdGF0dXMYBSABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVG9vbENhbGxTdGF0dXNCCLpIBYIBAhABEhIKCnN0YXJ0ZWRfYXQYByABKAkSFAoMY29tcGxldGVkX2F0GAggASgJEg0KBWVycm9yGAkgASgJEhkKEXJlcXVpcmVzX2FwcHJvdmFsGAogASgIEhgKEGFwcHJvdmFsX21lc3NhZ2UYCyABKAkSHQoVYXBwcm92YWxfcmVxdWVzdGVkX2F0GAwgASgJEhsKE2FwcHJvdmFsX2RlY2lkZWRfYXQYDSABKAkSEwoLYXBwcm92ZWRfYnkYDiABKAkSTQoPYXBwcm92YWxfYWN0aW9uGA8gASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsQWN0aW9uEhQKDGlzX3N0cmVhbWluZxgQIAEoCBJXChBzdHJlYW1pbmdfc291cmNlGBMgASgOMj0uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xDYWxsU3RyZWFtaW5nU291cmNlEhcKD21jcF9zZXJ2ZXJfc2x1ZxgRIAEoCRIUCgxhcmdzX3ByZXZpZXcYEiABKAkSQQoJdG9vbF9raW5kGBQgASgOMi4uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xLaW5kEksKCm91dHB1dF9yZWYYFSABKAsyNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVG9vbENhbGxPdXRwdXRSZWYSWgoWYXBwcm92YWxfcG9saWN5X3NvdXJjZRgXIAEoDjI6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFBvbGljeVNvdXJjZRIdChVwb2xpY3lfZW5naW5lX3ZlcnNpb24YGCABKAkSHwoXYXBwcm92YWxfY29udGVudF9kaWdlc3QYGSABKAkSGgoSZmlsZV9jaGFuZ2Vfc2V0X2lkGBogASgJSgQIFhAXIpIBChFUb29sQ2FsbE91dHB1dFJlZhITCgtzdG9yYWdlX2tleRgBIAEoCRISCgpzaXplX2J5dGVzGAMgASgDEhQKDGNvbnRlbnRfaGFzaBgEIAEoCRIRCgltaW1lX3R5cGUYBSABKAkSEAoIaXNfaW1hZ2UYBiABKAgSGQoRdHJ1bmNhdGVkX3ByZXZpZXcYByABKAkiwQMKCkZpbGVDaGFuZ2USDAoEcGF0aBgBIAEoCRIVCg1hYnNvbHV0ZV9wYXRoGAIgASgJElMKC2NoYW5nZV90eXBlGAMgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVDaGFuZ2VUeXBlQgi6SAWCAQIQARJdCg1jYXB0dXJlX2xldmVsGAQgASgOMjwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVDaGFuZ2VDYXB0dXJlTGV2ZWxCCLpIBYIBAhABEkEKBmJlZm9yZRgFIAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ29udGVudBJACgVhZnRlchgGIAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ29udGVudBIUCgx1bmlmaWVkX2RpZmYYByABKAkSEwoLbGluZXNfYWRkZWQYCCABKAUSFQoNbGluZXNfcmVtb3ZlZBgJIAEoBRITCgtyZW5hbWVfZnJvbRgKIAEoCSKCAQoLRmlsZUNvbnRlbnQSEAoGaW5saW5lGAEgASgJSAASRgoDcmVmGAIgASgLMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xDYWxsT3V0cHV0UmVmSAASEQoJaXNfYmluYXJ5GAMgASgIQgYKBGJvZHliBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_buf_validate_validate,file_google_protobuf_struct]),AgentMessageSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_message,0);var file_ai_stigmer_agentic_agentexecution_v1_filereview=fileDesc("CjVhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvZmlsZXJldmlldy5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIokFCg1GaWxlQ2hhbmdlU2V0EgoKAmlkGAEgASgJEg8KB3R1cm5faWQYAiABKAkSEgoKaGFybmVzc19pZBgDIAEoCRJTCgZzdGF0dXMYBCABKA4yOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNoYW5nZVNldFN0YXR1c0IIukgFggECEAESTAoRYmFzZWxpbmVfc25hcHNob3QYBSABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU25hcHNob3RSZWYSTQoSY2FuZGlkYXRlX3NuYXBzaG90GAYgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmEkwKEWFwcHJvdmVkX3NuYXBzaG90GAcgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmEkkKB2NoYW5nZXMYCCADKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ2FwdHVyZWRGaWxlQ2hhbmdlEhgKEGFnZ3JlZ2F0ZV9kaWdlc3QYCSABKAkSWwoRZGlmZl9jb21wbGV0ZW5lc3MYCiABKA4yNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRGlmZkNvbXBsZXRlbmVzc0IIukgFggECEAESRQoJZGVjaXNpb25zGAsgAygLMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVEZWNpc2lvbiKoBQoSQ2FwdHVyZWRGaWxlQ2hhbmdlEgoKAmlkGAEgASgJEhMKC3BhdGhfYmVmb3JlGAIgASgJEhIKCnBhdGhfYWZ0ZXIYAyABKAkSTAoEa2luZBgEIAEoDjI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ2hhbmdlS2luZEIIukgFggECEAESVwoNY2FwdHVyZV9jbGFzcxgFIAEoDjI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ2FwdHVyZUNsYXNzQgi6SAWCAQIQARJBCgZiZWZvcmUYBiABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNvbnRlbnQSQAoFYWZ0ZXIYByABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNvbnRlbnQSFQoNYmVmb3JlX3NoYTI1NhgIIAEoCRIUCgxhZnRlcl9zaGEyNTYYCSABKAkSTQoMdW5pZmllZF9kaWZmGAogASgLMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xDYWxsT3V0cHV0UmVmEhUKDWRpZmZfY29tcGxldGUYCyABKAgSEwoLZmlsZV9kaWdlc3QYDCABKAkSXQoOYmxvY2tlZF9yZWFzb24YDSABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZVJldmlld0Jsb2NrUmVhc29uQgi6SAWCAQIQARITCgtsaW5lc19hZGRlZBgOIAEoBRIVCg1saW5lc19yZW1vdmVkGA8gASgFItsBCgtTbmFwc2hvdFJlZhJKCgRraW5kGAEgASgOMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90S2luZEIIukgFggECEAESPQoDZ2l0GAIgASgLMjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkdpdFRyZWVSZWYSQQoDY2FzGAMgASgLMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkNhc01hbmlmZXN0UmVmIisKCkdpdFRyZWVSZWYSEAoIdHJlZV9vaWQYASABKAkSCwoDcmVmGAIgASgJIj8KDkNhc01hbmlmZXN0UmVmEhcKD21hbmlmZXN0X2RpZ2VzdBgBIAEoCRIUCgxhcnRpZmFjdF91cmkYAiABKAkitwMKDEZpbGVEZWNpc2lvbhIKCgJpZBgBIAEoCRIVCg1jaGFuZ2Vfc2V0X2lkGAIgASgJElAKBXNjb3BlGAMgASgOMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVEZWNpc2lvblNjb3BlQgi6SAWCAQIQARIWCg5maWxlX2NoYW5nZV9pZBgEIAEoCRJSCgZhY3Rpb24YBSABKA4yOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZURlY2lzaW9uQWN0aW9uQgi6SAWCAQIQARIXCg9leHBlY3RlZF9kaWdlc3QYBiABKAkSEwoLcmV2aWV3ZXJfaWQYByABKAkSEgoKZGVjaWRlZF9hdBgIIAEoCRIOCgZyZWFzb24YCSABKAkSIAoYYWNrbm93bGVkZ2VfdW5yZXZpZXdhYmxlGAogASgIElIKBm9yaWdpbhgLIAEoDjI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlRGVjaXNpb25PcmlnaW5CCLpIBYIBAhABIqYBChpGaWxlUmV2aWV3QmFzZWxpbmVDYXB0dXJlZBIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJEg8KB3R1cm5faWQYAiABKAkSEgoKaGFybmVzc19pZBgDIAEoCRJMChFiYXNlbGluZV9zbmFwc2hvdBgEIAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5TbmFwc2hvdFJlZiJeChVUdXJuQ29tbWFuZFByb3ZlbmFuY2USHQoVY29uc2VudF90b29sX2NhbGxfaWRzGAEgAygJEiYKHmF1dGhvcml6ZWRfYnlfYXV0b19hcHByb3ZlX2FsbBgCIAEoCCKeAwobRmlsZVJldmlld0NhbmRpZGF0ZUNhcHR1cmVkEhUKDWNoYW5nZV9zZXRfaWQYASABKAkSTQoSY2FuZGlkYXRlX3NuYXBzaG90GAIgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmEkkKB2NoYW5nZXMYAyADKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ2FwdHVyZWRGaWxlQ2hhbmdlEhgKEGFnZ3JlZ2F0ZV9kaWdlc3QYBCABKAkSWwoRZGlmZl9jb21wbGV0ZW5lc3MYBSABKA4yNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRGlmZkNvbXBsZXRlbmVzc0IIukgFggECEAESVwoSY29tbWFuZF9wcm92ZW5hbmNlGAYgASgLMjsuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlR1cm5Db21tYW5kUHJvdmVuYW5jZSJ7ChRGaWxlUmV2aWV3UmVjb25jaWxlZBIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJEkwKEWFwcHJvdmVkX3NuYXBzaG90GAIgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmIo8BChFGaWxlUmV2aWV3RmFpbHVyZRIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJElMKBGtpbmQYAiABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZVJldmlld0ZhaWx1cmVLaW5kQgi6SAWCAQIQARIOCgZkZXRhaWwYAyABKAki6QQKD0ZpbGVSZXZpZXdFdmVudBIQCghldmVudF9pZBgBIAEoCRIVCg1jaGFuZ2Vfc2V0X2lkGAIgASgJElcKCmV2ZW50X3R5cGUYAyABKA4yOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZVJldmlld0V2ZW50VHlwZUIIukgFggECEAESEQoJdGltZXN0YW1wGAQgASgJEg0KBWFjdG9yGAUgASgJEl0KEWJhc2VsaW5lX2NhcHR1cmVkGAYgASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdCYXNlbGluZUNhcHR1cmVkSAASXwoSY2FuZGlkYXRlX2NhcHR1cmVkGAcgASgLMkEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdDYW5kaWRhdGVDYXB0dXJlZEgAEkoKDGZpbGVfZGVjaWRlZBgIIAEoCzIyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlRGVjaXNpb25IABJQCgpyZWNvbmNpbGVkGAkgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdSZWNvbmNpbGVkSAASSQoGZmFpbGVkGAogASgLMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdGYWlsdXJlSABCCQoHcGF5bG9hZCJ0ChVGaWxlUmV2aWV3RXZlbnRTdHJlYW0SFAoMZXhlY3V0aW9uX2lkGAEgASgJEkUKBmV2ZW50cxgCIAMoCzI1LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlUmV2aWV3RXZlbnQi0wEKEkZpbGVDaGFuZ2VQcm9ncmVzcxIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJEhUKDWZpbGVzX2NoYW5nZWQYAiABKAUSEwoLbGluZXNfYWRkZWQYAyABKAUSFQoNbGluZXNfcmVtb3ZlZBgEIAEoBRJOCgdlbnRyaWVzGAUgAygLMj0uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVDaGFuZ2VQcm9ncmVzc0VudHJ5EhMKC2NhcHR1cmVkX2F0GAYgASgJIrwBChdGaWxlQ2hhbmdlUHJvZ3Jlc3NFbnRyeRITCgtwYXRoX2JlZm9yZRgBIAEoCRISCgpwYXRoX2FmdGVyGAIgASgJEkwKBGtpbmQYAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNoYW5nZUtpbmRCCLpIBYIBAhABEhMKC2xpbmVzX2FkZGVkGAQgASgFEhUKDWxpbmVzX3JlbW92ZWQYBSABKAViBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_agentexecution_v1_message,file_buf_validate_validate]),FileChangeSetSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,0);var FileDecisionSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,5);var FileReviewEventSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,11),FileReviewEventStreamSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,12);var file_ai_stigmer_agentic_executioncontext_v1_spec=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9zcGVjLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MSLwAQoURXhlY3V0aW9uQ29udGV4dFNwZWMSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABElQKBGRhdGEYAiADKAsyRi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0U3BlYy5EYXRhRW50cnkaYwoJRGF0YUVudHJ5EgsKA2tleRgBIAEoCRJFCgV2YWx1ZRgCIAEoCzI2LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvblZhbHVlOgI4ASIyCg5FeGVjdXRpb25WYWx1ZRINCgV2YWx1ZRgBIAEoCRIRCglpc19zZWNyZXQYAiABKAhiBnByb3RvMw",[file_buf_validate_validate]);var ExecutionValueSchema=messageDesc2(file_ai_stigmer_agentic_executioncontext_v1_spec,1);var file_ai_stigmer_agentic_session_v1_spec=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9zcGVjLnByb3RvEh1haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MSKWBwoLU2Vzc2lvblNwZWMSGQoRYWdlbnRfaW5zdGFuY2VfaWQYASABKAkSDwoHc3ViamVjdBgCIAEoCRIYChBoYXJuZXNzX3N0YXRlX2lkGAMgASgJEiAKGGhhcm5lc3Nfc3RhdGVfaWRfaGlzdG9yeRgNIAMoCRJKCghtZXRhZGF0YRgFIAMoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25TcGVjLk1ldGFkYXRhRW50cnkSSAoRd29ya3NwYWNlX2VudHJpZXMYBiADKAsyLS5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5Xb3Jrc3BhY2VFbnRyeRLZAQoRbWNwX3NlcnZlcl91c2FnZXMYByADKAsyKy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuTWNwU2VydmVyVXNhZ2VCkAG6SIwBkgGIASKFAboBgQEKHnNlc3Npb25fbWNwX3NlcnZlcl91c2FnZXMua2luZBI/bWNwX3NlcnZlcl91c2FnZXMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1tY3Bfc2VydmVyGh50aGlzLm1jcF9zZXJ2ZXJfcmVmLmtpbmQgPT0gNDQSuAEKCnNraWxsX3JlZnMYCCADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCbrpIZ5IBZCJiugFfChdzZXNzaW9uX3NraWxsX3JlZnMua2luZBIzc2tpbGxfcmVmcyBtdXN0IHJlZmVyZW5jZSByZXNvdXJjZXMgd2l0aCBraW5kPXNraWxsGg90aGlzLmtpbmQgPT0gNDPghSwrEjcKB2hhcm5lc3MYCiABKA4yJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5IYXJuZXNzEj4KC2N1cnNvcl9tb2RlGAsgASgOMikuYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuQ3Vyc29yTW9kZRJIChBleGVjdXRpb25fdGFyZ2V0GAwgASgOMi4uYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuRXhlY3V0aW9uVGFyZ2V0Gi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4AWIGcHJvdG8z",[file_ai_stigmer_agentic_agent_v1_spec,file_ai_stigmer_agentic_session_v1_enum,file_ai_stigmer_agentic_session_v1_workspace,file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]),SessionSpecSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_spec,0);var file_ai_stigmer_agentic_agentexecution_v1_spec=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvc3BlYy5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIuEKChJBZ2VudEV4ZWN1dGlvblNwZWMSEgoKc2Vzc2lvbl9pZBgBIAEoCRIQCghhZ2VudF9pZBgCIAEoCRJACgxzZXNzaW9uX3NwZWMYDSABKAsyKi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uU3BlYxIYCgdtZXNzYWdlGAMgASgJQge6SARyAhABEk8KEGV4ZWN1dGlvbl9jb25maWcYBCABKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRXhlY3V0aW9uQ29uZmlnEl0KC3J1bnRpbWVfZW52GAUgAygLMkguYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uU3BlYy5SdW50aW1lRW52RW50cnkSFgoOY2FsbGJhY2tfdG9rZW4YBiABKAwSGAoQYXV0b19hcHByb3ZlX2FsbBgHIAEoCBIaChJwYXJlbnRfd29ya2Zsb3dfaWQYCCABKAkSRQoLYXR0YWNobWVudHMYCSADKAsyMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXR0YWNobWVudBIbChN3b3Jrc3BhY2VfZmlsZV9yZWZzGAogAygJEhsKE2FjdGl2aXR5X3Rhc2tfcXVldWUYCyABKAkSHwoXc3VwZXJzZWRlc19leGVjdXRpb25faWQYDCABKAkSVwoUY29udmVyc2F0aW9uX2NhdGNodXAYDiABKAsyOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29udmVyc2F0aW9uQ2F0Y2h1cBJXChRkZWNsYXJlZF9wcmVmZXJlbmNlcxgPIAEoCzI5LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5EZWNsYXJlZFByZWZlcmVuY2VzElEKEXJlY2FsbGVkX21lbW9yaWVzGBAgASgLMjYuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlJlY2FsbGVkTWVtb3JpZXMaaQoPUnVudGltZUVudkVudHJ5EgsKA2tleRgBIAEoCRJFCgV2YWx1ZRgCIAEoCzI2LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvblZhbHVlOgI4ATq4A7pItAMaywEKIWFnZW50X2V4ZWN1dGlvbi5zZXNzaW9uX2V4Y2x1c2l2ZRJyc2Vzc2lvbl9pZCBhbmQgc2Vzc2lvbl9zcGVjIGFyZSBtdXR1YWxseSBleGNsdXNpdmUg4oCUIHJlZmVyZW5jZSBhbiBleGlzdGluZyBzZXNzaW9uIG9yIGRlZmluZSBhIG5ldyBvbmUsIG5vdCBib3RoGjIhKHRoaXMuc2Vzc2lvbl9pZCAhPSAnJyAmJiBoYXModGhpcy5zZXNzaW9uX3NwZWMpKRrjAQoqYWdlbnRfZXhlY3V0aW9uLnNlc3Npb25fc3BlY19oYXJuZXNzX3N0YXRlEnBzZXNzaW9uX3NwZWMuaGFybmVzc19zdGF0ZV9pZCBtdXN0IGJlIGVtcHR5IOKAlCBoYXJuZXNzIHN0YXRlIGlzIGNyZWF0ZWQgYnkgdGhlIHJ1bm5lciBhZnRlciB0aGUgZmlyc3QgZXhlY3V0aW9uGkMhaGFzKHRoaXMuc2Vzc2lvbl9zcGVjKSB8fCB0aGlzLnNlc3Npb25fc3BlYy5oYXJuZXNzX3N0YXRlX2lkID09ICcnIvoECg9FeGVjdXRpb25Db25maWcSEgoKbW9kZWxfbmFtZRgBIAEoCRJZChJjb250ZXh0X21hbmFnZW1lbnQYAiABKAsyPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29udGV4dE1hbmFnZW1lbnRDb25maWcSFwoPbWF4X3Rvb2xfcm91bmRzGAMgASgFEh0KFW1heF90b29sX3Jlc3VsdF9jaGFycxgEIAEoBRIUCgxtYXhfY29zdF91c2QYBSABKAESWQoQaW50ZXJhY3Rpb25fbW9kZRgGIAEoDjI1LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5JbnRlcmFjdGlvbk1vZGVCCLpIBYIBAhABEjkKGHN0cnVjdHVyZWRfb3V0cHV0X3NjaGVtYRgHIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSFwoPYnVpbGRfZnJvbV9wbGFuGAggASgIElMKDWFwcHJvdmFsX21vZGUYCSABKA4yMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXBwcm92YWxNb2RlQgi6SAWCAQIQARJRCgxzZXJ2aWNlX3RpZXIYCiABKA4yMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU2VydmljZVRpZXJCCLpIBYIBAhABElMKDXRoaW5raW5nX21vZGUYCyABKA4yMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVGhpbmtpbmdNb2RlQgi6SAWCAQIQASKKAQoXQ29udGV4dE1hbmFnZW1lbnRDb25maWcSHQoVZGlzYWJsZV9zdW1tYXJpemF0aW9uGAEgASgIEikKGGN1c3RvbV90cmlnZ2VyX3RocmVzaG9sZBgCIAEoBUIHukgEGgIoABIlChRjdXN0b21fdGFyZ2V0X3Rva2VucxgDIAEoBUIHukgEGgIoACLUAgoKQXR0YWNobWVudBLYAQoIZmlsZW5hbWUYASABKAlCxQG6SMEBugG5AQobYXR0YWNobWVudC5maWxlbmFtZS5ub19wYXRoEk5maWxlbmFtZSBtdXN0IGJlIGEgYmFyZSBmaWxlbmFtZSB3aXRob3V0IHBhdGggc2VwYXJhdG9ycyBvciB0cmF2ZXJzYWwgc2VnbWVudHMaSiF0aGlzLmNvbnRhaW5zKCcvJykgJiYgIXRoaXMuY29udGFpbnMoJ1xcJykgJiYgdGhpcyAhPSAnLicgJiYgdGhpcyAhPSAnLi4ncgIQARIcCgtzdG9yYWdlX2tleRgCIAEoCUIHukgEcgIQARISCgptb3VudF9wYXRoGAMgASgJEhQKDGNvbnRlbnRfdHlwZRgEIAEoCRIPCgdleHRyYWN0GAUgASgIEhIKCmxvY2FsX3BhdGgYBiABKAkiVQoTQ29udmVyc2F0aW9uQ2F0Y2h1cBIOCgZkaWdlc3QYASABKAkSLgoKd2luZG93X2VuZBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiQAoTRGVjbGFyZWRQcmVmZXJlbmNlcxITCgtvcmdfY29udGV4dBgBIAEoCRIUCgx1c2VyX2NvbnRleHQYAiABKAkibAoQUmVjYWxsZWRNZW1vcmllcxIPCgdlbmFibGVkGAEgASgIEkcKBWZhY3RzGAIgAygLMjguYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlJlY2FsbGVkTWVtb3J5RmFjdCI4ChJSZWNhbGxlZE1lbW9yeUZhY3QSEQoJbWVtb3J5X2lkGAEgASgJEg8KB2NvbnRlbnQYAiABKAliBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_executioncontext_v1_spec,file_ai_stigmer_agentic_session_v1_spec,file_buf_validate_validate,file_google_protobuf_struct,file_google_protobuf_timestamp]),AgentExecutionSpecSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,0),ExecutionConfigSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,1);var DeclaredPreferencesSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,5),RecalledMemoriesSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,6),RecalledMemoryFactSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,7);var file_ai_stigmer_agentic_agentexecution_v1_todo=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvdG9kby5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIpEBCghUb2RvSXRlbRIKCgJpZBgBIAEoCRIPCgdjb250ZW50GAIgASgJEkAKBnN0YXR1cxgDIAEoDjIwLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub2RvU3RhdHVzEhIKCmNyZWF0ZWRfYXQYBCABKAkSEgoKdXBkYXRlZF9hdBgFIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_enum]);var file_ai_stigmer_agentic_agentexecution_v1_subagent=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvc3ViYWdlbnQucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSKIBAoRU3ViQWdlbnRFeGVjdXRpb24SCgoCaWQYASABKAkSDAoEbmFtZRgCIAEoCRINCgVpbnB1dBgDIAEoCRIOCgZvdXRwdXQYBCABKAkSTgoGc3RhdHVzGAUgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlN1YkFnZW50U3RhdHVzQgi6SAWCAQIQARISCgpzdGFydGVkX2F0GAYgASgJEhQKDGNvbXBsZXRlZF9hdBgHIAEoCRINCgVlcnJvchgIIAEoCRIpCghtZXRhZGF0YRgJIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSRAoIbWVzc2FnZXMYCyADKAsyMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRNZXNzYWdlEg8KB3N1YmplY3QYDSABKAkSUQoFdG9kb3MYDiADKAsyQi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU3ViQWdlbnRFeGVjdXRpb24uVG9kb3NFbnRyeRpcCgpUb2Rvc0VudHJ5EgsKA2tleRgBIAEoCRI9CgV2YWx1ZRgCIAEoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub2RvSXRlbToCOAFiBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_agentexecution_v1_message,file_ai_stigmer_agentic_agentexecution_v1_todo,file_buf_validate_validate,file_google_protobuf_struct]);var file_ai_stigmer_agentic_agentexecution_v1_usage=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvdXNhZ2UucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSKxAwoKVG9rZW5Vc2FnZRIUCgxpbnB1dF90b2tlbnMYASABKAMSFQoNb3V0cHV0X3Rva2VucxgCIAEoAxIUCgx0b3RhbF90b2tlbnMYAyABKAMSIwobY2FjaGVfY3JlYXRpb25faW5wdXRfdG9rZW5zGAQgASgDEh8KF2NhY2hlX3JlYWRfaW5wdXRfdG9rZW5zGAUgASgDEhgKEHJlYXNvbmluZ190b2tlbnMYBiABKAMSHgoWdG9vbF91c2VfcHJvbXB0X3Rva2VucxgHIAEoAxIaChJhdWRpb19pbnB1dF90b2tlbnMYCCABKAMSGwoTYXVkaW9fb3V0cHV0X3Rva2VucxgJIAEoAxJqChZwcm92aWRlcl90b2tlbl9kZXRhaWxzGBQgAygLMkouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRva2VuVXNhZ2UuUHJvdmlkZXJUb2tlbkRldGFpbHNFbnRyeRo7ChlQcm92aWRlclRva2VuRGV0YWlsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoAzoCOAEiugMKD1ByaWNpbmdTbmFwc2hvdBIgChhwcmljaW5nX3JlZ2lzdHJ5X3ZlcnNpb24YASABKAkSOAoUcHJpY2luZ19lZmZlY3RpdmVfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhAKCGN1cnJlbmN5GAMgASgJEiYKHmlucHV0X3ByaWNlX21pY3Jvc19wZXJfbWlsbGlvbhgKIAEoAxInCh9vdXRwdXRfcHJpY2VfbWljcm9zX3Blcl9taWxsaW9uGAsgASgDEi8KJ2NhY2hlX2NyZWF0aW9uX3ByaWNlX21pY3Jvc19wZXJfbWlsbGlvbhgMIAEoAxIrCiNjYWNoZV9yZWFkX3ByaWNlX21pY3Jvc19wZXJfbWlsbGlvbhgNIAEoAxIqCiJyZWFzb25pbmdfcHJpY2VfbWljcm9zX3Blcl9taWxsaW9uGA4gASgDEiwKJGN1cnNvcl90b2tlbl9yYXRlX21pY3Jvc19wZXJfbWlsbGlvbhgPIAEoAxIdChVtYXJrdXBfcG9saWN5X3ZlcnNpb24YHiABKAkSEQoJY29zdF90aWVyGB8gASgJIqkCCglDb3N0U3RhbXASEAoIY3VycmVuY3kYASABKAkSHAoUcHJvdmlkZXJfY29zdF9taWNyb3MYAiABKAMSJwofY3VzdG9tZXJfYmlsbGFibGVfYW1vdW50X21pY3JvcxgDIAEoAxJXChJjYWxjdWxhdGlvbl9zdGF0dXMYBCABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29zdENhbGN1bGF0aW9uU3RhdHVzEkYKB3ByaWNpbmcYBSABKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUHJpY2luZ1NuYXBzaG90EiIKGmN1cnNvcl9wbGF0Zm9ybV9mZWVfbWljcm9zGAYgASgDItQDCgtQcm94eVRpbWluZxI1ChFwcm94eV9yZWNlaXZlZF9hdBgBIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASPwobdXBzdHJlYW1fcmVxdWVzdF9zdGFydGVkX2F0GAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI6ChZmaXJzdF9yZXNwb25zZV9ieXRlX2F0GAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI5ChVsYXN0X3Jlc3BvbnNlX2J5dGVfYXQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjYKEnByb3h5X2NvbXBsZXRlZF9hdBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGAoQdXBzdHJlYW1fdHRmYl9tcxgKIAEoAxIYChB1cHN0cmVhbV90dGxiX21zGAsgASgDEhoKEnN0cmVhbV9kdXJhdGlvbl9tcxgMIAEoAxIfChdwcm94eV90b3RhbF9kdXJhdGlvbl9tcxgNIAEoAxIVCg1yZXF1ZXN0X2J5dGVzGBQgASgDEhYKDnJlc3BvbnNlX2J5dGVzGBUgASgDIvoBCgtCaWxsaW5nTGluaxJOCgxkZWJpdF9zdGF0dXMYASABKA4yOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQmlsbGluZ0RlYml0U3RhdHVzEhYKDnJlc2VydmF0aW9uX2lkGAIgASgJEhgKEGJpbGxpbmdfZGViaXRfaWQYAyABKAkSLgoKZGViaXRlZF9hdBgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASHQoVYmlsbGluZ19hdHRlbXB0X2NvdW50GAUgASgFEhoKEmxhc3RfYmlsbGluZ19lcnJvchgGIAEoCSL+CgoSTGxtQ2FsbFVzYWdlUmVjb3JkEhcKD3VzYWdlX3JlY29yZF9pZBgBIAEoCRIUCgxleGVjdXRpb25faWQYAiABKAkSGQoRcm9vdF9leGVjdXRpb25faWQYAyABKAkSEAoIc2VxdWVuY2UYBCABKAUSFwoPaWRlbXBvdGVuY3lfa2V5GAUgASgJEh4KFmNhbm9uaWNhbF9wYXlsb2FkX2hhc2gYBiABKAkSDwoHY2FsbF9pZBgJIAEoCRIvCgtvYnNlcnZlZF9hdBgKIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLgoKY3JlYXRlZF9hdBgLIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASUgoPbWV0ZXJpbmdfc291cmNlGBQgASgOMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlVzYWdlTWV0ZXJpbmdTb3VyY2USSgoLdHJ1c3RfbGV2ZWwYFSABKA4yNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVXNhZ2VUcnVzdExldmVsElEKDHVzYWdlX3N0YXR1cxgWIAEoDjI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Vc2FnZUNvbXBsZXRpb25TdGF0dXMSEwoLaXNfYmlsbGFibGUYFyABKAgSEAoIcHJvdmlkZXIYHiABKAkSFwoPcmVxdWVzdGVkX21vZGVsGB8gASgJEhYKDnJlc29sdmVkX21vZGVsGCAgASgJEhAKCGVuZHBvaW50GCEgASgJEhEKCXN0cmVhbWluZxgiIAEoCBIUCgxzZXJ2aWNlX3RpZXIYIyABKAkSGwoTcHJvdmlkZXJfcmVxdWVzdF9pZBgkIAEoCRIPCgdoYXJuZXNzGCUgASgJEhkKEWN1cnNvcl9hY2NvdW50X2lkGCYgASgJEhUKDWN1cnNvcl9rZXlfaWQYJyABKAkSGAoQaHR0cF9zdGF0dXNfY29kZRgoIAEoBRIVCg1maW5pc2hfcmVhc29uGCkgASgJEhIKCmVycm9yX2NvZGUYKiABKAkSUAoRY3Vyc29yX2tleV9zb3VyY2UYKyABKA4yNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ3Vyc29yS2V5U291cmNlEhAKCHRoaW5raW5nGCwgASgJEkAKBnRva2VucxgyIAEoCzIwLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub2tlblVzYWdlEj0KBGNvc3QYMyABKAsyLy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29zdFN0YW1wEkcKDHByb3h5X3RpbWluZxg8IAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Qcm94eVRpbWluZxIbChNwcm92aWRlcl91c2FnZV9qc29uGEYgASgJEkIKB2JpbGxpbmcYUCABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQmlsbGluZ0xpbmsSDgoGb3JnX2lkGAcgASgJEhIKCnNlc3Npb25faWQYCCABKAkSVAoGbGFiZWxzGFogAygLMkQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkxsbUNhbGxVc2FnZVJlY29yZC5MYWJlbHNFbnRyeRotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIr4CChRVc2FnZVJlcG9ydEFnZ3JlZ2F0ZRIUCgxpbnB1dF90b2tlbnMYASABKAMSFQoNb3V0cHV0X3Rva2VucxgCIAEoAxIUCgx0b3RhbF90b2tlbnMYAyABKAMSIwobY2FjaGVfY3JlYXRpb25faW5wdXRfdG9rZW5zGAQgASgDEh8KF2NhY2hlX3JlYWRfaW5wdXRfdG9rZW5zGAUgASgDEhgKEHJlYXNvbmluZ190b2tlbnMYBiABKAMSFgoObGxtX2NhbGxfY291bnQYCiABKAUSHAoUYmlsbGFibGVfY29zdF9taWNyb3MYFCABKAMSHAoUcHJvdmlkZXJfY29zdF9taWNyb3MYFSABKAMSFQoNcHJpbWFyeV9tb2RlbBgeIAEoCRIYChBwcmltYXJ5X3Byb3ZpZGVyGB8gASgJIvABCgpNb2RlbFVzYWdlEg0KBW1vZGVsGAEgASgJEhAKCHByb3ZpZGVyGAIgASgJEhQKDGlucHV0X3Rva2VucxgDIAEoAxIVCg1vdXRwdXRfdG9rZW5zGAQgASgDEiMKG2NhY2hlX2NyZWF0aW9uX2lucHV0X3Rva2VucxgFIAEoAxIfChdjYWNoZV9yZWFkX2lucHV0X3Rva2VucxgGIAEoAxISCgpjYWxsX2NvdW50GAcgASgFEhwKFGJpbGxhYmxlX2Nvc3RfbWljcm9zGAggASgDEhwKFHByb3ZpZGVyX2Nvc3RfbWljcm9zGAkgASgDIq0DChVTdHJlYW1pbmdVc2FnZVN1bW1hcnkSFAoMaW5wdXRfdG9rZW5zGAEgASgDEhUKDW91dHB1dF90b2tlbnMYAiABKAMSGQoRY2FjaGVfcmVhZF90b2tlbnMYAyABKAMSGgoSY2FjaGVfd3JpdGVfdG9rZW5zGAQgASgDEhQKDHRvdGFsX3Rva2VucxgFIAEoAxISCgp0dXJuX2NvdW50GAYgASgFEhoKEmVzdGltYXRlZF9jb3N0X3VzZBgHIAEoARINCgVtb2RlbBgIIAEoCRITCgtvYnNlcnZlZF9hdBgJIAEoCRJRChZyZXF1ZXN0ZWRfc2VydmljZV90aWVyGAogASgOMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNlcnZpY2VUaWVyEh4KFnJlcXVlc3RlZF9tb2RlbF9wYXJhbXMYCyABKAkSUwoXcmVxdWVzdGVkX3RoaW5raW5nX21vZGUYDCABKA4yMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVGhpbmtpbmdNb2RlKq4CChNVc2FnZU1ldGVyaW5nU291cmNlEiUKIVVTQUdFX01FVEVSSU5HX1NPVVJDRV9VTlNQRUNJRklFRBAAEjEKLVVTQUdFX01FVEVSSU5HX1NPVVJDRV9QUk9YWV9QUk9WSURFUl9SRVBPUlRFRBABEjYKMlVTQUdFX01FVEVSSU5HX1NPVVJDRV9SVU5ORVJfUFJPVklERVJfUkVQT1JURURfT1NTEAISIwofVVNBR0VfTUVURVJJTkdfU09VUkNFX0VTVElNQVRFRBADEjMKL1VTQUdFX01FVEVSSU5HX1NPVVJDRV9QUk9WSURFUl9BRE1JTl9SRUNPTkNJTEVEEAQSKwonVVNBR0VfTUVURVJJTkdfU09VUkNFX01BTlVBTF9BREpVU1RNRU5UEAUqqAEKD1VzYWdlVHJ1c3RMZXZlbBIhCh1VU0FHRV9UUlVTVF9MRVZFTF9VTlNQRUNJRklFRBAAEicKI1VTQUdFX1RSVVNUX0xFVkVMX0JJTExJTkdfQVVUSE9SSVRZEAESJQohVVNBR0VfVFJVU1RfTEVWRUxfU0VSVkVSX09CU0VSVkVEEAISIgoeVVNBR0VfVFJVU1RfTEVWRUxfRElTUExBWV9PTkxZEAMq/AIKFVVzYWdlQ29tcGxldGlvblN0YXR1cxInCiNVU0FHRV9DT01QTEVUSU9OX1NUQVRVU19VTlNQRUNJRklFRBAAEiQKIFVTQUdFX0NPTVBMRVRJT05fU1RBVFVTX0NPTVBMRVRFEAESLgoqVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfU1RSRUFNX0lOVEVSUlVQVEVEEAISNQoxVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfUFJPVklERVJfRVJST1JfV0lUSF9VU0FHRRADEjMKL1VTQUdFX0NPTVBMRVRJT05fU1RBVFVTX1BST1ZJREVSX0VSUk9SX05PX1VTQUdFEAQSKgomVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfRVNUSU1BVEVEX09OTFkQBRImCiJVU0FHRV9DT01QTEVUSU9OX1NUQVRVU19SRUNPTkNJTEVEEAYSJAogVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfQ09ORkxJQ1QQByqfAgoSQmlsbGluZ0RlYml0U3RhdHVzEiQKIEJJTExJTkdfREVCSVRfU1RBVFVTX1VOU1BFQ0lGSUVEEAASJwojQklMTElOR19ERUJJVF9TVEFUVVNfTk9UX0FQUExJQ0FCTEUQARIgChxCSUxMSU5HX0RFQklUX1NUQVRVU19QRU5ESU5HEAISIAocQklMTElOR19ERUJJVF9TVEFUVVNfREVCSVRFRBADEikKJUJJTExJTkdfREVCSVRfU1RBVFVTX0ZBSUxFRF9SRVRSWUFCTEUQBBIoCiRCSUxMSU5HX0RFQklUX1NUQVRVU19GQUlMRURfVEVSTUlOQUwQBRIhCh1CSUxMSU5HX0RFQklUX1NUQVRVU19DT05GTElDVBAGKo8CChVDb3N0Q2FsY3VsYXRpb25TdGF0dXMSJwojQ09TVF9DQUxDVUxBVElPTl9TVEFUVVNfVU5TUEVDSUZJRUQQABIkCiBDT1NUX0NBTENVTEFUSU9OX1NUQVRVU19DT01QVVRFRBABEiUKIUNPU1RfQ0FMQ1VMQVRJT05fU1RBVFVTX0VTVElNQVRFRBACEisKJ0NPU1RfQ0FMQ1VMQVRJT05fU1RBVFVTX1BSSUNFX05PVF9GT1VORBADEiYKIkNPU1RfQ0FMQ1VMQVRJT05fU1RBVFVTX1JFQ09OQ0lMRUQQBBIrCidDT1NUX0NBTENVTEFUSU9OX1NUQVRVU19NQU5VQUxfQURKVVNURUQQBSpXCg9DdXJzb3JLZXlTb3VyY2USIQodQ1VSU09SX0tFWV9TT1VSQ0VfVU5TUEVDSUZJRUQQABIhCh1DVVJTT1JfS0VZX1NPVVJDRV9NQU5BR0VEX0tFWRABYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_google_protobuf_timestamp]);var UsageReportAggregateSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_usage,6);var UsageMeteringSource;(function(UsageMeteringSource2){UsageMeteringSource2[UsageMeteringSource2.UNSPECIFIED=0]="UNSPECIFIED",UsageMeteringSource2[UsageMeteringSource2.PROXY_PROVIDER_REPORTED=1]="PROXY_PROVIDER_REPORTED",UsageMeteringSource2[UsageMeteringSource2.RUNNER_PROVIDER_REPORTED_OSS=2]="RUNNER_PROVIDER_REPORTED_OSS",UsageMeteringSource2[UsageMeteringSource2.ESTIMATED=3]="ESTIMATED",UsageMeteringSource2[UsageMeteringSource2.PROVIDER_ADMIN_RECONCILED=4]="PROVIDER_ADMIN_RECONCILED",UsageMeteringSource2[UsageMeteringSource2.MANUAL_ADJUSTMENT=5]="MANUAL_ADJUSTMENT"})(UsageMeteringSource||(UsageMeteringSource={}));var UsageTrustLevel;(function(UsageTrustLevel2){UsageTrustLevel2[UsageTrustLevel2.UNSPECIFIED=0]="UNSPECIFIED",UsageTrustLevel2[UsageTrustLevel2.BILLING_AUTHORITY=1]="BILLING_AUTHORITY",UsageTrustLevel2[UsageTrustLevel2.SERVER_OBSERVED=2]="SERVER_OBSERVED",UsageTrustLevel2[UsageTrustLevel2.DISPLAY_ONLY=3]="DISPLAY_ONLY"})(UsageTrustLevel||(UsageTrustLevel={}));var UsageCompletionStatus;(function(UsageCompletionStatus2){UsageCompletionStatus2[UsageCompletionStatus2.UNSPECIFIED=0]="UNSPECIFIED",UsageCompletionStatus2[UsageCompletionStatus2.COMPLETE=1]="COMPLETE",UsageCompletionStatus2[UsageCompletionStatus2.STREAM_INTERRUPTED=2]="STREAM_INTERRUPTED",UsageCompletionStatus2[UsageCompletionStatus2.PROVIDER_ERROR_WITH_USAGE=3]="PROVIDER_ERROR_WITH_USAGE",UsageCompletionStatus2[UsageCompletionStatus2.PROVIDER_ERROR_NO_USAGE=4]="PROVIDER_ERROR_NO_USAGE",UsageCompletionStatus2[UsageCompletionStatus2.ESTIMATED_ONLY=5]="ESTIMATED_ONLY",UsageCompletionStatus2[UsageCompletionStatus2.RECONCILED=6]="RECONCILED",UsageCompletionStatus2[UsageCompletionStatus2.CONFLICT=7]="CONFLICT"})(UsageCompletionStatus||(UsageCompletionStatus={}));var BillingDebitStatus;(function(BillingDebitStatus2){BillingDebitStatus2[BillingDebitStatus2.UNSPECIFIED=0]="UNSPECIFIED",BillingDebitStatus2[BillingDebitStatus2.NOT_APPLICABLE=1]="NOT_APPLICABLE",BillingDebitStatus2[BillingDebitStatus2.PENDING=2]="PENDING",BillingDebitStatus2[BillingDebitStatus2.DEBITED=3]="DEBITED",BillingDebitStatus2[BillingDebitStatus2.FAILED_RETRYABLE=4]="FAILED_RETRYABLE",BillingDebitStatus2[BillingDebitStatus2.FAILED_TERMINAL=5]="FAILED_TERMINAL",BillingDebitStatus2[BillingDebitStatus2.CONFLICT=6]="CONFLICT"})(BillingDebitStatus||(BillingDebitStatus={}));var CostCalculationStatus;(function(CostCalculationStatus2){CostCalculationStatus2[CostCalculationStatus2.UNSPECIFIED=0]="UNSPECIFIED",CostCalculationStatus2[CostCalculationStatus2.COMPUTED=1]="COMPUTED",CostCalculationStatus2[CostCalculationStatus2.ESTIMATED=2]="ESTIMATED",CostCalculationStatus2[CostCalculationStatus2.PRICE_NOT_FOUND=3]="PRICE_NOT_FOUND",CostCalculationStatus2[CostCalculationStatus2.RECONCILED=4]="RECONCILED",CostCalculationStatus2[CostCalculationStatus2.MANUAL_ADJUSTED=5]="MANUAL_ADJUSTED"})(CostCalculationStatus||(CostCalculationStatus={}));var CursorKeySource;(function(CursorKeySource2){CursorKeySource2[CursorKeySource2.UNSPECIFIED=0]="UNSPECIFIED",CursorKeySource2[CursorKeySource2.MANAGED_KEY=1]="MANAGED_KEY"})(CursorKeySource||(CursorKeySource={}));var file_ai_stigmer_agentic_agentexecution_v1_writeback=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvd3JpdGViYWNrLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEimgIKEldvcmtzcGFjZVdyaXRlQmFjaxIcChR3b3Jrc3BhY2VfZW50cnlfbmFtZRgBIAEoCRITCgticmFuY2hfbmFtZRgCIAEoCRITCgtiYXNlX2JyYW5jaBgDIAEoCRISCgpjb21taXRfc2hhGAQgASgJEhgKEHB1bGxfcmVxdWVzdF91cmwYBSABKAkSGwoTcHVsbF9yZXF1ZXN0X251bWJlchgGIAEoBRIUCgxkaWZmX3N1bW1hcnkYByABKAkSTAoFcGhhc2UYCCABKA4yPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuV29ya3NwYWNlV3JpdGVCYWNrUGhhc2USDQoFZXJyb3IYCSABKAkq0AEKF1dvcmtzcGFjZVdyaXRlQmFja1BoYXNlEioKJldPUktTUEFDRV9XUklURV9CQUNLX1BIQVNFX1VOU1BFQ0lGSUVEEAASIgoeV09SS1NQQUNFX1dSSVRFX0JBQ0tfQ09NTUlUVEVEEAESHwobV09SS1NQQUNFX1dSSVRFX0JBQ0tfUFVTSEVEEAISIwofV09SS1NQQUNFX1dSSVRFX0JBQ0tfUFJfQ1JFQVRFRBADEh8KG1dPUktTUEFDRV9XUklURV9CQUNLX0ZBSUxFRBAEYgZwcm90bzM");var WorkspaceWriteBackPhase;(function(WorkspaceWriteBackPhase2){WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_PHASE_UNSPECIFIED=0]="WORKSPACE_WRITE_BACK_PHASE_UNSPECIFIED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_COMMITTED=1]="WORKSPACE_WRITE_BACK_COMMITTED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_PUSHED=2]="WORKSPACE_WRITE_BACK_PUSHED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_PR_CREATED=3]="WORKSPACE_WRITE_BACK_PR_CREATED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_FAILED=4]="WORKSPACE_WRITE_BACK_FAILED"})(WorkspaceWriteBackPhase||(WorkspaceWriteBackPhase={}));var file_ai_stigmer_agentic_agentexecution_v1_api=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvYXBpLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEiywIKDkFnZW50RXhlY3V0aW9uEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiMKBGtpbmQYAiABKAlCFbpIEnIQCg5BZ2VudEV4ZWN1dGlvbhJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESRgoEc3BlYxgEIAEoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvblNwZWMSSgoGc3RhdHVzGAUgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uU3RhdHVzIrcMChRBZ2VudEV4ZWN1dGlvblN0YXR1cxI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0EkQKCG1lc3NhZ2VzGAEgAygLMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50TWVzc2FnZRJNCgVwaGFzZRgCIAEoDjI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25QaGFzZUIIukgFggECEAESVQoUc3ViX2FnZW50X2V4ZWN1dGlvbnMYBCADKAsyNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU3ViQWdlbnRFeGVjdXRpb24SDQoFZXJyb3IYBiABKAkSEgoKc3RhcnRlZF9hdBgHIAEoCRIUCgxjb21wbGV0ZWRfYXQYCCABKAkSVAoFdG9kb3MYCSADKAsyRS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb25TdGF0dXMuVG9kb3NFbnRyeRIWCg5jYWxsYmFja190b2tlbhgKIAEoDBJQChFwZW5kaW5nX2FwcHJvdmFscxgQIAMoCzI1LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5QZW5kaW5nQXBwcm92YWwSWAoVYXBwcm92YWxfZXZlbnRfc3RyZWFtGBYgASgLMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsRXZlbnRTdHJlYW0SRwoMY29udGV4dF9pbmZvGA4gASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkNvbnRleHRJbmZvEkoKCWFydGlmYWN0cxgPIAMoCzI3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25BcnRpZmFjdBJXChV3b3Jrc3BhY2Vfd3JpdGVfYmFja3MYESADKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuV29ya3NwYWNlV3JpdGVCYWNrEksKDnNldHVwX3Byb2dyZXNzGBIgASgLMjMuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNldHVwUHJvZ3Jlc3MSVAoPc3RyZWFtaW5nX3VzYWdlGBQgASgLMjsuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlN0cmVhbWluZ1VzYWdlU3VtbWFyeRIyChFzdHJ1Y3R1cmVkX291dHB1dBgVIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSTQoQZmlsZV9jaGFuZ2Vfc2V0cxgXIAMoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ2hhbmdlU2V0El0KGGZpbGVfcmV2aWV3X2V2ZW50X3N0cmVhbRgYIAEoCzI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlUmV2aWV3RXZlbnRTdHJlYW0SVgoUZmlsZV9jaGFuZ2VfcHJvZ3Jlc3MYGSABKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNoYW5nZVByb2dyZXNzEl4KGHJlY2FsbGVkX21lbW9yaWVzX3JlcG9ydBgaIAEoCzI8LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5SZWNhbGxlZE1lbW9yaWVzUmVwb3J0GlwKClRvZG9zRW50cnkSCwoDa2V5GAEgASgJEj0KBXZhbHVlGAIgASgLMi4uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvZG9JdGVtOgI4AUoECAwQDVIQcmVzb2x2ZWRfY29udGV4dCImCg1TZXR1cFByb2dyZXNzEhUKDWN1cnJlbnRfcGhhc2UYASABKAkiaAoWUmVjYWxsZWRNZW1vcmllc1JlcG9ydBIYChBzZWxlY3Rpb25fYWN0aXZlGAEgASgIEhsKE2luamVjdGVkX21lbW9yeV9pZHMYAiADKAkSFwoPZW1iZWRkaW5nX21vZGVsGAMgASgJYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_approval,file_ai_stigmer_agentic_agentexecution_v1_artifact,file_ai_stigmer_agentic_agentexecution_v1_context,file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_agentexecution_v1_filereview,file_ai_stigmer_agentic_agentexecution_v1_message,file_ai_stigmer_agentic_agentexecution_v1_spec,file_ai_stigmer_agentic_agentexecution_v1_subagent,file_ai_stigmer_agentic_agentexecution_v1_todo,file_ai_stigmer_agentic_agentexecution_v1_usage,file_ai_stigmer_agentic_agentexecution_v1_writeback,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_struct]),AgentExecutionSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_api,0),AgentExecutionStatusSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_api,1);var file_ai_stigmer_agentic_agentinstance_v1_spec=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRpbnN0YW5jZS92MS9zcGVjLnByb3RvEiNhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRpbnN0YW5jZS52MSKpAgoRQWdlbnRJbnN0YW5jZVNwZWMSGQoIYWdlbnRfaWQYASABKAlCB7pIBHICEAESEwoLZGVzY3JpcHRpb24YAiABKAkSyAEKEGVudmlyb25tZW50X3JlZnMYAyADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCeLpIcZIBbiJsugFpChVlbnZpcm9ubWVudF9yZWZzLmtpbmQSP2Vudmlyb25tZW50X3JlZnMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1lbnZpcm9ubWVudBoPdGhpcy5raW5kID09IDUz4IUsNUoECAQQBVITZGF0YXN0b3JlX3BhcnRpdGlvbmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]);var file_ai_stigmer_agentic_agentinstance_v1_api=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRpbnN0YW5jZS92MS9hcGkucHJvdG8SI2FpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxIsMCCg1BZ2VudEluc3RhbmNlEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiIKBGtpbmQYAiABKAlCFLpIEXIPCg1BZ2VudEluc3RhbmNlEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJECgRzcGVjGAQgASgLMjYuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuQWdlbnRJbnN0YW5jZVNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_agentinstance_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),AgentInstanceSchema=messageDesc2(file_ai_stigmer_agentic_agentinstance_v1_api,0);var file_ai_stigmer_agentic_agentshare_v1_spec=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9zcGVjLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MSLWCQoOQWdlbnRTaGFyZVNwZWMSrAEKCWFnZW50X3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUJjukhcugFWCg5hZ2VudF9yZWYua2luZBIzYWdlbnRfcmVmIG11c3QgcmVmZXJlbmNlIGEgcmVzb3VyY2Ugd2l0aCBraW5kPWFnZW50Gg90aGlzLmtpbmQgPT0gNDDIAQHghSwoEg8KB2VuYWJsZWQYAiABKAgSRgoIYXVkaWVuY2UYAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MS5BZ2VudFNoYXJlQXVkaWVuY2USsAIKD2FsbG93ZWRfb3JpZ2lucxgEIAMoCUKWArpIkgKSAY4CECAiiQK6AYUCChZhbGxvd2VkX29yaWdpbnMuZm9ybWF0Em5hbGxvd2VkX29yaWdpbnMgZW50cmllcyBtdXN0IGJlIGV4YWN0IHdlYiBvcmlnaW5zIGxpa2UgaHR0cHM6Ly9leGFtcGxlLmNvbSAobm8gcGF0aCwgcXVlcnksIG9yIHRyYWlsaW5nIHNsYXNoKRp7dGhpcy5tYXRjaGVzKCdeaHR0cHM/Oi8vW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8oXFwuW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8pKig6WzAtOV17MSw1fSk/JCcpEkYKCG1lc3NhZ2VzGAUgASgLMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZU1lc3NhZ2VzEsgBChBlbnZpcm9ubWVudF9yZWZzGAYgAygLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlQni6SHGSAW4ibLoBaQoVZW52aXJvbm1lbnRfcmVmcy5raW5kEj9lbnZpcm9ubWVudF9yZWZzIG11c3QgcmVmZXJlbmNlIHJlc291cmNlcyB3aXRoIGtpbmQ9ZW52aXJvbm1lbnQaD3RoaXMua2luZCA9PSA1M+CFLDUSQwoKcnVuX2NvbmZpZxgHIAEoCzIvLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5SdW5Db25maWc6sAK6SKwCGp8BCihhZ2VudF9zaGFyZS5lbnZpcm9ubWVudF9yZWZzX3B1YmxpY19vbmx5EjplbnZpcm9ubWVudF9yZWZzIGNhbiBvbmx5IGJlIHNldCBvbiBwdWJsaWMtYXVkaWVuY2Ugc2hhcmVzGjd0aGlzLmF1ZGllbmNlICE9IDIgfHwgdGhpcy5lbnZpcm9ubWVudF9yZWZzLnNpemUoKSA9PSAwGocBCiJhZ2VudF9zaGFyZS5ydW5fY29uZmlnX3B1YmxpY19vbmx5EjRydW5fY29uZmlnIGNhbiBvbmx5IGJlIHNldCBvbiBwdWJsaWMtYXVkaWVuY2Ugc2hhcmVzGit0aGlzLmF1ZGllbmNlICE9IDIgfHwgIWhhcyh0aGlzLnJ1bl9jb25maWcpInkKEkFnZW50U2hhcmVNZXNzYWdlcxIeCgxyYXRlX2xpbWl0ZWQYASABKAlCCLpIBXIDGKwCEh0KC3VuYXZhaWxhYmxlGAIgASgJQgi6SAVyAxisAhIkChJjb252ZXJzYXRpb25fZW5kZWQYAyABKAlCCLpIBXIDGKwCKnkKEkFnZW50U2hhcmVBdWRpZW5jZRIkCiBhZ2VudF9zaGFyZV9hdWRpZW5jZV91bnNwZWNpZmllZBAAEh8KG2FnZW50X3NoYXJlX2F1ZGllbmNlX3B1YmxpYxABEhwKGGFnZW50X3NoYXJlX2F1ZGllbmNlX29yZxACYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_invocation,file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]);var AgentShareAudience;(function(AgentShareAudience2){AgentShareAudience2[AgentShareAudience2.unspecified=0]="unspecified",AgentShareAudience2[AgentShareAudience2.public=1]="public",AgentShareAudience2[AgentShareAudience2.org=2]="org"})(AgentShareAudience||(AgentShareAudience={}));var file_ai_stigmer_agentic_agentshare_v1_status=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9zdGF0dXMucHJvdG8SIGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxIn8KEEFnZW50U2hhcmVTdGF0dXMSPwoFYXVkaXQYYyABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdBIYChBzaGFyZV9saW5rX3Rva2VuGAEgASgJEhAKCGFnZW50X2lkGAIgASgJYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_status]),AgentShareStatusSchema=messageDesc2(file_ai_stigmer_agentic_agentshare_v1_status,0);var file_ai_stigmer_agentic_agentshare_v1_api=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9hcGkucHJvdG8SIGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxIrMCCgpBZ2VudFNoYXJlEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEh8KBGtpbmQYAiABKAlCEbpIDnIMCgpBZ2VudFNoYXJlEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARI+CgRzcGVjGAQgASgLMjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZVNwZWMSQgoGc3RhdHVzGAUgASgLMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZVN0YXR1c2IGcHJvdG8z",[file_ai_stigmer_agentic_agentshare_v1_spec,file_ai_stigmer_agentic_agentshare_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),AgentShareSchema=messageDesc2(file_ai_stigmer_agentic_agentshare_v1_api,0);var file_ai_stigmer_agentic_artifact_v1_enum=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvZW51bS5wcm90bxIeYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxKoUBChRBcnRpZmFjdFN0b3JhZ2VTdGF0ZRIdChlzdG9yYWdlX3N0YXRlX3Vuc3BlY2lmaWVkEAASGQoVc3RvcmFnZV9zdGF0ZV9wZW5kaW5nEAESGAoUc3RvcmFnZV9zdGF0ZV9zdG9yZWQQAhIZChVzdG9yYWdlX3N0YXRlX2RlbGV0ZWQQA2IGcHJvdG8z"),ArtifactStorageState;(function(ArtifactStorageState2){ArtifactStorageState2[ArtifactStorageState2.storage_state_unspecified=0]="storage_state_unspecified",ArtifactStorageState2[ArtifactStorageState2.storage_state_pending=1]="storage_state_pending",ArtifactStorageState2[ArtifactStorageState2.storage_state_stored=2]="storage_state_stored",ArtifactStorageState2[ArtifactStorageState2.storage_state_deleted=3]="storage_state_deleted"})(ArtifactStorageState||(ArtifactStorageState={}));var file_ai_stigmer_agentic_artifact_v1_spec=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvc3BlYy5wcm90bxIeYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxIuQBCgxBcnRpZmFjdFNwZWMSIwoMY29udGVudF90eXBlGAEgASgJQg26SArIAQFyBRABGP8BEiMKDGRpc3BsYXlfbmFtZRgCIAEoCUINukgKyAEBcgUQARj/ARJGCgZzb3VyY2UYAyABKAsyLi5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuQXJ0aWZhY3RTb3VyY2VCBrpIA8gBARJCCglyZXRlbnRpb24YBCABKAsyLy5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuUmV0ZW50aW9uUG9saWN5Il4KDkFydGlmYWN0U291cmNlEh0KFXdvcmtmbG93X2V4ZWN1dGlvbl9pZBgBIAEoCRIaChJhZ2VudF9leGVjdXRpb25faWQYAiABKAkSEQoJdGFza19uYW1lGAMgASgJIiMKD1JldGVudGlvblBvbGljeRIQCgh0dGxfZGF5cxgBIAEoBWIGcHJvdG8z",[file_buf_validate_validate]);var file_ai_stigmer_agentic_artifact_v1_api=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvYXBpLnByb3RvEh5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEipwIKCEFydGlmYWN0EjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEh0KBGtpbmQYAiABKAlCD7pIDHIKCghBcnRpZmFjdBJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESOgoEc3BlYxgEIAEoCzIsLmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5BcnRpZmFjdFNwZWMSPgoGc3RhdHVzGAUgASgLMi4uYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxLkFydGlmYWN0U3RhdHVzItwBCg5BcnRpZmFjdFN0YXR1cxI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0EhQKDGNvbnRlbnRfaGFzaBgBIAEoCRISCgpzaXplX2J5dGVzGAIgASgDEksKDXN0b3JhZ2Vfc3RhdGUYAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuQXJ0aWZhY3RTdG9yYWdlU3RhdGUSEgoKZXhwaXJlc19hdBgEIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_artifact_v1_enum,file_ai_stigmer_agentic_artifact_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),ArtifactSchema=messageDesc2(file_ai_stigmer_agentic_artifact_v1_api,0),ArtifactStatusSchema=messageDesc2(file_ai_stigmer_agentic_artifact_v1_api,1);var file_ai_stigmer_agentic_channelapp_v1_spec=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9zcGVjLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MSLEAQoOQ2hhbm5lbEFwcFNwZWMSSAoFc2xhY2sYASABKAsyNy5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5TbGFja0NoYW5uZWxBcHBDb25maWdIABJOCgh3aGF0c2FwcBgCIAEoCzI6LmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLldoYXRzQXBwQ2hhbm5lbEFwcENvbmZpZ0gAQhgKD3Byb3ZpZGVyX2NvbmZpZxIFukgCCAEidAoVU2xhY2tDaGFubmVsQXBwQ29uZmlnEhoKCWNsaWVudF9pZBgBIAEoCUIHukgEcgIQARIeCg1jbGllbnRfc2VjcmV0GAIgASgJQge6SARyAhABEh8KDnNpZ25pbmdfc2VjcmV0GAMgASgJQge6SARyAhABIo4BChhXaGF0c0FwcENoYW5uZWxBcHBDb25maWcSFwoGYXBwX2lkGAEgASgJQge6SARyAhABEhsKCmFwcF9zZWNyZXQYAiABKAlCB7pIBHICEAESHQoMYWNjZXNzX3Rva2VuGAMgASgJQge6SARyAhABEh0KDHZlcmlmeV90b2tlbhgEIAEoCUIHukgEcgIQAWIGcHJvdG8z",[file_buf_validate_validate]);var file_ai_stigmer_agentic_channelapp_v1_api=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9hcGkucHJvdG8SIGFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxIrcCCgpDaGFubmVsQXBwEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEh8KBGtpbmQYAiABKAlCEbpIDnIMCgpDaGFubmVsQXBwEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARI+CgRzcGVjGAQgASgLMjAuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcFNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_channelapp_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),ChannelAppSchema=messageDesc2(file_ai_stigmer_agentic_channelapp_v1_api,0);var file_ai_stigmer_agentic_executioncontext_v1_api=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9hcGkucHJvdG8SJmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxIs8CChBFeGVjdXRpb25Db250ZXh0EjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiUKBGtpbmQYAiABKAlCF7pIFHISChBFeGVjdXRpb25Db250ZXh0Ek0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJKCgRzcGVjGAQgASgLMjwuYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dFNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),ExecutionContextSchema=messageDesc2(file_ai_stigmer_agentic_executioncontext_v1_api,0);var file_ai_stigmer_agentic_memory_v1_spec=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3NwZWMucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEikgEKCk1lbW9yeVNwZWMSGwoHY29udGVudBgBIAEoCUIKukgHcgUQARj0AxIjChtzdWJqZWN0X2lkZW50aXR5X2FjY291bnRfaWQYAiABKAkSQgoKcHJvdmVuYW5jZRgDIAEoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5UHJvdmVuYW5jZSJqChBNZW1vcnlQcm92ZW5hbmNlEhAKCGFnZW50X2lkGAEgASgJEhIKCnNlc3Npb25faWQYAiABKAkSGgoSYWdlbnRfZXhlY3V0aW9uX2lkGAMgASgJEhQKDHRvb2xfY2FsbF9pZBgEIAEoCWIGcHJvdG8z",[file_buf_validate_validate]);var MemoryProvenanceSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_spec,1);var file_ai_stigmer_agentic_memory_v1_enum=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2VudW0ucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEqkgEKFE1lbW9yeUxpZmVjeWNsZVN0YXRlEh8KG2xpZmVjeWNsZV9zdGF0ZV91bnNwZWNpZmllZBAAEhwKGGxpZmVjeWNsZV9zdGF0ZV9wcm9wb3NlZBABEh0KGWxpZmVjeWNsZV9zdGF0ZV9jb25maXJtZWQQAhIcChhsaWZlY3ljbGVfc3RhdGVfcmVqZWN0ZWQQA2IGcHJvdG8z"),MemoryLifecycleState;(function(MemoryLifecycleState2){MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_unspecified=0]="lifecycle_state_unspecified",MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_proposed=1]="lifecycle_state_proposed",MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_confirmed=2]="lifecycle_state_confirmed",MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_rejected=3]="lifecycle_state_rejected"})(MemoryLifecycleState||(MemoryLifecycleState={}));var file_ai_stigmer_agentic_memory_v1_status=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3N0YXR1cy5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MSLSAQoMTWVtb3J5U3RhdHVzEksKD2xpZmVjeWNsZV9zdGF0ZRgBIAEoDjIyLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5TGlmZWN5Y2xlU3RhdGUSNAoQc3RhdGVfY2hhbmdlZF9hdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASPwoFYXVkaXQYYyABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdGIGcHJvdG8z",[file_ai_stigmer_agentic_memory_v1_enum,file_ai_stigmer_commons_apiresource_status,file_google_protobuf_timestamp]),MemoryStatusSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_status,0);var file_ai_stigmer_agentic_memory_v1_api=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2FwaS5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MSKbAgoGTWVtb3J5EjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEhsKBGtpbmQYAiABKAlCDbpICnIICgZNZW1vcnkSTQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YUIGukgDyAEBEjYKBHNwZWMYBCABKAsyKC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeVNwZWMSOgoGc3RhdHVzGAUgASgLMiouYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_memory_v1_spec,file_ai_stigmer_agentic_memory_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),MemorySchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_api,0);var file_ai_stigmer_agentic_plugin_v1_spec=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3NwZWMucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEigwIKClBsdWdpblNwZWMSDAoEbmFtZRgBIAEoCRIPCgd2ZXJzaW9uGAIgASgJEhMKC2Rlc2NyaXB0aW9uGAMgASgJEjoKBmF1dGhvchgEIAEoCzIqLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luQXV0aG9yEhAKCGhvbWVwYWdlGAUgASgJEhIKCnJlcG9zaXRvcnkYBiABKAkSDwoHbGljZW5zZRgHIAEoCRIQCghrZXl3b3JkcxgIIAMoCRI8CgdkaWFsZWN0GAkgASgOMisuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5EaWFsZWN0IjgKDFBsdWdpbkF1dGhvchIMCgRuYW1lGAEgASgJEg0KBWVtYWlsGAIgASgJEgsKA3VybBgDIAEoCSqhAQoNUGx1Z2luRGlhbGVjdBIeChpQTFVHSU5fRElBTEVDVF9VTlNQRUNJRklFRBAAEiAKHFBMVUdJTl9ESUFMRUNUX0FHRU5UX1BMVUdJTlMQARIZChVQTFVHSU5fRElBTEVDVF9DTEFVREUQAhIZChVQTFVHSU5fRElBTEVDVF9DVVJTT1IQAxIYChRQTFVHSU5fRElBTEVDVF9DT0RFWBAEYgZwcm90bzM"),PluginSpecSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_spec,0),PluginAuthorSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_spec,1),PluginDialect;(function(PluginDialect2){PluginDialect2[PluginDialect2.UNSPECIFIED=0]="UNSPECIFIED",PluginDialect2[PluginDialect2.AGENT_PLUGINS=1]="AGENT_PLUGINS",PluginDialect2[PluginDialect2.CLAUDE=2]="CLAUDE",PluginDialect2[PluginDialect2.CURSOR=3]="CURSOR",PluginDialect2[PluginDialect2.CODEX=4]="CODEX"})(PluginDialect||(PluginDialect={}));var file_ai_stigmer_agentic_plugin_v1_status=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3N0YXR1cy5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MSLqAgoMUGx1Z2luU3RhdHVzEj8KBWF1ZGl0GGMgASgLMjAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXQSKAoGZGlnZXN0GAEgASgJQhi6SBVyEzIRXiR8XlthLWYwLTldezY0fSQSHAoUYXJ0aWZhY3Rfc3RvcmFnZV9rZXkYAiABKAkSOAoFc3RhdGUYAyABKA4yKS5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpblN0YXRlEg0KBWVycm9yGAQgASgJEkkKDG1hdGVyaWFsaXplZBgFIAEoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luTWF0ZXJpYWxpemF0aW9uEj0KCHdhcm5pbmdzGAYgAygLMisuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5XYXJuaW5nIl8KFVBsdWdpbk1hdGVyaWFsaXphdGlvbhIOCgZza2lsbHMYASABKAUSEwoLbWNwX3NlcnZlcnMYAiABKAUSDgoGYWdlbnRzGAMgASgFEhEKCXdvcmtmbG93cxgEIAEoBSI8Cg1QbHVnaW5XYXJuaW5nEgwKBGtpbmQYASABKAkSDwoHbWVzc2FnZRgCIAEoCRIMCgRwYXRoGAMgASgJKnkKC1BsdWdpblN0YXRlEhwKGFBMVUdJTl9TVEFURV9VTlNQRUNJRklFRBAAEhsKF1BMVUdJTl9TVEFURV9JTlNUQUxMSU5HEAESFgoSUExVR0lOX1NUQVRFX1JFQURZEAISFwoTUExVR0lOX1NUQVRFX0ZBSUxFRBADYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),PluginStatusSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_status,0),PluginMaterializationSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_status,1),PluginWarningSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_status,2),PluginState;(function(PluginState2){PluginState2[PluginState2.UNSPECIFIED=0]="UNSPECIFIED",PluginState2[PluginState2.INSTALLING=1]="INSTALLING",PluginState2[PluginState2.READY=2]="READY",PluginState2[PluginState2.FAILED=3]="FAILED"})(PluginState||(PluginState={}));var file_ai_stigmer_agentic_plugin_v1_api=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2FwaS5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MSKbAgoGUGx1Z2luEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEhsKBGtpbmQYAiABKAlCDbpICnIICgZQbHVnaW4STQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YUIGukgDyAEBEjYKBHNwZWMYBCABKAsyKC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpblNwZWMSOgoGc3RhdHVzGAUgASgLMiouYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5TdGF0dXMiZAoKUGx1Z2luTGlzdBITCgthcGlfdmVyc2lvbhgBIAEoCRIMCgRraW5kGAIgASgJEjMKBWl0ZW1zGAMgAygLMiQuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5iBnByb3RvMw",[file_ai_stigmer_agentic_plugin_v1_spec,file_ai_stigmer_agentic_plugin_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),PluginSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_api,0);var file_ai_stigmer_agentic_session_v1_api=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9hcGkucHJvdG8SHWFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxIqsCCgdTZXNzaW9uEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEhwKBGtpbmQYAiABKAlCDrpIC3IJCgdTZXNzaW9uEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARI4CgRzcGVjGAQgASgLMiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvblNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_session_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),SessionSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_api,0);var file_ai_stigmer_agentic_workflowexecution_v1_enum=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvZW51bS5wcm90bxInYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxKtsBCg5FeGVjdXRpb25QaGFzZRIfChtFWEVDVVRJT05fUEhBU0VfVU5TUEVDSUZJRUQQABIVChFFWEVDVVRJT05fUEVORElORxABEhkKFUVYRUNVVElPTl9JTl9QUk9HUkVTUxACEhcKE0VYRUNVVElPTl9DT01QTEVURUQQAxIUChBFWEVDVVRJT05fRkFJTEVEEAQSFwoTRVhFQ1VUSU9OX0NBTkNFTExFRBAFEhgKFEVYRUNVVElPTl9URVJNSU5BVEVEEAYSFAoQRVhFQ1VUSU9OX1BBVVNFRBAHKoQCChBXb3JrZmxvd1Rhc2tUeXBlEiIKHldPUktGTE9XX1RBU0tfVFlQRV9VTlNQRUNJRklFRBAAEiIKHldPUktGTE9XX1RBU0tfQUdFTlRfSU5WT0NBVElPThABEhoKFldPUktGTE9XX1RBU0tfQVBQUk9WQUwQAhIaChZXT1JLRkxPV19UQVNLX0FQSV9DQUxMEAMSHQoZV09SS0ZMT1dfVEFTS19DT05ESVRJT05BTBAEEhoKFldPUktGTE9XX1RBU0tfUEFSQUxMRUwQBRIbChdXT1JLRkxPV19UQVNLX1RSQU5TRk9STRAGEhgKFFdPUktGTE9XX1RBU0tfQ1VTVE9NEAcq6gEKEldvcmtmbG93VGFza1N0YXR1cxIkCiBXT1JLRkxPV19UQVNLX1NUQVRVU19VTlNQRUNJRklFRBAAEhkKFVdPUktGTE9XX1RBU0tfUEVORElORxABEh0KGVdPUktGTE9XX1RBU0tfSU5fUFJPR1JFU1MQAhIbChdXT1JLRkxPV19UQVNLX0NPTVBMRVRFRBADEhgKFFdPUktGTE9XX1RBU0tfRkFJTEVEEAQSGQoVV09SS0ZMT1dfVEFTS19TS0lQUEVEEAUSIgoeV09SS0ZMT1dfVEFTS19XQUlUSU5HX0FQUFJPVkFMEAZiBnByb3RvMw"),ExecutionPhase2;(function(ExecutionPhase3){ExecutionPhase3[ExecutionPhase3.EXECUTION_PHASE_UNSPECIFIED=0]="EXECUTION_PHASE_UNSPECIFIED",ExecutionPhase3[ExecutionPhase3.EXECUTION_PENDING=1]="EXECUTION_PENDING",ExecutionPhase3[ExecutionPhase3.EXECUTION_IN_PROGRESS=2]="EXECUTION_IN_PROGRESS",ExecutionPhase3[ExecutionPhase3.EXECUTION_COMPLETED=3]="EXECUTION_COMPLETED",ExecutionPhase3[ExecutionPhase3.EXECUTION_FAILED=4]="EXECUTION_FAILED",ExecutionPhase3[ExecutionPhase3.EXECUTION_CANCELLED=5]="EXECUTION_CANCELLED",ExecutionPhase3[ExecutionPhase3.EXECUTION_TERMINATED=6]="EXECUTION_TERMINATED",ExecutionPhase3[ExecutionPhase3.EXECUTION_PAUSED=7]="EXECUTION_PAUSED"})(ExecutionPhase2||(ExecutionPhase2={}));var WorkflowTaskType;(function(WorkflowTaskType2){WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_TYPE_UNSPECIFIED=0]="WORKFLOW_TASK_TYPE_UNSPECIFIED",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_AGENT_INVOCATION=1]="WORKFLOW_TASK_AGENT_INVOCATION",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_APPROVAL=2]="WORKFLOW_TASK_APPROVAL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_API_CALL=3]="WORKFLOW_TASK_API_CALL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_CONDITIONAL=4]="WORKFLOW_TASK_CONDITIONAL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_PARALLEL=5]="WORKFLOW_TASK_PARALLEL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_TRANSFORM=6]="WORKFLOW_TASK_TRANSFORM",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_CUSTOM=7]="WORKFLOW_TASK_CUSTOM"})(WorkflowTaskType||(WorkflowTaskType={}));var WorkflowTaskStatus;(function(WorkflowTaskStatus2){WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_STATUS_UNSPECIFIED=0]="WORKFLOW_TASK_STATUS_UNSPECIFIED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_PENDING=1]="WORKFLOW_TASK_PENDING",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_IN_PROGRESS=2]="WORKFLOW_TASK_IN_PROGRESS",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_COMPLETED=3]="WORKFLOW_TASK_COMPLETED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_FAILED=4]="WORKFLOW_TASK_FAILED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_SKIPPED=5]="WORKFLOW_TASK_SKIPPED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_WAITING_APPROVAL=6]="WORKFLOW_TASK_WAITING_APPROVAL"})(WorkflowTaskStatus||(WorkflowTaskStatus={}));var file_ai_stigmer_agentic_workflowexecution_v1_spec=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvc3BlYy5wcm90bxInYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxIrwEChVXb3JrZmxvd0V4ZWN1dGlvblNwZWMSHAoUd29ya2Zsb3dfaW5zdGFuY2VfaWQYASABKAkSEwoLd29ya2Zsb3dfaWQYBiABKAkSFwoPdHJpZ2dlcl9tZXNzYWdlGAMgASgJEm0KEHRyaWdnZXJfbWV0YWRhdGEYBCADKAsyUy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb25TcGVjLlRyaWdnZXJNZXRhZGF0YUVudHJ5EmMKC3J1bnRpbWVfZW52GAUgAygLMk4uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uU3BlYy5SdW50aW1lRW52RW50cnkSFgoOY2FsbGJhY2tfdG9rZW4YByABKAwSSAoQZXhlY3V0aW9uX3RhcmdldBgIIAEoDjIuLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLkV4ZWN1dGlvblRhcmdldBo2ChRUcmlnZ2VyTWV0YWRhdGFFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBGmkKD1J1bnRpbWVFbnZFbnRyeRILCgNrZXkYASABKAkSRQoFdmFsdWUYAiABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25WYWx1ZToCOAFiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_spec,file_ai_stigmer_agentic_session_v1_enum]);var file_ai_stigmer_agentic_workflowexecution_v1_api=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvYXBpLnByb3RvEidhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEi3QIKEVdvcmtmbG93RXhlY3V0aW9uEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiYKBGtpbmQYAiABKAlCGLpIFXITChFXb3JrZmxvd0V4ZWN1dGlvbhJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESTAoEc3BlYxgEIAEoCzI+LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvblNwZWMSUAoGc3RhdHVzGAUgASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uU3RhdHVzIqQFChdXb3JrZmxvd0V4ZWN1dGlvblN0YXR1cxI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0ElAKBXBoYXNlGAEgASgOMjcuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvblBoYXNlQgi6SAWCAQIQARJECgV0YXNrcxgCIAMoCzI1LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd1Rhc2sSJwoGb3V0cHV0GAMgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBINCgVlcnJvchgEIAEoCRISCgpzdGFydGVkX2F0GAUgASgJEhQKDGNvbXBsZXRlZF9hdBgGIAEoCRIcChR0ZW1wb3JhbF93b3JrZmxvd19pZBgHIAEoCRJbChFwZW5kaW5nX2FwcHJvdmFscxgJIAMoCzJALmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd1BlbmRpbmdBcHByb3ZhbBIZChF0b3RhbF9jb3N0X21pY3JvcxgKIAEoAxIaChJ0b3RhbF9pbnB1dF90b2tlbnMYCyABKAMSGwoTdG90YWxfb3V0cHV0X3Rva2VucxgMIAEoAxIdChV3b3JrZmxvd192ZXJzaW9uX2hhc2gYDSABKAkSYAoUcGVuZGluZ19maWxlX3Jldmlld3MYDiADKAsyQi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dQZW5kaW5nRmlsZVJldmlldyKEAQoXV29ya2Zsb3dQZW5kaW5nQXBwcm92YWwSRwoIYXBwcm92YWwYASABKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUGVuZGluZ0FwcHJvdmFsEiAKGGNoaWxkX2FnZW50X2V4ZWN1dGlvbl9pZBgCIAEoCSJUChlXb3JrZmxvd1BlbmRpbmdGaWxlUmV2aWV3EiAKGGNoaWxkX2FnZW50X2V4ZWN1dGlvbl9pZBgBIAEoCRIVCg1jaGFuZ2Vfc2V0X2lkGAIgAygJIv8DCgxXb3JrZmxvd1Rhc2sSDwoHdGFza19pZBgBIAEoCRIRCgl0YXNrX25hbWUYAiABKAkSVgoJdGFza190eXBlGAMgASgOMjkuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93VGFza1R5cGVCCLpIBYIBAhABEiYKBWlucHV0GAQgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBInCgZvdXRwdXQYBSABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0ElUKBnN0YXR1cxgGIAEoDjI7LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd1Rhc2tTdGF0dXNCCLpIBYIBAhABEhIKCnN0YXJ0ZWRfYXQYByABKAkSFAoMY29tcGxldGVkX2F0GAggASgJEg0KBWVycm9yGAkgASgJEikKCG1ldGFkYXRhGAogASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBIUCgxhcnRpZmFjdF9pZHMYCyADKAkSEwoLY29zdF9taWNyb3MYDCABKAMSFAoMaW5wdXRfdG9rZW5zGA0gASgDEhUKDW91dHB1dF90b2tlbnMYDiABKAMSDwoHdWlfaGludBgPIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_approval,file_ai_stigmer_agentic_workflowexecution_v1_enum,file_ai_stigmer_agentic_workflowexecution_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_struct]),WorkflowExecutionSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_api,0),WorkflowExecutionStatusSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_api,1);var file_ai_stigmer_agentic_workflowinstance_v1_spec=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dpbnN0YW5jZS92MS9zcGVjLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MSKBAwoUV29ya2Zsb3dJbnN0YW5jZVNwZWMSHAoLd29ya2Zsb3dfaWQYASABKAlCB7pIBHICEAESEwoLZGVzY3JpcHRpb24YAiABKAkSyAEKEGVudmlyb25tZW50X3JlZnMYAyADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCeLpIcZIBbiJsugFpChVlbnZpcm9ubWVudF9yZWZzLmtpbmQSP2Vudmlyb25tZW50X3JlZnMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1lbnZpcm9ubWVudBoPdGhpcy5raW5kID09IDUz4IUsNRJrChRleGVjdXRpb25fdmlzaWJpbGl0eRgEIAEoDjJDLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93RXhlY3V0aW9uVmlzaWJpbGl0eUIIukgFggECEAEqpwEKG1dvcmtmbG93RXhlY3V0aW9uVmlzaWJpbGl0eRItCil3b3JrZmxvd19leGVjdXRpb25fdmlzaWJpbGl0eV91bnNwZWNpZmllZBAAEikKJXdvcmtmbG93X2V4ZWN1dGlvbl92aXNpYmlsaXR5X3ByaXZhdGUQARIuCip3b3JrZmxvd19leGVjdXRpb25fdmlzaWJpbGl0eV9vcmdhbml6YXRpb24QAmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]),WorkflowInstanceSpecSchema=messageDesc2(file_ai_stigmer_agentic_workflowinstance_v1_spec,0),WorkflowExecutionVisibility;(function(WorkflowExecutionVisibility2){WorkflowExecutionVisibility2[WorkflowExecutionVisibility2.unspecified=0]="unspecified",WorkflowExecutionVisibility2[WorkflowExecutionVisibility2.private=1]="private",WorkflowExecutionVisibility2[WorkflowExecutionVisibility2.organization=2]="organization"})(WorkflowExecutionVisibility||(WorkflowExecutionVisibility={}));var file_ai_stigmer_agentic_workflowinstance_v1_api=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dpbnN0YW5jZS92MS9hcGkucHJvdG8SJmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxIs8CChBXb3JrZmxvd0luc3RhbmNlEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiUKBGtpbmQYAiABKAlCF7pIFHISChBXb3JrZmxvd0luc3RhbmNlEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJKCgRzcGVjGAQgASgLMjwuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEuV29ya2Zsb3dJbnN0YW5jZVNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_workflowinstance_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),WorkflowInstanceSchema=messageDesc2(file_ai_stigmer_agentic_workflowinstance_v1_api,0);var file_ai_stigmer_iam_apikey_v1_spec=fileDesc("CiNhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvc3BlYy5wcm90bxIYYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxIoYBCgpBcGlLZXlTcGVjEhYKCGtleV9oYXNoGAEgASgJQgTIhSwBEhkKC2ZpbmdlcnByaW50GAIgASgJQgTIhSwBEi4KCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhUKDW5ldmVyX2V4cGlyZXMYBCABKAhiBnByb3RvMw",[file_ai_stigmer_commons_apiresource_field_options,file_google_protobuf_timestamp]);var file_ai_stigmer_iam_apikey_v1_api=fileDesc("CiJhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvYXBpLnByb3RvEhhhaS5zdGlnbWVyLmlhbS5hcGlrZXkudjEihwIKBkFwaUtleRItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEhsKBGtpbmQYAiABKAlCDbpICnIICgZBcGlLZXkSRQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YRIyCgRzcGVjGAQgASgLMiQuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleVNwZWMSNgoGc3RhdHVzGAUgASgLMiYuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleVN0YXR1cyKBAQoMQXBpS2V5U3RhdHVzEj8KBWF1ZGl0GGMgASgLMjAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXQSMAoMbGFzdF91c2VkX2F0GAEgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_apikey_v1_spec,file_buf_validate_validate,file_google_protobuf_timestamp]),ApiKeySchema=messageDesc2(file_ai_stigmer_iam_apikey_v1_api,0),ApiKeyStatusSchema=messageDesc2(file_ai_stigmer_iam_apikey_v1_api,1);var file_ai_stigmer_iam_iampolicy_v1_api=fileDesc("CiVhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvYXBpLnByb3RvEhthaS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEimQIKCUlhbVBvbGljeRItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEh4KBGtpbmQYAiABKAlCELpIDXILCglJYW1Qb2xpY3kSRQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YRI4CgRzcGVjGAQgASgLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMSPAoGc3RhdHVzGAUgASgLMiwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVN0YXR1cyJSCg9JYW1Qb2xpY3lTdGF0dXMSPwoFYXVkaXQYASABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_iampolicy_v1_spec,file_buf_validate_validate]),IamPolicySchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_api,0);var file_ai_stigmer_iam_identityprovider_v1_spec=fileDesc("Ci1haS9zdGlnbWVyL2lhbS9pZGVudGl0eXByb3ZpZGVyL3YxL3NwZWMucHJvdG8SImFpLnN0aWdtZXIuaWFtLmlkZW50aXR5cHJvdmlkZXIudjEixwQKFElkZW50aXR5UHJvdmlkZXJTcGVjEh4KDGRpc3BsYXlfbmFtZRgBIAEoCUIIukgFcgMYyAESGgoIandrc191cmkYAiABKAlCCLpIBXIDGIAQEhcKD2FsbG93ZWRfaXNzdWVycxgDIAMoCRIjChFleHBlY3RlZF9hdWRpZW5jZRgEIAEoCUIIukgFcgMYyAESGQoRcmF0ZV9saW1pdF9idWRnZXQYBSABKAUSIwoRdXNlcmluZm9fZW5kcG9pbnQYBiABKAlCCLpIBXIDGIAQEhcKD2lzX3Nzb19wcm92aWRlchgHIAEoCBIgCg5vaWRjX2NsaWVudF9pZBgIIAEoCUIIukgFcgMYgAISHwoXYXV0b19wcm92aXNpb25fYWNjb3VudHMYCSABKAgSGQoRYXV0b19ncmFudF9vbl9vcmcYCiABKAgSMwoPYXV0b19ncmFudF9yb2xlGAsgASgOMhouYWkuc3RpZ21lci5pYW0udjEuSWFtUm9sZRIiChB0ZW5hbnRfb3JnX2NsYWltGAwgASgJQgi6SAVyAxiAAjqkAbpIoAEanQEKK2lkZW50aXR5X3Byb3ZpZGVyLmF1dG9fZ3JhbnRfcm9sZV9ub3Rfb3duZXISU2F1dG9fZ3JhbnRfcm9sZSBjYW5ub3QgYmUgb3duZXI7IG9yZ2FuaXphdGlvbiBvd25lcnNoaXAgbXVzdCBiZSBhc3NpZ25lZCBleHBsaWNpdGx5Ghl0aGlzLmF1dG9fZ3JhbnRfcm9sZSAhPSAxYgZwcm90bzM",[file_ai_stigmer_iam_v1_enum,file_buf_validate_validate]);var file_ai_stigmer_iam_identityprovider_v1_api=fileDesc("CixhaS9zdGlnbWVyL2lhbS9pZGVudGl0eXByb3ZpZGVyL3YxL2FwaS5wcm90bxIiYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlwcm92aWRlci52MSLHAgoQSWRlbnRpdHlQcm92aWRlchItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEiUKBGtpbmQYAiABKAlCF7pIFHISChBJZGVudGl0eVByb3ZpZGVyEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJGCgRzcGVjGAQgASgLMjguYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlwcm92aWRlci52MS5JZGVudGl0eVByb3ZpZGVyU3BlYxJGCgZzdGF0dXMYBSABKAsyNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdFN0YXR1c2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_identityprovider_v1_spec,file_buf_validate_validate]),IdentityProviderSchema=messageDesc2(file_ai_stigmer_iam_identityprovider_v1_api,0);var file_ai_stigmer_iam_invitation_v1_enum=fileDesc("CidhaS9zdGlnbWVyL2lhbS9pbnZpdGF0aW9uL3YxL2VudW0ucHJvdG8SHGFpLnN0aWdtZXIuaWFtLmludml0YXRpb24udjEqbQoPSW52aXRhdGlvblN0YXRlEiAKHGludml0YXRpb25fc3RhdGVfdW5zcGVjaWZpZWQQABIKCgZhY3RpdmUQARILCgdleHBpcmVkEAISCwoHcmV2b2tlZBADEhIKDmZ1bGx5X3JlZGVlbWVkEARiBnByb3RvMw"),InvitationState;(function(InvitationState2){InvitationState2[InvitationState2.invitation_state_unspecified=0]="invitation_state_unspecified",InvitationState2[InvitationState2.active=1]="active",InvitationState2[InvitationState2.expired=2]="expired",InvitationState2[InvitationState2.revoked=3]="revoked",InvitationState2[InvitationState2.fully_redeemed=4]="fully_redeemed"})(InvitationState||(InvitationState={}));var file_ai_stigmer_iam_invitation_v1_spec=fileDesc("CidhaS9zdGlnbWVyL2lhbS9pbnZpdGF0aW9uL3YxL3NwZWMucHJvdG8SHGFpLnN0aWdtZXIuaWFtLmludml0YXRpb24udjEirAEKDkludml0YXRpb25TcGVjEjAKBHJvbGUYASABKA4yGi5haS5zdGlnbWVyLmlhbS52MS5JYW1Sb2xlQga6SAPIAQESFwoPbWF4X3JlZGVtcHRpb25zGAIgASgFEjYKCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQga6SAPIAQESFwoFbGFiZWwYBCABKAlCCLpIBXIDGMgBYgZwcm90bzM",[file_ai_stigmer_iam_v1_enum,file_buf_validate_validate,file_google_protobuf_timestamp]);var file_ai_stigmer_iam_invitation_v1_api=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9pbnZpdGF0aW9uL3YxL2FwaS5wcm90bxIcYWkuc3RpZ21lci5pYW0uaW52aXRhdGlvbi52MSKnAgoKSW52aXRhdGlvbhItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEh8KBGtpbmQYAiABKAlCEbpIDnIMCgpJbnZpdGF0aW9uEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARI6CgRzcGVjGAQgASgLMiwuYWkuc3RpZ21lci5pYW0uaW52aXRhdGlvbi52MS5JbnZpdGF0aW9uU3BlYxI+CgZzdGF0dXMYBSABKAsyLi5haS5zdGlnbWVyLmlhbS5pbnZpdGF0aW9uLnYxLkludml0YXRpb25TdGF0dXMigwIKEEludml0YXRpb25TdGF0dXMSDQoFdG9rZW4YASABKAkSPAoFc3RhdGUYAiABKA4yLS5haS5zdGlnbWVyLmlhbS5pbnZpdGF0aW9uLnYxLkludml0YXRpb25TdGF0ZRIYChByZWRlbXB0aW9uX2NvdW50GAMgASgFEkcKC3JlZGVtcHRpb25zGAQgAygLMjIuYWkuc3RpZ21lci5pYW0uaW52aXRhdGlvbi52MS5JbnZpdGF0aW9uUmVkZW1wdGlvbhI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0ImQKFEludml0YXRpb25SZWRlbXB0aW9uEhsKE2lkZW50aXR5X2FjY291bnRfaWQYASABKAkSLwoLcmVkZWVtZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_invitation_v1_enum,file_ai_stigmer_iam_invitation_v1_spec,file_buf_validate_validate,file_google_protobuf_timestamp]),InvitationSchema=messageDesc2(file_ai_stigmer_iam_invitation_v1_api,0);var file_ai_stigmer_iam_oauthapp_v1_api=fileDesc("CiRhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9hcGkucHJvdG8SGmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxIqcCCghPQXV0aEFwcBItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEh0KBGtpbmQYAiABKAlCD7pIDHIKCghPQXV0aEFwcBJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESNgoEc3BlYxgEIAEoCzIoLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwU3BlYxJGCgZzdGF0dXMYBSABKAsyNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdFN0YXR1c2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_oauthapp_v1_spec,file_buf_validate_validate]),OAuthAppSchema=messageDesc2(file_ai_stigmer_iam_oauthapp_v1_api,0);var file_ai_stigmer_iam_platformclient_v1_spec=fileDesc("CithaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9zcGVjLnByb3RvEiBhaS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MSKQBwoSUGxhdGZvcm1DbGllbnRTcGVjEhcKCWNsaWVudF9pZBgBIAEoCUIEyIUsARIgChJjbGllbnRfc2VjcmV0X2hhc2gYAiABKAlCBMiFLAESIAoSc2VjcmV0X2ZpbmdlcnByaW50GAMgASgJQgTIhSwBEi4KCmV4cGlyZXNfYXQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhUKDW5ldmVyX2V4cGlyZXMYBSABKAgSHwoXYXV0b19wcm92aXNpb25fYWNjb3VudHMYBiABKAgSGQoRYXV0b19ncmFudF9vbl9vcmcYByABKAgSMwoPYXV0b19ncmFudF9yb2xlGAggASgOMhouYWkuc3RpZ21lci5pYW0udjEuSWFtUm9sZRIXCg9hbGxvd2VkX29yaWdpbnMYCSADKAkSyAEKEGVudmlyb25tZW50X3JlZnMYCiADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCeLpIcZIBbiJsugFpChVlbnZpcm9ubWVudF9yZWZzLmtpbmQSP2Vudmlyb25tZW50X3JlZnMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1lbnZpcm9ubWVudBoPdGhpcy5raW5kID09IDUz4IUsNTqAA7pI/AIa2wEKMnBsYXRmb3JtX2NsaWVudC5hdXRvX2dyYW50X3JlcXVpcmVzX2F1dG9fcHJvdmlzaW9uEmxhdXRvX2dyYW50X29uX29yZyByZXF1aXJlcyBhdXRvX3Byb3Zpc2lvbl9hY2NvdW50czogb25seSBhbiBhY2NvdW50IHRoZSBjbGllbnQgcHJvdmlzaW9ucyByZWNlaXZlcyB0aGUgZ3JhbnQaNyF0aGlzLmF1dG9fZ3JhbnRfb25fb3JnIHx8IHRoaXMuYXV0b19wcm92aXNpb25fYWNjb3VudHMamwEKKXBsYXRmb3JtX2NsaWVudC5hdXRvX2dyYW50X3JvbGVfbm90X293bmVyElNhdXRvX2dyYW50X3JvbGUgY2Fubm90IGJlIG93bmVyOyBvcmdhbml6YXRpb24gb3duZXJzaGlwIG11c3QgYmUgYXNzaWduZWQgZXhwbGljaXRseRoZdGhpcy5hdXRvX2dyYW50X3JvbGUgIT0gMWIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_iam_v1_enum,file_buf_validate_validate,file_google_protobuf_timestamp]),PlatformClientSpecSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_spec,0);var file_ai_stigmer_iam_platformclient_v1_api=fileDesc("CiphaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9hcGkucHJvdG8SIGFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxIr8CCg5QbGF0Zm9ybUNsaWVudBItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEiMKBGtpbmQYAiABKAlCFbpIEnIQCg5QbGF0Zm9ybUNsaWVudBJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESQgoEc3BlYxgEIAEoCzI0LmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50U3BlYxJGCgZzdGF0dXMYBSABKAsyNi5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5QbGF0Zm9ybUNsaWVudFN0YXR1cyKJAQoUUGxhdGZvcm1DbGllbnRTdGF0dXMSPwoFYXVkaXQYYyABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdBIwCgxsYXN0X3VzZWRfYXQYASABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_platformclient_v1_spec,file_buf_validate_validate,file_google_protobuf_timestamp]),PlatformClientSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_api,0),PlatformClientStatusSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_api,1);var file_ai_stigmer_iam_team_v1_spec=fileDesc("CiFhaS9zdGlnbWVyL2lhbS90ZWFtL3YxL3NwZWMucHJvdG8SFmFpLnN0aWdtZXIuaWFtLnRlYW0udjEiKQoIVGVhbVNwZWMSHQoLZGVzY3JpcHRpb24YASABKAlCCLpIBXIDGPQDYgZwcm90bzM",[file_buf_validate_validate]);var file_ai_stigmer_iam_team_v1_api=fileDesc("CiBhaS9zdGlnbWVyL2lhbS90ZWFtL3YxL2FwaS5wcm90bxIWYWkuc3RpZ21lci5pYW0udGVhbS52MSKXAgoEVGVhbRItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEhkKBGtpbmQYAiABKAlCC7pICHIGCgRUZWFtEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARIuCgRzcGVjGAQgASgLMiAuYWkuc3RpZ21lci5pYW0udGVhbS52MS5UZWFtU3BlYxJGCgZzdGF0dXMYBSABKAsyNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdFN0YXR1c2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_team_v1_spec,file_buf_validate_validate]),TeamSchema=messageDesc2(file_ai_stigmer_iam_team_v1_api,0);function defaultOfBlueprint(blueprint){let blueprintType=kindEnumName(blueprint.kind);return async(object,row,loader2)=>{let blueprintId=parentIdOf(row,blueprintSpecFieldOf(object.type,blueprint.kind));if(blueprintId==="")return[];let loaded=await loader2.load({type:blueprintType,id:blueprintId});return loaded===void 0||!isMessage2(loaded,blueprint.schema)||blueprint.defaultInstanceIdOf(loaded)!==object.id?[]:[{object,relation:"default_of",subject:{form:"object",object:{type:blueprintType,id:blueprintId}}}]}}function blueprintSpecFieldOf(instanceType,blueprintKind){let instanceKind=kindByEnumName(instanceType),entry=getKindMeta(instanceKind).authorization?.additionalParents?.find(parent=>getKindEnum(parent.kind)===blueprintKind);if(entry===void 0)throw new Error(`${instanceType} declares default_of but kind_meta names no ${kindEnumName(blueprintKind)} parent`);return entry.specField}var executionViewer=(object,row)=>{if(!isMessage2(row,WorkflowInstanceSchema))return Promise.resolve([]);let level=row.spec?.executionVisibility??WorkflowExecutionVisibility.unspecified;switch(level){case WorkflowExecutionVisibility.organization:{let org=row.metadata?.org??"";return Promise.resolve(org===""?[]:[{object,relation:"execution_viewer",subject:{form:"userset",object:{type:"organization",id:org},relation:"viewer"}}])}case WorkflowExecutionVisibility.private:case WorkflowExecutionVisibility.unspecified:return Promise.resolve([]);default:{let exhaustive=level;throw new Error(`unknown execution visibility: ${String(exhaustive)}`)}}};var ROWLESS=void 0,KIND_BINDINGS=new Map([[ApiResourceKind.platform,{schema:ROWLESS}],[ApiResourceKind.identity_account,{schema:IdentityAccountSchema}],[ApiResourceKind.identity_provider,{schema:IdentityProviderSchema}],[ApiResourceKind.iam_policy,{schema:IamPolicySchema}],[ApiResourceKind.api_key,{schema:ApiKeySchema}],[ApiResourceKind.oauth_app,{schema:OAuthAppSchema}],[ApiResourceKind.platform_client,{schema:PlatformClientSchema}],[ApiResourceKind.invitation,{schema:InvitationSchema}],[ApiResourceKind.team,{schema:TeamSchema}],[ApiResourceKind.organization,{schema:OrganizationSchema}],[ApiResourceKind.agent,{schema:AgentSchema}],[ApiResourceKind.agent_channel,{schema:AgentChannelSchema}],[ApiResourceKind.agent_share,{schema:AgentShareSchema}],[ApiResourceKind.channel_app,{schema:ChannelAppSchema}],[ApiResourceKind.agent_instance,{schema:AgentInstanceSchema,derived:{default_of:defaultOfBlueprint({kind:ApiResourceKind.agent,schema:AgentSchema,defaultInstanceIdOf:agent=>agent.status?.defaultInstanceId??""})}}],[ApiResourceKind.agent_execution,{schema:AgentExecutionSchema}],[ApiResourceKind.artifact,{schema:ArtifactSchema}],[ApiResourceKind.environment,{schema:EnvironmentSchema}],[ApiResourceKind.execution_context,{schema:ExecutionContextSchema}],[ApiResourceKind.mcp_server,{schema:McpServerSchema}],[ApiResourceKind.memory,{schema:MemorySchema}],[ApiResourceKind.plugin,{schema:PluginSchema}],[ApiResourceKind.schedule,{schema:ScheduleSchema}],[ApiResourceKind.session,{schema:SessionSchema}],[ApiResourceKind.skill,{schema:SkillSchema}],[ApiResourceKind.workflow,{schema:WorkflowSchema}],[ApiResourceKind.workflow_instance,{schema:WorkflowInstanceSchema,derived:{default_of:defaultOfBlueprint({kind:ApiResourceKind.workflow,schema:WorkflowSchema,defaultInstanceIdOf:workflow=>workflow.status?.defaultInstanceId??""}),execution_viewer:executionViewer}}],[ApiResourceKind.workflow_execution,{schema:WorkflowExecutionSchema}]]);var authorization_model_default={schema_version:"1.2",type_definitions:[{metadata:{module:"stigmer",relations:{can_bootstrap_iam:{},can_execute_billing_ops:{},can_grant_access:{},can_impersonate:{},can_issue_license:{},can_manage_credits:{},can_manage_cursor_accounts:{},can_manage_identity_accounts:{},can_manage_model_pricing:{},can_manage_plans:{},can_update_usage:{},can_view_access:{},can_view_provider_standing:{},can_write_reserved_labels:{},credit_issuer:{directly_related_user_types:[{type:"identity_account"}]},operator:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"platform.fga"}},relations:{can_bootstrap_iam:{computedUserset:{relation:"operator"}},can_execute_billing_ops:{computedUserset:{relation:"operator"}},can_grant_access:{computedUserset:{relation:"operator"}},can_impersonate:{computedUserset:{relation:"operator"}},can_issue_license:{computedUserset:{relation:"operator"}},can_manage_credits:{union:{child:[{computedUserset:{relation:"operator"}},{computedUserset:{relation:"credit_issuer"}}]}},can_manage_cursor_accounts:{computedUserset:{relation:"operator"}},can_manage_identity_accounts:{computedUserset:{relation:"operator"}},can_manage_model_pricing:{computedUserset:{relation:"operator"}},can_manage_plans:{computedUserset:{relation:"operator"}},can_update_usage:{computedUserset:{relation:"operator"}},can_view_access:{computedUserset:{relation:"operator"}},can_view_provider_standing:{computedUserset:{relation:"operator"}},can_write_reserved_labels:{computedUserset:{relation:"operator"}},credit_issuer:{this:{}},operator:{this:{}}},type:"platform"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},owner:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"iam/identity_account.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"owner"}},can_view_access:{computedUserset:{relation:"owner"}},owner:{this:{}}},type:"identity_account"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},managed_org:{directly_related_user_types:[{type:"organization"}]},organization:{directly_related_user_types:[{type:"organization"}]},owner:{},platform_user:{},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"iam/identity_provider.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},managed_org:{this:{}},organization:{this:{}},owner:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}},platform_user:{tupleToUserset:{computedUserset:{relation:"member"},tupleset:{relation:"managed_org"}}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}}},type:"identity_provider"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{}},source_info:{file:"iam/iam_policy.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},viewer:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}},type:"iam_policy"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_revoke:{},can_rotate:{},can_use:{},can_view:{},can_view_access:{},owner:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"iam/api_key.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_revoke:{computedUserset:{relation:"owner"}},can_rotate:{computedUserset:{relation:"owner"}},can_use:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"owner"}},can_view_access:{computedUserset:{relation:"owner"}},owner:{this:{}}},type:"api_key"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"iam/oauth_app.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}}},type:"oauth_app"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"iam/platform_client.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}}},type:"platform_client"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_view:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{},viewer:{}},source_info:{file:"iam/invitation.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}},viewer:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}},type:"invitation"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},member:{directly_related_user_types:[{type:"identity_account"}]},organization:{directly_related_user_types:[{type:"organization"}]},viewer:{}},source_info:{file:"iam/team.fga"}},relations:{can_delete:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}},can_edit:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}},can_grant_access:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},member:{intersection:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"organization"}}}]}},organization:{this:{}},viewer:{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"organization"}}}},type:"team"},{metadata:{module:"tenancy",relations:{admin:{directly_related_user_types:[{type:"identity_account"}]},can_assign_roles:{},can_create_agent:{},can_create_agent_instance:{},can_create_agent_share:{},can_create_channel_app:{},can_create_environment:{},can_create_execution_in:{},can_create_identity_account:{},can_create_idp:{},can_create_mcp_server:{},can_create_oauth_app:{},can_create_platform_client:{},can_create_plugin:{},can_create_session:{},can_create_skill:{},can_create_team:{},can_create_workflow:{},can_delete:{},can_edit:{},can_grant_access:{},can_manage_billing:{},can_manage_members:{},can_view:{},can_view_access:{},can_view_billing:{},guest:{directly_related_user_types:[{type:"identity_account"}]},member:{directly_related_user_types:[{type:"identity_account"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"tenancy/organization.fga"}},relations:{admin:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}},can_assign_roles:{computedUserset:{relation:"owner"}},can_create_agent:{computedUserset:{relation:"admin"}},can_create_agent_instance:{computedUserset:{relation:"member"}},can_create_agent_share:{computedUserset:{relation:"admin"}},can_create_channel_app:{computedUserset:{relation:"admin"}},can_create_environment:{computedUserset:{relation:"member"}},can_create_execution_in:{union:{child:[{computedUserset:{relation:"member"}},{computedUserset:{relation:"guest"}}]}},can_create_identity_account:{computedUserset:{relation:"admin"}},can_create_idp:{computedUserset:{relation:"admin"}},can_create_mcp_server:{computedUserset:{relation:"admin"}},can_create_oauth_app:{computedUserset:{relation:"admin"}},can_create_platform_client:{computedUserset:{relation:"admin"}},can_create_plugin:{computedUserset:{relation:"admin"}},can_create_session:{union:{child:[{computedUserset:{relation:"member"}},{computedUserset:{relation:"guest"}}]}},can_create_skill:{computedUserset:{relation:"admin"}},can_create_team:{computedUserset:{relation:"admin"}},can_create_workflow:{computedUserset:{relation:"admin"}},can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"admin"}},can_grant_access:{computedUserset:{relation:"admin"}},can_manage_billing:{computedUserset:{relation:"admin"}},can_manage_members:{computedUserset:{relation:"admin"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},can_view_billing:{computedUserset:{relation:"viewer"}},guest:{this:{}},member:{union:{child:[{this:{}},{computedUserset:{relation:"admin"}}]}},owner:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"member"}}]}}},type:"organization"},{metadata:{module:"agentic",relations:{can_clone:{},can_create_instance:{},can_delete:{},can_edit:{},can_execute:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},platform_viewer:{directly_related_user_types:[{relation:"platform_user",type:"identity_provider"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/agent.fga"}},relations:{can_clone:{computedUserset:{relation:"viewer"}},can_create_instance:{computedUserset:{relation:"can_execute"}},can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_execute:{computedUserset:{relation:"viewer"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},platform_viewer:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{computedUserset:{relation:"platform_viewer"}}]}}},type:"agent"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_participate:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},participant:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"team"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/agent_channel.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_participate:{computedUserset:{relation:"participant"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},participant:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"participant"}}]}}},type:"agent_channel"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"agentic/agent_share.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}}},type:"agent_share"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"agentic/channel_app.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}}},type:"channel_app"},{metadata:{module:"agentic",relations:{agent:{directly_related_user_types:[{type:"agent"}]},can_delete:{},can_edit:{},can_execute:{},can_grant_access:{},can_view:{},can_view_access:{},default_of:{directly_related_user_types:[{type:"agent"}]},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/agent_instance.fga"}},relations:{agent:{this:{}},can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_execute:{computedUserset:{relation:"can_view"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},default_of:{this:{}},organization:{this:{}},owner:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"default_of"}}}]}}},type:"agent_instance"},{metadata:{module:"agentic",relations:{can_edit:{},can_view:{},owner:{},session:{directly_related_user_types:[{type:"session"}]},viewer:{}},source_info:{file:"agentic/agent_execution.fga"}},relations:{can_edit:{computedUserset:{relation:"owner"}},can_view:{union:{child:[{computedUserset:{relation:"viewer"}},{tupleToUserset:{computedUserset:{relation:"can_view"},tupleset:{relation:"session"}}}]}},owner:{tupleToUserset:{computedUserset:{relation:"owner"},tupleset:{relation:"session"}}},session:{this:{}},viewer:{union:{child:[{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"session"}}},{computedUserset:{relation:"owner"}}]}}},type:"agent_execution"},{metadata:{module:"agentic",relations:{can_edit:{},can_view:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"agentic/artifact.fga"}},relations:{can_edit:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}},can_view:{union:{child:[{computedUserset:{relation:"owner"}},{computedUserset:{relation:"viewer"}}]}},organization:{this:{}},owner:{this:{}},viewer:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"organization"}}}]}}},type:"artifact"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_read_secrets:{},can_view:{},can_view_access:{},creator:{directly_related_user_types:[{type:"identity_account"}]},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"}]}},source_info:{file:"agentic/environment.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_read_secrets:{computedUserset:{relation:"creator"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},creator:{this:{}},organization:{this:{}},owner:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}}},type:"environment"},{metadata:{module:"agentic",relations:{can_edit:{},can_view:{},owner:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"agentic/execution_context.fga"}},relations:{can_edit:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"owner"}},owner:{this:{}}},type:"execution_context"},{metadata:{module:"agentic",relations:{can_clone:{},can_connect:{},can_delete:{},can_edit:{},can_grant_access:{},can_use:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},platform_viewer:{directly_related_user_types:[{relation:"platform_user",type:"identity_provider"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/mcp_server.fga"}},relations:{can_clone:{computedUserset:{relation:"viewer"}},can_connect:{computedUserset:{relation:"viewer"}},can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_use:{computedUserset:{relation:"viewer"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},platform_viewer:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{computedUserset:{relation:"platform_viewer"}}]}}},type:"mcp_server"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_view:{},organization:{directly_related_user_types:[{type:"organization"}]},subject:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"agentic/memory.fga"}},relations:{can_delete:{computedUserset:{relation:"subject"}},can_edit:{computedUserset:{relation:"subject"}},can_view:{computedUserset:{relation:"subject"}},organization:{this:{}},subject:{this:{}}},type:"memory"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_use:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},platform_viewer:{directly_related_user_types:[{relation:"platform_user",type:"identity_provider"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/plugin.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_use:{computedUserset:{relation:"viewer"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},platform_viewer:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{computedUserset:{relation:"platform_viewer"}}]}}},type:"plugin"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/schedule.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}}},type:"schedule"},{metadata:{module:"agentic",relations:{agent_instance:{directly_related_user_types:[{type:"agent_instance"}]},can_create_execution_in:{},can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},channel:{directly_related_user_types:[{type:"agent_channel"}]},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},schedule:{directly_related_user_types:[{type:"schedule"}]},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"agentic/session.fga"}},relations:{agent_instance:{this:{}},can_create_execution_in:{computedUserset:{relation:"viewer"}},can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{union:{child:[{computedUserset:{relation:"viewer"}},{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"channel"}}},{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"schedule"}}}]}},can_view_access:{computedUserset:{relation:"viewer"}},channel:{this:{}},organization:{this:{}},owner:{this:{}},schedule:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}}},type:"session"},{metadata:{module:"agentic",relations:{can_clone:{},can_delete:{},can_edit:{},can_grant_access:{},can_use:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},platform_viewer:{directly_related_user_types:[{relation:"platform_user",type:"identity_provider"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/skill.fga"}},relations:{can_clone:{computedUserset:{relation:"viewer"}},can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_use:{computedUserset:{relation:"viewer"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},platform_viewer:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{computedUserset:{relation:"platform_viewer"}}]}}},type:"skill"},{metadata:{module:"agentic",relations:{can_clone:{},can_delete:{},can_edit:{},can_execute:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},platform_viewer:{directly_related_user_types:[{relation:"platform_user",type:"identity_provider"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/workflow.fga"}},relations:{can_clone:{computedUserset:{relation:"viewer"}},can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_execute:{computedUserset:{relation:"viewer"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},platform_viewer:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{computedUserset:{relation:"platform_viewer"}}]}}},type:"workflow"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_execute:{},can_grant_access:{},can_view:{},can_view_access:{},default_of:{directly_related_user_types:[{type:"workflow"}]},execution_viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"}]},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"},{relation:"member",type:"team"}]},workflow:{directly_related_user_types:[{type:"workflow"}]}},source_info:{file:"agentic/workflow_instance.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_execute:{computedUserset:{relation:"can_view"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},default_of:{this:{}},execution_viewer:{this:{}},organization:{this:{}},owner:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"default_of"}}}]}},workflow:{this:{}}},type:"workflow_instance"},{metadata:{module:"agentic",relations:{can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"team"}]},workflow_instance:{directly_related_user_types:[{type:"workflow_instance"}]}},source_info:{file:"agentic/workflow_execution.fga"}},relations:{can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{tupleToUserset:{computedUserset:{relation:"execution_viewer"},tupleset:{relation:"workflow_instance"}}}]}},workflow_instance:{this:{}}},type:"workflow_execution"}]};function record(value,where,allowedKeys){if(value===null||typeof value!="object"||Array.isArray(value))throw new Error(`${where}: expected a mapping`);let entry=value;if(allowedKeys!==void 0){for(let key of Object.keys(entry))if(!allowedKeys.includes(key))throw new Error(`${where}: unknown key '${key}'`)}return entry}function list(value,where){if(!Array.isArray(value))throw new Error(`${where}: expected a list`);return value}function text(value,where){if(typeof value!="string")throw new Error(`${where}: expected a string`);return value}var SUPPORTED_SCHEMA_VERSION="1.2",MODEL_SOURCE_DIR="fga/model";function readOpenFgaModel(value,where="authorization-model.json"){let root5=record(value,where,["schema_version","type_definitions","conditions"]);if(root5.conditions!==void 0)throw new Error(`${where}: conditions are not evaluated by this server`);let version=text(root5.schema_version,`${where}: schema_version`);if(version!==SUPPORTED_SCHEMA_VERSION)throw new Error(`${where}: schema_version '${version}' is not ${SUPPORTED_SCHEMA_VERSION}, the only version this server reads`);let types3=[],seen=new Set;return list(root5.type_definitions,`${where}: type_definitions`).forEach((entry,index2)=>{let parsed=readType(entry,`${where}: type_definitions[${index2}]`);if(seen.has(parsed.type))throw new Error(`${where}: type '${parsed.type}' is defined twice`);seen.add(parsed.type),types3.push(parsed)}),assertReferencesResolve(types3,where),types3}function readType(value,where){let entry=record(value,where,["type","relations","metadata"]),type2=text(entry.type,`${where}.type`),at2=`${where} (${type2})`,metadata=record(entry.metadata,`${at2}.metadata`,["module","relations","source_info"]);text(metadata.module,`${at2}.metadata.module`);let sourceInfo=record(metadata.source_info,`${at2}.metadata.source_info`,["file"]),file=text(sourceInfo.file,`${at2}.metadata.source_info.file`),directTypes=readDirectTypes(metadata.relations,`${at2}.metadata.relations`),rewrites=entry.relations===void 0?{}:record(entry.relations,`${at2}.relations`);for(let relation of directTypes.keys())if(!(relation in rewrites))throw new Error(`${at2}.metadata.relations.${relation}: metadata for a relation ${type2} does not define`);let relations=new Map;for(let name of Object.keys(rewrites).sort()){let subjects=directTypes.get(name),rewrite=readRewrite(rewrites[name],`${at2}.relations.${name}`,subjects),hasThis=containsThis(rewrite);if(hasThis&&subjects===void 0)throw new Error(`${at2}.relations.${name}: a direct relation with no directly_related_user_types`);if(!hasThis&&subjects!==void 0)throw new Error(`${at2}.relations.${name}: directly_related_user_types on a relation with no direct node`);relations.set(name,rewrite)}return{type:type2,source:`${MODEL_SOURCE_DIR}/${file}`,relations}}function readDirectTypes(value,where){let out=new Map;if(value===void 0)return out;for(let[relation,meta]of Object.entries(record(value,where))){let entry=record(meta,`${where}.${relation}`,["directly_related_user_types"]);if(entry.directly_related_user_types===void 0)continue;let at2=`${where}.${relation}.directly_related_user_types`;out.set(relation,list(entry.directly_related_user_types,at2).map((item,index2)=>readSubjectType(item,`${at2}[${index2}]`)))}return out}function readSubjectType(value,where){let entry=record(value,where,["type","relation","wildcard","condition"]);if(entry.wildcard!==void 0)throw new Error(`${where}: wildcard subject types are not evaluated by this server`);if(entry.condition!==void 0)throw new Error(`${where}: conditional subject types are not evaluated by this server`);let type2=text(entry.type,`${where}.type`);return entry.relation===void 0?{form:"object",type:type2}:{form:"userset",type:type2,relation:text(entry.relation,`${where}.relation`)}}function readRewrite(value,where,subjects){let node=record(value,where,["this","computedUserset","tupleToUserset","union","intersection","difference"]),keys=Object.keys(node);if(keys.length!==1)throw new Error(`${where}: a rewrite node has exactly one form, found ${keys.length}`);let form=keys[0];switch(form){case"this":return record(node.this,`${where}.this`,[]),{node:"this",subjects:subjects??[]};case"computedUserset":return{node:"computed",relation:localRelation(node.computedUserset,`${where}.computedUserset`)};case"tupleToUserset":{let ttu=record(node.tupleToUserset,`${where}.tupleToUserset`,["tupleset","computedUserset"]);return{node:"from",tupleset:localRelation(ttu.tupleset,`${where}.tupleToUserset.tupleset`),relation:localRelation(ttu.computedUserset,`${where}.tupleToUserset.computedUserset`)}}case"union":case"intersection":{let operator=record(node[form],`${where}.${form}`,["child"]),members=list(operator.child,`${where}.${form}.child`).map((child,index2)=>readRewrite(child,`${where}.${form}.child[${index2}]`,subjects));if(members.length===0)throw new Error(`${where}.${form}: an operator with no children`);return{node:form,members}}case"difference":throw new Error(`${where}: 'but not' (difference) is not evaluated by this server`);default:throw new Error(`${where}: unknown rewrite form '${String(form)}'`)}}function localRelation(value,where){let entry=record(value,where,["relation","object"]);if(entry.object!==void 0)throw new Error(`${where}: a relation on another object is not evaluated by this server`);return text(entry.relation,`${where}.relation`)}function containsThis(rewrite){switch(rewrite.node){case"this":return!0;case"computed":case"from":return!1;case"union":case"intersection":return rewrite.members.some(containsThis);default:{let exhaustive=rewrite;throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`)}}}function assertReferencesResolve(types3,where){let byType=new Map(types3.map(entry=>[entry.type,entry]));for(let entry of types3)for(let[name,rewrite]of entry.relations){let at2=`${where}: ${entry.type}#${name}`;walk(rewrite,node=>{switch(node.node){case"computed":if(!entry.relations.has(node.relation))throw new Error(`${at2}: names relation '${node.relation}', which ${entry.type} does not define`);return;case"from":if(!entry.relations.has(node.tupleset))throw new Error(`${at2}: names tupleset '${node.tupleset}', which ${entry.type} does not define`);return;case"this":for(let subject of node.subjects){let target=byType.get(subject.type);if(target===void 0)throw new Error(`${at2}: admits subject type '${subject.type}', which the model does not define`);if(subject.form==="userset"&&!target.relations.has(subject.relation))throw new Error(`${at2}: admits '${subject.type}#${subject.relation}', which ${subject.type} does not define`)}return;case"union":case"intersection":return;default:{let exhaustive=node;throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`)}}})}}function walk(rewrite,visit2){if(visit2(rewrite),rewrite.node==="union"||rewrite.node==="intersection")for(let member2 of rewrite.members)walk(member2,visit2)}function newModel(declarations){let byKind=new Map,byType=new Map;for(let declaration of declarations){if(byKind.has(declaration.kind))throw new Error(`${declaration.type} is declared twice in the model`);byKind.set(declaration.kind,declaration),byType.set(declaration.type,declaration)}return{declarations,byKind:kind=>byKind.get(kind),byType:type2=>byType.get(type2)}}function bindModel(types3,bindings){let bound=new Set,declarations=types3.map(entry=>{let kind=kindByEnumName(entry.type);if(kind===ApiResourceKind.api_resource_kind_unknown)throw new Error(`${entry.source}: type '${entry.type}' names no ApiResourceKind`);let binding=bindings.get(kind);if(binding===void 0)throw new Error(`${entry.source}: type '${entry.type}' has no binding (model/bindings.ts)`);bound.add(kind);let derived=new Map;for(let[relation,rule]of Object.entries(binding.derived??{})){if(!entry.relations.has(relation))throw new Error(`model/bindings.ts: a derived rule for '${entry.type}#${relation}', which ${entry.source} does not define`);derived.set(relation,rule)}return{kind,type:entry.type,schema:binding.schema,source:entry.source,relations:entry.relations,derived}});for(let kind of bindings.keys())if(!bound.has(kind))throw new Error(`model/bindings.ts: a binding for '${ApiResourceKind[kind]}', which the model does not define`);return declarations}var builtInModel=newModel(bindModel(readOpenFgaModel(authorization_model_default),KIND_BINDINGS));var ACCOUNT_TYPE="identity_account";function formatObjectRef(object){return`${object.type}:${object.id}`}function pairKey(object,relation){return`${formatObjectRef(object)}#${relation}`}var ROW_RECORDED_OWNER_KINDS=new Set([ApiResourceKind.organization]),TEAM_TYPE=kindEnumName(ApiResourceKind.team),TEAM_MEMBER_RELATION="member";function account(id){return{form:"object",object:{type:ACCOUNT_TYPE,id}}}function deriveTuples(facts){let object={type:kindEnumName(facts.kind),id:facts.id},config2=getKindMeta(facts.kind).authorization;if(config2===void 0)return[];let tuples=[];for(let link of facts.parentLinks)tuples.push({object,relation:link.relation,subject:{form:"object",object:{type:kindEnumName(link.parentKind),id:link.parentId}}});let stampIsPerson=isPersonStamp(facts.createdBy);switch(config2.ownerType){case OwnerAttributionType.DIRECT:stampIsPerson&&!ROW_RECORDED_OWNER_KINDS.has(facts.kind)&&tuples.push({object,relation:"owner",subject:account(facts.createdBy)});break;case OwnerAttributionType.SELF:tuples.push({object,relation:"owner",subject:account(facts.id)});break;case OwnerAttributionType.INHERITED:case OwnerAttributionType.NONE:case OwnerAttributionType.UNSPECIFIED:break;default:{let exhaustive=config2.ownerType;throw new Error(`unknown owner attribution: ${String(exhaustive)}`)}}config2.requiresCreatorTuple&&stampIsPerson&&tuples.push({object,relation:"creator",subject:account(facts.createdBy)});for(let shape of visibilityShapesFor(facts.kind,facts.visibility)){let subject=visibilitySubject(shape,facts.org);subject!==void 0&&tuples.push({object,relation:"viewer",subject})}return tuples}function visibilitySubject(shape,org){switch(shape){case"org-viewer":return org===""?void 0:{form:"userset",object:{type:"organization",id:org},relation:"viewer"};case"platform-viewer":return;default:{let exhaustive=shape;throw new Error(`unknown visibility shape: ${String(exhaustive)}`)}}}function newDerivedTupleSource(deps,person,seed){let model=deps.model??builtInModel,rows=new Map,derived=new Map,seeded=new Map;for(let facts of seed?.facts??[])seeded.set(formatObjectRef({type:kindEnumName(facts.kind),id:facts.id}),facts);let personRows,reachableRows,loader2={load(object){let key=formatObjectRef(object),held=rows.get(key);if(held!==void 0)return held;let loading=loadRow(deps,model,object);return rows.set(key,loading),loading}};function derivedTuplesOf(object){let key=formatObjectRef(object),held=derived.get(key);if(held!==void 0)return held;let declaration=model.byType(object.type),known=seeded.get(key),deriving;return declaration===void 0?deriving=Promise.resolve([]):known!==void 0?deriving=Promise.resolve(deriveTuples(known)):deriving=loader2.load(object).then(row=>row===void 0?[]:deriveTuples(rowFactsOf(declaration.kind,row))),derived.set(key,deriving),deriving}function rowTuples(){return personRows===void 0&&(personRows=deps.policies.findByPrincipal(ACCOUNT_TYPE,person.accountId).then(found=>found.map(tupleOfRow))),personRows}function reachableTuples(){return reachableRows===void 0&&(reachableRows=rowTuples().then(async own=>{let teams=new Set;for(let tuple of own)tuple.object.type===TEAM_TYPE&&tuple.relation===TEAM_MEMBER_RELATION&&tuple.object.id!==""&&teams.add(tuple.object.id);let granted=await Promise.all([...teams].map(team=>deps.policies.findByPrincipal(TEAM_TYPE,team)));return indexByPair([...own,...granted.flat().map(tupleOfRow)])})),reachableRows}return{loader:loader2,personTuples:rowTuples,async tuplesOf(object,relation){let onPair=tuple=>tuple.relation===relation&&tuple.object.type===object.type&&tuple.object.id===object.id,fromRows=(await reachableTuples()).get(pairKey2(object,relation))??[],declaration=model.byType(object.type);if(declaration===void 0)return fromRows;let fromRow=(await derivedTuplesOf(object)).filter(onPair),rule=declaration.derived.get(relation);if(rule===void 0)return[...fromRows,...fromRow];let row=await loader2.load(object),fromRule=row===void 0?[]:await rule(object,row,loader2);return[...fromRows,...fromRow,...fromRule]}}}async function loadRow(deps,model,object){let declaration=model.byType(object.type),kind=kindByEnumName(object.type);if(!(declaration===void 0||declaration.schema===void 0||kind===ApiResourceKind.api_resource_kind_unknown||object.id==="")){if(kind===ApiResourceKind.identity_account)return deps.accounts.findById(object.id);try{return await deps.store.getResource(kind,object.id,declaration.schema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}}function pairKey2(object,relation){return`${formatObjectRef(object)}#${relation}`}function indexByPair(tuples){let index2=new Map;for(let tuple of tuples){let key=pairKey2(tuple.object,tuple.relation),held=index2.get(key);held===void 0?index2.set(key,[tuple]):held.push(tuple)}return index2}function tupleOfRow(row){let spec=row.spec,principal=spec?.principal,resource=spec?.resource,object={type:resource?.kind??"",id:resource?.id??""},principalObject={type:principal?.kind??"",id:principal?.id??""},subject=principal!==void 0&&principal.relation!==""?{form:"userset",object:principalObject,relation:principal.relation}:{form:"object",object:principalObject};return{object,relation:spec?.relation??"",subject}}var MAX_RESOLUTION_DEPTH=25,AuthorizationEvaluationError=class extends Error{reason;constructor(reason,message6){super(message6),this.name="AuthorizationEvaluationError",this.reason=reason}};async function checkRelation(deps,object,relation,person){if(deps.model.byType(object.type)===void 0)throw new AuthorizationEvaluationError("undeclared-target-kind",`no declaration for kind '${object.type}' (target ${formatObjectRef(object)})`);return new Walk(deps,person).resolve(object,relation,0)}var Walk=class{deps;person;memo=new Map;inProgress=new Set;constructor(deps,person){this.deps=deps,this.person=person}resolve(object,relation,depth){let key=pairKey(object,relation);if(this.inProgress.has(key))throw new AuthorizationEvaluationError("resolution-cycle",`'${key}' re-entered while being resolved \u2014 the declarations cycle`);if(depth>MAX_RESOLUTION_DEPTH)throw new AuthorizationEvaluationError("resolution-depth-exceeded",`resolving '${key}' exceeded ${MAX_RESOLUTION_DEPTH} hops`);let held=this.memo.get(key);if(held!==void 0)return held;let declaration=this.deps.model.byType(object.type),rewrite=declaration?.relations.get(relation);if(declaration===void 0||rewrite===void 0)return Promise.resolve(!1);this.inProgress.add(key);let result=this.evaluate(rewrite,object,relation,depth).finally(()=>this.inProgress.delete(key));return this.memo.set(key,result),result}async evaluate(rewrite,object,relation,depth){switch(rewrite.node){case"this":{let tuples=await this.deps.source.tuplesOf(object,relation);for(let tuple of tuples)if(await this.subjectHolds(tuple.subject,rewrite.subjects,depth))return!0;return!1}case"computed":return this.resolve(object,rewrite.relation,depth+1);case"from":{let linkTypes=this.objectTypesOf(object,rewrite.tupleset),links=await this.deps.source.tuplesOf(object,rewrite.tupleset);for(let link of links)if(link.subject.form==="object"&&linkTypes.has(link.subject.object.type)&&await this.resolve(link.subject.object,rewrite.relation,depth+1))return!0;return!1}case"union":{for(let member2 of rewrite.members)if(await this.evaluate(member2,object,relation,depth))return!0;return!1}case"intersection":{for(let member2 of rewrite.members)if(!await this.evaluate(member2,object,relation,depth))return!1;return!0}default:{let exhaustive=rewrite;throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`)}}}async subjectHolds(subject,restriction,depth){switch(subject.form){case"object":return subject.object.type===ACCOUNT_TYPE&&restriction.some(allowed=>allowed.form==="object"&&allowed.type===ACCOUNT_TYPE)&&this.person.aliases.has(subject.object.id);case"userset":return restriction.some(allowed=>allowed.form==="userset"&&allowed.type===subject.object.type&&allowed.relation===subject.relation)&&await this.resolve(subject.object,subject.relation,depth+1);default:{let exhaustive=subject;throw new Error(`unknown subject form: ${JSON.stringify(exhaustive)}`)}}}objectTypesOf(object,tupleset){let rewrite=this.deps.model.byType(object.type)?.relations.get(tupleset),types3=new Set,collect=node=>{if(node.node==="this")for(let subject of node.subjects)subject.form==="object"&&types3.add(subject.type);else node.node==="union"&&node.members.forEach(collect)};return rewrite!==void 0&&collect(rewrite),types3}};var ACCOUNT_ID_PREFIX="ida";function accountIdFor(idpId){if(idpId==="")throw new Error("idp_id must not be empty");return derivedId(ACCOUNT_ID_PREFIX,idpId)}var LOCAL_IDP_ID_PREFIX="local|";function localIdpIdFor(identityId){return`${LOCAL_IDP_ID_PREFIX}${identityId}`}function idpIdOf(caller){return caller.issuer===""&&caller.rawToken===""?localIdpIdFor(caller.identityId):jwtSubjectOf(caller.rawToken)}function jwtSubjectOf(rawToken){let segments=rawToken.split(".");if(segments.length!==3)return"";try{let payload=JSON.parse(Buffer.from(segments[1]??"","base64url").toString("utf8"));return typeof payload.sub=="string"?payload.sub:""}catch{return""}}var MACHINE_ACCOUNT_SUFFIX="@clients";function isMachineSubject(idpId){return idpId.endsWith(MACHINE_ACCOUNT_SUFFIX)}var PLATFORM_CLIENT_SUBJECT_PREFIX="stgm_pc|";function isPlatformClientSubject(idpId){return idpId.startsWith(PLATFORM_CLIENT_SUBJECT_PREFIX)}function reservedSubjectMessage(idpId){return`subject '${idpId}' uses the '${PLATFORM_CLIENT_SUBJECT_PREFIX}' prefix reserved for accounts a platform client provisions`}var ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE="Identity account not found for the authenticated user",NO_IDP_ID_MESSAGE="Cannot provision account: no IDP ID in authentication context",USERINFO_UNAVAILABLE_PREFIX="Failed to fetch user profile from identity provider: ";function accountNotFoundMessage(handle){return`Identity account not found: ${handle}`}var CREATE_IS_INTERNAL_MESSAGE="this RPC is internal to the platform",FEDERATION_UNIMPLEMENTED_REASON="federated identity accounts are served by the Enterprise and Cloud editions";function federationUnimplementedMessage(method){return`${method} is not implemented: ${FEDERATION_UNIMPLEMENTED_REASON}`}function idpIdImmutableMessage(existingIdpId){return`spec.idp_id is immutable (account subject is '${existingIdpId}') \u2014 create a new account for a different subject`}async function identityIdForSubject(accounts,subject){let account2=await accounts.findDirectByIdpId(subject);if(account2===void 0)return subject;let id=account2.metadata?.id??"";if(id==="")throw new Error(`identity account for subject '${subject}' carries no id \u2014 refusing to stamp an empty principal`);return id}async function accountForCaller(accounts,caller){let byId=await accounts.findById(caller.identityId);if(byId!==void 0)return byId;let subject=idpIdOf(caller);if(subject!=="")return accounts.findDirectByIdpId(subject)}async function accountForStamp(accounts,stamp2){if(stamp2!=="")return await accounts.findById(stamp2)??await accounts.findDirectByIdpId(stamp2)}function personFor(caller,account2){let accountId=account2?.metadata?.id??caller.identityId;if(!isPersonStamp(accountId))throw new Error(`caller '${accountId}' names no person \u2014 the built-in authorizer evaluates people only`);let aliases=new Set([accountId]),subject=account2?.spec?.idpId??"";return subject!==""&&aliases.add(subject),{accountId,aliases}}async function resolvePerson(accounts,caller){return personFor(caller,await accountForCaller(accounts,caller))}var NOT_FOUND_EXEMPT_KINDS=new Set([ApiResourceKind.identity_account,ApiResourceKind.iam_policy,ApiResourceKind.platform_client]),UNKNOWN_PERMISSION_DENY_REASON="authorization cannot be performed with unknown permission",EMPTY_IDENTITY_DENY_REASON="authorization cannot be performed on empty identity string",EMPTY_RESOURCE_ID_DENY_REASON="authorization cannot be performed on empty api-resource-id",UNKNOWN_KIND_DENY_REASON="authorization cannot be performed on unknown api-resource-kind",UNSERVED_KIND_DENY_REASON="authorization cannot be performed on a kind this edition does not serve";function newBuiltInAuthorizer(deps){let model=deps.model??builtInModel;return{async authorize(caller,check){if(check.permission===IamPermission.unspecified)return deny(UNKNOWN_PERMISSION_DENY_REASON);if(caller.identityId==="")return deny(EMPTY_IDENTITY_DENY_REASON);if(check.resourceId==="")return deny(EMPTY_RESOURCE_ID_DENY_REASON);if(check.resourceKind===ApiResourceKind.api_resource_kind_unknown)return deny(UNKNOWN_KIND_DENY_REASON);if(!kindServedByEdition(check.resourceKind,deps.edition))return deny(UNSERVED_KIND_DENY_REASON);let object={type:kindEnumName(check.resourceKind),id:check.resourceId},relation=IamPermission[check.permission];try{let person=await resolvePerson(deps.accounts,caller),source=newDerivedTupleSource({store:deps.store,policies:deps.policies,accounts:deps.accounts,model},person);return await source.loader.load(object)===void 0&&!NOT_FOUND_EXEMPT_KINDS.has(check.resourceKind)?(deps.logger.debug("authorization target not found",{account:person.accountId,permission:relation,object:formatObjectRef(object)}),{kind:"not-found"}):await checkRelation({model,source},object,relation,person)?{kind:"allow"}:(deps.logger.debug("authorization denied",{account:person.accountId,permission:relation,object:formatObjectRef(object)}),deny(""))}catch(error2){return{kind:"unavailable",cause:error2 instanceof Error?error2:new Error(String(error2))}}}}}function deny(reason){return{kind:"deny",reason}}var AUTHORIZATION_UNAVAILABLE_MESSAGE="authorization check could not be completed",AUTHORIZATION_DENIED_FALLBACK_MESSAGE="permission denied";function newPermissiveSingleTeamAuthorizer(){return{authorize(){return Promise.resolve({kind:"allow"})}}}function newAuthorizeStep(method,authorizer){return{name:"Authorize",execute(ctx){return authorizeDirect(method,authorizer,ctx.callerIdentity,ctx.input)}}}function resolveAnnotatedCheck(method,input,override){if(getOption(method,is_public)||getOption(method,is_skip_authorization)||!hasOption(method,config))return;let config2=getOption(method,config);return{permission:config2.permission,resourceKind:override?.resourceKind??resolveResourceKind(input,config2),resourceId:override?.resourceId??resolveResourceId(input,config2),deniedMessage:config2.errorMsg}}async function authorizeDirect(method,authorizer,identity2,input,override){if(identity2.callerClass==="internal")return;let target=resolveAnnotatedCheck(method,input,override);if(target!==void 0)return authorizeTarget(authorizer,identity2,target)}function authorizeTarget(authorizer,identity2,target){return authorizeResolvedResource(authorizer,identity2,{permission:target.permission,resourceKind:target.resourceKind,resourceId:target.resourceId},target.deniedMessage)}async function authorizeResolvedResource(authorizer,identity2,check,errorMsg){if(identity2.callerClass==="internal")return;let decision=await evaluateAuthorizer(authorizer,identity2,check);switch(decision.kind){case"allow":return;case"deny":throw new ConnectError(errorMsg!==""?errorMsg:decision.reason!==""?decision.reason:AUTHORIZATION_DENIED_FALLBACK_MESSAGE,Code.PermissionDenied);case"not-found":throw check.resourceId===""||check.resourceKind===ApiResourceKind.api_resource_kind_unknown?internalError(new Error("authorizer answered not-found for a non-resource-scoped check"),AUTHORIZATION_UNAVAILABLE_MESSAGE):notFoundError(getKindName(check.resourceKind),check.resourceId);case"unavailable":throw internalError(decision.cause,AUTHORIZATION_UNAVAILABLE_MESSAGE);default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),AUTHORIZATION_UNAVAILABLE_MESSAGE)}}}async function evaluateAuthorizer(authorizer,identity2,check){try{return await authorizer.authorize(identity2,check)}catch(error2){return{kind:"unavailable",cause:error2 instanceof Error?error2:new Error(String(error2))}}}function resolveResourceKind(input,config2){if(config2.resourceKindPath==="")return config2.resourceKind;let value=resolveDotPath(input,config2.resourceKindPath);return typeof value=="number"?value:typeof value=="string"?kindByEnumName(value):ApiResourceKind.api_resource_kind_unknown}function resolveResourceId(input,config2){if(config2.resourceId!=="")return config2.resourceId;if(config2.fieldPath==="")return"";let value=resolveDotPath(input,config2.fieldPath);return typeof value=="string"?value:""}function resolveDotPath(input,path14){let current=input;for(let segment of path14.split(".")){if(current===null||typeof current!="object")return;current=current[snakeToCamel(segment)]}return current}function snakeToCamel(segment){return segment.replace(/_([a-z0-9])/g,(_,ch)=>ch.toUpperCase())}var RUN_GATE_CHECKS={agent:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.agent},agentInstance:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.agent_instance},session:{permission:IamPermission.can_create_execution_in,resourceKind:ApiResourceKind.session},workflow:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.workflow},workflowInstance:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.workflow_instance}},RUN_GATE_CHECK_LIST=Object.values(RUN_GATE_CHECKS);function isRunGateCheck(check){return RUN_GATE_CHECK_LIST.some(candidate=>candidate.permission===check.permission&&candidate.resourceKind===check.resourceKind)}function newAuthorizeRunTargetStep(authorizer,resolveRunTarget){return{name:"AuthorizeRunTarget",async execute(ctx){let target=resolveRunTarget(ctx.newState);target!==void 0&&await authorizeResolvedResource(authorizer,ctx.callerIdentity,{permission:target.permission,resourceKind:target.resourceKind,resourceId:target.resourceId},target.deniedMessage)}}}var ADMITTED={kind:"allow"};function newLaneAdmittedAuthorizer(inner,isAdmittedLane){return{authorize(caller,check){return isRunGateCheck(check)&&isAdmittedLane(caller)?Promise.resolve(ADMITTED):inner.authorize(caller,check)}}}var InternalCallerOfferedError=class extends Error{kind;constructor(kind){super(`the internal caller class was offered to the list scope for kind '${kindEnumName(kind)}' \u2014 the shared helper answers that class before any driver; a list lane reached the driver around it`),this.name="InternalCallerOfferedError",this.kind=kind}};async function restrictListByReadScope(scope,caller,kind,resources,requestOrg){if(scope===void 0)return[...resources];let offered=requestOrg===""?resources:resources.filter(resource=>resource.metadata?.org===requestOrg);if(caller.callerClass==="internal")return[...offered];let parentOf=authorizationParentReader(kind),entries=offered.map(resource=>{let entry={...rowAuthorizationFactsOf(kind,resource),labels:resource.metadata?.labels??{}},authorizationParent=parentOf(entry.parentLinks);return authorizationParent===void 0?entry:{...entry,authorizationParent}}),keptIds=await scope.restrictListEntries(caller,kind,entries);return offered.filter(resource=>keptIds.has(resource.metadata?.id??""))}function authorizationParentReader(kind){let parent=inheritedAuthorizationParentOf(kind);return parent===void 0?()=>{}:parentLinks=>parentLinks.find(link=>link.relation===parent.relation)}var LIST_RELATION="can_view";function newBuiltInListReadScope(deps){let model=deps.model??builtInModel;async function visibleAmong(caller,kind,candidates){if(candidates.length===0)return new Set;let started=performance.now(),person=await resolvePerson(deps.accounts,caller),source=newDerivedTupleSource({store:deps.store,policies:deps.policies,accounts:deps.accounts,model},person,{facts:candidates}),type2=kindEnumName(kind),answers=await Promise.all(candidates.map(async facts=>{let object={type:type2,id:facts.id};return await checkRelation({model,source},object,LIST_RELATION,person)?facts.id:void 0})),kept=new Set;for(let id of answers)id!==void 0&&kept.add(id);return deps.logger.debug("list scope evaluated candidates",{account:person.accountId,kind:type2,offered:candidates.length,kept:kept.size,elapsedMs:Math.round(performance.now()-started)}),kept}function requireListable(kind){let declaration=model.byKind(kind);if(declaration===void 0)throw new AuthorizationEvaluationError("undeclared-target-kind",`no declaration for kind '${kindEnumName(kind)}' \u2014 a list lane asked the scope about a kind the model does not declare`);let schema2=declaration.schema;if(schema2===void 0)throw new AuthorizationEvaluationError("undeclared-target-kind",`kind '${kindEnumName(kind)}' has no stored rows \u2014 a list lane asked the scope about a rowless kind`);return{...declaration,schema:schema2}}async function everyRowOf(declaration){let kind=declaration.kind,rows=await deps.store.listResources(kind),facts=[];for(let bytes of rows)try{facts.push(rowFactsOf(kind,fromBinary2(declaration.schema,bytes)))}catch(error2){deps.logger.warn("list scope skipped a row that does not decode",{kind:kindEnumName(kind),error:error2 instanceof Error?error2.message:String(error2)})}return facts}return{async restrictListEntries(caller,kind,entries){if(requireListable(kind),caller.callerClass==="internal")throw new InternalCallerOfferedError(kind);let unique2=new Map;for(let entry of entries)unique2.has(entry.id)||unique2.set(entry.id,rowFactsOfEntry(kind,entry));return visibleAmong(caller,kind,[...unique2.values()])},async authorizedResourceIds(caller,kind){let candidates=await everyRowOf(requireListable(kind));return caller.callerClass==="internal"?new Set(candidates.map(facts=>facts.id)):visibleAmong(caller,kind,candidates)}}}var ORGANIZATION2=kindEnumName(ApiResourceKind.organization);function newBuiltInOrganizationDirectory(deps){let model=deps.model??builtInModel;return{refusesEnumeration:!0,async listMyOrganizationIds(caller){if(caller.callerClass==="internal")return"all";let person=await resolvePerson(deps.accounts,caller),source=newDerivedTupleSource({store:deps.store,policies:deps.policies,accounts:deps.accounts,model},person),candidates=new Set;for(let tuple of await source.personTuples())tuple.object.type===ORGANIZATION2&&tuple.object.id!==""&&candidates.add(tuple.object.id);let visible=[];for(let id of candidates)await checkRelation({model,source},{type:ORGANIZATION2,id},"can_view",person)&&visible.push(id);return visible}}}function authorizationPostureOf(inputs){return inputs.unitAuthorizer?"unit-authorizer":inputs.requireAuthentication?"built-in":"trusted-local"}var ScheduleFireCallerRefusedError=class extends Error{constructor(reason){super(reason),this.name="ScheduleFireCallerRefusedError"}};function scheduleHasNoPersonMessage(scheduleId){return`schedule ${scheduleId} was created by nobody this server recognizes as a person; recreate it while signed in`}function newBuiltInScheduleFireCaller(deps){return{async mintFireCaller(_org,scheduleId){let schedule=await deps.store.getResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema),stamp2=auditOf(ScheduleSchema,schedule)?.specAudit?.createdBy?.id??"",account2=await accountForStamp(deps.accounts,stamp2);if(account2===void 0)throw new ScheduleFireCallerRefusedError(scheduleHasNoPersonMessage(scheduleId));return accountAsCaller(account2)}}}var ABSENT_LICENSE_STATUS={status:()=>Promise.resolve({state:LicenseState.absent})};var import_node_net=require("node:net");function egressPolicyForPosture(posture){return{name:posture,blockedReason:address=>blockedReason(address,posture)}}function blockedReason(address,posture){let family=(0,import_node_net.isIP)(address);if(family===4)return blockedReasonV4(address,posture);if(family===6){let groups=expandV6(address);if(!groups)return"unrecognized";let embedded=extractMappedV4(groups);return embedded?blockedReasonV4(embedded,posture):blockedReasonV6(groups,posture)}return"unrecognized"}function blockedReasonV4(address,posture){let octets=address.split(".").map(Number);if(octets.length!==4||octets.some(o3=>Number.isNaN(o3)||o3<0||o3>255))return"unrecognized";let a5=octets[0],b7=octets[1];return a5===169&&b7===254?"link-local (cloud metadata)":posture==="relaxed"?null:a5===127?"loopback":a5===0?"unspecified":a5===10||a5===172&&b7!==void 0&&b7>=16&&b7<=31||a5===192&&b7===168?"private (RFC 1918)":null}function blockedReasonV6(groups,posture){let first=groups[0]??0;return(first&65472)===65152?"link-local (cloud metadata)":posture==="relaxed"?null:groups.every(g5=>g5===0)?"unspecified":groups.slice(0,7).every(g5=>g5===0)&&groups[7]===1?"loopback":(first&65024)===64512?"private (unique local)":null}function expandV6(address){let text2=address.toLowerCase().split("%")[0]??"",tail4=/(\d+\.\d+\.\d+\.\d+)$/.exec(text2)?.[1];if(tail4!==void 0){let octets=tail4.split(".").map(Number);if(octets.length!==4||octets.some(o4=>o4>255))return null;let[o0=0,o1=0,o22=0,o3=0]=octets,hex=`${(o0<<8|o1).toString(16)}:${(o22<<8|o3).toString(16)}`;text2=text2.slice(0,-tail4.length)+hex}let halves=text2.split("::");if(halves.length>2)return null;let parseHalf=half=>half===""?[]:half.split(":").map(g5=>parseInt(g5,16)),head=parseHalf(halves[0]??""),tail=halves.length===2?parseHalf(halves[1]??""):[],fill=8-head.length-tail.length;if(halves.length===2?fill<0:head.length!==8)return null;let groups=[...head,...halves.length===2?Array(fill).fill(0):[],...tail];return groups.length!==8||groups.some(g5=>Number.isNaN(g5)||g5<0||g5>65535)?null:groups}function extractMappedV4(groups){if(!(groups.slice(0,5).every(g5=>g5===0)&&groups[5]===65535))return null;let hi=groups[6]??0,lo=groups[7]??0;return`${hi>>8}.${hi&255}.${lo>>8}.${lo&255}`}var import_node_net2=require("node:net");function describeRefusal(refusal2){switch(refusal2.kind){case"invalid-url":return`Invalid URL: ${refusal2.url}`;case"unsupported-scheme":return`Unsupported URL scheme "${refusal2.scheme}": only http and https are allowed.`;case"unresolvable":return`Could not resolve hostname: ${refusal2.hostname}`;case"blocked":return`Refusing to reach ${refusal2.hostname}: it resolves to ${refusal2.address}, a ${refusal2.reason} address the ${refusal2.policy} egress policy does not dial.`;case"too-many-redirects":return`Refusing to follow more than ${refusal2.hops} redirects from ${refusal2.url.href}.`;default:return refusal2}}var EgressError=class extends Error{refusal;constructor(refusal2){super(describeRefusal(refusal2)),this.refusal=refusal2,this.name="EgressError"}};async function checkEgress(rawUrl,policy,options){let url;try{url=new URL(rawUrl)}catch{return{ok:!1,refusal:{kind:"invalid-url",url:String(rawUrl)}}}if(url.protocol!=="http:"&&url.protocol!=="https:")return{ok:!1,refusal:{kind:"unsupported-scheme",url,scheme:url.protocol.replace(/:$/,"")}};let addresses=await resolveAddresses(url.hostname,options);if(addresses===void 0)return{ok:!1,refusal:{kind:"unresolvable",url,hostname:url.hostname}};for(let address of addresses){let reason=policy.blockedReason(address);if(reason!==null)return{ok:!1,refusal:{kind:"blocked",url,hostname:url.hostname,address,reason,policy:policy.name}}}return{ok:!0,url,addresses}}async function resolveAddresses(hostname,options){let literal=hostname.replace(/^\[|\]$/g,"");if((0,import_node_net2.isIP)(literal)!==0)return[literal];try{let records=await raceSignal2(options.lookup(hostname),options.signal);return records.length===0?void 0:records}catch(error2){if(options.signal?.aborted===!0)throw error2;return}}function raceSignal2(promise,signal3){return signal3==null?promise:signal3.aborted?(promise.catch(()=>{}),Promise.reject(abortReason(signal3))):new Promise((resolve,reject2)=>{let onAbort=()=>{promise.catch(()=>{}),reject2(abortReason(signal3))};signal3.addEventListener("abort",onAbort,{once:!0}),promise.then(value=>{signal3.removeEventListener("abort",onAbort),resolve(value)},error2=>{signal3.removeEventListener("abort",onAbort),reject2(error2)})})}function abortReason(signal3){return signal3.reason??new DOMException("The operation was aborted.","AbortError")}var DEFAULT_MAX_REDIRECTS=3,REDIRECT_STATUSES=new Set([301,302,303,307,308]);function asFetch(outbound){return(input,init)=>typeof input=="string"||input instanceof URL?outbound(input,init):Promise.reject(new TypeError("OutboundFetch takes a URL, not a Request"))}function guardedFetch(policy,options){let maxRedirects=options.maxRedirects??DEFAULT_MAX_REDIRECTS;return async(input,init)=>{let url=new URL(input),method=(init?.method??"GET").toUpperCase(),body=init?.body,headers2=new Headers(init?.headers),callerRedirect=init?.redirect??"follow";for(let hop=0;;hop+=1){let check=await checkEgress(url,policy,{lookup:options.lookup,signal:init?.signal});if(!check.ok)throw new EgressError(check.refusal);let response=await options.fetchImpl(url,{...init,method,body,headers:headers2,redirect:"manual"}),location=response.headers.get("location");if(!REDIRECT_STATUSES.has(response.status)||location===null||callerRedirect==="manual")return response;if(callerRedirect==="error")throw await response.body?.cancel(),new TypeError(`fetch refused to follow a redirect from ${url.href}`);if(hop>=maxRedirects)throw await response.body?.cancel(),new EgressError({kind:"too-many-redirects",url,hops:maxRedirects});await response.body?.cancel();let next=new URL(location,url);next.origin!==url.origin&&headers2.delete("authorization"),(response.status===303||(response.status===301||response.status===302)&&method!=="GET"&&method!=="HEAD")&&(method="GET",body=void 0,headers2.delete("content-type"),headers2.delete("content-length")),url=next}}}var import_promises=require("node:dns/promises");function nodeLookup(){return async hostname=>(await(0,import_promises.lookup)(hostname,{all:!0,verbatim:!0})).map(record2=>record2.address)}function relaxedEgressPolicy(){return egressPolicyForPosture("relaxed")}var file_ai_stigmer_agentic_agent_v1_io=fileDesc("CiRhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnQvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MSIgCgdBZ2VudElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQFiBnByb3RvMw",[file_buf_validate_validate]),AgentIdSchema=messageDesc2(file_ai_stigmer_agentic_agent_v1_io,0);var file_ai_stigmer_commons_apiresource_rpc_service_options=fileDesc("CjhhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvcnBjX3NlcnZpY2Vfb3B0aW9ucy5wcm90bxIeYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlOo4BChFhcGlfcmVzb3VyY2Vfa2luZBIfLmdvb2dsZS5wcm90b2J1Zi5TZXJ2aWNlT3B0aW9ucxj0vwUgASgOMj8uYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUtpbmRSD2FwaVJlc291cmNlS2luZGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind,file_google_protobuf_descriptor]),api_resource_kind=extDesc(file_ai_stigmer_commons_apiresource_rpc_service_options,0);var file_ai_stigmer_agentic_agent_v1_command=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnQvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxMskFChZBZ2VudENvbW1hbmRDb250cm9sbGVyEk8KBWFwcGx5EiIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50GiIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50EpsBCgZjcmVhdGUSIi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuQWdlbnQaIi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuQWdlbnQiScK4GEUIBhAeIgxtZXRhZGF0YS5vcmcqMXVuYXV0aG9yaXplZCB0byBjcmVhdGUgYWdlbnQgaW4gdGhpcyBvcmdhbml6YXRpb24ShQEKBnVwZGF0ZRIiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudBoiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudCIzwrgYLwgCECgiC21ldGFkYXRhLmlkKhx1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGFnZW50Eq0BChB1cGRhdGVWaXNpYmlsaXR5EjUuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlVwZGF0ZVZpc2liaWxpdHlJbnB1dBoiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudCI+wrgYOggCECgiC3Jlc291cmNlX2lkKid1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGFnZW50IHZpc2liaWxpdHkSgQEKBmRlbGV0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudElkGiIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50Ii3CuBgpCAMQKCIFdmFsdWUqHHVuYXV0aG9yaXplZCB0byBkZWxldGUgYWdlbnQaBKD/KyhiBnByb3RvMw",[file_ai_stigmer_agentic_agent_v1_api,file_ai_stigmer_agentic_agent_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentCommandController=serviceDesc(file_ai_stigmer_agentic_agent_v1_command,0);var file_ai_stigmer_agentic_agent_v1_query=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnQvdjEvcXVlcnkucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MTKLAgoUQWdlbnRRdWVyeUNvbnRyb2xsZXISewoDZ2V0EiQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50SWQaIi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuQWdlbnQiKsK4GCYIARAoIgV2YWx1ZSoZdW5hdXRob3JpemVkIHRvIGdldCBhZ2VudBJwCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRoiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudCIE0LgYARoEoP8rKGIGcHJvdG8z",[file_ai_stigmer_agentic_agent_v1_api,file_ai_stigmer_agentic_agent_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentQueryController=serviceDesc(file_ai_stigmer_agentic_agent_v1_query,0);var apiResourceKindKey=createContextKey(ApiResourceKind.api_resource_kind_unknown,{description:"api_resource_kind service option of the target service"});function createApiResourceInterceptor(){return next=>request=>{if(!request.stream&&hasOption(request.service,api_resource_kind)){let kind=getOption(request.service,api_resource_kind);kind!==ApiResourceKind.api_resource_kind_unknown&&request.contextValues.set(apiResourceKindKey,kind)}return next(request)}}var INTERNAL_FALLBACK_MESSAGE="internal server error",Pipeline=class{pipelineName;steps;logger;constructor(pipelineName,steps,logger2){this.pipelineName=pipelineName,this.steps=steps,this.logger=logger2}get name(){return this.pipelineName}get stepCount(){return this.steps.length}async execute(ctx){for(let step of this.steps){let startedAt=performance.now();try{await step.execute(ctx)}catch(error2){throw this.logger.warn("pipeline step failed",{pipeline:this.pipelineName,step:step.name,durationMs:Math.round(performance.now()-startedAt),error:error2 instanceof Error?error2.message:String(error2)}),error2 instanceof ConnectError?error2:internalError(error2,INTERNAL_FALLBACK_MESSAGE)}this.logger.debug("pipeline step completed",{pipeline:this.pipelineName,step:step.name,durationMs:Math.round(performance.now()-startedAt)})}}},PipelineBuilder=class{name;logger;steps=[];constructor(name,logger2){this.name=name,this.logger=logger2}addStep(step){return this.steps.push(step),this}build(){return new Pipeline(this.name,this.steps,this.logger)}};function newPipeline(name,logger2){return new PipelineBuilder(name,logger2)}var LOADED_EXECUTION_KEY="loadedExecution",RequestContext=class{input;schema;callerIdentity;apiResourceKind;state;metadata=new Map;constructor(schema2,input,callerIdentity,apiResourceKind=ApiResourceKind.api_resource_kind_unknown){this.schema=schema2,this.input=input,this.state=clone(schema2,input),this.callerIdentity=callerIdentity,this.apiResourceKind=apiResourceKind}get newState(){return this.state}setNewState(state2){this.state=state2}get(key){return this.metadata.get(key)}set(key,value){this.metadata.set(key,value)}};var TARGET_RESOURCE_KEY="targetResource";function newLoadTargetStep(store,targetSchema){return{name:"LoadTarget",async execute(ctx){let resourceId=idValueOf(ctx.input);if(resourceId==="")throw invalidArgumentError("resource id is required");let target;try{target=await store.getResource(ctx.apiResourceKind,resourceId,targetSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError(getKindName(ctx.apiResourceKind),resourceId):error2}ctx.set(TARGET_RESOURCE_KEY,target)}}}var AUTHORIZE_RESOLVED_TARGET_STEP="AuthorizeResolvedTarget";function newAuthorizeResolvedTargetStep(authorizer,resolve,stepName=AUTHORIZE_RESOLVED_TARGET_STEP){return{name:stepName,async execute(ctx){for(let target of resolve(ctx))await authorizeTarget(authorizer,ctx.callerIdentity,target)}}}function loadedTargetAsMethod(get26){return ctx=>{let loaded=ctx.get(TARGET_RESOURCE_KEY),id=loaded===void 0?void 0:metadataOf(loaded)?.id;if(id===void 0)throw new Error(`${AUTHORIZE_RESOLVED_TARGET_STEP}: no loaded target with metadata under ${TARGET_RESOURCE_KEY}; the loader must run first`);let target=resolveAnnotatedCheck(get26,ctx.input,{resourceId:id});return target===void 0?[]:[target]}}function isPlatformPipelineCaller(caller){return caller.callerClass==="machine"||isServerComposedRequest(caller)}function isServerComposedRequest(caller){return caller.callerClass==="internal"||caller.origin==="in-process"}var STAMPED_KEYS_CONTEXT_KEY="serverStampedReservedLabels";function recordServerStampedReservedLabels(ctx,...keys){let existing=ctx.get(STAMPED_KEYS_CONTEXT_KEY),stamped=existing instanceof Set?existing:new Set;for(let key of keys)stamped.add(key);ctx.set(STAMPED_KEYS_CONTEXT_KEY,stamped)}function serverStampedReservedLabels(ctx){let stamped=ctx.get(STAMPED_KEYS_CONTEXT_KEY);return stamped instanceof Set?stamped:new Set}var RESERVED_LABEL_PREFIX="stigmer.ai/",CLIENT_CONTRACT_ALLOWLIST=new Map([[ApiResourceKind.environment,new Set(["stigmer.ai/personal"])]]);function reservedLabelMutations(stored,requested){let mutations=[];for(let[key,value]of Object.entries(requested))key.startsWith(RESERVED_LABEL_PREFIX)&&stored[key]!==value&&mutations.push(key);return mutations.sort()}function newGuardReservedLabelsStep(authorizer,positions={}){let stateOf=positions.stateOf??(ctx=>ctx.newState),existingKey=positions.existingKey??EXISTING_RESOURCE_KEY;return{name:"GuardReservedLabels",async execute(ctx){if(isServerComposedRequest(ctx.callerIdentity))return;let state2=stateOf(ctx),requested=state2===void 0?{}:metadataOf(state2)?.labels??{},existing=ctx.get(existingKey),stored=existing===void 0?{}:metadataOf(existing)?.labels??{},allowlist=CLIENT_CONTRACT_ALLOWLIST.get(ctx.apiResourceKind)??new Set,stamped=serverStampedReservedLabels(ctx),mutations=reservedLabelMutations(stored,requested).filter(key=>!allowlist.has(key)&&!stamped.has(key));if(mutations.length===0)return;let decision;try{decision=await authorizer.authorize(ctx.callerIdentity,{permission:IamPermission.can_write_reserved_labels,resourceKind:ApiResourceKind.platform,resourceId:"stigmer"})}catch(error2){throw reservedLabelCheckFailure(error2)}switch(decision.kind){case"allow":return;case"deny":case"not-found":throw new ConnectError(`Labels in the reserved '${RESERVED_LABEL_PREFIX}' namespace are platform-managed and cannot be set or changed by this request: ${mutations.join(", ")}. Stored reserved labels may be echoed back unchanged or removed.`,Code.InvalidArgument);case"unavailable":throw reservedLabelCheckFailure(decision.cause);default:{let exhaustive=decision;throw reservedLabelCheckFailure(new Error(`unknown decision ${JSON.stringify(exhaustive)}`))}}}}}function reservedLabelCheckFailure(error2){return internalError(error2 instanceof Error?error2:new Error(String(error2)),"reserved-label validation could not be completed")}function newBuildUpdateStateStep(){return{name:"BuildUpdateState",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not found in context - LoadExisting must run first"),"build update state");let merged=clone(ctx.schema,ctx.input);preserveImmutableFields(merged,existing),hasStatusField(ctx.schema)&&(clearStatusField(ctx.schema,merged),copyStatusFromExisting(ctx.schema,merged,existing),updateAuditFields(ctx.schema,merged,existing,ctx.callerIdentity)),ctx.setNewState(merged)}}}function preserveImmutableFields(merged,existing){let mergedMeta=metadataOf(merged),existingMeta=metadataOf(existing);if(mergedMeta===void 0||existingMeta===void 0)throw internalError(new Error("metadata is nil"),"preserve immutable fields");mergedMeta.id=existingMeta.id,mergedMeta.slug=existingMeta.slug,mergedMeta.org=existingMeta.org,mergedMeta.visibility=existingMeta.visibility}function copyStatusFromExisting(schema2,merged,existing){let existingRoot=reflect2(schema2,existing),statusField=messageFieldByName(existingRoot,"status");if(statusField===void 0||!existingRoot.isSet(statusField))return;let statusCopy=reflect2(statusField.message,clone(statusField.message,existingRoot.get(statusField).message));reflect2(schema2,merged).set(statusField,statusCopy)}function updateAuditFields(schema2,resource,existing,identity2){let now=timestampNow(),actor=auditActorFor(identity2),{createdBy,createdAt}=creationAuditOf(schema2,existing,"spec_audit");setAuditReflect(schema2,resource,create2(ApiResourceAuditSchema,{specAudit:updatedAuditInfo(createdBy,createdAt,actor,now),statusAudit:create2(ApiResourceAuditInfoSchema,{createdBy:actor,createdAt:now,updatedBy:actor,updatedAt:now,event:"updated"})}))}function newCheckDuplicateStep(store){return{name:"CheckDuplicate",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"duplicate check");if(metadata.slug==="")throw internalError(new Error("resource slug is empty"),"duplicate check");let existing;try{existing=await findResourceBySlug(store,ctx.apiResourceKind,ctx.schema,metadata.slug,metadata.org)}catch(error2){throw internalError(error2,"failed to check for duplicates")}if(existing!==void 0){let existingMetadata=metadataOf(existing);throw alreadyExistsError(getKindName(ctx.apiResourceKind),`slug '${metadata.slug}' in org '${existingMetadata?.org??""}' (id: ${existingMetadata?.id??""})`)}}}}var RESOURCE_ID_KEY="resourceId";function newExtractResourceIdStep(){return{name:"ExtractResourceId",execute(ctx){let id=idValueOf(ctx.input);if(id==="")throw invalidArgumentError("resource id is required");ctx.set(RESOURCE_ID_KEY,id)}}}function newLoadExistingForDeleteStep(store,resourceSchema){return{name:"LoadExistingForDelete",async execute(ctx){let id=requireResourceId(ctx),resource;try{resource=await store.getResource(ctx.apiResourceKind,id,resourceSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError(getKindName(ctx.apiResourceKind),id):error2}ctx.set(EXISTING_RESOURCE_KEY,resource)}}}function newDeleteResourceStep(store){return{name:"DeleteResource",async execute(ctx){let id=requireResourceId(ctx);try{await store.deleteResource(ctx.apiResourceKind,id)}catch(error2){throw internalError(error2,`failed to delete ${getKindName(ctx.apiResourceKind)}`)}}}}function requireResourceId(ctx){let id=ctx.get(RESOURCE_ID_KEY);if(typeof id!="string"||id==="")throw internalError(new Error("resource id not found in context (ExtractResourceId must run first)"),"delete pipeline ordering");return id}function apiResourceKindName(kind){return enumToJson(ApiResourceKindSchema,kind)}function extractFieldValue(schema2,msg,fieldPath){let parts=fieldPath.split("."),current=reflect2(schema2,msg);for(let i6=0;i6<parts.length;i6++){let part=parts[i6],field3=findFieldByProtoName(current,part);if(field3===void 0)return"";if(i6===parts.length-1)return scalarString(current,field3);if(field3.fieldKind!=="message")return"";current=current.get(field3)}return""}function extractLabelValue(schema2,msg,labelKey){let root5=reflect2(schema2,msg),metadataField=root5.fields.find(f5=>f5.name==="metadata");if(metadataField===void 0||metadataField.fieldKind!=="message")return"";let metadata=root5.get(metadataField),labelsField=metadata.fields.find(f5=>f5.name==="labels");if(labelsField===void 0||labelsField.fieldKind!=="map")return"";let value=metadata.get(labelsField).get(labelKey);return typeof value=="string"?value:""}function scanForFieldMatch(rows,schema2,fieldPath,value){for(let data of rows){let msg;try{msg=fromBinary2(schema2,data)}catch{continue}if(extractFieldValue(schema2,msg,fieldPath)===value)return msg}}function filterRowsByLabel(rows,schema2,labelKey,labelValue){let results=[];for(let data of rows){let msg;try{msg=fromBinary2(schema2,data)}catch{continue}extractLabelValue(schema2,msg,labelKey)===labelValue&&results.push(data)}return results}function findFieldByProtoName(message6,part){return message6.fields.find(f5=>f5.name===part)??message6.fields.find(f5=>f5.name===toSnakeCase(part))}function scalarString(message6,field3){if(field3.fieldKind==="list"||field3.fieldKind==="map"||field3.fieldKind==="message")return"";let value=message6.get(field3);return typeof value=="string"?value:typeof value=="number"||typeof value=="bigint"?String(value):typeof value=="boolean"?value?"true":"false":value instanceof Uint8Array?Buffer.from(value).toString("latin1"):""}function toSnakeCase(value){let result="";for(let i6=0;i6<value.length;i6++){let ch=value[i6];i6>0&&ch>="A"&&ch<="Z"&&(result+="_"),result+=ch}return result.toLowerCase()}function newIndexSearchStep(store,extractor,logger2){return{name:"IndexSearch",async execute(ctx){let resource=ctx.newState,metadata=metadataOf(resource);if(metadata===void 0||metadata.id===""){logger2.warn("IndexSearch: resource has no metadata or ID, skipping indexing");return}let entry=extractor.getSearchIndexEntry(resource);if(entry===void 0){logger2.warn("IndexSearch: extractor returned no entry, skipping indexing",{id:metadata.id});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,metadata.id,entry)}catch(error2){logger2.warn("IndexSearch: failed to update search index (best-effort)",{id:metadata.id,kind:apiResourceKindName(ctx.apiResourceKind),error:error2 instanceof Error?error2.message:String(error2)})}}}}function newDeleteSearchIndexStep(store,logger2){return{name:"DeleteSearchIndex",async execute(ctx){let id=ctx.get(RESOURCE_ID_KEY);if(typeof id!="string"||id==="")throw internalError(new Error("resource id not found in context (ExtractResourceId must run first)"),"delete search index ordering");try{await store.deleteSearchIndex(ctx.apiResourceKind,id)}catch(error2){logger2.warn("DeleteSearchIndex: failed to remove search index entry (best-effort)",{id,kind:apiResourceKindName(ctx.apiResourceKind),error:error2 instanceof Error?error2.message:String(error2)})}}}}var RESERVED_LABEL_PREFIX2="stigmer.ai/",DEFAULT_INSTANCE_LABEL=`${RESERVED_LABEL_PREFIX2}default-instance`,SYSTEM_MANAGED_LABEL=`${RESERVED_LABEL_PREFIX2}system-managed`,SYSTEM_LABEL=`${RESERVED_LABEL_PREFIX2}system`,RESERVED_LABEL_TRUE="true",PLUGIN_LABEL=`${RESERVED_LABEL_PREFIX2}plugin`,PLUGIN_VERSION_LABEL=`${RESERVED_LABEL_PREFIX2}plugin-version`,MCP_AUTH_LABEL=`${RESERVED_LABEL_PREFIX2}mcp-auth`,MCP_AUTH_ENDPOINT="endpoint";function pluginIdOf(metadata){let value=metadata?.labels[PLUGIN_LABEL];return value===void 0||value===""?void 0:value}function isDefaultInstance(metadata){return metadata?.labels[DEFAULT_INSTANCE_LABEL]===RESERVED_LABEL_TRUE}function isSystemContent(metadata){return metadata?.labels[SYSTEM_LABEL]===RESERVED_LABEL_TRUE}var MANAGED_KIND_NOUNS=new Map([[ApiResourceKind.skill,"skill"],[ApiResourceKind.mcp_server,"MCP server"],[ApiResourceKind.agent,"agent"],[ApiResourceKind.workflow,"workflow"]]);function pluginManagedRefusal(kind,slug,pluginSlug){return`${MANAGED_KIND_NOUNS.get(kind)??ApiResourceKind[kind]??String(kind)} '${slug}' is managed by plugin '${pluginSlug}'; change the plugin and push it again, or compose your own agent over it`}function newGuardPluginManagedStep(store,positions={}){let existingKey=positions.existingKey??EXISTING_RESOURCE_KEY;return{name:"GuardPluginManaged",async execute(ctx){if(ctx.callerIdentity.callerClass==="internal"||ctx.callerIdentity.origin==="in-process")return;let existing=ctx.get(existingKey);if(existing===void 0)return;let metadata=metadataOf(existing),pluginId=pluginIdOf(metadata);if(pluginId===void 0)return;let pluginSlug;try{pluginSlug=(await store.getResource(ApiResourceKind.plugin,pluginId,PluginSchema)).metadata?.slug??pluginId}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw internalError(error2,"plugin ownership could not be checked")}throw new ConnectError(pluginManagedRefusal(ctx.apiResourceKind,metadata?.slug??"",pluginSlug),Code.FailedPrecondition)}}}var EXISTS_IN_DATABASE_KEY="existsInDatabase",SHOULD_CREATE_KEY="shouldCreate";function newLoadForApplyStep(store){return{name:"LoadForApply",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0||metadata.slug===""){ctx.set(EXISTS_IN_DATABASE_KEY,!1),ctx.set(SHOULD_CREATE_KEY,!0);return}let existing=await findResourceBySlug(store,ctx.apiResourceKind,ctx.schema,metadata.slug,metadata.org);if(existing===void 0){ctx.set(EXISTS_IN_DATABASE_KEY,!1),ctx.set(SHOULD_CREATE_KEY,!0);return}ctx.set(EXISTING_RESOURCE_KEY,existing),ctx.set(EXISTS_IN_DATABASE_KEY,!0),ctx.set(SHOULD_CREATE_KEY,!1),metadata.id===""&&(metadata.id=metadataOf(existing)?.id??"")}}}function withResolvedApplyId(schema2,original,resolved){let enriched=clone(schema2,original),metadata=metadataOf(enriched),resolvedId=metadataOf(resolved.newState)?.id??"";return metadata!==void 0&&metadata.id===""&&resolvedId!==""&&(metadata.id=resolvedId),enriched}function newLoadByReferenceStep(store,targetSchema){return{name:"LoadByReference",async execute(ctx){let ref=ctx.input;if(ref.slug==="")throw invalidArgumentError("slug is required in reference");let kind=ctx.apiResourceKind;if(ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==kind)throw invalidArgumentError(`kind mismatch: expected ${apiResourceKindName(kind)}, got ${apiResourceKindName(ref.kind)}`);requireOrgForReference(kind,ref.org);let target=await findResourceBySlug(store,kind,targetSchema,ref.slug,ref.org);if(target===void 0)throw notFoundError(getKindName(kind),ref.slug);ctx.set(TARGET_RESOURCE_KEY,target)}}}var API_RESOURCE_REFERENCE_TYPE="ai.stigmer.commons.apiresource.ApiResourceReference",REFERENCE_TARGET_KINDS=[{kind:ApiResourceKind.skill,schema:SkillSchema,readByRun:!0,label:"skill(s)",listHint:"stigmer list skills"},{kind:ApiResourceKind.mcp_server,schema:McpServerSchema,readByRun:!0,label:"MCP server(s)",listHint:"stigmer get mcp-servers"},{kind:ApiResourceKind.agent,schema:AgentSchema,readByRun:!0,label:"agent(s)",listHint:"stigmer list agents"},{kind:ApiResourceKind.environment,schema:EnvironmentSchema,readByRun:!1,label:"environment(s)",listHint:"stigmer list environments"},{kind:ApiResourceKind.channel_app,schema:ChannelAppSchema,readByRun:!1,label:"channel app(s)",listHint:"stigmer list channel-app"},{kind:ApiResourceKind.oauth_app,schema:OAuthAppSchema,readByRun:!1,label:"OAuth app(s)",listHint:void 0}];function referenceTargetKind(kind){return REFERENCE_TARGET_KINDS.find(entry=>entry.kind===kind)}async function loadReferenceTargets(store,refs){let byKind=new Map;for(let kind of new Set(refs.map(ref=>ref.kind))){let entry=referenceTargetKind(kind);if(entry===void 0)throw internalError(new Error(`kind ${ApiResourceKind[kind]??kind} is not a reference target`),"reference rule table has no entry for the referenced kind");let index2=new Map;for(let data of await store.listResources(kind)){let metadata;try{metadata=metadataOf(fromBinary2(entry.schema,data))}catch{continue}metadata===void 0||metadata.slug===""||index2.set(targetKey(metadata.org,metadata.slug),metadata.visibility)}byKind.set(kind,index2)}return{visibilityOf(ref){return byKind.get(ref.kind)?.get(targetKey(ref.org,ref.slug))}}}function targetKey(org,slug){return`${org}/${slug}`}function checkReference(targets,parent,ref){if(ref.org==="")return{kind:"no-org"};let target=targets.visibilityOf(ref);return ref.org!==parent.org?target===ApiResourceVisibility.visibility_platform?{kind:"ok"}:{kind:"not-available"}:target===void 0?{kind:"missing"}:referenceTargetKind(ref.kind)?.readByRun===!0&&visibilityRank(target)<visibilityRank(floorOf(parent,ref))?{kind:"below-floor",targetVisibility:target}:{kind:"ok"}}function floorOf(parent,ref){return ref.resolvesIn==="running-organization"&&visibilityRank(parent.visibility)>visibilityRank(ApiResourceVisibility.visibility_org)?ApiResourceVisibility.visibility_org:parent.visibility}function visibilityRank(level){switch(level){case ApiResourceVisibility.api_resource_visibility_unspecified:case ApiResourceVisibility.visibility_private:return 0;case ApiResourceVisibility.visibility_org:return 1;case ApiResourceVisibility.visibility_platform:return 2;case ApiResourceVisibility.visibility_public:throw new Error("the retired public level has no rank");default:{let exhaustive=level;throw new Error(`unknown visibility level: ${String(exhaustive)}`)}}}function noOrgReferenceMessage(entry,slug){return`referenced ${entry.label} '${slug}' names no organization; a reference is 'org/slug', or 'slug' for a resource of this organization.`}function missingReferencesMessage(entry,handles){let list12=handles.map(h5=>`'${h5.slug}' (org: ${h5.org})`).join(", "),hint=entry.listHint===void 0?"":` Use '${entry.listHint}' to list available ${plural(entry)}.`;return`referenced ${entry.label} not found: ${list12}. Verify the slug and org are correct.${hint}`}function belowFloorMessage(entry,ref,targetVisibility,parentVisibility){return`referenced ${singular(entry)} '${ref.org}/${ref.slug}' is ${levelWord(targetVisibility)} while this resource is ${levelWord(parentVisibility)}; a resource may not be more visible than the ${plural(entry)} it runs with. Widen the referenced resource's visibility or narrow this one.`}function levelWord(level){return level===ApiResourceVisibility.api_resource_visibility_unspecified?ApiResourceVisibility[ApiResourceVisibility.visibility_private]:ApiResourceVisibility[level]}function notAvailableReferenceMessage(entry,ref){return`referenced ${singular(entry)} '${ref.org}/${ref.slug}' is not available to this organization; another organization's resource can be referenced only when that organization shares it at platform visibility.`}function singular(entry){return entry.label.replace("(s)","")}function plural(entry){return entry.label.replace("(s)","s")}function referenceRefusal(parent,verdicts){let missingByKind=new Map;for(let{ref,verdict}of verdicts)if(verdict.kind==="missing"){let held=missingByKind.get(ref.kind);held===void 0?missingByKind.set(ref.kind,[ref]):held.push(ref)}let sentences=[],groupedKindsSaid=new Set,malformed=!1;for(let{ref,verdict}of verdicts){let entry=referenceTargetKind(ref.kind);if(entry!==void 0)switch(verdict.kind){case"ok":break;case"no-org":malformed=!0,sentences.push(noOrgReferenceMessage(entry,ref.slug));break;case"missing":groupedKindsSaid.has(ref.kind)||(groupedKindsSaid.add(ref.kind),sentences.push(missingReferencesMessage(entry,missingByKind.get(ref.kind)??[])));break;case"below-floor":sentences.push(belowFloorMessage(entry,ref,verdict.targetVisibility,parent.visibility));break;case"not-available":sentences.push(notAvailableReferenceMessage(entry,ref));break;default:{let exhaustive=verdict;throw new Error(`unknown verdict: ${JSON.stringify(exhaustive)}`)}}}if(sentences.length===0)return;let text2=sentences.join(" ");return malformed?invalidArgumentError(text2):failedPreconditionError(text2)}function newNormalizeReferencesStep(){return{name:"NormalizeReferences",execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"normalize references");metadata.org!==""&&forEachSpecReference(ctx.schema,ctx.newState,ref=>{let orgField=ref.fields.find(f5=>f5.name==="org");orgField!==void 0&&ref.get(orgField)===""&&ref.set(orgField,metadata.org)})}}}function newValidateReferencesStep(store){return{name:"ValidateReferences",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"validate references");let refs=collectSpecReferences(ctx.schema,ctx.newState).filter(ref=>ref.slug!=="");if(refs.length===0)return;let parent={org:metadata.org,visibility:metadata.visibility},refusal2=await checkReferences(store,parent,refs);if(refusal2!==void 0)throw refusal2}}}async function checkReferences(store,parent,refs){let targets=await loadReferenceTargets(store,refs);return referenceRefusal(parent,refs.map(ref=>({ref,verdict:checkReference(targets,parent,ref)})))}function newGuardReferenceFloorOnEscalationStep(store,targetKey2,collectors){return{name:"GuardReferenceFloorOnEscalation",async execute(ctx){let row=ctx.get(targetKey2);if(row===void 0)throw internalError(new Error("GuardReferenceFloorOnEscalation ran without a loaded target \u2014 the step must follow the load step"),"reference floor requires the loaded resource");let metadata=metadataOf(row);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"reference floor requires the loaded resource");let requested=ctx.input.visibility;if(visibilityRank(requested)<=visibilityRank(metadata.visibility))return;let refs=collectors.flatMap(collect=>collect(row)).filter(ref=>ref.slug!=="");if(refs.length===0)return;let parent={org:metadata.org,visibility:requested},targets=await loadReferenceTargets(store,refs),refusal2=referenceRefusal(parent,refs.map(ref=>({ref,verdict:checkReference(targets,parent,ref)})).filter(({verdict})=>verdict.kind==="below-floor"));if(refusal2!==void 0)throw refusal2}}}function collectSpecReferences(schema2,msg){let refs=[];return forEachSpecReference(schema2,msg,(ref,field3)=>{refs.push({kind:declaredKind(field3,ref),slug:stringField(ref,"slug"),org:stringField(ref,"org")})}),refs}function declaredKind(field3,ref){return hasOption(field3,reference_kind)?getOption(field3,reference_kind):numberField(ref,"kind")}function forEachSpecReference(schema2,msg,fn){let root5=reflect2(schema2,msg),specField=messageFieldByName(root5,"spec");specField===void 0||!root5.isSet(specField)||walk2(root5.get(specField),fn)}function walk2(msg,fn){for(let field3 of msg.fields)if(field3.fieldKind==="list"){if(field3.listKind!=="message")continue;for(let item of msg.get(field3))visit(item,field3,fn)}else if(field3.fieldKind==="map"){if(field3.mapKind!=="message")continue;let map5=msg.get(field3);for(let[,value]of map5)visit(value,field3,fn)}else if(field3.fieldKind==="message"){if(!msg.isSet(field3))continue;visit(msg.get(field3),field3,fn)}}function visit(sub,field3,fn){sub.desc.typeName===API_RESOURCE_REFERENCE_TYPE?fn(sub,field3):walk2(sub,fn)}function stringField(msg,name){let field3=msg.fields.find(f5=>f5.name===name);if(field3===void 0)return"";let value=msg.get(field3);return typeof value=="string"?value:""}function numberField(msg,name){let field3=msg.fields.find(f5=>f5.name===name);if(field3===void 0)return 0;let value=msg.get(field3);return typeof value=="number"?value:0}function newPersistStep(store){return{name:"Persist",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"persist");if(metadata.id==="")throw internalError(new Error("resource ID is empty, cannot persist"),"persist");try{await store.saveResource(ctx.apiResourceKind,metadata.id,ctx.schema,ctx.newState)}catch(error2){throw internalError(error2,"failed to save resource to store")}}}}function newResolveSlugStep(){return{name:"ResolveSlug",execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"slug resolution");if(metadata.slug===""){if(metadata.name==="")throw invalidArgumentError("resource name is required");metadata.slug=generateSlug(metadata.name)}}}}function generateSlug(name){let slug=name.toLowerCase();return slug=slug.replaceAll(" ","-").replaceAll(".","-"),slug=slug.replace(/[^a-z0-9\- ]/g,""),slug=slug.replace(/-{2,}/g,"-"),slug.replace(/^-+|-+$/g,"")}var file_buf_validate_validate2=fileDesc2("ChtidWYvdmFsaWRhdGUvdmFsaWRhdGUucHJvdG8SDGJ1Zi52YWxpZGF0ZSI3CgRSdWxlEgoKAmlkGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEgoKZXhwcmVzc2lvbhgDIAEoCSKGAQoMTWVzc2FnZVJ1bGVzEhYKDmNlbF9leHByZXNzaW9uGAUgAygJEh8KA2NlbBgDIAMoCzISLmJ1Zi52YWxpZGF0ZS5SdWxlEi0KBW9uZW9mGAQgAygLMh4uYnVmLnZhbGlkYXRlLk1lc3NhZ2VPbmVvZlJ1bGVKBAgBEAJSCGRpc2FibGVkIjQKEE1lc3NhZ2VPbmVvZlJ1bGUSDgoGZmllbGRzGAEgAygJEhAKCHJlcXVpcmVkGAIgASgIIh4KCk9uZW9mUnVsZXMSEAoIcmVxdWlyZWQYASABKAgiiwkKCkZpZWxkUnVsZXMSFgoOY2VsX2V4cHJlc3Npb24YHSADKAkSHwoDY2VsGBcgAygLMhIuYnVmLnZhbGlkYXRlLlJ1bGUSEAoIcmVxdWlyZWQYGSABKAgSJAoGaWdub3JlGBsgASgOMhQuYnVmLnZhbGlkYXRlLklnbm9yZRIpCgVmbG9hdBgBIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GbG9hdFJ1bGVzSAASKwoGZG91YmxlGAIgASgLMhkuYnVmLnZhbGlkYXRlLkRvdWJsZVJ1bGVzSAASKQoFaW50MzIYAyABKAsyGC5idWYudmFsaWRhdGUuSW50MzJSdWxlc0gAEikKBWludDY0GAQgASgLMhguYnVmLnZhbGlkYXRlLkludDY0UnVsZXNIABIrCgZ1aW50MzIYBSABKAsyGS5idWYudmFsaWRhdGUuVUludDMyUnVsZXNIABIrCgZ1aW50NjQYBiABKAsyGS5idWYudmFsaWRhdGUuVUludDY0UnVsZXNIABIrCgZzaW50MzIYByABKAsyGS5idWYudmFsaWRhdGUuU0ludDMyUnVsZXNIABIrCgZzaW50NjQYCCABKAsyGS5idWYudmFsaWRhdGUuU0ludDY0UnVsZXNIABItCgdmaXhlZDMyGAkgASgLMhouYnVmLnZhbGlkYXRlLkZpeGVkMzJSdWxlc0gAEi0KB2ZpeGVkNjQYCiABKAsyGi5idWYudmFsaWRhdGUuRml4ZWQ2NFJ1bGVzSAASLwoIc2ZpeGVkMzIYCyABKAsyGy5idWYudmFsaWRhdGUuU0ZpeGVkMzJSdWxlc0gAEi8KCHNmaXhlZDY0GAwgASgLMhsuYnVmLnZhbGlkYXRlLlNGaXhlZDY0UnVsZXNIABInCgRib29sGA0gASgLMhcuYnVmLnZhbGlkYXRlLkJvb2xSdWxlc0gAEisKBnN0cmluZxgOIAEoCzIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlc0gAEikKBWJ5dGVzGA8gASgLMhguYnVmLnZhbGlkYXRlLkJ5dGVzUnVsZXNIABInCgRlbnVtGBAgASgLMhcuYnVmLnZhbGlkYXRlLkVudW1SdWxlc0gAEi8KCHJlcGVhdGVkGBIgASgLMhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXNIABIlCgNtYXAYEyABKAsyFi5idWYudmFsaWRhdGUuTWFwUnVsZXNIABIlCgNhbnkYFCABKAsyFi5idWYudmFsaWRhdGUuQW55UnVsZXNIABIvCghkdXJhdGlvbhgVIAEoCzIbLmJ1Zi52YWxpZGF0ZS5EdXJhdGlvblJ1bGVzSAASMgoKZmllbGRfbWFzaxgcIAEoCzIcLmJ1Zi52YWxpZGF0ZS5GaWVsZE1hc2tSdWxlc0gAEjEKCXRpbWVzdGFtcBgWIAEoCzIcLmJ1Zi52YWxpZGF0ZS5UaW1lc3RhbXBSdWxlc0gAQgYKBHR5cGVKBAgYEBlKBAgaEBtSB3NraXBwZWRSDGlnbm9yZV9lbXB0eSJVCg9QcmVkZWZpbmVkUnVsZXMSHwoDY2VsGAEgAygLMhIuYnVmLnZhbGlkYXRlLlJ1bGVKBAgYEBlKBAgaEBtSB3NraXBwZWRSDGlnbm9yZV9lbXB0eSL4FgoKRmxvYXRSdWxlcxJ9CgVjb25zdBgBIAEoAkJuwkhrCmkKC2Zsb2F0LmNvbnN0Glp0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICdtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSmQEKAmx0GAIgASgCQooBwkiGAQqDAQoIZmxvYXQubHQadyFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPj0gcnVsZXMubHQpPyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASqQEKA2x0ZRgDIAEoAkKZAcJIlQEKkgEKCWZsb2F0Lmx0ZRqEASFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUpPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEtAHCgJndBgEIAEoAkLBB8JIvQcKhgEKCGZsb2F0Lmd0GnohaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwq9AQoLZmxvYXQuZ3RfbHQarQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrHAQoVZmxvYXQuZ3RfbHRfZXhjbHVzaXZlGq0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKzQEKDGZsb2F0Lmd0X2x0ZRq8AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCtcBChZmbG9hdC5ndF9sdGVfZXhjbHVzaXZlGrwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARKcCAoDZ3RlGAUgASgCQowIwkiICAqVAQoJZmxvYXQuZ3RlGocBIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCswBCgxmbG9hdC5ndGVfbHQauwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCtYBChZmbG9hdC5ndGVfbHRfZXhjbHVzaXZlGrsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrcAQoNZmxvYXQuZ3RlX2x0ZRrKAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK5gEKF2Zsb2F0Lmd0ZV9sdGVfZXhjbHVzaXZlGsoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEnkKAmluGAYgAygCQm3CSGoKaAoIZmxvYXQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnAKBm5vdF9pbhgHIAMoAkJgwkhdClsKDGZsb2F0Lm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEm8KBmZpbml0ZRgIIAEoCEJfwkhcCloKDGZsb2F0LmZpbml0ZRpKcnVsZXMuZmluaXRlID8gKHRoaXMuaXNOYW4oKSB8fCB0aGlzLmlzSW5mKCkgPyAnbXVzdCBiZSBmaW5pdGUnIDogJycpIDogJycSKwoHZXhhbXBsZRgJIAMoAkIawkgXChUKDWZsb2F0LmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIooXCgtEb3VibGVSdWxlcxJ+CgVjb25zdBgBIAEoAUJvwkhsCmoKDGRvdWJsZS5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEpoBCgJsdBgCIAEoAUKLAcJIhwEKhAEKCWRvdWJsZS5sdBp3IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+PSBydWxlcy5sdCk/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKqAQoDbHRlGAMgASgBQpoBwkiWAQqTAQoKZG91YmxlLmx0ZRqEASFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUpPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEtUHCgJndBgEIAEoAULGB8JIwgcKhwEKCWRvdWJsZS5ndBp6IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKvgEKDGRvdWJsZS5ndF9sdBqtAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCsgBChZkb3VibGUuZ3RfbHRfZXhjbHVzaXZlGq0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKzgEKDWRvdWJsZS5ndF9sdGUavAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrYAQoXZG91YmxlLmd0X2x0ZV9leGNsdXNpdmUavAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEqEICgNndGUYBSABKAFCkQjCSI0ICpYBCgpkb3VibGUuZ3RlGocBIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCs0BCg1kb3VibGUuZ3RlX2x0GrsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrXAQoXZG91YmxlLmd0ZV9sdF9leGNsdXNpdmUauwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCt0BCg5kb3VibGUuZ3RlX2x0ZRrKAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK5wEKGGRvdWJsZS5ndGVfbHRlX2V4Y2x1c2l2ZRrKAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ6CgJpbhgGIAMoAUJuwkhrCmkKCWRvdWJsZS5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAcgAygBQmHCSF4KXAoNZG91YmxlLm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEnAKBmZpbml0ZRgIIAEoCEJgwkhdClsKDWRvdWJsZS5maW5pdGUaSnJ1bGVzLmZpbml0ZSA/ICh0aGlzLmlzTmFuKCkgfHwgdGhpcy5pc0luZigpID8gJ211c3QgYmUgZmluaXRlJyA6ICcnKSA6ICcnEiwKB2V4YW1wbGUYCSADKAFCG8JIGAoWCg5kb3VibGUuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4isBQKCkludDMyUnVsZXMSfQoFY29uc3QYASABKAVCbsJIawppCgtpbnQzMi5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEoQBCgJsdBgCIAEoBUJ2wkhzCnEKCGludDMyLmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpUBCgNsdGUYAyABKAVChQHCSIEBCn8KCWludDMyLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAAS+QYKAmd0GAQgASgFQuoGwkjmBgp0CghpbnQzMi5ndBpoIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKrQEKC2ludDMyLmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq1AQoVaW50MzIuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvQEKDGludDMyLmd0X2x0ZRqsAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKxQEKFmludDMyLmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEsUHCgNndGUYBSABKAVCtQfCSLEHCoIBCglpbnQzMi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq8AQoMaW50MzIuZ3RlX2x0GqsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCsQBChZpbnQzMi5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrMAQoNaW50MzIuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrUAQoXaW50MzIuZ3RlX2x0ZV9leGNsdXNpdmUauAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESeQoCaW4YBiADKAVCbcJIagpoCghpbnQzMi5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScAoGbm90X2luGAcgAygFQmDCSF0KWwoMaW50MzIubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSKwoHZXhhbXBsZRgIIAMoBUIawkgXChUKDWludDMyLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIrAUCgpJbnQ2NFJ1bGVzEn0KBWNvbnN0GAEgASgDQm7CSGsKaQoLaW50NjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKEAQoCbHQYAiABKANCdsJIcwpxCghpbnQ2NC5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKVAQoDbHRlGAMgASgDQoUBwkiBAQp/CglpbnQ2NC5sdGUaciFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEvkGCgJndBgEIAEoA0LqBsJI5gYKdAoIaW50NjQuZ3QaaCFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCq0BCgtpbnQ2NC5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtQEKFWludDY0Lmd0X2x0X2V4Y2x1c2l2ZRqbAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr0BCgxpbnQ2NC5ndF9sdGUarAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCsUBChZpbnQ2NC5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLFBwoDZ3RlGAUgASgDQrUHwkixBwqCAQoJaW50NjQuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKvAEKDGludDY0Lmd0ZV9sdBqrAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrEAQoWaW50NjQuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzAEKDWludDY0Lmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK1AEKF2ludDY0Lmd0ZV9sdGVfZXhjbHVzaXZlGrgBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEnkKAmluGAYgAygDQm3CSGoKaAoIaW50NjQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnAKBm5vdF9pbhgHIAMoA0JgwkhdClsKDGludDY0Lm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEisKB2V4YW1wbGUYCSADKANCGsJIFwoVCg1pbnQ2NC5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiLCFAoLVUludDMyUnVsZXMSfgoFY29uc3QYASABKA1Cb8JIbApqCgx1aW50MzIuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKFAQoCbHQYAiABKA1Cd8JIdApyCgl1aW50MzIubHQaZSFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASlwEKA2x0ZRgDIAEoDUKHAcJIgwEKgAEKCnVpbnQzMi5sdGUaciFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEv4GCgJndBgEIAEoDULvBsJI6wYKdQoJdWludDMyLmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwquAQoMdWludDMyLmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq2AQoWdWludDMyLmd0X2x0X2V4Y2x1c2l2ZRqbAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr4BCg11aW50MzIuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrGAQoXdWludDMyLmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEsoHCgNndGUYBSABKA1CugfCSLYHCoMBCgp1aW50MzIuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKvQEKDXVpbnQzMi5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxQEKF3VpbnQzMi5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrNAQoOdWludDMyLmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK1QEKGHVpbnQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ6CgJpbhgGIAMoDUJuwkhrCmkKCXVpbnQzMi5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAcgAygNQmHCSF4KXAoNdWludDMyLm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEiwKB2V4YW1wbGUYCCADKA1CG8JIGAoWCg51aW50MzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4iwhQKC1VJbnQ2NFJ1bGVzEn4KBWNvbnN0GAEgASgEQm/CSGwKagoMdWludDY0LmNvbnN0Glp0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICdtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycShQEKAmx0GAIgASgEQnfCSHQKcgoJdWludDY0Lmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpcBCgNsdGUYAyABKARChwHCSIMBCoABCgp1aW50NjQubHRlGnIhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ211c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABL+BgoCZ3QYBCABKARC7wbCSOsGCnUKCXVpbnQ2NC5ndBpoIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKrgEKDHVpbnQ2NC5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtgEKFnVpbnQ2NC5ndF9sdF9leGNsdXNpdmUamwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq+AQoNdWludDY0Lmd0X2x0ZRqsAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKxgEKF3VpbnQ2NC5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLKBwoDZ3RlGAUgASgEQroHwki2BwqDAQoKdWludDY0Lmd0ZRp1IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCr0BCg11aW50NjQuZ3RlX2x0GqsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCsUBChd1aW50NjQuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzQEKDnVpbnQ2NC5ndGVfbHRlGroBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtUBChh1aW50NjQuZ3RlX2x0ZV9leGNsdXNpdmUauAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESegoCaW4YBiADKARCbsJIawppCgl1aW50NjQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnEKBm5vdF9pbhgHIAMoBEJhwkheClwKDXVpbnQ2NC5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIsCgdleGFtcGxlGAggAygEQhvCSBgKFgoOdWludDY0LmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIsIUCgtTSW50MzJSdWxlcxJ+CgVjb25zdBgBIAEoEUJvwkhsCmoKDHNpbnQzMi5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEoUBCgJsdBgCIAEoEUJ3wkh0CnIKCXNpbnQzMi5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKXAQoDbHRlGAMgASgRQocBwkiDAQqAAQoKc2ludDMyLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAAS/gYKAmd0GAQgASgRQu8GwkjrBgp1CglzaW50MzIuZ3QaaCFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCq4BCgxzaW50MzIuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrYBChZzaW50MzIuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvgEKDXNpbnQzMi5ndF9sdGUarAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCsYBChdzaW50MzIuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAESygcKA2d0ZRgFIAEoEUK6B8JItgcKgwEKCnNpbnQzMi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq9AQoNc2ludDMyLmd0ZV9sdBqrAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrFAQoXc2ludDMyLmd0ZV9sdF9leGNsdXNpdmUaqQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs0BCg5zaW50MzIuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrVAQoYc2ludDMyLmd0ZV9sdGVfZXhjbHVzaXZlGrgBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEnoKAmluGAYgAygRQm7CSGsKaQoJc2ludDMyLmluGlwhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJxCgZub3RfaW4YByADKBFCYcJIXgpcCg1zaW50MzIubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLAoHZXhhbXBsZRgIIAMoEUIbwkgYChYKDnNpbnQzMi5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiLCFAoLU0ludDY0UnVsZXMSfgoFY29uc3QYASABKBJCb8JIbApqCgxzaW50NjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKFAQoCbHQYAiABKBJCd8JIdApyCglzaW50NjQubHQaZSFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASlwEKA2x0ZRgDIAEoEkKHAcJIgwEKgAEKCnNpbnQ2NC5sdGUaciFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEv4GCgJndBgEIAEoEkLvBsJI6wYKdQoJc2ludDY0Lmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwquAQoMc2ludDY0Lmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq2AQoWc2ludDY0Lmd0X2x0X2V4Y2x1c2l2ZRqbAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr4BCg1zaW50NjQuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrGAQoXc2ludDY0Lmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEsoHCgNndGUYBSABKBJCugfCSLYHCoMBCgpzaW50NjQuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKvQEKDXNpbnQ2NC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxQEKF3NpbnQ2NC5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrNAQoOc2ludDY0Lmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK1QEKGHNpbnQ2NC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ6CgJpbhgGIAMoEkJuwkhrCmkKCXNpbnQ2NC5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAcgAygSQmHCSF4KXAoNc2ludDY0Lm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEiwKB2V4YW1wbGUYCCADKBJCG8JIGAoWCg5zaW50NjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i0xQKDEZpeGVkMzJSdWxlcxJ/CgVjb25zdBgBIAEoB0JwwkhtCmsKDWZpeGVkMzIuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKGAQoCbHQYAiABKAdCeMJIdQpzCgpmaXhlZDMyLmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpgBCgNsdGUYAyABKAdCiAHCSIQBCoEBCgtmaXhlZDMyLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASgwcKAmd0GAQgASgHQvQGwkjwBgp2CgpmaXhlZDMyLmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqvAQoNZml4ZWQzMi5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtwEKF2ZpeGVkMzIuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvwEKDmZpeGVkMzIuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrHAQoYZml4ZWQzMi5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLPBwoDZ3RlGAUgASgHQr8Hwki7BwqEAQoLZml4ZWQzMi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq+AQoOZml4ZWQzMi5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxgEKGGZpeGVkMzIuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzgEKD2ZpeGVkMzIuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrWAQoZZml4ZWQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ7CgJpbhgGIAMoB0JvwkhsCmoKCmZpeGVkMzIuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnIKBm5vdF9pbhgHIAMoB0JiwkhfCl0KDmZpeGVkMzIubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLQoHZXhhbXBsZRgIIAMoB0IcwkgZChcKD2ZpeGVkMzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i0xQKDEZpeGVkNjRSdWxlcxJ/CgVjb25zdBgBIAEoBkJwwkhtCmsKDWZpeGVkNjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKGAQoCbHQYAiABKAZCeMJIdQpzCgpmaXhlZDY0Lmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpgBCgNsdGUYAyABKAZCiAHCSIQBCoEBCgtmaXhlZDY0Lmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASgwcKAmd0GAQgASgGQvQGwkjwBgp2CgpmaXhlZDY0Lmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqvAQoNZml4ZWQ2NC5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtwEKF2ZpeGVkNjQuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvwEKDmZpeGVkNjQuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrHAQoYZml4ZWQ2NC5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLPBwoDZ3RlGAUgASgGQr8Hwki7BwqEAQoLZml4ZWQ2NC5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq+AQoOZml4ZWQ2NC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxgEKGGZpeGVkNjQuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzgEKD2ZpeGVkNjQuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrWAQoZZml4ZWQ2NC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ7CgJpbhgGIAMoBkJvwkhsCmoKCmZpeGVkNjQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnIKBm5vdF9pbhgHIAMoBkJiwkhfCl0KDmZpeGVkNjQubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLQoHZXhhbXBsZRgIIAMoBkIcwkgZChcKD2ZpeGVkNjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i5RQKDVNGaXhlZDMyUnVsZXMSgAEKBWNvbnN0GAEgASgPQnHCSG4KbAoOc2ZpeGVkMzIuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKHAQoCbHQYAiABKA9CecJIdgp0CgtzZml4ZWQzMi5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKZAQoDbHRlGAMgASgPQokBwkiFAQqCAQoMc2ZpeGVkMzIubHRlGnIhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ211c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKIBwoCZ3QYBCABKA9C+QbCSPUGCncKC3NmaXhlZDMyLmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqwAQoOc2ZpeGVkMzIuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrgBChhzZml4ZWQzMi5ndF9sdF9leGNsdXNpdmUamwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrAAQoPc2ZpeGVkMzIuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrIAQoZc2ZpeGVkMzIuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES1AcKA2d0ZRgFIAEoD0LEB8JIwAcKhQEKDHNmaXhlZDMyLmd0ZRp1IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCr8BCg9zZml4ZWQzMi5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxwEKGXNmaXhlZDMyLmd0ZV9sdF9leGNsdXNpdmUaqQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs8BChBzZml4ZWQzMi5ndGVfbHRlGroBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtcBChpzZml4ZWQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ8CgJpbhgGIAMoD0JwwkhtCmsKC3NmaXhlZDMyLmluGlwhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJzCgZub3RfaW4YByADKA9CY8JIYApeCg9zZml4ZWQzMi5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIuCgdleGFtcGxlGAggAygPQh3CSBoKGAoQc2ZpeGVkMzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i5RQKDVNGaXhlZDY0UnVsZXMSgAEKBWNvbnN0GAEgASgQQnHCSG4KbAoOc2ZpeGVkNjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKHAQoCbHQYAiABKBBCecJIdgp0CgtzZml4ZWQ2NC5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKZAQoDbHRlGAMgASgQQokBwkiFAQqCAQoMc2ZpeGVkNjQubHRlGnIhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ211c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKIBwoCZ3QYBCABKBBC+QbCSPUGCncKC3NmaXhlZDY0Lmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqwAQoOc2ZpeGVkNjQuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrgBChhzZml4ZWQ2NC5ndF9sdF9leGNsdXNpdmUamwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrAAQoPc2ZpeGVkNjQuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrIAQoZc2ZpeGVkNjQuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES1AcKA2d0ZRgFIAEoEELEB8JIwAcKhQEKDHNmaXhlZDY0Lmd0ZRp1IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCr8BCg9zZml4ZWQ2NC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxwEKGXNmaXhlZDY0Lmd0ZV9sdF9leGNsdXNpdmUaqQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs8BChBzZml4ZWQ2NC5ndGVfbHRlGroBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtcBChpzZml4ZWQ2NC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ8CgJpbhgGIAMoEEJwwkhtCmsKC3NmaXhlZDY0LmluGlwhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJzCgZub3RfaW4YByADKBBCY8JIYApeCg9zZml4ZWQ2NC5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIuCgdleGFtcGxlGAggAygQQh3CSBoKGAoQc2ZpeGVkNjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4iwAEKCUJvb2xSdWxlcxJ8CgVjb25zdBgBIAEoCEJtwkhqCmgKCmJvb2wuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxIqCgdleGFtcGxlGAIgAygIQhnCSBYKFAoMYm9vbC5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAIi6jwKC1N0cmluZ1J1bGVzEoABCgVjb25zdBgBIAEoCUJxwkhuCmwKDHN0cmluZy5jb25zdBpcdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCBgJXNgJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycScQoDbGVuGBMgASgEQmTCSGEKXwoKc3RyaW5nLmxlbhpRdWludCh0aGlzLnNpemUoKSkgIT0gcnVsZXMubGVuID8gJ211c3QgYmUgJXMgY2hhcmFjdGVycycuZm9ybWF0KFtydWxlcy5sZW5dKSA6ICcnEokBCgdtaW5fbGVuGAIgASgEQnjCSHUKcwoOc3RyaW5nLm1pbl9sZW4aYXVpbnQodGhpcy5zaXplKCkpIDwgcnVsZXMubWluX2xlbiA/ICdtdXN0IGJlIGF0IGxlYXN0ICVzIGNoYXJhY3RlcnMnLmZvcm1hdChbcnVsZXMubWluX2xlbl0pIDogJycSiAEKB21heF9sZW4YAyABKARCd8JIdApyCg5zdHJpbmcubWF4X2xlbhpgdWludCh0aGlzLnNpemUoKSkgPiBydWxlcy5tYXhfbGVuID8gJ211c3QgYmUgYXQgbW9zdCAlcyBjaGFyYWN0ZXJzJy5mb3JtYXQoW3J1bGVzLm1heF9sZW5dKSA6ICcnEosBCglsZW5fYnl0ZXMYFCABKARCeMJIdQpzChBzdHJpbmcubGVuX2J5dGVzGl91aW50KGJ5dGVzKHRoaXMpLnNpemUoKSkgIT0gcnVsZXMubGVuX2J5dGVzID8gJ211c3QgYmUgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubGVuX2J5dGVzXSkgOiAnJxKUAQoJbWluX2J5dGVzGAQgASgEQoABwkh9CnsKEHN0cmluZy5taW5fYnl0ZXMaZ3VpbnQoYnl0ZXModGhpcykuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9ieXRlcyA/ICdtdXN0IGJlIGF0IGxlYXN0ICVzIGJ5dGVzJy5mb3JtYXQoW3J1bGVzLm1pbl9ieXRlc10pIDogJycSkgEKCW1heF9ieXRlcxgFIAEoBEJ/wkh8CnoKEHN0cmluZy5tYXhfYnl0ZXMaZnVpbnQoYnl0ZXModGhpcykuc2l6ZSgpKSA+IHJ1bGVzLm1heF9ieXRlcyA/ICdtdXN0IGJlIGF0IG1vc3QgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubWF4X2J5dGVzXSkgOiAnJxKHAQoHcGF0dGVybhgGIAEoCUJ2wkhzCnEKDnN0cmluZy5wYXR0ZXJuGl8hdGhpcy5tYXRjaGVzKHJ1bGVzLnBhdHRlcm4pID8gJ2RvZXMgbm90IG1hdGNoIHJlZ2V4IHBhdHRlcm4gYCVzYCcuZm9ybWF0KFtydWxlcy5wYXR0ZXJuXSkgOiAnJxJ+CgZwcmVmaXgYByABKAlCbsJIawppCg1zdHJpbmcucHJlZml4GlghdGhpcy5zdGFydHNXaXRoKHJ1bGVzLnByZWZpeCkgPyAnZG9lcyBub3QgaGF2ZSBwcmVmaXggYCVzYCcuZm9ybWF0KFtydWxlcy5wcmVmaXhdKSA6ICcnEnwKBnN1ZmZpeBgIIAEoCUJswkhpCmcKDXN0cmluZy5zdWZmaXgaViF0aGlzLmVuZHNXaXRoKHJ1bGVzLnN1ZmZpeCkgPyAnZG9lcyBub3QgaGF2ZSBzdWZmaXggYCVzYCcuZm9ybWF0KFtydWxlcy5zdWZmaXhdKSA6ICcnEooBCghjb250YWlucxgJIAEoCUJ4wkh1CnMKD3N0cmluZy5jb250YWlucxpgIXRoaXMuY29udGFpbnMocnVsZXMuY29udGFpbnMpID8gJ2RvZXMgbm90IGNvbnRhaW4gc3Vic3RyaW5nIGAlc2AnLmZvcm1hdChbcnVsZXMuY29udGFpbnNdKSA6ICcnEpEBCgxub3RfY29udGFpbnMYFyABKAlCe8JIeAp2ChNzdHJpbmcubm90X2NvbnRhaW5zGl90aGlzLmNvbnRhaW5zKHJ1bGVzLm5vdF9jb250YWlucykgPyAnY29udGFpbnMgc3Vic3RyaW5nIGAlc2AnLmZvcm1hdChbcnVsZXMubm90X2NvbnRhaW5zXSkgOiAnJxJ6CgJpbhgKIAMoCUJuwkhrCmkKCXN0cmluZy5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAsgAygJQmHCSF4KXAoNc3RyaW5nLm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEtkBCgVlbWFpbBgMIAEoCELHAcJIwwEKWwoMc3RyaW5nLmVtYWlsEh1tdXN0IGJlIGEgdmFsaWQgZW1haWwgYWRkcmVzcxosIXJ1bGVzLmVtYWlsIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc0VtYWlsKCkKZAoSc3RyaW5nLmVtYWlsX2VtcHR5EjJ2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgZW1haWwgYWRkcmVzcxoaIXJ1bGVzLmVtYWlsIHx8IHRoaXMgIT0gJydIABLhAQoIaG9zdG5hbWUYDSABKAhCzAHCSMgBCl8KD3N0cmluZy5ob3N0bmFtZRIYbXVzdCBiZSBhIHZhbGlkIGhvc3RuYW1lGjIhcnVsZXMuaG9zdG5hbWUgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSG9zdG5hbWUoKQplChVzdHJpbmcuaG9zdG5hbWVfZW1wdHkSLXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBob3N0bmFtZRodIXJ1bGVzLmhvc3RuYW1lIHx8IHRoaXMgIT0gJydIABLBAQoCaXAYDiABKAhCsgHCSK4BCk8KCXN0cmluZy5pcBIabXVzdCBiZSBhIHZhbGlkIElQIGFkZHJlc3MaJiFydWxlcy5pcCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcCgpClsKD3N0cmluZy5pcF9lbXB0eRIvdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIGFkZHJlc3MaFyFydWxlcy5pcCB8fCB0aGlzICE9ICcnSAAS0AEKBGlwdjQYDyABKAhCvwHCSLsBClYKC3N0cmluZy5pcHY0EhxtdXN0IGJlIGEgdmFsaWQgSVB2NCBhZGRyZXNzGikhcnVsZXMuaXB2NCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcCg0KQphChFzdHJpbmcuaXB2NF9lbXB0eRIxdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjQgYWRkcmVzcxoZIXJ1bGVzLmlwdjQgfHwgdGhpcyAhPSAnJ0gAEtABCgRpcHY2GBAgASgIQr8Bwki7AQpWCgtzdHJpbmcuaXB2NhIcbXVzdCBiZSBhIHZhbGlkIElQdjYgYWRkcmVzcxopIXJ1bGVzLmlwdjYgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXAoNikKYQoRc3RyaW5nLmlwdjZfZW1wdHkSMXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBJUHY2IGFkZHJlc3MaGSFydWxlcy5pcHY2IHx8IHRoaXMgIT0gJydIABK5AQoDdXJpGBEgASgIQqkBwkilAQpLCgpzdHJpbmcudXJpEhNtdXN0IGJlIGEgdmFsaWQgVVJJGighcnVsZXMudXJpIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc1VyaSgpClYKEHN0cmluZy51cmlfZW1wdHkSKHZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBVUkkaGCFydWxlcy51cmkgfHwgdGhpcyAhPSAnJ0gAEmoKB3VyaV9yZWYYEiABKAhCV8JIVApSCg5zdHJpbmcudXJpX3JlZhIdbXVzdCBiZSBhIHZhbGlkIFVSSSBSZWZlcmVuY2UaISFydWxlcy51cmlfcmVmIHx8IHRoaXMuaXNVcmlSZWYoKUgAEokCCgdhZGRyZXNzGBUgASgIQvUBwkjxAQp7Cg5zdHJpbmcuYWRkcmVzcxInbXVzdCBiZSBhIHZhbGlkIGhvc3RuYW1lLCBvciBpcCBhZGRyZXNzGkAhcnVsZXMuYWRkcmVzcyB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNIb3N0bmFtZSgpIHx8IHRoaXMuaXNJcCgpCnIKFHN0cmluZy5hZGRyZXNzX2VtcHR5Ejx2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgaG9zdG5hbWUsIG9yIGlwIGFkZHJlc3MaHCFydWxlcy5hZGRyZXNzIHx8IHRoaXMgIT0gJydIABKSAgoEdXVpZBgWIAEoCEKBAsJI/QEKnwEKC3N0cmluZy51dWlkEhRtdXN0IGJlIGEgdmFsaWQgVVVJRBp6IXJ1bGVzLnV1aWQgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykKWQoRc3RyaW5nLnV1aWRfZW1wdHkSKXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBVVUlEGhkhcnVsZXMudXVpZCB8fCB0aGlzICE9ICcnSAAS6gEKBXR1dWlkGCEgASgIQtgBwkjUAQptCgxzdHJpbmcudHV1aWQSHG11c3QgYmUgYSB2YWxpZCB0cmltbWVkIFVVSUQaPyFydWxlcy50dXVpZCB8fCB0aGlzID09ICcnIHx8IHRoaXMubWF0Y2hlcygnXlswLTlhLWZBLUZdezMyfSQnKQpjChJzdHJpbmcudHV1aWRfZW1wdHkSMXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCB0cmltbWVkIFVVSUQaGiFydWxlcy50dXVpZCB8fCB0aGlzICE9ICcnSAASkAIKEWlwX3dpdGhfcHJlZml4bGVuGBogASgIQvIBwkjuAQpyChhzdHJpbmcuaXBfd2l0aF9wcmVmaXhsZW4SGW11c3QgYmUgYSB2YWxpZCBJUCBwcmVmaXgaOyFydWxlcy5pcF93aXRoX3ByZWZpeGxlbiB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCgpCngKHnN0cmluZy5pcF93aXRoX3ByZWZpeGxlbl9lbXB0eRIudmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIHByZWZpeBomIXJ1bGVzLmlwX3dpdGhfcHJlZml4bGVuIHx8IHRoaXMgIT0gJydIABLJAgoTaXB2NF93aXRoX3ByZWZpeGxlbhgbIAEoCEKpAsJIpQIKjQEKGnN0cmluZy5pcHY0X3dpdGhfcHJlZml4bGVuEi9tdXN0IGJlIGEgdmFsaWQgSVB2NCBhZGRyZXNzIHdpdGggcHJlZml4IGxlbmd0aBo+IXJ1bGVzLmlwdjRfd2l0aF9wcmVmaXhsZW4gfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXBQcmVmaXgoNCkKkgEKIHN0cmluZy5pcHY0X3dpdGhfcHJlZml4bGVuX2VtcHR5EkR2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBhZGRyZXNzIHdpdGggcHJlZml4IGxlbmd0aBooIXJ1bGVzLmlwdjRfd2l0aF9wcmVmaXhsZW4gfHwgdGhpcyAhPSAnJ0gAEskCChNpcHY2X3dpdGhfcHJlZml4bGVuGBwgASgIQqkCwkilAgqNAQoac3RyaW5nLmlwdjZfd2l0aF9wcmVmaXhsZW4SL211c3QgYmUgYSB2YWxpZCBJUHY2IGFkZHJlc3Mgd2l0aCBwcmVmaXggbGVuZ3RoGj4hcnVsZXMuaXB2Nl93aXRoX3ByZWZpeGxlbiB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCg2KQqSAQogc3RyaW5nLmlwdjZfd2l0aF9wcmVmaXhsZW5fZW1wdHkSRHZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBJUHY2IGFkZHJlc3Mgd2l0aCBwcmVmaXggbGVuZ3RoGighcnVsZXMuaXB2Nl93aXRoX3ByZWZpeGxlbiB8fCB0aGlzICE9ICcnSAAS7AEKCWlwX3ByZWZpeBgdIAEoCELWAcJI0gEKZgoQc3RyaW5nLmlwX3ByZWZpeBIZbXVzdCBiZSBhIHZhbGlkIElQIHByZWZpeBo3IXJ1bGVzLmlwX3ByZWZpeCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCh0cnVlKQpoChZzdHJpbmcuaXBfcHJlZml4X2VtcHR5Ei52YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVAgcHJlZml4Gh4hcnVsZXMuaXBfcHJlZml4IHx8IHRoaXMgIT0gJydIABL9AQoLaXB2NF9wcmVmaXgYHiABKAhC5QHCSOEBCm8KEnN0cmluZy5pcHY0X3ByZWZpeBIbbXVzdCBiZSBhIHZhbGlkIElQdjQgcHJlZml4GjwhcnVsZXMuaXB2NF9wcmVmaXggfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXBQcmVmaXgoNCwgdHJ1ZSkKbgoYc3RyaW5nLmlwdjRfcHJlZml4X2VtcHR5EjB2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBwcmVmaXgaICFydWxlcy5pcHY0X3ByZWZpeCB8fCB0aGlzICE9ICcnSAAS/QEKC2lwdjZfcHJlZml4GB8gASgIQuUBwkjhAQpvChJzdHJpbmcuaXB2Nl9wcmVmaXgSG211c3QgYmUgYSB2YWxpZCBJUHY2IHByZWZpeBo8IXJ1bGVzLmlwdjZfcHJlZml4IHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc0lwUHJlZml4KDYsIHRydWUpCm4KGHN0cmluZy5pcHY2X3ByZWZpeF9lbXB0eRIwdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjYgcHJlZml4GiAhcnVsZXMuaXB2Nl9wcmVmaXggfHwgdGhpcyAhPSAnJ0gAEq8CCg1ob3N0X2FuZF9wb3J0GCAgASgIQpUCwkiRAgqTAQoUc3RyaW5nLmhvc3RfYW5kX3BvcnQSO211c3QgYmUgYSB2YWxpZCBob3N0IChob3N0bmFtZSBvciBJUCBhZGRyZXNzKSBhbmQgcG9ydCBwYWlyGj4hcnVsZXMuaG9zdF9hbmRfcG9ydCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNIb3N0QW5kUG9ydCh0cnVlKQp5ChpzdHJpbmcuaG9zdF9hbmRfcG9ydF9lbXB0eRI3dmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIGhvc3QgYW5kIHBvcnQgcGFpchoiIXJ1bGVzLmhvc3RfYW5kX3BvcnQgfHwgdGhpcyAhPSAnJ0gAEu4BCgR1bGlkGCMgASgIQt0BwkjZAQp8CgtzdHJpbmcudWxpZBIUbXVzdCBiZSBhIHZhbGlkIFVMSUQaVyFydWxlcy51bGlkIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5tYXRjaGVzKCdeWzAtN11bMC05QS1ISktNTlAtVFYtWmEtaGprbW5wLXR2LXpdezI1fSQnKQpZChFzdHJpbmcudWxpZF9lbXB0eRIpdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIFVMSUQaGSFydWxlcy51bGlkIHx8IHRoaXMgIT0gJydIABLUAgoMcHJvdG9idWZfZnFuGCUgASgIQrsCwki3AgqvAQoTc3RyaW5nLnByb3RvYnVmX2ZxbhItbXVzdCBiZSBhIHZhbGlkIGZ1bGx5LXF1YWxpZmllZCBQcm90b2J1ZiBuYW1lGmkhcnVsZXMucHJvdG9idWZfZnFuIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5tYXRjaGVzKCdeW0EtWmEtel9dW0EtWmEtel8wLTldKihcXC5bQS1aYS16X11bQS1aYS16XzAtOV0qKSokJykKggEKGXN0cmluZy5wcm90b2J1Zl9mcW5fZW1wdHkSQnZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBmdWxseS1xdWFsaWZpZWQgUHJvdG9idWYgbmFtZRohIXJ1bGVzLnByb3RvYnVmX2ZxbiB8fCB0aGlzICE9ICcnSAASkQMKEHByb3RvYnVmX2RvdF9mcW4YJiABKAhC9ALCSPACCs0BChdzdHJpbmcucHJvdG9idWZfZG90X2ZxbhJAbXVzdCBiZSBhIHZhbGlkIGZ1bGx5LXF1YWxpZmllZCBQcm90b2J1ZiBuYW1lIHdpdGggYSBsZWFkaW5nIGRvdBpwIXJ1bGVzLnByb3RvYnVmX2RvdF9mcW4gfHwgdGhpcyA9PSAnJyB8fCB0aGlzLm1hdGNoZXMoJ15cXC5bQS1aYS16X11bQS1aYS16XzAtOV0qKFxcLltBLVphLXpfXVtBLVphLXpfMC05XSopKiQnKQqdAQodc3RyaW5nLnByb3RvYnVmX2RvdF9mcW5fZW1wdHkSVXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBmdWxseS1xdWFsaWZpZWQgUHJvdG9idWYgbmFtZSB3aXRoIGEgbGVhZGluZyBkb3QaJSFydWxlcy5wcm90b2J1Zl9kb3RfZnFuIHx8IHRoaXMgIT0gJydIABKcBQoQd2VsbF9rbm93bl9yZWdleBgYIAEoDjIYLmJ1Zi52YWxpZGF0ZS5Lbm93blJlZ2V4QuUEwkjhBArqAQojc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX25hbWUSIG11c3QgYmUgYSB2YWxpZCBIVFRQIGhlYWRlciBuYW1lGqABcnVsZXMud2VsbF9rbm93bl9yZWdleCAhPSAxIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5tYXRjaGVzKCFoYXMocnVsZXMuc3RyaWN0KSB8fCBydWxlcy5zdHJpY3QgPydeOj9bMC05YS16QS1aISMkJSZcJyorLS5eX3x+XHg2MF0rJCcgOideW15cdTAwMDBcdTAwMEFcdTAwMERdKyQnKQqNAQopc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX25hbWVfZW1wdHkSNXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBIVFRQIGhlYWRlciBuYW1lGilydWxlcy53ZWxsX2tub3duX3JlZ2V4ICE9IDEgfHwgdGhpcyAhPSAnJwrhAQokc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX3ZhbHVlEiFtdXN0IGJlIGEgdmFsaWQgSFRUUCBoZWFkZXIgdmFsdWUalQFydWxlcy53ZWxsX2tub3duX3JlZ2V4ICE9IDIgfHwgdGhpcy5tYXRjaGVzKCFoYXMocnVsZXMuc3RyaWN0KSB8fCBydWxlcy5zdHJpY3QgPydeW15cdTAwMDAtXHUwMDA4XHUwMDBBLVx1MDAxRlx1MDA3Rl0qJCcgOideW15cdTAwMDBcdTAwMEFcdTAwMERdKiQnKUgAEg4KBnN0cmljdBgZIAEoCBIsCgdleGFtcGxlGCIgAygJQhvCSBgKFgoOc3RyaW5nLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkIMCgp3ZWxsX2tub3duIt0RCgpCeXRlc1J1bGVzEnoKBWNvbnN0GAEgASgMQmvCSGgKZgoLYnl0ZXMuY29uc3QaV3RoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgYmUgJXgnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxJrCgNsZW4YDSABKARCXsJIWwpZCglieXRlcy5sZW4aTHVpbnQodGhpcy5zaXplKCkpICE9IHJ1bGVzLmxlbiA/ICdtdXN0IGJlICVzIGJ5dGVzJy5mb3JtYXQoW3J1bGVzLmxlbl0pIDogJycSgwEKB21pbl9sZW4YAiABKARCcsJIbwptCg1ieXRlcy5taW5fbGVuGlx1aW50KHRoaXMuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9sZW4gPyAnbXVzdCBiZSBhdCBsZWFzdCAlcyBieXRlcycuZm9ybWF0KFtydWxlcy5taW5fbGVuXSkgOiAnJxKCAQoHbWF4X2xlbhgDIAEoBEJxwkhuCmwKDWJ5dGVzLm1heF9sZW4aW3VpbnQodGhpcy5zaXplKCkpID4gcnVsZXMubWF4X2xlbiA/ICdtdXN0IGJlIGF0IG1vc3QgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubWF4X2xlbl0pIDogJycSigEKB3BhdHRlcm4YBCABKAlCecJIdgp0Cg1ieXRlcy5wYXR0ZXJuGmMhc3RyaW5nKHRoaXMpLm1hdGNoZXMocnVsZXMucGF0dGVybikgPyAnbXVzdCBtYXRjaCByZWdleCBwYXR0ZXJuIGAlc2AnLmZvcm1hdChbcnVsZXMucGF0dGVybl0pIDogJycSewoGcHJlZml4GAUgASgMQmvCSGgKZgoMYnl0ZXMucHJlZml4GlYhdGhpcy5zdGFydHNXaXRoKHJ1bGVzLnByZWZpeCkgPyAnZG9lcyBub3QgaGF2ZSBwcmVmaXggJXgnLmZvcm1hdChbcnVsZXMucHJlZml4XSkgOiAnJxJ5CgZzdWZmaXgYBiABKAxCacJIZgpkCgxieXRlcy5zdWZmaXgaVCF0aGlzLmVuZHNXaXRoKHJ1bGVzLnN1ZmZpeCkgPyAnZG9lcyBub3QgaGF2ZSBzdWZmaXggJXgnLmZvcm1hdChbcnVsZXMuc3VmZml4XSkgOiAnJxJ9Cghjb250YWlucxgHIAEoDEJrwkhoCmYKDmJ5dGVzLmNvbnRhaW5zGlQhdGhpcy5jb250YWlucyhydWxlcy5jb250YWlucykgPyAnZG9lcyBub3QgY29udGFpbiAleCcuZm9ybWF0KFtydWxlcy5jb250YWluc10pIDogJycSoQEKAmluGAggAygMQpQBwkiQAQqNAQoIYnl0ZXMuaW4agAFnZXRGaWVsZChydWxlcywgJ2luJykuc2l6ZSgpID4gMCAmJiAhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJwCgZub3RfaW4YCSADKAxCYMJIXQpbCgxieXRlcy5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxLlAQoCaXAYCiABKAhC1gHCSNIBCm4KCGJ5dGVzLmlwEhptdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcxpGIXJ1bGVzLmlwIHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gNCB8fCB0aGlzLnNpemUoKSA9PSAxNgpgCg5ieXRlcy5pcF9lbXB0eRIvdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIGFkZHJlc3MaHSFydWxlcy5pcCB8fCB0aGlzLnNpemUoKSAhPSAwSAAS3gEKBGlwdjQYCyABKAhCzQHCSMkBCl8KCmJ5dGVzLmlwdjQSHG11c3QgYmUgYSB2YWxpZCBJUHY0IGFkZHJlc3MaMyFydWxlcy5pcHY0IHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gNApmChBieXRlcy5pcHY0X2VtcHR5EjF2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBhZGRyZXNzGh8hcnVsZXMuaXB2NCB8fCB0aGlzLnNpemUoKSAhPSAwSAAS3wEKBGlwdjYYDCABKAhCzgHCSMoBCmAKCmJ5dGVzLmlwdjYSHG11c3QgYmUgYSB2YWxpZCBJUHY2IGFkZHJlc3MaNCFydWxlcy5pcHY2IHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gMTYKZgoQYnl0ZXMuaXB2Nl9lbXB0eRIxdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjYgYWRkcmVzcxofIXJ1bGVzLmlwdjYgfHwgdGhpcy5zaXplKCkgIT0gMEgAEs8BCgR1dWlkGA8gASgIQr4Bwki6AQpYCgpieXRlcy51dWlkEhRtdXN0IGJlIGEgdmFsaWQgVVVJRBo0IXJ1bGVzLnV1aWQgfHwgdGhpcy5zaXplKCkgPT0gMCB8fCB0aGlzLnNpemUoKSA9PSAxNgpeChBieXRlcy51dWlkX2VtcHR5Eil2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgVVVJRBofIXJ1bGVzLnV1aWQgfHwgdGhpcy5zaXplKCkgIT0gMEgAEisKB2V4YW1wbGUYDiADKAxCGsJIFwoVCg1ieXRlcy5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCDAoKd2VsbF9rbm93biLBAwoJRW51bVJ1bGVzEnwKBWNvbnN0GAEgASgFQm3CSGoKaAoKZW51bS5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEhQKDGRlZmluZWRfb25seRgCIAEoCBJ4CgJpbhgDIAMoBUJswkhpCmcKB2VudW0uaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEm8KBm5vdF9pbhgEIAMoBUJfwkhcCloKC2VudW0ubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSKgoHZXhhbXBsZRgFIAMoBUIZwkgWChQKDGVudW0uZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACIu0DCg1SZXBlYXRlZFJ1bGVzEpYBCgltaW5faXRlbXMYASABKARCggHCSH8KfQoScmVwZWF0ZWQubWluX2l0ZW1zGmd1aW50KHRoaXMuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9pdGVtcyA/ICdtdXN0IGNvbnRhaW4gYXQgbGVhc3QgJWQgaXRlbShzKScuZm9ybWF0KFtydWxlcy5taW5faXRlbXNdKSA6ICcnEpwBCgltYXhfaXRlbXMYAiABKARCiAHCSIQBCoEBChJyZXBlYXRlZC5tYXhfaXRlbXMaa3VpbnQodGhpcy5zaXplKCkpID4gcnVsZXMubWF4X2l0ZW1zID8gJ211c3QgY29udGFpbiBubyBtb3JlIHRoYW4gJXMgaXRlbShzKScuZm9ybWF0KFtydWxlcy5tYXhfaXRlbXNdKSA6ICcnEnAKBnVuaXF1ZRgDIAEoCEJgwkhdClsKD3JlcGVhdGVkLnVuaXF1ZRIocmVwZWF0ZWQgdmFsdWUgbXVzdCBjb250YWluIHVuaXF1ZSBpdGVtcxoeIXJ1bGVzLnVuaXF1ZSB8fCB0aGlzLnVuaXF1ZSgpEicKBWl0ZW1zGAQgASgLMhguYnVmLnZhbGlkYXRlLkZpZWxkUnVsZXMqCQjoBxCAgICAAiKKAwoITWFwUnVsZXMSjwEKCW1pbl9wYWlycxgBIAEoBEJ8wkh5CncKDW1hcC5taW5fcGFpcnMaZnVpbnQodGhpcy5zaXplKCkpIDwgcnVsZXMubWluX3BhaXJzID8gJ21hcCBtdXN0IGJlIGF0IGxlYXN0ICVkIGVudHJpZXMnLmZvcm1hdChbcnVsZXMubWluX3BhaXJzXSkgOiAnJxKOAQoJbWF4X3BhaXJzGAIgASgEQnvCSHgKdgoNbWFwLm1heF9wYWlycxpldWludCh0aGlzLnNpemUoKSkgPiBydWxlcy5tYXhfcGFpcnMgPyAnbWFwIG11c3QgYmUgYXQgbW9zdCAlZCBlbnRyaWVzJy5mb3JtYXQoW3J1bGVzLm1heF9wYWlyc10pIDogJycSJgoEa2V5cxgEIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GaWVsZFJ1bGVzEigKBnZhbHVlcxgFIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GaWVsZFJ1bGVzKgkI6AcQgICAgAIiJgoIQW55UnVsZXMSCgoCaW4YAiADKAkSDgoGbm90X2luGAMgAygJIr8WCg1EdXJhdGlvblJ1bGVzEpsBCgVjb25zdBgCIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkJxwkhuCmwKDmR1cmF0aW9uLmNvbnN0Glp0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICdtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSogEKAmx0GAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQnnCSHYKdAoLZHVyYXRpb24ubHQaZSFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAAStAEKA2x0ZRgEIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkKJAcJIhQEKggEKDGR1cmF0aW9uLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASowcKAmd0GAUgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQvkGwkj1Bgp3CgtkdXJhdGlvbi5ndBpoIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKsAEKDmR1cmF0aW9uLmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq4AQoYZHVyYXRpb24uZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKwAEKD2R1cmF0aW9uLmd0X2x0ZRqsAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKyAEKGWR1cmF0aW9uLmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEu8HCgNndGUYBiABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CxAfCSMAHCoUBCgxkdXJhdGlvbi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq/AQoPZHVyYXRpb24uZ3RlX2x0GqsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCscBChlkdXJhdGlvbi5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrPAQoQZHVyYXRpb24uZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrXAQoaZHVyYXRpb24uZ3RlX2x0ZV9leGNsdXNpdmUauAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESlwEKAmluGAcgAygLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQnDCSG0KawoLZHVyYXRpb24uaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEo4BCgZub3RfaW4YCCADKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CY8JIYApeCg9kdXJhdGlvbi5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxJJCgdleGFtcGxlGAkgAygLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQh3CSBoKGAoQZHVyYXRpb24uZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i6wUKDkZpZWxkTWFza1J1bGVzErkBCgVjb25zdBgBIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCjQHCSIkBCoYBChBmaWVsZF9tYXNrLmNvbnN0GnJ0aGlzLnBhdGhzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKS5wYXRocyA/ICdtdXN0IGVxdWFsIHBhdGhzICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKS5wYXRoc10pIDogJycS0wEKAmluGAIgAygJQsYBwkjCAQq/AQoNZmllbGRfbWFzay5pbhqtASF0aGlzLnBhdGhzLmFsbChwLCBwIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSB8fCBnZXRGaWVsZChydWxlcywgJ2luJykuZXhpc3RzKGYsIHAuc3RhcnRzV2l0aChmKycuJykpKSA/ICdtdXN0IG9ubHkgY29udGFpbiBwYXRocyBpbiAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEu0BCgZub3RfaW4YAyADKAlC3AHCSNgBCtUBChFmaWVsZF9tYXNrLm5vdF9pbhq/ASF0aGlzLnBhdGhzLmFsbChwLCAhKHAgaW4gZ2V0RmllbGQocnVsZXMsICdub3RfaW4nKSB8fCBnZXRGaWVsZChydWxlcywgJ25vdF9pbicpLmV4aXN0cyhmLCBwLnN0YXJ0c1dpdGgoZisnLicpKSkpID8gJ211c3Qgbm90IGNvbnRhaW4gYW55IHBhdGhzIGluICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnbm90X2luJyldKSA6ICcnEkwKB2V4YW1wbGUYBCADKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQh/CSBwKGgoSZmllbGRfbWFzay5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAIisBcKDlRpbWVzdGFtcFJ1bGVzEp0BCgVjb25zdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCcsJIbwptCg90aW1lc3RhbXAuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKkAQoCbHQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQnrCSHcKdQoMdGltZXN0YW1wLmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAErYBCgNsdGUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQooBwkiGAQqDAQoNdGltZXN0YW1wLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASZgoGbHRfbm93GAcgASgIQlTCSFEKTwoQdGltZXN0YW1wLmx0X25vdxo7KHJ1bGVzLmx0X25vdyAmJiB0aGlzID4gbm93KSA/ICdtdXN0IGJlIGxlc3MgdGhhbiBub3cnIDogJydIABKpBwoCZ3QYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQv4Gwkj6Bgp4Cgx0aW1lc3RhbXAuZ3QaaCFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCrEBCg90aW1lc3RhbXAuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrkBChl0aW1lc3RhbXAuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKwQEKEHRpbWVzdGFtcC5ndF9sdGUarAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCskBChp0aW1lc3RhbXAuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES9QcKA2d0ZRgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCyQfCSMUHCoYBCg10aW1lc3RhbXAuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKwAEKEHRpbWVzdGFtcC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKyAEKGnRpbWVzdGFtcC5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrQAQoRdGltZXN0YW1wLmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK2AEKG3RpbWVzdGFtcC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJpCgZndF9ub3cYCCABKAhCV8JIVApSChB0aW1lc3RhbXAuZ3Rfbm93Gj4ocnVsZXMuZ3Rfbm93ICYmIHRoaXMgPCBub3cpID8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG5vdycgOiAnJ0gBErEBCgZ3aXRoaW4YCSABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25ChQHCSIEBCn8KEHRpbWVzdGFtcC53aXRoaW4aa3RoaXMgPCBub3ctcnVsZXMud2l0aGluIHx8IHRoaXMgPiBub3crcnVsZXMud2l0aGluID8gJ211c3QgYmUgd2l0aGluICVzIG9mIG5vdycuZm9ybWF0KFtydWxlcy53aXRoaW5dKSA6ICcnEksKB2V4YW1wbGUYCiADKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQh7CSBsKGQoRdGltZXN0YW1wLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIjkKClZpb2xhdGlvbnMSKwoKdmlvbGF0aW9ucxgBIAMoCzIXLmJ1Zi52YWxpZGF0ZS5WaW9sYXRpb24inwEKCVZpb2xhdGlvbhImCgVmaWVsZBgFIAEoCzIXLmJ1Zi52YWxpZGF0ZS5GaWVsZFBhdGgSJQoEcnVsZRgGIAEoCzIXLmJ1Zi52YWxpZGF0ZS5GaWVsZFBhdGgSDwoHcnVsZV9pZBgCIAEoCRIPCgdtZXNzYWdlGAMgASgJEg8KB2Zvcl9rZXkYBCABKAhKBAgBEAJSCmZpZWxkX3BhdGgiPQoJRmllbGRQYXRoEjAKCGVsZW1lbnRzGAEgAygLMh4uYnVmLnZhbGlkYXRlLkZpZWxkUGF0aEVsZW1lbnQi6QIKEEZpZWxkUGF0aEVsZW1lbnQSFAoMZmllbGRfbnVtYmVyGAEgASgFEhIKCmZpZWxkX25hbWUYAiABKAkSPgoKZmllbGRfdHlwZRgDIAEoDjIqLmdvb2dsZS5wcm90b2J1Zi5GaWVsZERlc2NyaXB0b3JQcm90by5UeXBlEjwKCGtleV90eXBlGAQgASgOMiouZ29vZ2xlLnByb3RvYnVmLkZpZWxkRGVzY3JpcHRvclByb3RvLlR5cGUSPgoKdmFsdWVfdHlwZRgFIAEoDjIqLmdvb2dsZS5wcm90b2J1Zi5GaWVsZERlc2NyaXB0b3JQcm90by5UeXBlEg8KBWluZGV4GAYgASgESAASEgoIYm9vbF9rZXkYByABKAhIABIRCgdpbnRfa2V5GAggASgDSAASEgoIdWludF9rZXkYCSABKARIABIUCgpzdHJpbmdfa2V5GAogASgJSABCCwoJc3Vic2NyaXB0KqEBCgZJZ25vcmUSFgoSSUdOT1JFX1VOU1BFQ0lGSUVEEAASGAoUSUdOT1JFX0lGX1pFUk9fVkFMVUUQARIRCg1JR05PUkVfQUxXQVlTEAMiBAgCEAIqDElHTk9SRV9FTVBUWSoOSUdOT1JFX0RFRkFVTFQqF0lHTk9SRV9JRl9ERUZBVUxUX1ZBTFVFKhVJR05PUkVfSUZfVU5QT1BVTEFURUQqbgoKS25vd25SZWdleBIbChdLTk9XTl9SRUdFWF9VTlNQRUNJRklFRBAAEiAKHEtOT1dOX1JFR0VYX0hUVFBfSEVBREVSX05BTUUQARIhCh1LTk9XTl9SRUdFWF9IVFRQX0hFQURFUl9WQUxVRRACOlYKB21lc3NhZ2USHy5nb29nbGUucHJvdG9idWYuTWVzc2FnZU9wdGlvbnMYhwkgASgLMhouYnVmLnZhbGlkYXRlLk1lc3NhZ2VSdWxlc1IHbWVzc2FnZTpOCgVvbmVvZhIdLmdvb2dsZS5wcm90b2J1Zi5PbmVvZk9wdGlvbnMYhwkgASgLMhguYnVmLnZhbGlkYXRlLk9uZW9mUnVsZXNSBW9uZW9mOk4KBWZpZWxkEh0uZ29vZ2xlLnByb3RvYnVmLkZpZWxkT3B0aW9ucxiHCSABKAsyGC5idWYudmFsaWRhdGUuRmllbGRSdWxlc1IFZmllbGQ6XQoKcHJlZGVmaW5lZBIdLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE9wdGlvbnMYiAkgASgLMh0uYnVmLnZhbGlkYXRlLlByZWRlZmluZWRSdWxlc1IKcHJlZGVmaW5lZEJuChJidWlsZC5idWYudmFsaWRhdGVCDVZhbGlkYXRlUHJvdG9QAVpHYnVmLmJ1aWxkL2dlbi9nby9idWZidWlsZC9wcm90b3ZhbGlkYXRlL3Byb3RvY29sYnVmZmVycy9nby9idWYvdmFsaWRhdGU",[file_google_protobuf_descriptor2,file_google_protobuf_duration2,file_google_protobuf_field_mask2,file_google_protobuf_timestamp2]),RuleSchema=messageDesc3(file_buf_validate_validate2,0);var FieldRulesSchema=messageDesc3(file_buf_validate_validate2,4);var FloatRulesSchema=messageDesc3(file_buf_validate_validate2,6),DoubleRulesSchema=messageDesc3(file_buf_validate_validate2,7),Int32RulesSchema=messageDesc3(file_buf_validate_validate2,8),Int64RulesSchema=messageDesc3(file_buf_validate_validate2,9),UInt32RulesSchema=messageDesc3(file_buf_validate_validate2,10),UInt64RulesSchema=messageDesc3(file_buf_validate_validate2,11),SInt32RulesSchema=messageDesc3(file_buf_validate_validate2,12),SInt64RulesSchema=messageDesc3(file_buf_validate_validate2,13),Fixed32RulesSchema=messageDesc3(file_buf_validate_validate2,14),Fixed64RulesSchema=messageDesc3(file_buf_validate_validate2,15),SFixed32RulesSchema=messageDesc3(file_buf_validate_validate2,16),SFixed64RulesSchema=messageDesc3(file_buf_validate_validate2,17),BoolRulesSchema=messageDesc3(file_buf_validate_validate2,18),StringRulesSchema=messageDesc3(file_buf_validate_validate2,19),BytesRulesSchema=messageDesc3(file_buf_validate_validate2,20),EnumRulesSchema=messageDesc3(file_buf_validate_validate2,21),RepeatedRulesSchema=messageDesc3(file_buf_validate_validate2,22),MapRulesSchema=messageDesc3(file_buf_validate_validate2,23),AnyRulesSchema=messageDesc3(file_buf_validate_validate2,24),DurationRulesSchema=messageDesc3(file_buf_validate_validate2,25),FieldMaskRulesSchema=messageDesc3(file_buf_validate_validate2,26),TimestampRulesSchema=messageDesc3(file_buf_validate_validate2,27);var ViolationSchema=messageDesc3(file_buf_validate_validate2,29),FieldPathSchema=messageDesc3(file_buf_validate_validate2,30),FieldPathElementSchema=messageDesc3(file_buf_validate_validate2,31),Ignore2;(function(Ignore3){Ignore3[Ignore3.UNSPECIFIED=0]="UNSPECIFIED",Ignore3[Ignore3.IF_ZERO_VALUE=1]="IF_ZERO_VALUE",Ignore3[Ignore3.ALWAYS=3]="ALWAYS"})(Ignore2||(Ignore2={}));var KnownRegex2;(function(KnownRegex3){KnownRegex3[KnownRegex3.UNSPECIFIED=0]="UNSPECIFIED",KnownRegex3[KnownRegex3.HTTP_HEADER_NAME=1]="HTTP_HEADER_NAME",KnownRegex3[KnownRegex3.HTTP_HEADER_VALUE=2]="HTTP_HEADER_VALUE"})(KnownRegex2||(KnownRegex2={}));var message=extDesc2(file_buf_validate_validate2,0),oneof=extDesc2(file_buf_validate_validate2,1),field=extDesc2(file_buf_validate_validate2,2),predefined=extDesc2(file_buf_validate_validate2,3);var CompilationError=class extends Error{constructor(message6,options){super(message6,options),this.name="CompilationError",Object.setPrototypeOf(this,new.target.prototype)}},RuntimeError=class extends Error{constructor(message6,options){super(message6,options),this.name="RuntimeError",Object.setPrototypeOf(this,new.target.prototype)}},ValidationError=class extends Error{constructor(violations){super(validationErrorMessage(violations)),this.name="ValidationError",Object.setPrototypeOf(this,new.target.prototype),this.violations=violations}};function validationErrorMessage(violations){return violations.length==0?"validation failed":violations.length==1?violations[0].toString():violations[0].toString()+`, and ${violations.length-1} more violation${violations.length>2?"s":""}`}var Violation=class{constructor(message6,ruleId,field3,rule,forKey){this.message=message6,this.ruleId=ruleId,this.field=field3,this.rule=rule,this.forKey=forKey}toString(){let path14=pathToString(this.field);return path14.length>0&&(path14+=": "),path14+`${this.message} [${this.ruleId}]`}};function violationToProto(violation){return[create2(ViolationSchema,{field:violation.field.length>0?pathToProto(violation.field):void 0,rule:violation.rule.length>0?pathToProto(violation.rule):void 0,ruleId:violation.ruleId,message:violation.message.length>0?violation.message:void 0,forKey:violation.forKey}),ViolationSchema]}function pathToProto(path14){let elements=[];for(let[i6,e6]of path14.entries())switch(e6.kind){case"field":elements.push(create2(FieldPathElementSchema,{fieldName:e6.name,fieldNumber:e6.number,fieldType:fieldType(e6)}));break;case"extension":elements.push(create2(FieldPathElementSchema,{fieldName:"["+e6.typeName+"]",fieldNumber:e6.number,fieldType:e6.proto.type}));break;case"oneof":elements.push(create2(FieldPathElementSchema,{fieldName:e6.name}));break;case"list_sub":{let prevProto=elements[elements.length-1];if(prevProto){let prevPath=path14[i6-1];prevProto.subscript=getListSub(e6.index,prevPath)}break}case"map_sub":{let prevProto=elements[elements.length-1];if(prevProto){let prevPath=path14[i6-1];setMapSub(prevProto,e6.key,prevPath)}break}}return create2(FieldPathSchema,{elements})}function fieldType(field3){return field3.fieldKind=="message"&&field3.delimitedEncoding?FieldDescriptorProto_Type2.GROUP:field3.proto.type}function getListSub(index2,prevPath){return prevPath?.kind=="field"&&prevPath.fieldKind=="list"?{case:"index",value:BigInt(index2)}:{case:void 0}}function setMapSub(proto2,key,prevPath){if(!(prevPath?.kind!="field"||prevPath.fieldKind!="map")){switch(proto2.keyType=prevPath.mapKey,prevPath.mapKind){case"scalar":proto2.valueType=prevPath.scalar;break;case"enum":proto2.valueType=FieldDescriptorProto_Type2.ENUM;break;case"message":proto2.valueType=FieldDescriptorProto_Type2.MESSAGE;break}switch(typeof key){case"boolean":prevPath.mapKey===ScalarType2.BOOL&&(proto2.subscript={case:"boolKey",value:key});break;case"string":prevPath.mapKey===ScalarType2.STRING&&(proto2.subscript={case:"stringKey",value:key});break;case"number":case"bigint":switch(prevPath.mapKey){case ScalarType2.INT32:case ScalarType2.SINT32:case ScalarType2.SFIXED32:case ScalarType2.INT64:case ScalarType2.SINT64:case ScalarType2.SFIXED64:proto2.subscript={case:"intKey",value:BigInt(key)};break;case ScalarType2.UINT32:case ScalarType2.FIXED32:case ScalarType2.UINT64:case ScalarType2.FIXED64:proto2.subscript={case:"uintKey",value:BigInt(key)};break}break}}}var Cursor=class _Cursor{static create(root5,failFast){return new _Cursor(root5,failFast,[],buildPath(root5))}constructor(root5,failFast,violations,builder2){this.root=root5,this.failFast=failFast,this.violations=violations,this.builder=builder2}get violated(){return this.violations.length>0}violate(message6,ruleId,rulePath,forMapKey=!1){this.violations.push(new Violation(message6,ruleId,this.builder.toPath(),rulePath,forMapKey)),this.failFast&&this.throwIfViolated()}throwIfViolated(){if(this.violated)throw new ValidationError(this.violations)}getPath(){return this.builder.toPath()}add(path14){return this.cloneWith(this.builder.clone().add(path14))}field(field3){return this.cloneWith(this.builder.clone().field(field3))}oneof(oneof2){return this.cloneWith(this.builder.clone().oneof(oneof2))}extension(ext){return this.cloneWith(this.builder.clone().extension(ext))}list(index2){return this.cloneWith(this.builder.clone().list(index2))}mapKey(key){return this.cloneWith(this.builder.clone().map(key))}cloneWith(path14){return new _Cursor(this.root,this.failFast,this.violations,path14)}};var EvalNoop=class _EvalNoop{static get(){return _EvalNoop.instance}eval(){}prune(){return!0}};EvalNoop.instance=new EvalNoop;var EvalMany=class{constructor(...evals){this.many=evals.flat()}add(...evals){return this.many.push(...evals),this}eval(val,cursor){for(let e6 of this.many)e6.eval(val,cursor)}prune(){return this.many=this.many.filter(e6=>!e6.prune()),this.many.length==0}},EvalListItems=class{constructor(condition,pass2){this.condition=condition,this.pass=pass2}eval(val,cursor){for(let i6=0;i6<val.size;i6++){let t=val.get(i6);this.condition.check(t)&&this.pass.eval(t,cursor.list(i6))}}prune(){return this.pass.prune()||this.condition.never}},EvalMapEntries=class{constructor(keyCondition,key,valueCondition,value){this.keyCondition=keyCondition,this.key=key,this.valueCondition=valueCondition,this.value=value}eval(val,cursor){if(!(this.keyCondition.never&&this.valueCondition.never))for(let[key,value]of val){let c5=cursor.mapKey(key);this.keyCondition.check(key)&&this.key.eval(key,c5),this.valueCondition.check(value)&&this.value.eval(value,c5)}}prune(){let key=this.key.prune()||this.keyCondition.never,value=this.value.prune()||this.valueCondition.never;return key&&value}},EvalField=class{constructor(field3,required,legacyRequired,condition,pass2){this.field=field3,this.required=required,this.legacyRequired=legacyRequired,this.condition=condition,this.pass=pass2}eval(val,cursor){if((this.required||this.legacyRequired)&&!val.isSet(this.field)){this.required?cursor.field(this.field).violate("value is required","required",[FieldRulesSchema.field.required]):cursor.field(this.field).violate("value is required","legacy_required",[]);return}if(this.condition.check(val)){let fieldVal=val.get(this.field);this.pass.eval(fieldVal,cursor.field(this.field))}}prune(){return this.condition.never&&!this.required&&!this.legacyRequired}},EvalOneofRequired=class{constructor(oneof2){this.oneof=oneof2}eval(val,cursor){this.oneof.fields.some(f5=>val.isSet(f5))||cursor.oneof(this.oneof).violate("exactly one field is required in oneof","required",[])}prune(){return!1}},EvalEnumDefinedOnly=class{constructor(descEnum,rulePath,rules){this.rulePath=rulePath,this.definedOnly=rules.definedOnly?new Set(descEnum.values.map(v=>v.number)):void 0}eval(val,cursor){this.definedOnly!==void 0&&!this.definedOnly.has(val)&&cursor.violate("value must be one of the defined enum values","enum.defined_only",this.rulePath.clone().field(EnumRulesSchema.field.definedOnly).toPath())}prune(){return this.definedOnly==null}},EvalAnyRules=class{constructor(rulePath,rules){this.rulePath=rulePath,this.in=rules.in,this.notIn=rules.notIn}eval(val,cursor){let any=val.message;this.in.length>0&&!this.in.includes(any.typeUrl)&&cursor.violate("type URL must be in the allow list","any.in",this.rulePath.clone().field(AnyRulesSchema.field.in).toPath()),this.notIn.length>0&&this.notIn.includes(any.typeUrl)&&cursor.violate("type URL must not be in the block list","any.not_in",this.rulePath.clone().field(AnyRulesSchema.field.notIn).toPath())}prune(){return this.in.length+this.notIn.length==0}},EvalMessageOneofRule=class{constructor(fields2,required){this.fields=fields2,this.required=required}eval(val,cursor){let setFields=this.fields.filter(field3=>val.isSet(field3));if(setFields.length>1){let oneofNames=this.fields.map(f5=>f5.name).join(", ");cursor.violate(`only one of ${oneofNames} can be set`,"message.oneof",[])}if(this.required&&setFields.length==0){let oneofNames=this.fields.map(f5=>f5.name).join(", ");cursor.violate(`one of ${oneofNames} must be set`,"message.oneof",[])}}prune(){return this.fields.length==0}};var messageToRuleType=new Map([[AnySchema.typeName,"any"],[DurationSchema.typeName,"duration"],[TimestampSchema.typeName,"timestamp"],[FloatValueSchema.typeName,"float"],[DoubleValueSchema.typeName,"double"],[Int32ValueSchema.typeName,"int32"],[Int64ValueSchema.typeName,"int64"],[UInt32ValueSchema.typeName,"uint32"],[UInt64ValueSchema.typeName,"uint64"],[BoolValueSchema.typeName,"bool"],[StringValueSchema.typeName,"string"],[FieldMaskSchema.typeName,"fieldMask"],[BytesValueSchema.typeName,"bytes"]]),scalarToRuleType=new Map([[ScalarType2.FLOAT,"float"],[ScalarType2.DOUBLE,"double"],[ScalarType2.INT32,"int32"],[ScalarType2.INT64,"int64"],[ScalarType2.UINT32,"uint32"],[ScalarType2.UINT64,"uint64"],[ScalarType2.SINT32,"sint32"],[ScalarType2.SINT64,"sint64"],[ScalarType2.FIXED32,"fixed32"],[ScalarType2.FIXED64,"fixed64"],[ScalarType2.SFIXED32,"sfixed32"],[ScalarType2.SFIXED64,"sfixed64"],[ScalarType2.BOOL,"bool"],[ScalarType2.STRING,"string"],[ScalarType2.BYTES,"bytes"]]),ruleMessageTypeToScalarType=new Map([[DoubleRulesSchema.typeName,ScalarType2.DOUBLE],[FloatRulesSchema.typeName,ScalarType2.FLOAT],[Int64RulesSchema.typeName,ScalarType2.INT64],[UInt64RulesSchema.typeName,ScalarType2.UINT64],[Int32RulesSchema.typeName,ScalarType2.INT32],[Fixed64RulesSchema.typeName,ScalarType2.FIXED64],[Fixed32RulesSchema.typeName,ScalarType2.FIXED32],[BoolRulesSchema.typeName,ScalarType2.BOOL],[BytesRulesSchema.typeName,ScalarType2.BYTES],[UInt32RulesSchema.typeName,ScalarType2.UINT32],[SFixed32RulesSchema.typeName,ScalarType2.SFIXED32],[SFixed64RulesSchema.typeName,ScalarType2.SFIXED64],[SInt32RulesSchema.typeName,ScalarType2.SINT32],[SInt64RulesSchema.typeName,ScalarType2.SINT64]]);function getRuleScalarType(rule){return ruleMessageTypeToScalarType.get(rule.$typeName)}function getRuleDescriptor(typeName){for(let d5 of[FloatRulesSchema,DoubleRulesSchema,Int32RulesSchema,Int64RulesSchema,UInt32RulesSchema,UInt64RulesSchema,SInt32RulesSchema,SInt64RulesSchema,Fixed32RulesSchema,Fixed64RulesSchema,SFixed32RulesSchema,SFixed64RulesSchema,BoolRulesSchema,StringRulesSchema,BytesRulesSchema,EnumRulesSchema,RepeatedRulesSchema,MapRulesSchema,AnyRulesSchema,DurationRulesSchema,FieldMaskRulesSchema,TimestampRulesSchema])if(typeName==d5.typeName)return d5;throw new Error(`unable to find descriptor for ${typeName}`)}function getListRules(rulePath,fieldRules,fieldContext){let listRules=getRulePath(rulePath,"repeated");return[getRules(fieldRules,"repeated",fieldContext),listRules,listRules.clone().field(RepeatedRulesSchema.field.items)]}function getMapRules(rulePath,fieldRules,fieldContext){let mapRules=getRulePath(rulePath,"map");return[getRules(fieldRules,"map",fieldContext),mapRules,mapRules.clone().field(MapRulesSchema.field.keys),mapRules.clone().field(MapRulesSchema.field.values)]}function getEnumRules(rulePath,fieldRules,fieldContext){return[getRules(fieldRules,"enum",fieldContext),getRulePath(rulePath,"enum")]}function getMessageRules(descMessage,rulePath,fieldRules,fieldContext){let type2=messageToRuleType.get(descMessage.typeName);return[getRules(fieldRules,type2,fieldContext),getRulePath(rulePath,type2)]}function getScalarRules(scalar,rulePath,fieldRules,fieldContext){let type2=scalarToRuleType.get(scalar);return[getRules(fieldRules,type2,fieldContext),getRulePath(rulePath,type2)]}function getRulePath(base,type2){if(type2==null)return base;let field3=FieldRulesSchema.field[type2];if(field3==null)throw new CompilationError(`cannot find rule "${type2}"`);return base.clone().field(field3)}function getRules(fieldRules,want,context2){let got=fieldRules?.type.case;if(!(fieldRules==null||got==null)){if(got!=want)throw new CompilationError(want==null?`rule "${got}" cannot be used on ${context2.toString()}`:`expected rule "${want}", got "${got}" on ${context2.toString()}`);return fieldRules.type.value}}var always={check(){return!0},always:!0,never:!1},never={check(){return!1},always:!1,never:!0};function ignoreListOrMapField(field3,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new FieldIsSet(field3);case Ignore2.ALWAYS:return never}}function ignoreMessageField(field3,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:case Ignore2.IF_ZERO_VALUE:return new FieldIsSet(field3);case Ignore2.ALWAYS:return never}}function ignoreScalarOrEnumField(field3,ignore){if(ignore==Ignore2.ALWAYS)return never;if(field3.presence==FeatureSet_FieldPresence2.IMPLICIT)switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new FieldIsSet(field3)}return new FieldIsSet(field3)}function ignoreEnumValue(enu,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new ScalarNot(ScalarType2.INT32,enu.values[0].number);case Ignore2.ALWAYS:return never}}function ignoreScalarValue(scalar,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new ScalarNot(scalar,scalarZeroValue2(scalar,!1));case Ignore2.ALWAYS:return never}}function ignoreMessageValue(ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:case Ignore2.IF_ZERO_VALUE:return always;case Ignore2.ALWAYS:return never}}var ScalarNot=class{constructor(scalar,not2){this.scalar=scalar,this.not=not2,this.always=!1,this.never=!1}check(val){return!scalarEquals(this.scalar,this.not,val)}},FieldIsSet=class{constructor(field3){this.field=field3,this.always=!1,this.never=!1}check(val){return val.isSet(this.field)}};var privateSymbol=Symbol.for("@bufbuild/cel/error");function celError(value,exprId){return isCelError(value)?value:(typeof exprId=="number"&&(exprId=BigInt(exprId)),value instanceof Error?new _CelError(value.message,value,exprId):typeof value=="string"?new _CelError(value,void 0,exprId):new _CelError(`${value}`,value,exprId))}function celErrorMerge(first,...rest){return new _CelError(first.message,rest,first.exprId)}function isCelError(v){return typeof v=="object"&&v!==null&&privateSymbol in v}var _CelError=class extends Error{_cause;_exprId;[privateSymbol]={};constructor(message6,_cause,_exprId){super(message6),this._cause=_cause,this._exprId=_exprId}get exprId(){return this._exprId}get cause(){return this._cause}};var privateSymbol2=Symbol.for("@bufbuild/cel/uint");function celUint(v){return new Uint(v)}function isCelUint(v){return typeof v=="object"&&v!==null&&privateSymbol2 in v}var Uint=class{_value;[privateSymbol2]={};constructor(_value){this._value=_value}get value(){return this._value}};function celFromScalar(type2,v){switch(type2){case ScalarType2.UINT32:case ScalarType2.UINT64:case ScalarType2.FIXED32:case ScalarType2.FIXED64:return celUint(BigInt(v));case ScalarType2.INT32:case ScalarType2.SINT32:case ScalarType2.SFIXED32:return BigInt(v);default:return v}}var privateSymbol3=Symbol.for("@bufbuild/cel/list");function celList(arrayOrReflectList){return isReflectList2(arrayOrReflectList)?new RepeatedFieldList(arrayOrReflectList):new ArrayList(arrayOrReflectList)}function celListConcat(...lists){return new ConcatList(lists)}function isCelList(v){return typeof v=="object"&&v!==null&&privateSymbol3 in v}var ArrayList=class{_array;[privateSymbol3]={};constructor(_array){this._array=_array}get size(){return this._array.length}get(index2){if(!(index2<0||index2>=this.size))return toCel(this._array[index2])}*values(){for(let element of this._array.values())yield toCel(element)}[Symbol.iterator](){return this.values()}},RepeatedFieldList=class{_list;[privateSymbol3]={};constructor(_list){this._list=_list}get size(){return this._list.size}get(index2){let val=this._list.get(index2);if(val!==void 0)return celFromListElem(this._list.field(),val)}*values(){for(let val of this._list)yield celFromListElem(this._list.field(),val)}[Symbol.iterator](){return this.values()}},ConcatList=class{_lists;[privateSymbol3]={};_size;constructor(_lists){this._lists=_lists;let size=0;for(let list12 of _lists)size+=list12.size;this._size=size}get size(){return this._size}get(index2){if(!(index2<0||index2>=this.size))for(let list12 of this._lists){if(index2<list12.size)return list12.get(index2);index2=index2-list12.size}}*values(){for(let list12 of this._lists)yield*list12.values()}[Symbol.iterator](){return this.values()}};function celFromListElem(desc,v){switch(desc.listKind){case"enum":return BigInt(v);case"message":return reflectMsgToCel(v);case"scalar":return celFromScalar(desc.scalar,v)}}var EMPTY_LIST=celList([]);var contextStack=[];function setEvalContext(context2){return contextStack.push(context2),()=>contextStack.pop()}function getEvalContext(){if(contextStack.length===0)throw new Error("cannot use `getEvalContext` outside of an evaluation");return contextStack[contextStack.length-1]}function withEvalContext(context2,next){return{id:next.id,eval(ctx){let unset=setEvalContext(context2);try{return next.eval(ctx)}finally{unset()}}}}function getMsgDesc(typeName){let schema2=getEvalContext().registry.getMessage(typeName);if(!schema2)throw new Error(`Message ${typeName} not found in registry`);return schema2}var privateSymbol4=Symbol.for("@bufbuild/cel/type"),CelScalar={INT:celScalarType("int"),UINT:celScalarType("uint"),BOOL:celScalarType("bool"),STRING:celScalarType("string"),BYTES:celScalarType("bytes"),DOUBLE:celScalarType("double"),NULL:celScalarType("null_type"),DYN:celScalarType("dyn"),TYPE:celScalarType("type")},TIMESTAMP=objectType(TimestampSchema),DURATION=objectType(DurationSchema);function mapType(key,value){return{[privateSymbol4]:{},kind:"map",key,value,name:"map",toString(){return`map(${key}, ${value})`}}}function listType(element){return{[privateSymbol4]:{},kind:"list",element,name:"list",toString(){return`list(${element})`}}}function objectType(descOrTypeName){let name,desc;return typeof descOrTypeName=="string"?(name=descOrTypeName,desc=void 0):(name=descOrTypeName.typeName,desc=descOrTypeName),{[privateSymbol4]:{},kind:"object",desc,name,toString(){return name}}}function celScalarType(scalar){return{[privateSymbol4]:{},kind:"scalar",scalar,name:scalar,toString(){return scalar}}}function celType(v){switch(typeof v){case"bigint":return CelScalar.INT;case"boolean":return CelScalar.BOOL;case"number":return CelScalar.DOUBLE;case"string":return CelScalar.STRING;case"object":switch(!0){case v===null:return CelScalar.NULL;case v instanceof Uint8Array:return CelScalar.BYTES;case isReflectMessage2(v):return celTypeOfMessage(v);case isCelList(v):return listType(CelScalar.DYN);case isCelMap(v):return mapType(CelScalar.DYN,CelScalar.DYN);case isCelUint(v):return CelScalar.UINT;default:if(isObjectCelType(v))return CelScalar.TYPE}}throw new Error(`Not a CEL value: ${v}`)}function isCelType(v){return typeof v=="object"&&v!==null&&isObjectCelType(v)}function isObjectCelType(v){return privateSymbol4 in v}function celTypeOfMessage(v){let typeName=v.desc.typeName;if(isReflectMessageAny(v)&&(typeName=typeUrlToName2(v.message.typeUrl),typeName===ValueSchema.typeName)){let value=anyUnpack(v.message,ValueSchema);return value?valueToType(value):CelScalar.NULL}switch(typeName){case FloatValueSchema.typeName:case DoubleValueSchema.typeName:return CelScalar.DOUBLE;case UInt64ValueSchema.typeName:case UInt32ValueSchema.typeName:return CelScalar.UINT;case Int32ValueSchema.typeName:case Int64ValueSchema.typeName:return CelScalar.INT;case StringValueSchema.typeName:return CelScalar.STRING;case BytesValueSchema.typeName:return CelScalar.BYTES;case BoolValueSchema.typeName:return CelScalar.BOOL;case StructSchema.typeName:return mapType(CelScalar.STRING,CelScalar.DYN);case ListValueSchema.typeName:return listType(CelScalar.DYN);case ValueSchema.typeName:return valueToType(v.message)}return typeName===v.desc.typeName?objectType(v.desc):objectType(typeName)}function valueToType(v){switch(v.kind.case){case"boolValue":return CelScalar.BOOL;case"listValue":return listType(CelScalar.DYN);case"nullValue":case void 0:return CelScalar.NULL;case"numberValue":return CelScalar.DOUBLE;case"stringValue":return CelScalar.STRING;case"structValue":return mapType(CelScalar.STRING,CelScalar.DYN)}}function isReflectMessageAny(v){return v.desc.typeName===AnySchema.typeName}function typeUrlToName2(url){let slash=url.lastIndexOf("/"),name=slash>=0?url.substring(slash+1):url;if(!name.length)throw new Error(`invalid type url: ${url}`);return name}function toCel(v){switch(typeof v){case"bigint":case"boolean":case"number":case"string":return v;case"object":break;default:throw new Error(`unsupported input ${typeof v}`)}switch(!0){case v===null:case v instanceof Uint8Array:case isCelList(v):case isCelMap(v):case isCelUint(v):case isCelType(v):return v}if(isArray(v)||isReflectList2(v))return celList(v);if(isMap(v)||isReflectMap2(v))return celMap(v);if(isMessage2(v)){let value=wktToCel(v);return value!==void 0?value:reflect2(getMsgDesc(v.$typeName),v)}if(isReflectMessage2(v))return reflectMsgToCel(v);if(v.constructor.name==="Object")return celMap(new Map(Object.entries(v)));throw new Error(`Unsupported input ${v}`)}function unwrapAny(v){if(!isReflectAny(v))return v;let unpacked=anyUnpack(v.message,getEvalContext().registry);if(unpacked===void 0)throw new Error(`invalid Any or ${v.message.typeUrl} not found in registry`);let value=wktToCel(unpacked);return value!==void 0?value:reflect2(getMsgDesc(unpacked.$typeName),unpacked)}function reflectMsgToCel(v){let value=wktToCel(v.message);return value!==void 0?value:v}function isReflectAny(v){return isReflectMessage2(v,AnySchema)}function isArray(v){return Array.isArray(v)}function isMap(v){return v instanceof Map}function wktToCel(msg){return isWrapper2(msg)?unwrapWrapper(msg):jsonWrapperToCel(msg)}function unwrapWrapper(v){switch(v.$typeName){case Int32ValueSchema.typeName:return BigInt(v.value);case UInt32ValueSchema.typeName:return celUint(BigInt(v.value));case UInt64ValueSchema.typeName:return celUint(v.value)}return v.value}function jsonWrapperToCel(msg){switch(!0){case isMessage2(msg,StructSchema):return structToCel(msg);case isMessage2(msg,ValueSchema):return valueToCel(msg);case isMessage2(msg,ListValueSchema):return listValueToCel(msg)}}function structToCel(s2){let map5=new Map;for(let[k5,v]of Object.entries(s2.fields))map5.set(k5,valueToCel(v));return celMap(map5)}function valueToCel(v){switch(v.kind.case){case"boolValue":case"numberValue":case"stringValue":return v.kind.value;case"nullValue":case void 0:return null;case"structValue":return structToCel(v.kind.value);case"listValue":return listValueToCel(v.kind.value)}}function listValueToCel(l3){return celList(l3.values)}var privateSymbol5=Symbol.for("@bufbuild/cel/map");function celMap(mapOrReflectMap){return isReflectMap2(mapOrReflectMap)?new ProtoMap(mapOrReflectMap):new NativeMap(mapOrReflectMap)}function isCelMap(v){return typeof v=="object"&&v!==null&&privateSymbol5 in v}var NativeMap=class{_map;[privateSymbol5]={};constructor(_map){this._map=_map}get size(){return this._map.size}get(key){if(isCelUint(key)&&(key=key.value),typeof key=="number"){if(!Number.isInteger(key))return;key=BigInt(key)}let value=this._map.get(key);if(value!==void 0)return toCel(value);if(typeof key=="bigint"){for(let mapKey of this._map.keys())if(isCelUint(mapKey)&&mapKey.value===key)return toCel(this._map.get(mapKey))}}has(key){return this.get(key)!=null}forEach(callback,thisArg){this._map.forEach((value,key,_)=>callback.call(thisArg,toCel(value),key,this))}*entries(){for(let[key,value]of this._map.entries())yield[key,toCel(value)]}keys(){return this._map.keys()}*values(){for(let value of this._map.values())yield toCel(value)}[Symbol.iterator](){return this.entries()}},ProtoMap=class{_map;[privateSymbol5]={};constructor(_map){this._map=_map}get size(){return this._map.size}get(key){let value=this._map.get(mapKeyFromCel(this._map.field(),key));if(value!==void 0)return celFromMapValue(this._map.field(),value)}has(key){return this._map.has(mapKeyFromCel(this._map.field(),key))}forEach(callback,thisArg){this._map.forEach((value,key,_)=>callback.call(thisArg,celFromMapValue(this._map.field(),value),celFromMapKey(this._map.field(),key),this))}*entries(){for(let[key,value]of this._map.entries())yield[celFromMapKey(this._map.field(),key),celFromMapValue(this._map.field(),value)]}*keys(){for(let key of this._map.keys())yield celFromMapKey(this._map.field(),key)}*values(){for(let value of this._map.keys())yield celFromMapValue(this._map.field(),value)}[Symbol.iterator](){return this.entries()}};function mapKeyFromCel(desc,v){switch(isCelUint(v)&&(v=v.value),desc.mapKey){case ScalarType2.SINT32:case ScalarType2.INT32:case ScalarType2.FIXED32:case ScalarType2.UINT32:case ScalarType2.SFIXED32:return typeof v=="bigint"?Number(v):v;case ScalarType2.SINT64:case ScalarType2.INT64:case ScalarType2.FIXED64:case ScalarType2.UINT64:case ScalarType2.SFIXED64:return v==="number"&&Number.isInteger(v)?BigInt(v):v;default:return v}}function celFromMapKey(desc,v){return celFromScalar(desc.mapKey,v)}function celFromMapValue(desc,v){switch(desc.mapKind){case"enum":return BigInt(v);case"message":return reflectMsgToCel(v);case"scalar":return celFromScalar(desc.scalar,v)}}var EMPTY_MAP=celMap(new Map);var wktRegistry=createRegistry(TimestampSchema,DurationSchema,AnySchema,file_google_protobuf_wrappers,file_google_protobuf_struct2);function createRegistryWithWKT(...inputs){return createRegistry(wktRegistry,...inputs)}var Namespace=class _Namespace{_name;_aliases;constructor(name=""){this._name=name,this._aliases=new Map}static ROOT=new _Namespace;name(){return this._name}aliases(){return this._aliases}resolveCandidateNames(name){if(name.startsWith(".")){let qn=name.substring(1),alias2=this.findAlias(qn);return alias2!==void 0?[alias2]:[qn]}let alias=this.findAlias(name);if(alias!==void 0)return[alias];if(this.name()==="")return[name];let nextCont=this.name(),candidates=[nextCont+"."+name];for(let i6=nextCont.lastIndexOf(".");i6>=0;i6=nextCont.lastIndexOf("."))nextCont=nextCont.substring(0,i6),candidates.push(nextCont+"."+name);return candidates.push(name),candidates}findAlias(name){let simple=name,qualifier="",dot=name.indexOf(".");dot>=0&&(simple=name.substring(0,dot),qualifier=name.substring(dot));let alias=this._aliases.get(simple);if(alias!==void 0)return alias+qualifier}};var privateSymbol6=Symbol.for("@bufbuild/cel/resolver");function createResolver(...inputs){let groups=new Map;for(let input of inputs){let funcs=isFuncResolver(input)||Array.isArray(input)?input:[input];for(let func of funcs){let group4=groups.get(func.name);group4===void 0&&(group4=[],groups.set(func.name,group4)),group4.push(func)}}return new Resolver(new Map(new Array(...groups.entries()).map(([name,funcs])=>[name,createFuncGroup(name,funcs)])))}function isFuncResolver(v){return typeof v=="object"&&v!==null&&privateSymbol6 in v}var Resolver=class{_groups;[privateSymbol6]={};constructor(_groups){this._groups=_groups}*[Symbol.iterator](){for(let group4 of this._groups.values())yield*group4}find(name){return this._groups.get(name)}};function createFuncGroup(name,funcs){let set2=[];for(let func of funcs){for(let i6=0;i6<set2.length;i6++)if(func.id===set2[i6].id){set2.splice(i6,1);break}set2.push(func)}return new Group(name,set2)}var Group=class{_name;_funcs;constructor(_name,_funcs){this._name=_name,this._funcs=_funcs}*[Symbol.iterator](){yield*this._funcs}get name(){return this._name}call(id,target,args){args=args.map(arg=>unwrapAny(arg));for(let func of this._funcs){let result=func.call(id,target,args);if(result!==void 0)return result}}};var CONDITIONAL="_?_:_";var EQUALS="_==_";var GREATER_EQUALS="_>=_";var INDEX="_[_]";var LESS_EQUALS="_<=_",LOGICAL_AND="_&&_";var LOGICAL_OR="_||_";var NOT_EQUALS="_!=_",NOT_STRICTLY_FALSE="@not_strictly_false";var OLD_NOT_STRICTLY_FALSE="__not_strictly_false__",OPT_INDEX="_[?_]",OPT_SELECT="_?._";var ONE_SECOND=1000000000n,MAX_DURATION_NANOS=9223372036854775807n,MIN_DURATION_NANOS=-9223372036854775808n;function createDuration(seconds=0n,ns=0n){let fullNanos=seconds*ONE_SECOND+BigInt(ns);if(fullNanos>MAX_DURATION_NANOS||fullNanos<MIN_DURATION_NANOS)throw new Error("duration out of range");return create2(DurationSchema,{seconds:fullNanos/ONE_SECOND,nanos:Number(fullNanos%ONE_SECOND)})}var DURATION_STRING_LENGTH_LIMIT=128,UNITS=Object.freeze({ns:1n,us:1000n,\u00B5s:1000n,ms:1000n*1000n,s:1000n*1000n*1000n,m:1000n*1000n*1000n*60n,h:1000n*1000n*1000n*60n*60n}),INT_REGEXP=/^\d+/,UNIT_REGEXP=new RegExp(`^(${Object.keys(UNITS).join("|")})`);function parseDuration(str2){if(str2.length>DURATION_STRING_LENGTH_LIMIT)throw badDurationStr(`duration string exceeds ${DURATION_STRING_LENGTH_LIMIT} characters`);if(/^[-+]?0$/.test(str2))return createDuration();let[sign4,values]=/^[+-]/.test(str2)?[str2[0]==="+"?1n:-1n,str2.slice(1)]:[1n,str2],fullNanos=0n,remainder=values;for(;remainder.length>0;){let int3=INT_REGEXP.exec(remainder)?.[0];remainder=remainder.slice(int3?.length??0),remainder[0]==="."&&(remainder=remainder.slice(1));let fraction=INT_REGEXP.exec(remainder)?.[0];remainder=remainder.slice(fraction?.length??0);let unit=UNIT_REGEXP.exec(remainder)?.[0];if(remainder=remainder.slice(unit?.length??0),(int3??fraction)===void 0||unit===void 0)throw badDurationStr("invalid syntax");let factor=UNITS[unit];fullNanos+=BigInt(int3??0)*factor,fullNanos+=BigInt(fraction??0)*factor/10n**BigInt(fraction?.length??0)}return createDuration(0n,sign4*fullNanos)}function badDurationStr(e6){return new Error(`Failed to parse duration: ${e6}`)}var MAX_TIMESTAMP_SECONDS=253402300799n,MIN_TIMESTAMP_SECONDS=-62135596800n,ONE_SECOND2=1000000000n;function createTimestamp(s2=0n,ns=0n){let fullNanos=s2*ONE_SECOND2+BigInt(ns),shift=fullNanos%ONE_SECOND2<0n?1n:0n,seconds=fullNanos/ONE_SECOND2-shift,nanos=Number(fullNanos%ONE_SECOND2+shift*ONE_SECOND2);if(seconds>MAX_TIMESTAMP_SECONDS||seconds<MIN_TIMESTAMP_SECONDS)throw new Error("timestamp out of range");return create2(TimestampSchema,{seconds,nanos})}function equals2(lhs,rhs){if(lhs===rhs)return!0;if(isCelUint(lhs)&&(lhs=lhs.value),isCelUint(rhs)&&(rhs=rhs.value),(typeof lhs=="number"||typeof lhs=="bigint")&&(typeof rhs=="number"||typeof rhs=="bigint"))return lhs==rhs;switch(!0){case lhs instanceof Uint8Array:return rhs instanceof Uint8Array&&equalsBytes(lhs,rhs);case isCelList(lhs):return isCelList(rhs)&&equalsList(lhs,rhs);case isCelMap(lhs):return isCelMap(rhs)&&equalsMap(lhs,rhs);case isCelType(lhs):return isCelType(rhs)&&equalsType(lhs,rhs)}return isReflectMessage2(lhs)?!isReflectMessage2(rhs)||lhs.desc.typeName!==rhs.desc.typeName?!1:equals(lhs.desc,lhs.message,rhs.message,{registry:getEvalContext().registry,unpackAny:!0,unknown:!0,extensions:!0}):!1}function equalsType(lhs,rhs){return lhs.kind===rhs.kind&&lhs.name===rhs.name}function equalsList(lhs,rhs){if(lhs.size!==rhs.size)return!1;for(let i6=0;i6<lhs.size;i6++)if(!equals2(lhs.get(i6),rhs.get(i6)))return!1;return!0}function equalsMap(lhs,rhs){if(lhs.size!==rhs.size)return!1;for(let[k5,v]of lhs){let rv=rhs.get(k5);if(rv===void 0||!equals2(v,rv))return!1}return!0}function equalsBytes(lhs,rhs){if(lhs.length!==rhs.length)return!1;for(let i6=0;i6<lhs.length;i6++)if(lhs[i6]!==rhs[i6])return!1;return!0}var privateSymbol7=Symbol.for("@bufbuild/cel/func");function celFunc(name,args,result,impl){return new Func(name,void 0,args,result,impl)}function celMethod(name,target,args,result,impl){return new Method(name,target,args,result,impl)}var Callable=class{_name;_target;_args;_result;_impl;_id;[privateSymbol7]={};constructor(_name,_target,_args,_result,_impl,_id=""){this._name=_name,this._target=_target,this._args=_args,this._result=_result,this._impl=_impl,this._id=_id}get id(){if(this._id===""){let qualifier=this.target?`${this.target.name}.`:"";this._id=`${qualifier}${this.name}(${this.arguments.map(p3=>p3.name).join(",")})`}return this._id}get name(){return this._name}get target(){return this._target}get arguments(){return this._args}get result(){return this._result}call(id,target,args){if(args.length==this.arguments.length){for(let i6=0;i6<args.length;i6++)if(!isSubtypeOf(args[i6],this.arguments[i6]))return;try{return toCel(this._impl.apply(target,args))}catch(ex){return celError(ex,id)}}}},Func=class extends Callable{call(id,target,args){if(target===void 0)return super.call(id,void 0,args)}},Method=class extends Callable{call(id,target,args){if(!(target===void 0||!isSubtypeOf(target,this.target)))return super.call(id,target,args)}};function isSubtypeOf(val,typ){return typ===CelScalar.DYN||equalsType(celType(val),typ)}var MAX_INT=9223372036854775807n,MIN_INT=-9223372036854775808n,MAX_UINT=18446744073709551615n;function safeInt(value,op2="type conversion"){let numeric=typeof value=="string"?BigInt(value):value;if(typeof numeric=="bigint"){if(numeric>=MIN_INT&&numeric<=MAX_INT)return numeric}else if(Number.isFinite(numeric)&&numeric>Number(MIN_INT)&&numeric<Number(MAX_INT))return BigInt(Math.trunc(numeric));throw celError(`int overflow during ${op2}`)}function safeUint(value,op2="type conversion"){let numeric=typeof value=="string"?BigInt(value):value;if(typeof numeric=="bigint"||Number.isFinite(numeric)){let int3=typeof numeric=="number"?BigInt(Math.trunc(numeric)):numeric;if(numeric>=0&&int3<=MAX_UINT)return celUint(int3)}throw celError(`uint overflow during ${op2}`)}function bytesConcat(l3,r5){let val=new Uint8Array(l3.length+r5.length);return val.set(l3),val.set(r5,l3.length),val}function timestampSum(l3,r5){return createTimestamp(l3.message.seconds+r5.message.seconds,l3.message.nanos+r5.message.nanos)}function durationSum(l3,r5){return createDuration(l3.message.seconds+r5.message.seconds,l3.message.nanos+r5.message.nanos)}function durationDifference(l3,r5){return createDuration(l3.message.seconds-r5.message.seconds,l3.message.nanos-r5.message.nanos)}function timestampDifference(l3,r5){return createTimestamp(l3.message.seconds-r5.message.seconds,l3.message.nanos-r5.message.nanos)}function safeDivide(type2,l3,r5){if(r5===0n)throw celError(`${type2.name} divide by zero`);return safeInt(l3/r5,`divide by ${r5}`)}function safeModulo(type2,l3,r5){if(r5===0n)throw celError(`${type2.name} modulus by zero`);return l3%r5}var LIST=listType(CelScalar.DYN),{BYTES,DOUBLE,INT,STRING,UINT}=CelScalar,math_default=[celFunc("_+_",[INT,INT],INT,(l3,r5)=>safeInt(l3+r5,"_+_")),celFunc("_+_",[UINT,UINT],UINT,(l3,r5)=>safeUint(l3.value+r5.value,"_+_")),celFunc("_+_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3+r5),celFunc("_+_",[DURATION,DURATION],DURATION,durationSum),celFunc("_+_",[TIMESTAMP,DURATION],TIMESTAMP,timestampSum),celFunc("_+_",[DURATION,TIMESTAMP],TIMESTAMP,timestampSum),celFunc("_+_",[STRING,STRING],STRING,(l3,r5)=>l3+r5),celFunc("_+_",[BYTES,BYTES],BYTES,bytesConcat),celFunc("_+_",[LIST,LIST],LIST,celListConcat),celFunc("_-_",[INT,INT],INT,(l3,r5)=>safeInt(l3-r5,"_-_")),celFunc("_-_",[UINT,UINT],UINT,(l3,r5)=>safeUint(l3.value-r5.value,"_-_")),celFunc("_-_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3-r5),celFunc("_-_",[TIMESTAMP,TIMESTAMP],DURATION,durationDifference),celFunc("_-_",[DURATION,DURATION],DURATION,durationDifference),celFunc("_-_",[TIMESTAMP,DURATION],TIMESTAMP,timestampDifference),celFunc("_*_",[INT,INT],INT,(l3,r5)=>safeInt(l3*r5,"_*_")),celFunc("_*_",[UINT,UINT],UINT,(l3,r5)=>safeUint(l3.value*r5.value,"_*_")),celFunc("_*_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3*r5),celFunc("_/_",[INT,INT],INT,(l3,r5)=>safeDivide(INT,l3,r5)),celFunc("_/_",[UINT,UINT],UINT,(l3,r5)=>celUint(safeDivide(UINT,l3.value,r5.value))),celFunc("_/_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3/r5),celFunc("_%_",[INT,INT],INT,(l3,r5)=>safeModulo(INT,l3,r5)),celFunc("_%_",[UINT,UINT],UINT,(l3,r5)=>celUint(safeModulo(UINT,l3.value,r5.value))),celFunc("-_",[INT],INT,x2=>safeInt(-x2)),celFunc("-_",[DOUBLE],DOUBLE,x2=>-x2)];var encoder=new TextEncoder,decoder=new TextDecoder(void 0,{fatal:!0});function stringToBool(x2){switch(x2){case"true":case"True":case"TRUE":case"t":case"1":return!0;case"false":case"False":case"FALSE":case"f":case"0":return!1}throw new Error(`Unable to convert string '${x2}' to bool`)}function bytesToString(x2){try{return decoder.decode(x2)}catch(e6){throw new Error(`Failed to decode bytes as string: ${e6}`)}}function stringToTimestamp(x2){try{return fromJson(TimestampSchema,x2)}catch(e6){throw new Error(`Failed to parse timestamp: ${e6}`)}}function toType(x2){return isMessage2(x2)?objectType(getMsgDesc(x2.$typeName)):celType(x2)}function identity(x2){return x2}var{BOOL,BYTES:BYTES2,DOUBLE:DOUBLE2,DYN,INT:INT2,STRING:STRING2,TYPE,UINT:UINT2}=CelScalar,cast_default=[celFunc("int",[INT2],INT2,identity),celFunc("int",[UINT2],INT2,x2=>safeInt(x2.value)),celFunc("int",[DOUBLE2],INT2,safeInt),celFunc("int",[STRING2],INT2,safeInt),celFunc("int",[TIMESTAMP],INT2,x2=>safeInt(x2.message.seconds)),celFunc("int",[DURATION],INT2,x2=>safeInt(x2.message.seconds)),celFunc("uint",[UINT2],UINT2,identity),celFunc("uint",[INT2],UINT2,safeUint),celFunc("uint",[DOUBLE2],UINT2,safeUint),celFunc("uint",[STRING2],UINT2,safeUint),celFunc("double",[DOUBLE2],DOUBLE2,identity),celFunc("double",[INT2],DOUBLE2,x2=>Number(x2)),celFunc("double",[UINT2],DOUBLE2,x2=>Number(x2.value)),celFunc("double",[STRING2],DOUBLE2,x2=>Number(x2)),celFunc("bool",[BOOL],BOOL,identity),celFunc("bool",[STRING2],BOOL,stringToBool),celFunc("bytes",[BYTES2],BYTES2,identity),celFunc("bytes",[STRING2],BYTES2,x2=>encoder.encode(x2)),celFunc("string",[STRING2],STRING2,identity),celFunc("string",[BOOL],STRING2,x2=>x2.toString()),celFunc("string",[INT2],STRING2,x2=>x2.toString()),celFunc("string",[UINT2],STRING2,x2=>x2.value.toString()),celFunc("string",[DOUBLE2],STRING2,x2=>x2.toString()),celFunc("string",[BYTES2],STRING2,bytesToString),celFunc("string",[TIMESTAMP],STRING2,x2=>toJson(TimestampSchema,x2.message)),celFunc("string",[DURATION],STRING2,x2=>toJson(DurationSchema,x2.message)),celFunc("timestamp",[TIMESTAMP],TIMESTAMP,identity),celFunc("timestamp",[STRING2],TIMESTAMP,stringToTimestamp),celFunc("timestamp",[INT2],TIMESTAMP,x2=>timestampFromMs(Number(x2))),celFunc("duration",[DURATION],DURATION,identity),celFunc("duration",[STRING2],DURATION,parseDuration),celFunc("duration",[INT2],DURATION,x2=>create2(DurationSchema,{seconds:x2})),celFunc("type",[DYN],TYPE,toType),celFunc("dyn",[DYN],DYN,identity)];var CONTAINS="contains";var ENDS_WITH="endsWith";var MATCHES="matches";var SIZE="size";var STARTS_WITH="startsWith";var TIME_GET_DATE="getDate",TIME_GET_DAY_OF_MONTH="getDayOfMonth",TIME_GET_DAY_OF_WEEK="getDayOfWeek",TIME_GET_DAY_OF_YEAR="getDayOfYear",TIME_GET_FULL_YEAR="getFullYear",TIME_GET_HOURS="getHours",TIME_GET_MILLISECONDS="getMilliseconds",TIME_GET_MINUTES="getMinutes",TIME_GET_MONTH="getMonth",TIME_GET_SECONDS="getSeconds";var invalidPatterns=[/\\[1-9]/,/\\k<.>/,/\(\?\=/,/\(\?\!/,/\(\?\<\=/,/\(\?\<\!/,/\\c[A-Z]/,/\\u[0-9a-fA-F]{4}/,/\\0(?!\d)/,/\[\\b.*\]/],flagPattern=new RegExp(/^\(\?(?<flags>[ims\-]+)\)/);function matches(pattern){for(let invalidPattern of invalidPatterns)if(invalidPattern.test(pattern))throw new Error(`Error evaluating pattern ${pattern}, invalid RE2 syntax`);let flags="",flagMatches=pattern.match(flagPattern);if(flagMatches){for(let flag of flagMatches?.groups?.flags??""){if(flag=="-")break;flags+=flag}pattern=pattern.substring(flagMatches[0].length)}return new RegExp(pattern,flags).test(this)}function compareDuration(lhs,rhs){let cmp=lhs.message.seconds-rhs.message.seconds;return cmp==0n?lhs.message.nanos-rhs.message.nanos:cmp<0n?-1:1}function compareTimestamp(lhs,rhs){let cmp=lhs.message.seconds-rhs.message.seconds;return cmp==0n?lhs.message.nanos-rhs.message.nanos:cmp<0n?-1:1}function compareBytes(lhs,rhs){let minLen=Math.min(lhs.length,rhs.length);for(let i6=0;i6<minLen;i6++){if(lhs[i6]<rhs[i6])return-1;if(lhs[i6]>rhs[i6])return 1}return lhs.length-rhs.length}function inList(value,list12){for(let v of list12)if(equals2(v,value))return!0;return!1}function inMap(value,map5){return map5.has(value)}var{BOOL:BOOL2,BYTES:BYTES3,DOUBLE:DOUBLE3,DYN:DYN2,INT:INT3,STRING:STRING3,UINT:UINT3}=CelScalar,LIST2=listType(CelScalar.DYN),MAP=mapType(CelScalar.DYN,CelScalar.DYN),logic_default=[celFunc("!_",[BOOL2],BOOL2,x2=>!x2),celFunc(EQUALS,[DYN2,DYN2],BOOL2,equals2),celFunc(NOT_EQUALS,[DYN2,DYN2],BOOL2,(l3,r5)=>!equals2(l3,r5)),celFunc("_<_",[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)<0),celFunc("_<_",[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[STRING3,STRING3],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[INT3,INT3],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[INT3,UINT3],BOOL2,(l3,r5)=>l3<r5.value),celFunc("_<_",[UINT3,INT3],BOOL2,(l3,r5)=>l3.value<r5),celFunc("_<_",[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value<r5.value),celFunc("_<_",[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)<r5),celFunc("_<_",[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3<Number(r5)),celFunc("_<_",[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3<Number(r5.value)),celFunc("_<_",[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)<r5),celFunc("_<_",[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)<0),celFunc("_<_",[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)<0),celFunc(LESS_EQUALS,[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)<=0),celFunc(LESS_EQUALS,[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[STRING3,STRING3],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[INT3,INT3],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[INT3,UINT3],BOOL2,(l3,r5)=>l3<=r5.value),celFunc(LESS_EQUALS,[UINT3,INT3],BOOL2,(l3,r5)=>l3.value<=r5),celFunc(LESS_EQUALS,[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value<=r5.value),celFunc(LESS_EQUALS,[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)<=r5),celFunc(LESS_EQUALS,[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3<=Number(r5)),celFunc(LESS_EQUALS,[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3<=Number(r5.value)),celFunc(LESS_EQUALS,[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)<=r5),celFunc(LESS_EQUALS,[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)<=0),celFunc(LESS_EQUALS,[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)<=0),celFunc("_>_",[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)>0),celFunc("_>_",[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[STRING3,STRING3],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[INT3,INT3],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[INT3,UINT3],BOOL2,(l3,r5)=>l3>r5.value),celFunc("_>_",[UINT3,INT3],BOOL2,(l3,r5)=>l3.value>r5),celFunc("_>_",[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value>r5.value),celFunc("_>_",[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)>r5),celFunc("_>_",[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3>Number(r5)),celFunc("_>_",[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3>Number(r5.value)),celFunc("_>_",[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)>r5),celFunc("_>_",[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)>0),celFunc("_>_",[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)>0),celFunc(GREATER_EQUALS,[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)>=0),celFunc(GREATER_EQUALS,[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[STRING3,STRING3],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[INT3,INT3],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[INT3,UINT3],BOOL2,(l3,r5)=>l3>=r5.value),celFunc(GREATER_EQUALS,[UINT3,INT3],BOOL2,(l3,r5)=>l3.value>=r5),celFunc(GREATER_EQUALS,[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value>=r5.value),celFunc(GREATER_EQUALS,[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)>=r5),celFunc(GREATER_EQUALS,[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3>=Number(r5)),celFunc(GREATER_EQUALS,[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3>=Number(r5.value)),celFunc(GREATER_EQUALS,[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)>=r5),celFunc(GREATER_EQUALS,[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)>=0),celFunc(GREATER_EQUALS,[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)>=0),celFunc(SIZE,[BYTES3],INT3,x2=>BigInt(x2.length)),celFunc(SIZE,[LIST2],INT3,x2=>BigInt(x2.size)),celFunc(SIZE,[STRING3],INT3,x2=>BigInt([...x2].length)),celFunc(SIZE,[MAP],INT3,x2=>BigInt(x2.size)),celMethod(SIZE,BYTES3,[],INT3,function(){return BigInt(this.length)}),celMethod(SIZE,LIST2,[],INT3,function(){return BigInt(this.size)}),celMethod(SIZE,STRING3,[],INT3,function(){return BigInt([...this].length)}),celMethod(SIZE,MAP,[],INT3,function(){return BigInt(this.size)}),celFunc("@in",[DYN2,LIST2],BOOL2,inList),celFunc("@in",[STRING3,MAP],BOOL2,inMap),celFunc("@in",[DOUBLE3,MAP],BOOL2,inMap),celFunc("@in",[INT3,MAP],BOOL2,inMap),celFunc("@in",[BOOL2,MAP],BOOL2,inMap),celFunc("@in",[UINT3,MAP],BOOL2,inMap),celMethod(CONTAINS,STRING3,[STRING3],BOOL2,String.prototype.includes),celMethod(ENDS_WITH,STRING3,[STRING3],BOOL2,String.prototype.endsWith),celMethod(STARTS_WITH,STRING3,[STRING3],BOOL2,String.prototype.startsWith),celMethod(MATCHES,STRING3,[STRING3],BOOL2,matches)];function getDayOfYear(date2){let start=new Date(0,0,1);start.setFullYear(date2.getFullYear());let diff=date2.getTime()-start.getTime(),oneDay=1e3*60*60*24;return Math.floor(diff/oneDay)}function convertToDate(msg,tz){let ts=msg.message,val=timestampDate(ts);if(tz===void 0)return new Date(val.getUTCFullYear(),val.getUTCMonth(),val.getUTCDate(),val.getUTCHours(),val.getUTCMinutes(),val.getUTCSeconds(),val.getUTCMilliseconds());let timeOffset=tz.match(/^(?<sign>[+-]?)(?<hours>\d\d):(?<minutes>\d\d)$/);if(timeOffset?.groups){let sign4=timeOffset.groups.sign=="-"?1:-1,hours=parseInt(timeOffset.groups.hours),minutes=parseInt(timeOffset.groups.minutes),offset=sign4*(hours*60*60*1e3+minutes*60*1e3);return val=new Date(val.getTime()-offset),new Date(val.getUTCFullYear(),val.getUTCMonth(),val.getUTCDate(),val.getUTCHours(),val.getUTCMinutes(),val.getUTCSeconds(),val.getUTCMilliseconds())}let format3=new Intl.DateTimeFormat("en-US",{hourCycle:"h23",hour12:!1,timeZone:tz,year:"numeric",month:"numeric",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit"}),year2,month,day,hour,minute,second;for(let part of format3.formatToParts(val))switch(part.type){case"year":year2=parseInt(part.value);break;case"month":month=parseInt(part.value)-1;break;case"day":day=parseInt(part.value);break;case"hour":hour=parseInt(part.value);break;case"minute":minute=parseInt(part.value);break;case"second":second=parseInt(part.value);break}if(year2===void 0||month===void 0||day===void 0||hour===void 0||minute===void 0||second===void 0)throw new Error(`Error converting ${toJson(TimestampSchema,ts)} to IANA timezone ${tz}`);return new Date(year2,month,day,hour,minute,second,val.getUTCMilliseconds())}var{STRING:STRING4,INT:INT4}=CelScalar;function celTimeMethods(name,func){function method(tz){let date2=convertToDate(this,tz),result=func(date2);try{return BigInt(result)}catch{throw new Error(`Error converting ${result} of ${String(date2)} of ${toJson(TimestampSchema,this.message)} to BigInt`)}}return[celMethod(name,TIMESTAMP,[],INT4,method),celMethod(name,TIMESTAMP,[STRING4],INT4,method)]}var time_default=[celMethod(TIME_GET_SECONDS,DURATION,[],INT4,function(){return this.message.seconds}),celMethod(TIME_GET_MINUTES,DURATION,[],INT4,function(){return this.message.seconds/60n}),celMethod(TIME_GET_HOURS,DURATION,[],INT4,function(){return this.message.seconds/3600n}),celMethod(TIME_GET_MILLISECONDS,DURATION,[],INT4,function(){return BigInt(this.message.nanos)/1000000n}),...celTimeMethods(TIME_GET_FULL_YEAR,x2=>x2.getFullYear()),...celTimeMethods(TIME_GET_MONTH,x2=>x2.getMonth()),...celTimeMethods(TIME_GET_DATE,x2=>x2.getDate()),...celTimeMethods(TIME_GET_DAY_OF_MONTH,x2=>x2.getDate()-1),...celTimeMethods(TIME_GET_DAY_OF_WEEK,x2=>x2.getDay()),...celTimeMethods(TIME_GET_DAY_OF_YEAR,x2=>getDayOfYear(x2)),...celTimeMethods(TIME_GET_SECONDS,x2=>x2.getSeconds()),...celTimeMethods(TIME_GET_MINUTES,x2=>x2.getMinutes()),...celTimeMethods(TIME_GET_HOURS,x2=>x2.getHours()),...celTimeMethods(TIME_GET_MILLISECONDS,x2=>x2.getMilliseconds())];var privateSymbol8=Symbol.for("@bufbuild/cel/env");function celEnv(options){return new _CelEnv(options?.namespace?new Namespace(options?.namespace):void 0,options?.registry?createRegistryWithWKT(options.registry):createRegistryWithWKT(),createResolver(math_default,cast_default,time_default,logic_default,options?.funcs??[]))}var _CelEnv=class{_namespace;_registry;_funcs;[privateSymbol8]={};constructor(_namespace,_registry,_funcs){this._namespace=_namespace,this._registry=_registry,this._funcs=_funcs}get namespace(){return this._namespace}get registry(){return this._registry}get funcs(){return this._funcs}};var file_cel_expr_syntax=fileDesc2("ChVjZWwvZXhwci9zeW50YXgucHJvdG8SCGNlbC5leHByIlUKClBhcnNlZEV4cHISHAoEZXhwchgCIAEoCzIOLmNlbC5leHByLkV4cHISKQoLc291cmNlX2luZm8YAyABKAsyFC5jZWwuZXhwci5Tb3VyY2VJbmZvItoICgRFeHByEgoKAmlkGAIgASgDEigKCmNvbnN0X2V4cHIYAyABKAsyEi5jZWwuZXhwci5Db25zdGFudEgAEioKCmlkZW50X2V4cHIYBCABKAsyFC5jZWwuZXhwci5FeHByLklkZW50SAASLAoLc2VsZWN0X2V4cHIYBSABKAsyFS5jZWwuZXhwci5FeHByLlNlbGVjdEgAEigKCWNhbGxfZXhwchgGIAEoCzITLmNlbC5leHByLkV4cHIuQ2FsbEgAEi4KCWxpc3RfZXhwchgHIAEoCzIZLmNlbC5leHByLkV4cHIuQ3JlYXRlTGlzdEgAEjIKC3N0cnVjdF9leHByGAggASgLMhsuY2VsLmV4cHIuRXhwci5DcmVhdGVTdHJ1Y3RIABI6ChJjb21wcmVoZW5zaW9uX2V4cHIYCSABKAsyHC5jZWwuZXhwci5FeHByLkNvbXByZWhlbnNpb25IABoVCgVJZGVudBIMCgRuYW1lGAEgASgJGksKBlNlbGVjdBIfCgdvcGVyYW5kGAEgASgLMg4uY2VsLmV4cHIuRXhwchINCgVmaWVsZBgCIAEoCRIRCgl0ZXN0X29ubHkYAyABKAgaVgoEQ2FsbBIeCgZ0YXJnZXQYASABKAsyDi5jZWwuZXhwci5FeHByEhAKCGZ1bmN0aW9uGAIgASgJEhwKBGFyZ3MYAyADKAsyDi5jZWwuZXhwci5FeHByGkgKCkNyZWF0ZUxpc3QSIAoIZWxlbWVudHMYASADKAsyDi5jZWwuZXhwci5FeHByEhgKEG9wdGlvbmFsX2luZGljZXMYAiADKAUa6QEKDENyZWF0ZVN0cnVjdBIUCgxtZXNzYWdlX25hbWUYASABKAkSMgoHZW50cmllcxgCIAMoCzIhLmNlbC5leHByLkV4cHIuQ3JlYXRlU3RydWN0LkVudHJ5Go4BCgVFbnRyeRIKCgJpZBgBIAEoAxITCglmaWVsZF9rZXkYAiABKAlIABIhCgdtYXBfa2V5GAMgASgLMg4uY2VsLmV4cHIuRXhwckgAEh0KBXZhbHVlGAQgASgLMg4uY2VsLmV4cHIuRXhwchIWCg5vcHRpb25hbF9lbnRyeRgFIAEoCEIKCghrZXlfa2luZBr4AQoNQ29tcHJlaGVuc2lvbhIQCghpdGVyX3ZhchgBIAEoCRIRCglpdGVyX3ZhcjIYCCABKAkSIgoKaXRlcl9yYW5nZRgCIAEoCzIOLmNlbC5leHByLkV4cHISEAoIYWNjdV92YXIYAyABKAkSIQoJYWNjdV9pbml0GAQgASgLMg4uY2VsLmV4cHIuRXhwchImCg5sb29wX2NvbmRpdGlvbhgFIAEoCzIOLmNlbC5leHByLkV4cHISIQoJbG9vcF9zdGVwGAYgASgLMg4uY2VsLmV4cHIuRXhwchIeCgZyZXN1bHQYByABKAsyDi5jZWwuZXhwci5FeHByQgsKCWV4cHJfa2luZCLNAgoIQ29uc3RhbnQSMAoKbnVsbF92YWx1ZRgBIAEoDjIaLmdvb2dsZS5wcm90b2J1Zi5OdWxsVmFsdWVIABIUCgpib29sX3ZhbHVlGAIgASgISAASFQoLaW50NjRfdmFsdWUYAyABKANIABIWCgx1aW50NjRfdmFsdWUYBCABKARIABIWCgxkb3VibGVfdmFsdWUYBSABKAFIABIWCgxzdHJpbmdfdmFsdWUYBiABKAlIABIVCgtieXRlc192YWx1ZRgHIAEoDEgAEjcKDmR1cmF0aW9uX3ZhbHVlGAggASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQgIYAUgAEjkKD3RpbWVzdGFtcF92YWx1ZRgJIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCAhgBSABCDwoNY29uc3RhbnRfa2luZCKcBQoKU291cmNlSW5mbxIWCg5zeW50YXhfdmVyc2lvbhgBIAEoCRIQCghsb2NhdGlvbhgCIAEoCRIUCgxsaW5lX29mZnNldHMYAyADKAUSNgoJcG9zaXRpb25zGAQgAygLMiMuY2VsLmV4cHIuU291cmNlSW5mby5Qb3NpdGlvbnNFbnRyeRI5CgttYWNyb19jYWxscxgFIAMoCzIkLmNlbC5leHByLlNvdXJjZUluZm8uTWFjcm9DYWxsc0VudHJ5EjIKCmV4dGVuc2lvbnMYBiADKAsyHi5jZWwuZXhwci5Tb3VyY2VJbmZvLkV4dGVuc2lvbhowCg5Qb3NpdGlvbnNFbnRyeRILCgNrZXkYASABKAMSDQoFdmFsdWUYAiABKAU6AjgBGkEKD01hY3JvQ2FsbHNFbnRyeRILCgNrZXkYASABKAMSHQoFdmFsdWUYAiABKAsyDi5jZWwuZXhwci5FeHByOgI4ARqxAgoJRXh0ZW5zaW9uEgoKAmlkGAEgASgJEkUKE2FmZmVjdGVkX2NvbXBvbmVudHMYAiADKA4yKC5jZWwuZXhwci5Tb3VyY2VJbmZvLkV4dGVuc2lvbi5Db21wb25lbnQSNwoHdmVyc2lvbhgDIAEoCzImLmNlbC5leHByLlNvdXJjZUluZm8uRXh0ZW5zaW9uLlZlcnNpb24aJwoHVmVyc2lvbhINCgVtYWpvchgBIAEoAxINCgVtaW5vchgCIAEoAyJvCglDb21wb25lbnQSGQoVQ09NUE9ORU5UX1VOU1BFQ0lGSUVEEAASFAoQQ09NUE9ORU5UX1BBUlNFUhABEhoKFkNPTVBPTkVOVF9UWVBFX0NIRUNLRVIQAhIVChFDT01QT05FTlRfUlVOVElNRRADQi4KDGRldi5jZWwuZXhwckILU3ludGF4UHJvdG9QAVoMY2VsLmRldi9leHBy+AEBYgZwcm90bzM",[file_google_protobuf_duration2,file_google_protobuf_struct2,file_google_protobuf_timestamp2]),ParsedExprSchema=messageDesc3(file_cel_expr_syntax,0),ExprSchema=messageDesc3(file_cel_expr_syntax,1);var SourceInfo_Extension_Component;(function(SourceInfo_Extension_Component2){SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.UNSPECIFIED=0]="UNSPECIFIED",SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.PARSER=1]="PARSER",SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.TYPE_CHECKER=2]="TYPE_CHECKER",SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.RUNTIME=3]="RUNTIME"})(SourceInfo_Extension_Component||(SourceInfo_Extension_Component={}));var LogicManager=class _LogicManager{builder;function;terms;ops;variadicASTs;constructor(builder2,functionName,term,variadicASTs){this.builder=builder2,this.function=functionName,this.terms=[term],this.ops=[],this.variadicASTs=variadicASTs}static newVariadicLogicManager(builder2,functionName,term){return new _LogicManager(builder2,functionName,term,!0)}static newBalancingLogicManager(builder2,functionName,term){return new _LogicManager(builder2,functionName,term,!1)}addTerm(op2,term){this.terms.push(term),this.ops.push(op2)}toExpr(){return this.terms.length===1?this.terms[0]:this.variadicASTs?this.builder.nextExpr(this.ops[0],{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:this.function,args:this.terms}}):this.balancedTree(0,this.ops.length-1)}balancedTree(lo,hi){let mid=Math.floor((lo+hi+1)/2),left;mid===lo?left=this.terms[mid]:left=this.balancedTree(lo,mid-1);let right;return mid===hi?right=this.terms[mid+1]:right=this.balancedTree(mid+1,hi),this.builder.nextExpr(this.ops[mid],{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:this.function,args:[left,right]}})}};var encoder2=new TextEncoder,accuVarName="@result",Builder=class{#prevId=0n;sourceInfo={$typeName:"cel.expr.SourceInfo",syntaxVersion:"",location:"",lineOffsets:[],positions:{},macroCalls:{},extensions:[]};nextExpr(offset,exprKind){return this.sourceInfo.positions[(++this.#prevId).toString()]=offset,{$typeName:"cel.expr.Expr",id:this.#prevId,exprKind}}nextEntry(offset,keyKind,value){return this.sourceInfo.positions[(++this.#prevId).toString()]=offset,{$typeName:"cel.expr.Expr.CreateStruct.Entry",id:this.#prevId,keyKind,value,optionalEntry:!1}}newConstExpr(offset,constantKind){return this.nextExpr(offset,{case:"constExpr",value:{$typeName:"cel.expr.Constant",constantKind}})}newCallExpr(offset,functionName,args){if(functionName==="has"&&args.length===1&&args[0].exprKind?.case==="selectExpr")return this.expandHasMacro(offset,args[0]);if((functionName==="_||_"||functionName==="_&&_")&&args.length>1){let logicManager=LogicManager.newBalancingLogicManager(this,functionName,args[0]);for(let i6=1;i6<args.length;i6+=1)logicManager.addTerm(offset,args[i6]);return logicManager.toExpr()}return this.nextExpr(offset,{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:functionName,args}})}newMemberCallExpr(offset,target,functionName,args){return this.maybeExpand(offset,this.nextExpr(offset,{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:functionName,target,args}}))}newStringExpr(offset,sequence){return this.newConstExpr(offset,{case:"stringValue",value:sequence.reduce((string,chunk)=>{if(typeof chunk!="string"){if(chunk.some(cp=>cp>=55296&&cp<57344))throw new Error("surrogate code points are not allowed");return string+String.fromCodePoint(...chunk)}return string+chunk},"")})}newBytesExpr(offset,sequence){let chunks=[],totalSize=0;for(let rawChunk of sequence){let chunk=typeof rawChunk=="string"?encoder2.encode(rawChunk):rawChunk;chunks.push(chunk),totalSize+=chunk.length}let value=new Uint8Array(totalSize),chunkOffset=0;for(let chunk of chunks)value.set(chunk,chunkOffset),chunkOffset+=chunk.length;return this.newConstExpr(offset,{case:"bytesValue",value})}newBoolExpr(offset,keyword){return this.newConstExpr(offset,{case:"boolValue",value:keyword==="true"})}newInt64Expr(offset,digits){return this.newConstExpr(offset,{case:"int64Value",value:digits[0]==="-"?-BigInt(digits.slice(1)):BigInt(digits)})}newUnsignedInt64Expr(offset,digits){return this.newConstExpr(offset,{case:"uint64Value",value:BigInt(digits)})}newDoubleExpr(offset,digits){return this.newConstExpr(offset,{case:"doubleValue",value:parseFloat(digits)})}newNullExpr(offset){return this.newConstExpr(offset,{case:"nullValue",value:0})}newIdentExpr(offset,name){return this.nextExpr(offset,{case:"identExpr",value:{$typeName:"cel.expr.Expr.Ident",name}})}newInfixExpr(offset,op2,args){return this.newCallExpr(offset,op2==="in"?"@in":`_${op2}_`,args)}newSelectExpr(offset,operand,field3){return this.nextExpr(offset,{case:"selectExpr",value:{$typeName:"cel.expr.Expr.Select",operand,field:field3,testOnly:!1}})}newIndexExpr(offset,operand,index2){return this.newCallExpr(offset,"_[_]",[operand,index2])}expandHasMacro(offset,target){return target.exprKind.case!=="selectExpr"?this.newCallExpr(offset,"has",[target]):(target.exprKind.value.testOnly=!0,target)}newListExpr(offset,elements){return this.nextExpr(offset,{case:"listExpr",value:{$typeName:"cel.expr.Expr.CreateList",elements,optionalIndices:[]}})}newBoolMacro(offset,iterRange,iterVar,init,loopStep,loopCondition){return this.nextExpr(offset,{case:"comprehensionExpr",value:{$typeName:"cel.expr.Expr.Comprehension",accuVar:accuVarName,accuInit:this.newConstExpr(offset,{case:"boolValue",value:init}),iterVar,iterVar2:"",iterRange,loopStep,loopCondition,result:this.newIdentExpr(offset,accuVarName)}})}newListMacro(offset,iterRange,iterVar,loopStep){return this.nextExpr(offset,{case:"comprehensionExpr",value:{$typeName:"cel.expr.Expr.Comprehension",accuVar:accuVarName,accuInit:this.newListExpr(offset,[]),iterVar,iterVar2:"",iterRange,loopCondition:this.newConstExpr(offset,{case:"boolValue",value:!0}),loopStep,result:this.newIdentExpr(offset,accuVarName)}})}expandExistsMacro(offset,target,x2,test){return this.newBoolMacro(offset,target,x2,!1,this.newCallExpr(offset,"_||_",[this.newIdentExpr(offset,accuVarName),test]),this.newCallExpr(offset,"@not_strictly_false",[this.newCallExpr(offset,"!_",[this.newIdentExpr(offset,accuVarName)])]))}expandAllMacro(offset,target,x2,test){return this.newBoolMacro(offset,target,x2,!0,this.newCallExpr(offset,"_&&_",[this.newIdentExpr(offset,accuVarName),test]),this.newCallExpr(offset,"@not_strictly_false",[this.newIdentExpr(offset,accuVarName)]))}expandMapMacro(offset,target,x2,step){return this.newListMacro(offset,target,x2,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newListExpr(offset,[step])]))}expandMapFilterMacro(offset,target,x2,test,step){return this.newListMacro(offset,target,x2,this.newCallExpr(offset,"_?_:_",[test,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newListExpr(offset,[step])]),this.newIdentExpr(offset,accuVarName)]))}expandFilterMacro(offset,target,x2,step){return this.newListMacro(offset,target,x2,this.newCallExpr(offset,"_?_:_",[step,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newListExpr(offset,[this.newIdentExpr(offset,x2)])]),this.newIdentExpr(offset,accuVarName)]))}expandExistsOne(offset,iterRange,iterVar,step){return this.nextExpr(offset,{case:"comprehensionExpr",value:{$typeName:"cel.expr.Expr.Comprehension",accuVar:accuVarName,accuInit:this.newConstExpr(offset,{case:"int64Value",value:BigInt(0)}),iterVar,iterVar2:"",iterRange,loopCondition:this.newConstExpr(offset,{case:"boolValue",value:!0}),loopStep:this.newCallExpr(offset,"_?_:_",[step,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newConstExpr(offset,{case:"int64Value",value:BigInt(1)})]),this.newIdentExpr(offset,accuVarName)]),result:this.newCallExpr(offset,"_==_",[this.newIdentExpr(offset,accuVarName),this.newConstExpr(offset,{case:"int64Value",value:BigInt(1)})])}})}maybeExpand(offset,call){if(call.exprKind.case==="callExpr"){let callExpr=call.exprKind.value,varName=callExpr.args[0];if(varName!==void 0&&call.exprKind.value.target!==void 0&&varName.exprKind?.case==="identExpr"){if(callExpr.args.length===2)switch(callExpr.function){case"exists":return this.expandExistsMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"all":return this.expandAllMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"map":return this.expandMapMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"filter":return this.expandFilterMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"exists_one":case"existsOne":return this.expandExistsOne(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1])}if(callExpr.args.length===3&&callExpr.function=="map")return this.expandMapFilterMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1],call.exprKind.value.args[2])}}return call}newMapEntry(offset,key,value){return this.nextEntry(offset,{case:"mapKey",value:key},value)}newStructExpr(offset,entries,messageName=""){return this.nextExpr(offset,{case:"structExpr",value:{$typeName:"cel.expr.Expr.CreateStruct",entries,messageName}})}newStructEntry(offset,field3,value){return this.nextEntry(offset,{case:"fieldKey",value:field3},value)}};var runtime;(function(runtime2){class GrammarLocation{source;start;constructor(source,start){this.source=source,this.start=start}toString(){return String(this.source)}offset(loc){return{line:loc.line+this.start.line-1,column:loc.line===1?loc.column+this.start.column-1:loc.column,offset:loc.offset+this.start.offset}}static offsetStart(range2){return range2.source instanceof GrammarLocation?range2.source.offset(range2.start):range2.start}static offsetEnd(range2){return range2.source instanceof GrammarLocation?range2.source.offset(range2.end):range2.end}}runtime2.GrammarLocation=GrammarLocation;function padEnd(str2,targetLength,padString){return padString=padString||" ",str2.length>targetLength?str2:(targetLength-=str2.length,padString+=padString.repeat(targetLength),str2+padString.slice(0,targetLength))}runtime2.padEnd=padEnd;class ParseFailure{}runtime2.ParseFailure=ParseFailure;function isFailure(r5){return!r5.success}runtime2.isFailure=isFailure;function getLine2(input,offset){let line=1;for(let i6=0;i6<offset;i6++)input[i6]==="\r"?(input[i6+1]===`
+caused by: ${_Layerr.fullStack(cause)}`:err2.stack??""}static info(err2){assertError(err2);let output={},cause=_Layerr.cause(err2);return cause&&Object.assign(output,_Layerr.info(cause)),err2._info&&Object.assign(output,err2._info),output}toString(){let output=this.name||this.constructor.name||this.constructor.prototype.name;return this.message&&(output=`${output}: ${this.message}`),output}};var ENCODING="0123456789ABCDEFGHJKMNPQRSTVWXYZ",ENCODING_LEN=32,TIME_MAX=0xffffffffffff,TIME_LEN=10,RANDOM_LEN=16,ERROR_INFO=Object.freeze({source:"ulid"});function detectPRNG(root5){let rootLookup=root5||detectRoot(),globalCrypto=rootLookup&&(rootLookup.crypto||rootLookup.msCrypto)||(typeof import_node_crypto2.default<"u"?import_node_crypto2.default:null);if(typeof globalCrypto?.getRandomValues=="function")return()=>{let buffer=new Uint8Array(1);return globalCrypto.getRandomValues(buffer),buffer[0]/255};if(typeof globalCrypto?.randomBytes=="function")return()=>globalCrypto.randomBytes(1).readUInt8()/255;if(import_node_crypto2.default?.randomBytes)return()=>import_node_crypto2.default.randomBytes(1).readUInt8()/255;throw new Layerr({info:{code:"PRNG_DETECT",...ERROR_INFO}},"Failed to find a reliable PRNG")}function detectRoot(){return inWebWorker()?self:typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:null}function encodeRandom(len,prng){let str2="";for(;len>0;len--)str2=randomChar(prng)+str2;return str2}function encodeTime(now,len){if(isNaN(now))throw new Layerr({info:{code:"ENC_TIME_NAN",...ERROR_INFO}},`Time must be a number: ${now}`);if(now>TIME_MAX)throw new Layerr({info:{code:"ENC_TIME_SIZE_EXCEED",...ERROR_INFO}},`Cannot encode a time larger than ${TIME_MAX}: ${now}`);if(now<0)throw new Layerr({info:{code:"ENC_TIME_NEG",...ERROR_INFO}},`Time must be positive: ${now}`);if(Number.isInteger(now)===!1)throw new Layerr({info:{code:"ENC_TIME_TYPE",...ERROR_INFO}},`Time must be an integer: ${now}`);let mod2,str2="";for(let currentLen=len;currentLen>0;currentLen--)mod2=now%ENCODING_LEN,str2=ENCODING.charAt(mod2)+str2,now=(now-mod2)/ENCODING_LEN;return str2}function inWebWorker(){return typeof WorkerGlobalScope<"u"&&self instanceof WorkerGlobalScope}function randomChar(prng){let rand=Math.floor(prng()*ENCODING_LEN);return rand===ENCODING_LEN&&(rand=ENCODING_LEN-1),ENCODING.charAt(rand)}function ulid(seedTime,prng){let currentPRNG=prng||detectPRNG(),seed=isNaN(seedTime)?Date.now():seedTime;return encodeTime(seed,TIME_LEN)+encodeRandom(RANDOM_LEN,currentPRNG)}function metadataOf(msg){return msg.metadata}function idValueOf(msg){let value=msg.value;return typeof value=="string"?value:""}function camelCaseFieldName(specField){return specField.replace(/_([a-z0-9])/g,(_,ch)=>ch.toUpperCase())}function parentIdOf(resource,specField){let spec=resource.spec;if(spec===void 0)return"";let value=spec[camelCaseFieldName(specField)];return typeof value=="string"?value:""}function messageFieldByName(msg,name){let field3=msg.fields.find(f5=>f5.name===name);return field3!==void 0&&field3.fieldKind==="message"?field3:void 0}function getStatusField(schema2,msg){let root5=reflect2(schema2,msg),field3=messageFieldByName(root5,"status");if(!(field3===void 0||!root5.isSet(field3)))return root5.get(field3)}function getOrCreateStatusField(schema2,msg){let root5=reflect2(schema2,msg),field3=messageFieldByName(root5,"status");if(field3!==void 0)return root5.isSet(field3)||root5.set(field3,reflect2(field3.message)),root5.get(field3)}function hasStatusField(schema2){return schema2.fields.some(f5=>f5.name==="status"&&f5.fieldKind==="message")}function newBuildNewStateStep(){return{name:"BuildNewState",execute(ctx){let resource=ctx.newState,metadata=metadataOf(resource);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"build new state");hasStatusField(ctx.schema)&&clearStatusField(ctx.schema,resource),metadata.id===""&&(metadata.id=generateId(getIdPrefix(ctx.apiResourceKind))),hasStatusField(ctx.schema)&&setAuditFieldsForCreate(ctx.schema,resource,ctx.callerIdentity),metadata.visibility===ApiResourceVisibility.api_resource_visibility_unspecified&&(metadata.visibility=defaultVisibilityFor(ctx.apiResourceKind))}}}function clearStatusField(schema2,msg){let root5=reflect2(schema2,msg),field3=root5.fields.find(f5=>f5.name==="status"&&f5.fieldKind==="message");field3!==void 0&&root5.isSet(field3)&&root5.clear(field3)}function setAuditFieldsForCreate(schema2,resource,identity2){let now=timestampNow(),actor=auditActorFor(identity2),info=create2(ApiResourceAuditInfoSchema,{createdBy:actor,createdAt:now,updatedBy:actor,updatedAt:now,event:"created"});setAuditReflect(schema2,resource,create2(ApiResourceAuditSchema,{specAudit:info,statusAudit:info}))}function setAuditFieldsForUpdate(schema2,resource,slot,identity2){let now=timestampNow(),actor=auditActorFor(identity2),{createdBy,createdAt}=creationAuditOf(schema2,resource,slot);setAuditSlotReflect(schema2,resource,slot,updatedAuditInfo(createdBy,createdAt,actor,now))}function bumpStatusAudit(status){status.audit===void 0&&(status.audit=create2(ApiResourceAuditSchema));let prior=status.audit.statusAudit,next=prior===void 0?create2(ApiResourceAuditInfoSchema):clone(ApiResourceAuditInfoSchema,prior);next.updatedAt=timestampNow(),next.event="updated",status.audit.statusAudit=next}var operatorEmail="",operatorName="",operatorIdentityInstalled=!1;function setOperatorIdentity(email,displayName){if(operatorIdentityInstalled)throw new Error("operator identity already installed (boot wiring bug)");operatorIdentityInstalled=!0,operatorEmail=email,operatorName=displayName}function operatorIdentitySnapshot(){return{email:operatorEmail,displayName:operatorName}}function auditActorFor(identity2){return create2(ApiResourceAuditActorSchema,{id:identity2.identityId,email:identity2.email??"",displayName:identity2.displayName??"",platformClientId:identity2.platformClientId??""})}function updatedAuditInfo(createdBy,createdAt,actor,now){return create2(ApiResourceAuditInfoSchema,{createdBy:createdBy??actor,createdAt:createdAt??now,updatedBy:actor,updatedAt:now,event:"updated"})}function creationAuditOf(schema2,resource,slot){let audit=auditOf(schema2,resource),info=slot==="spec_audit"?audit?.specAudit:audit?.statusAudit;return{createdBy:info?.createdBy!==void 0?clone(ApiResourceAuditActorSchema,info.createdBy):void 0,createdAt:info?.createdAt!==void 0?{...info.createdAt}:void 0}}function auditOf(schema2,resource){let status=getStatusField(schema2,resource);if(status===void 0)return;let auditField=messageFieldByName(status,"audit");if(!(auditField===void 0||!status.isSet(auditField)))return status.get(auditField).message}function setAuditReflect(schema2,resource,audit){let status=getOrCreateStatusField(schema2,resource);if(status===void 0)return;let auditField=messageFieldByName(status,"audit");auditField!==void 0&&status.set(auditField,reflect2(ApiResourceAuditSchema,audit))}function setAuditSlotReflect(schema2,resource,slot,info){let status=getOrCreateStatusField(schema2,resource);if(status===void 0)return;let auditField=messageFieldByName(status,"audit");if(auditField===void 0)return;status.isSet(auditField)||status.set(auditField,reflect2(auditField.message));let auditMsg=status.get(auditField),slotField=messageFieldByName(auditMsg,slot);slotField!==void 0&&auditMsg.set(slotField,reflect2(ApiResourceAuditInfoSchema,info))}function generateId(prefix){return`${prefix}_${ulid().toLowerCase()}`}var CROCKFORD_ALPHABET="0123456789abcdefghjkmnpqrstvwxyz",DERIVED_ID_CHARS=26,DERIVED_ID_BITS=BigInt(DERIVED_ID_CHARS*5),SHA256_BITS=256n;function derivedId(prefix,canonicalText){let digest3=(0,import_node_crypto3.createHash)("sha256").update(canonicalText,"utf8").digest(),bits2=0n;for(let byte of digest3)bits2=bits2<<8n|BigInt(byte);let top=bits2>>SHA256_BITS-DERIVED_ID_BITS,encoded="";for(let i6=0;i6<DERIVED_ID_CHARS;i6++)encoded=CROCKFORD_ALPHABET[Number(top&31n)]+encoded,top>>=5n;return`${prefix}_${encoded}`}var AUTHENTICATION_TOKEN_MISSING_MESSAGE="authentication token missing",AUTHENTICATION_EXEMPT_SERVICES=new Set(["grpc.health.v1.Health"]);function isAuthenticationExempt(method){return getOption(method,is_public)||AUTHENTICATION_EXEMPT_SERVICES.has(method.parent.typeName)}var callerIdentityKey=createContextKey(void 0,{description:"caller identity produced at chain position 1"});function callerIdentityOf(ctx){let identity2=ctx.values.get(callerIdentityKey);if(identity2===void 0)throw internalError(new Error("no caller identity in context (chain wiring bug)"),"internal server error");return identity2}function trustedLocalIdentity(){return trustedLocalIdentityFor(operatorIdentitySnapshot())}var SYSTEM_OPERATOR_IDENTITY_ID="system";function trustedLocalIdentityFor(operator){return operator.email===""?{identityId:SYSTEM_OPERATOR_IDENTITY_ID,callerClass:"user",issuer:"",rawToken:""}:{identityId:operator.email,callerClass:"user",issuer:"",rawToken:"",email:operator.email,displayName:operator.displayName}}function serverActingFor(principalId){if(principalId==="")throw new Error("the server acts for a named principal \u2014 refusing to build an internal caller with none");return{identityId:principalId,callerClass:"internal",issuer:"",rawToken:""}}function createVerifierChainInterceptor(verifiers,guards,logger2,requireAuthentication=!1){return next=>async request=>{request.header.delete(IN_PROCESS_CALLER_HEADER);let token=parseBearerToken(request.header.get("authorization")??""),identity2;if(token!==""){if(identity2=await authenticateBearerToken(verifiers,token,logger2),identity2===void 0&&verifiers.length>0)throw logger2.warn("presented token not claimed by any identity verifier",{verifiers:verifiers.map(v=>v.name).join(", ")}),new ConnectError("the presented token was not accepted by any configured identity verifier",Code.Unauthenticated)}else if(requireAuthentication&&!isAuthenticationExempt(request.method))throw new ConnectError(AUTHENTICATION_TOKEN_MISSING_MESSAGE,Code.Unauthenticated);let stamped=identity2??trustedLocalIdentity();return request.contextValues.set(callerIdentityKey,stamped),await runCallerGuards(guards,stamped,request,logger2),next(request)}}async function runCallerGuards(guards,caller,request,logger2){for(let guard of guards)try{await guard.guard(caller,request.method,request.header)}catch(error2){let procedure=`/${request.service.typeName}/${request.method.name}`;throw error2 instanceof ConnectError?(logger2.warn("caller guard refused the request",{guard:guard.name,procedure,code:Code[error2.code]}),error2):(logger2.error("caller guard failed",{guard:guard.name,procedure,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"internal server error"))}}var IN_PROCESS_CALLER_HEADER="x-stigmer-inprocess-caller";function encodeInProcessCaller(caller){return Buffer.from(JSON.stringify(caller)).toString("base64url")}function createInProcessCallerInterceptor(){return next=>request=>{let encoded=request.header.get(IN_PROCESS_CALLER_HEADER),identity2;if(encoded!==null){request.header.delete(IN_PROCESS_CALLER_HEADER);try{identity2={...JSON.parse(Buffer.from(encoded,"base64url").toString("utf8")),origin:"in-process"}}catch(error2){throw internalError(error2 instanceof Error?error2:new Error(String(error2)),"internal server error")}}else identity2={...trustedLocalIdentity(),callerClass:"internal",origin:"in-process"};return request.contextValues.set(callerIdentityKey,identity2),next(request)}}async function authenticateBearerToken(verifiers,token,logger2){for(let verifier of verifiers){let claimed;try{claimed=await verifier.verify(token)}catch(error2){throw error2 instanceof ConnectError?error2:(logger2.error("identity verifier failed",{verifier:verifier.name,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"internal server error"))}if(claimed!==null)return claimed}}function parseBearerToken(joinedHeaderValue){let header=joinedHeaderValue.split(",")[0]??"",prefix="bearer ";return header.length<=prefix.length||header.slice(0,prefix.length).toLowerCase()!==prefix?"":header.slice(prefix.length).trim()}function rfc3339Seconds(date2){return date2.toISOString().replace(/\.\d{3}Z$/,"Z")}function accountAsCaller(account2){return{...principalOf(account2),callerClass:"user",issuer:"",rawToken:""}}function accountAsRunnerCaller(account2,rawToken){if(rawToken==="")throw new Error("a runner caller carries the credential it presented \u2014 refusing to build one with none");return{...principalOf(account2),callerClass:"runner",issuer:"",rawToken}}function principalOf(account2){let accountId=account2.metadata?.id??"";if(accountId==="")throw new Error("identity account carries no id \u2014 refusing to build a caller for an empty principal");let email=account2.spec?.email??"",displayName=account2.metadata?.name??"";return{identityId:accountId,...email!==""?{email}:{},...displayName!==""?{displayName}:{}}}var POLICY_ID_PREFIX="iamp",IAM_POLICY_API_VERSION="iam.stigmer.ai/v1",IAM_POLICY_KIND="IamPolicy",TRIPLE_DELIMITERS=[":","#","@"];function completeTriple(spec){if(spec.principal===void 0||spec.resource===void 0)throw new Error("policy spec must carry principal and resource");return{principal:spec.principal,resource:spec.resource,relation:spec.relation}}function canonicalTripleText(spec){let{principal,resource,relation}=completeTriple(spec);return`${principal.kind}:${principal.id}#${principal.relation}@${resource.kind}:${resource.id}#${relation}`}function malformedTripleField(spec){let fields2=[["principal.kind",spec.principal?.kind??""],["principal.id",spec.principal?.id??""],["principal.relation",spec.principal?.relation??""],["resource.kind",spec.resource?.kind??""],["resource.id",spec.resource?.id??""],["relation",spec.relation]];for(let[path14,value]of fields2)if(TRIPLE_DELIMITERS.some(delimiter=>value.includes(delimiter)))return path14}function policyIdFor(spec){let text2=canonicalTripleText(spec),malformed=malformedTripleField(spec);if(malformed!==void 0)throw new Error(malformedTripleMessage(malformed));return derivedId(POLICY_ID_PREFIX,text2)}var BLUEPRINT_KINDS=[ApiResourceKind.agent,ApiResourceKind.workflow,ApiResourceKind.skill,ApiResourceKind.mcp_server,ApiResourceKind.environment,ApiResourceKind.schedule],ROLES_RECONCILED_KEY="membership_rules_reconciled",USER_GRANT_PRINCIPAL_KINDS=[ApiResourceKind.identity_account,ApiResourceKind.team],TEAM_MEMBERS_RELATION="member";function policyNotFoundMessage(id){return`IAM policy not found: ${id}`}function noGrantableRolesMessage(kind){return`No roles can be granted on resource kind '${kind}'. Role assignments for this resource kind are system-managed.`}function roleNotGrantableMessage(role,kind,grantable){return`Role '${role}' cannot be granted on resource kind '${kind}'. Grantable roles: [${grantable.join(", ")}]`}var AUTHENTICATION_REQUIRED_MESSAGE="Authentication required to check permissions";function unknownResourceKindMessage(kind){return`Unknown resource kind: '${kind}'`}var PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE="per-resource access grants are served by the Enterprise and Cloud editions",AUTHORIZATION_QUERIES_UNIMPLEMENTED_MESSAGE="authorization queries are served by the Enterprise and Cloud editions";function unknownPermissionMessage(relation){return`unknown permission '${relation}'`}function unknownPrincipalKindMessage(kind){return`Unknown principal kind: '${kind}'`}function principalNotGrantableMessage(kind){let grantable=USER_GRANT_PRINCIPAL_KINDS.map(k5=>kindEnumName(k5));return`Principal kind '${kind}' cannot be granted a role. Grantable principal kinds: [${grantable.join(", ")}]`}function personQualifierMessage(relation){return`Principal kind 'identity_account' takes no relation; got '${relation}'`}function teamQualifierMessage(relation){return`A team principal must name the relation '${TEAM_MEMBERS_RELATION}' (the team's members); got '${relation}'`}function teamNotGrantableMessage(kind){return`A team cannot be granted access to resource kind '${kind}'.`}function teamRoleNotGrantableMessage(role,kind,grantable){return`Role '${role}' cannot be granted to a team on resource kind '${kind}'. Roles a team can hold: [${grantable.join(", ")}]`}function malformedTripleMessage(field3){return`policy ${field3} must not contain ':', '#' or '@'`}var OWNER_ASSIGNMENT_DENIED_MESSAGE="only an owner of the organization can grant, revoke or remove the owner role",LAST_OWNER_MESSAGE="an organization must keep at least one owner; make another member an owner first";var file_ai_stigmer_iam_iampolicy_v1_spec=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvc3BlYy5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxIr4BCg1JYW1Qb2xpY3lTcGVjEkYKCXByaW5jaXBhbBgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEkUKCHJlc291cmNlGAIgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmQga6SAPIAQESHgoIcmVsYXRpb24YAyABKAlCDLpICcgBAXIEEAEYQCJkCg5BcGlSZXNvdXJjZVJlZhIbCgRraW5kGAEgASgJQg26SArIAQFyBRABGIACEhkKAmlkGAIgASgJQg26SArIAQFyBRABGIACEhoKCHJlbGF0aW9uGAMgASgJQgi6SAVyAxiAAmIGcHJvdG8z",[file_buf_validate_validate]),IamPolicySpecSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_spec,0),ApiResourceRefSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_spec,1);function relationOf(role){if(role===IamRole.iam_role_unspecified)throw new Error("iam_role_unspecified is not a relation");return IamRole[role]}function organizationRole(accountId,role,organizationId){return create2(IamPolicySpecSchema,{principal:{kind:kindEnumName(ApiResourceKind.identity_account),id:accountId},relation:relationOf(role),resource:{kind:kindEnumName(ApiResourceKind.organization),id:organizationId}})}var CREATOR_SCAN_SCHEMAS=new Map([[ApiResourceKind.organization,OrganizationSchema],[ApiResourceKind.agent,AgentSchema],[ApiResourceKind.workflow,WorkflowSchema],[ApiResourceKind.skill,SkillSchema],[ApiResourceKind.mcp_server,McpServerSchema],[ApiResourceKind.environment,EnvironmentSchema],[ApiResourceKind.schedule,ScheduleSchema]]),ORGANIZATION=kindEnumName(ApiResourceKind.organization),IDENTITY_ACCOUNT=kindEnumName(ApiResourceKind.identity_account);function isPersonStamp(stamp2){return stamp2!==""&&stamp2!==SYSTEM_OPERATOR_IDENTITY_ID}function isPersonAccount(account2){let spec=account2.spec;return spec!==void 0&&!spec.isMachineAccount&&spec.provisioningMode!==IdentityAccountProvisioningMode.machine&&spec.provisioningMode!==IdentityAccountProvisioningMode.platform_client}function roleFor(question){let{accountId,subject,email,operatorEmail:operatorEmail2,organization,blueprintsInOrganization,organizationHasRows}=question,isMine=stamp2=>stamp2!==""&&(stamp2===subject||stamp2===accountId);return isMine(organization.createdBy)?IamRole.owner:blueprintsInOrganization.some(b7=>isMine(b7.createdBy))?IamRole.admin:operatorEmail2!==""&&email===operatorEmail2?IamRole.admin:![organization.createdBy,...blueprintsInOrganization.map(b7=>b7.createdBy)].some(stamp2=>isPersonStamp(stamp2)&&!isMine(stamp2))&&!organizationHasRows?IamRole.admin:IamRole.member}function createdAtMillisOf(account2){let stamp2=account2.status?.audit?.specAudit?.createdAt;return stamp2===void 0?Number.NEGATIVE_INFINITY:Number(stamp2.seconds)*1e3+Math.floor(stamp2.nanos/1e6)}function newMembershipRules(deps){let{grantPath,policies,store,operatorEmail:operatorEmail2}=deps;async function scan2(kind){let schema2=CREATOR_SCAN_SCHEMAS.get(kind);if(schema2===void 0)throw new Error(`no schema to decode ${kindEnumName(kind)} rows for the creator scan`);return(await store.listResources(kind)).map(bytes=>{let resource=fromBinary2(schema2,bytes),metadata=metadataOf(resource);return{id:metadata?.id??"",org:metadata?.org??"",createdBy:auditOf(schema2,resource)?.specAudit?.createdBy?.id??""}})}async function scanBlueprints(){let scanned=[];for(let kind of BLUEPRINT_KINDS)scanned.push(...await scan2(kind));return scanned}async function organizationsHeldBy(accountId){let rows=await policies.findByPrincipal(IDENTITY_ACCOUNT,accountId);return new Set(rows.filter(row=>row.spec?.resource?.kind===ORGANIZATION).map(row=>row.spec?.resource?.id??""))}async function scanWorld(){return{organizations:await scan2(ApiResourceKind.organization),blueprints:await scanBlueprints()}}async function applyRulesTo(account2,caller,world){let accountId=account2.metadata?.id??"";if(accountId==="")throw new Error("membership rules: the account carries no id");let subject=account2.spec?.idpId??"",email=account2.spec?.email??"",held=await organizationsHeldBy(accountId);for(let organization of world.organizations){if(held.has(organization.id))continue;let blueprintsInOrganization=world.blueprints.filter(blueprint=>blueprint.org===organization.id),role=roleFor({accountId,subject,email,operatorEmail:operatorEmail2,organization,blueprintsInOrganization,organizationHasRows:(await policies.findByResource(ORGANIZATION,organization.id)).length>0});await grantPath.grant(organizationRole(accountId,role,organization.id),caller)}}async function scanPersonAccounts(){return(await store.listResources(ApiResourceKind.identity_account)).map(bytes=>fromBinary2(IdentityAccountSchema,bytes)).filter(isPersonAccount).sort((a5,b7)=>{let byCreation=createdAtMillisOf(a5)-createdAtMillisOf(b7);return byCreation!==0?byCreation:(a5.metadata?.id??"").localeCompare(b7.metadata?.id??"")})}return{async onAccountCreated(account2,caller){if(caller.callerClass!=="user")return;if((account2.metadata?.id??"")==="")throw new Error("membership rules: the provisioned account carries no id");let organizations=await scan2(ApiResourceKind.organization);organizations.length!==0&&await applyRulesTo(account2,caller,{organizations,blueprints:await scanBlueprints()})},async ensureRolesForExistingAccounts(){if(await store.bootstrapState.get(ROLES_RECONCILED_KEY)!=="")return;let accounts=await scanPersonAccounts();if(accounts.length>0){let world=await scanWorld();for(let account2 of accounts)await applyRulesTo(account2,accountAsCaller(account2),world)}await store.bootstrapState.set(ROLES_RECONCILED_KEY,rfc3339Seconds(new Date))},async ensureOperatorOwnership(operator){let accountId=operator.metadata?.id??"";if(accountId==="")throw new Error("membership rules: the operator account carries no id");let actor=accountAsCaller(operator);for(let organization of await scan2(ApiResourceKind.organization))(await policies.findByResourceWithRelations(ORGANIZATION,organization.id,[relationOf(IamRole.owner)])).length>0||await grantPath.grant(organizationRole(accountId,IamRole.owner,organization.id),actor)}}}var ResourceNotFoundError=class extends Error{constructor(detail){super(`resource not found: ${detail}`),this.name="ResourceNotFoundError"}},AuditNotFoundError=class extends Error{constructor(detail){super(`audit record not found: ${detail}`),this.name="AuditNotFoundError"}},IN_FLIGHT_CLAIM_TTL_MS=300*1e3,DELIVERED_SIGNAL_DEDUPE_TTL_MS=1440*60*1e3,PENDING_OAUTH_STATE_TTL_MS=600*1e3;async function findResourceBySlug(store,kind,schema2,slug,org){let rows=await store.listResources(kind);for(let data of rows){let resource;try{resource=fromBinary2(schema2,data)}catch{continue}let metadata=metadataOf(resource);if(!(metadata===void 0||metadata.slug!==slug)&&!(org!==""&&metadata.org!==org))return resource}}async function findResourceByLabelAndOrg(store,kind,schema2,labelKey,labelValue,org){let rows=await store.listResources(kind);for(let data of rows){let resource;try{resource=fromBinary2(schema2,data)}catch{continue}let metadata=metadataOf(resource);if(metadata!==void 0&&metadata.labels[labelKey]===labelValue&&metadata.org===org)return resource}}function requireOrgForReference(kind,org){if(org!=="")return;let kindName;try{kindName=getKindMeta(kind).name}catch(error2){throw internalError(error2,"failed to resolve kind metadata for reference org check")}throw invalidArgumentError(`org is required for ${kindName} lookup`)}function compareCreatedAtDesc(a5,b7){return a5===void 0||b7===void 0?a5===void 0&&b7===void 0?0:a5!==void 0?-1:1:a5.seconds!==b7.seconds?a5.seconds>b7.seconds?-1:1:a5.nanos!==b7.nanos?a5.nanos>b7.nanos?-1:1:0}function matchesAllLabels(resourceLabels,filterLabels){return Object.entries(filterLabels).every(([key,value])=>resourceLabels[key]===value)}var EXISTING_RESOURCE_KEY="existingResource";function newLoadExistingStep(store){return{name:"LoadExisting",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"load existing");let existing;if(metadata.id!=="")try{existing=await store.getResource(ctx.apiResourceKind,metadata.id,ctx.schema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError(getKindName(ctx.apiResourceKind),metadata.id):error2}else if(metadata.slug!==""){let found=await findResourceBySlug(store,ctx.apiResourceKind,ctx.schema,metadata.slug,metadata.org);if(found===void 0)throw notFoundError(getKindName(ctx.apiResourceKind),metadata.slug);existing=found,metadata.id=metadataOf(existing)?.id??""}else throw invalidArgumentError("resource id or slug is required for update");ctx.set(EXISTING_RESOURCE_KEY,existing)}}}async function notifyDefaultInstanceLinked(lifecycle,event){lifecycle?.onDefaultInstanceLinked!==void 0&&await lifecycle.onDefaultInstanceLinked(event)}function visibilityShapesFor(kind,level){let config2=getKindMeta(kind).authorization?.visibility,shapes=new Set,orgFloor=config2?.defaultsToOrgVisibility===!0&&config2.supportsOrg===!0;switch(level){case ApiResourceVisibility.visibility_org:config2?.supportsOrg===!0&&shapes.add("org-viewer");break;case ApiResourceVisibility.visibility_platform:config2?.supportsPlatform===!0&&(shapes.add("platform-viewer"),orgFloor&&shapes.add("org-viewer"));break;default:break}return shapes}function diffVisibilityShapes(kind,oldLevel,newLevel){if(oldLevel===newLevel)return{shapesToCreate:[],shapesToDelete:[]};let oldShapes=visibilityShapesFor(kind,oldLevel),newShapes=visibilityShapesFor(kind,newLevel);return{shapesToCreate:[...newShapes].filter(shape=>!oldShapes.has(shape)),shapesToDelete:[...oldShapes].filter(shape=>!newShapes.has(shape))}}function resolveParentLink(kind,resource,parentConfig){let parentId=parentIdOf(resource,parentConfig.specField);if(parentId==="")throw internalError(new Error(`parent id for relation '${parentConfig.relation}' (spec field '${parentConfig.specField}') is missing on ${getKindName(kind)}`),"failed to create authorization tuples");return{relation:parentConfig.relation,parentKind:getKindEnum(parentConfig.kind),parentId}}function resolveParentLinks(kind,config2,resource,orgId,logger2){let links=[];switch(config2.scopeType){case AuthorizationScopeType.ORGANIZATION:{if(orgId==="")throw internalError(new Error(`organization id is required to create authorization tuples for ${getKindName(kind)}`),"failed to create authorization tuples");links.push({relation:"organization",parentKind:getKindEnum("organization"),parentId:orgId});break}case AuthorizationScopeType.PARENT:{if(config2.parent===void 0)throw internalError(new Error(`${getKindName(kind)} declares PARENT scope without a parent config`),"failed to create authorization tuples");links.push(resolveParentLink(kind,resource,config2.parent));break}case AuthorizationScopeType.OWNER_ONLY:break;case AuthorizationScopeType.PLATFORM:logger2.warn("unhandled PLATFORM authorization scope \u2014 no scope link",{kind:getKindName(kind)});break;default:break}for(let parent of config2.additionalParents)links.push(resolveParentLink(kind,resource,parent));return links}function resolveResourceCreatedEvent(kind,resource,caller,logger2){let config2=getKindMeta(kind).authorization;if(config2===void 0||config2.scopeType===AuthorizationScopeType.NONE||config2.scopeType===AuthorizationScopeType.UNSPECIFIED)return;let metadata=metadataOf(resource);if(metadata===void 0||metadata.id==="")throw internalError(new Error("resource metadata missing after persist"),"failed to create authorization tuples");return{kind,resourceId:metadata.id,orgId:metadata.org,caller,ownerAttribution:config2.ownerType,requiresCreatorTuple:config2.requiresCreatorTuple,parentLinks:resolveParentLinks(kind,config2,resource,metadata.org,logger2),visibilityShapes:[...visibilityShapesFor(kind,metadata.visibility)]}}function newCreateAuthorizationTuplesStep(lifecycle,logger2){return{name:"CreateAuthorizationTuples",async execute(ctx){if(lifecycle===void 0)return;let event=resolveResourceCreatedEvent(ctx.apiResourceKind,ctx.newState,ctx.callerIdentity,logger2);if(event!==void 0)try{await lifecycle.onResourceCreated(event)}catch(error2){throw internalError(error2,"failed to create authorization tuples")}}}}function newCleanupIamPoliciesStep(lifecycle,logger2){return{name:"CleanupIamPolicies",async execute(ctx){if(lifecycle===void 0)return;let metadata=ctx.get(EXISTING_RESOURCE_KEY)?.metadata;if(!(metadata===void 0||metadata.id===""))try{await lifecycle.onResourceDeleted({kind:ctx.apiResourceKind,resourceId:metadata.id,orgId:metadata.org,caller:ctx.callerIdentity})}catch(error2){logger2.warn("authorization cleanup failed \u2014 orphaned IAM policies may remain",{kind:getKindName(ctx.apiResourceKind),resourceId:metadata.id,error:error2 instanceof Error?error2.message:String(error2)})}}}}var OLD_VISIBILITY_KEY="authorizationOldVisibility";function newRecordVisibilityBeforeUpdateStep(resourceKey){return{name:"RecordVisibilityBeforeUpdate",execute(ctx){let resource=ctx.get(resourceKey);ctx.set(OLD_VISIBILITY_KEY,resource?.metadata?.visibility??ApiResourceVisibility.api_resource_visibility_unspecified)}}}function newUpdateVisibilityTuplesStep(lifecycle,resourceKey){return{name:"UpdateVisibilityTuples",async execute(ctx){if(lifecycle===void 0)return;let metadata=ctx.get(resourceKey)?.metadata;if(metadata===void 0||metadata.id==="")return;let oldLevel=ctx.get(OLD_VISIBILITY_KEY)??ApiResourceVisibility.api_resource_visibility_unspecified,{shapesToCreate,shapesToDelete}=diffVisibilityShapes(ctx.apiResourceKind,oldLevel,metadata.visibility);if(!(shapesToCreate.length===0&&shapesToDelete.length===0))try{await lifecycle.onVisibilityChanged({kind:ctx.apiResourceKind,resourceId:metadata.id,orgId:metadata.org,shapesToCreate,shapesToDelete})}catch(error2){throw internalError(error2,"failed to update visibility tuples")}}}}function rowAuthorizationFactsOf(kind,resource){let metadata=resource.metadata,org=metadata?.org??"";return{id:metadata?.id??"",org,visibility:metadata?.visibility??ApiResourceVisibility.api_resource_visibility_unspecified,createdBy:createdByOf(resource),parentLinks:parentLinksOf(kind,resource,org)}}function createdByOf(resource){return resource.status?.audit?.specAudit?.createdBy?.id??""}function parentLinksOf(kind,resource,org){let config2=getKindMeta(kind).authorization;if(config2===void 0)return[];let links=[];switch(config2.scopeType){case AuthorizationScopeType.ORGANIZATION:org!==""&&links.push({relation:"organization",parentKind:getKindEnum("organization"),parentId:org});break;case AuthorizationScopeType.PARENT:config2.parent!==void 0&&pushLink(links,resource,config2.parent);break;case AuthorizationScopeType.OWNER_ONLY:case AuthorizationScopeType.PLATFORM:case AuthorizationScopeType.NONE:case AuthorizationScopeType.UNSPECIFIED:break;default:{let exhaustive=config2.scopeType;throw new Error(`unknown scope type: ${String(exhaustive)}`)}}for(let parent of config2.additionalParents)pushLink(links,resource,parent);return links}function pushLink(links,resource,parent){let parentId=parentIdOf(resource,parent.specField);parentId!==""&&links.push({relation:parent.relation,parentKind:getKindEnum(parent.kind),parentId})}function rowFactsOf(kind,row){return{kind,...rowAuthorizationFactsOf(kind,row)}}function rowFactsOfEntry(kind,entry){return{kind,id:entry.id,org:entry.org,visibility:entry.visibility,createdBy:entry.createdBy,parentLinks:entry.parentLinks}}var file_ai_stigmer_agentic_agentchannel_v1_spec=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL3NwZWMucHJvdG8SImFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEi+AYKEEFnZW50Q2hhbm5lbFNwZWMSrAEKCWFnZW50X3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUJjukhcugFWCg5hZ2VudF9yZWYua2luZBIzYWdlbnRfcmVmIG11c3QgcmVmZXJlbmNlIGEgcmVzb3VyY2Ugd2l0aCBraW5kPWFnZW50Gg90aGlzLmtpbmQgPT0gNDDIAQHghSwoEg8KB2VuYWJsZWQYAiABKAgSRwoFc2xhY2sYAyABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLlNsYWNrQ2hhbm5lbENvbmZpZ0gAEk0KCHdoYXRzYXBwGAYgASgLMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5XaGF0c0FwcENoYW5uZWxDb25maWdIABLIAQoQZW52aXJvbm1lbnRfcmVmcxgEIAMoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUJ4ukhxkgFuImy6AWkKFWVudmlyb25tZW50X3JlZnMua2luZBI/ZW52aXJvbm1lbnRfcmVmcyBtdXN0IHJlZmVyZW5jZSByZXNvdXJjZXMgd2l0aCBraW5kPWVudmlyb25tZW50Gg90aGlzLmtpbmQgPT0gNTPghSw1ErwBCgdhcHBfcmVmGAUgASgLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlQnW6SG66AWsKDGFwcF9yZWYua2luZBI3YXBwX3JlZiBtdXN0IHJlZmVyZW5jZSBhIHJlc291cmNlIHdpdGgga2luZD1jaGFubmVsX2FwcBoidGhpcy5zbHVnID09ICcnIHx8IHRoaXMua2luZCA9PSA0OOCFLDASIwobcHJvYWN0aXZlX21lc3NhZ2luZ19lbmFibGVkGAcgASgIEkMKCnJ1bl9jb25maWcYCCABKAsyLy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUnVuQ29uZmlnQhgKD3Byb3ZpZGVyX2NvbmZpZxIFukgCCAEiFAoSU2xhY2tDaGFubmVsQ29uZmlnIjkKFVdoYXRzQXBwQ2hhbm5lbENvbmZpZxIgCg9waG9uZV9udW1iZXJfaWQYASABKAlCB7pIBHICEAFiBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_invocation,file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]),AgentChannelSpecSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_spec,0);var file_ai_stigmer_agentic_agentchannel_v1_status=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL3N0YXR1cy5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MSL5AgoSQWdlbnRDaGFubmVsU3RhdHVzElMKDWluc3RhbGxfc3RhdGUYASABKA4yPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbEluc3RhbGxTdGF0ZRJHCgVzbGFjaxgCIAEoCzI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuU2xhY2tJbnN0YWxsU3RhdHVzSAASTQoId2hhdHNhcHAYBCABKAsyOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLldoYXRzQXBwSW5zdGFsbFN0YXR1c0gAEiIKGmNyZWRlbnRpYWxzX2Vudmlyb25tZW50X2lkGAMgASgJEj8KBWF1ZGl0GGMgASgLMjAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRCEQoPcHJvdmlkZXJfc3RhdHVzItABChJTbGFja0luc3RhbGxTdGF0dXMSDwoHdGVhbV9pZBgBIAEoCRIRCgl0ZWFtX25hbWUYAiABKAkSEwoLYm90X3VzZXJfaWQYAyABKAkSFgoOZ3JhbnRlZF9zY29wZXMYBCADKAkSHwoXaW5zdGFsbGVyX3NsYWNrX3VzZXJfaWQYBSABKAkSMAoMaW5zdGFsbGVkX2F0GAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIWCg5jaGFubmVsX2FwcF9pZBgHIAEoCSKvAQoVV2hhdHNBcHBJbnN0YWxsU3RhdHVzEhcKD3Bob25lX251bWJlcl9pZBgBIAEoCRIcChRkaXNwbGF5X3Bob25lX251bWJlchgCIAEoCRIVCg12ZXJpZmllZF9uYW1lGAMgASgJEhYKDmNoYW5uZWxfYXBwX2lkGAQgASgJEjAKDGluc3RhbGxlZF9hdBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAqeAoYQWdlbnRDaGFubmVsSW5zdGFsbFN0YXRlEisKJ2FnZW50X2NoYW5uZWxfaW5zdGFsbF9zdGF0ZV91bnNwZWNpZmllZBAAEhMKD3BlbmRpbmdfaW5zdGFsbBABEg0KCWluc3RhbGxlZBACEgsKB3Jldm9rZWQQA2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_status,file_google_protobuf_timestamp]),AgentChannelStatusSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_status,0);var AgentChannelInstallState;(function(AgentChannelInstallState2){AgentChannelInstallState2[AgentChannelInstallState2.agent_channel_install_state_unspecified=0]="agent_channel_install_state_unspecified",AgentChannelInstallState2[AgentChannelInstallState2.pending_install=1]="pending_install",AgentChannelInstallState2[AgentChannelInstallState2.installed=2]="installed",AgentChannelInstallState2[AgentChannelInstallState2.revoked=3]="revoked"})(AgentChannelInstallState||(AgentChannelInstallState={}));var file_ai_stigmer_agentic_agentchannel_v1_api=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2FwaS5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MSK/AgoMQWdlbnRDaGFubmVsEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiEKBGtpbmQYAiABKAlCE7pIEHIOCgxBZ2VudENoYW5uZWwSTQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YUIGukgDyAEBEkIKBHNwZWMYBCABKAsyNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbFNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5BZ2VudENoYW5uZWxTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_agentchannel_v1_spec,file_ai_stigmer_agentic_agentchannel_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),AgentChannelSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_api,0);var file_ai_stigmer_agentic_agentexecution_v1_approval=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvYXBwcm92YWwucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSLLAwoPUGVuZGluZ0FwcHJvdmFsEhQKDHRvb2xfY2FsbF9pZBgBIAEoCRIRCgl0b29sX25hbWUYAiABKAkSDwoHbWVzc2FnZRgDIAEoCRIUCgxhcmdzX3ByZXZpZXcYBCABKAkSFAoMcmVxdWVzdGVkX2F0GAUgASgJEhYKDmZyb21fc3ViX2FnZW50GAYgASgIEhYKDnN1Yl9hZ2VudF9uYW1lGAcgASgJEhcKD21jcF9zZXJ2ZXJfc2x1ZxgIIAEoCRIZChFzdWJfYWdlbnRfc3ViamVjdBgJIAEoCRIXCg9hZ2VudF9yYXRpb25hbGUYCiABKAkSFgoOYnJhbmNoX2F0X2RlbnkYCyABKAkSGAoQaGVhZF9zaGFfYXRfZGVueRgMIAEoCRJBCgl0b29sX2tpbmQYDSABKA4yLi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVG9vbEtpbmQSWgoWYXBwcm92YWxfcG9saWN5X3NvdXJjZRgPIAEoDjI6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFBvbGljeVNvdXJjZUoECA4QDyKDAQoZQ2hpbGRBcHByb3ZhbE5vdGlmaWNhdGlvbhIUCgxleGVjdXRpb25faWQYASABKAkSUAoRcGVuZGluZ19hcHByb3ZhbHMYAiADKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUGVuZGluZ0FwcHJvdmFsIp0DCg9BcHByb3ZhbFJlcXVlc3QSGwoTYXBwcm92YWxfcmVxdWVzdF9pZBgBIAEoCRIUCgx0b29sX2NhbGxfaWQYAiABKAkSFAoMcmVxdWVzdGVkX2F0GAMgASgJEhEKCXRvb2xfbmFtZRgEIAEoCRIPCgdtZXNzYWdlGAUgASgJEhQKDGFyZ3NfcHJldmlldxgGIAEoCRIWCg5mcm9tX3N1Yl9hZ2VudBgHIAEoCBIWCg5zdWJfYWdlbnRfbmFtZRgIIAEoCRIZChFzdWJfYWdlbnRfc3ViamVjdBgJIAEoCRIXCg9tY3Bfc2VydmVyX3NsdWcYCiABKAkSQQoJdG9vbF9raW5kGAsgASgOMi4uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xLaW5kEloKFmFwcHJvdmFsX3BvbGljeV9zb3VyY2UYDSABKA4yOi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXBwcm92YWxQb2xpY3lTb3VyY2VKBAgMEA0ilwEKEkFwcHJvdmFsUmV0cmFjdGlvbhIbChNhcHByb3ZhbF9yZXF1ZXN0X2lkGAEgASgJEk4KBnJlYXNvbhgCIAEoDjI+LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFJldHJhY3Rpb25SZWFzb24SFAoMcmV0cmFjdGVkX2F0GAMgASgJIq4BChBBcHByb3ZhbERlY2lzaW9uEhsKE2FwcHJvdmFsX3JlcXVlc3RfaWQYASABKAkSRAoGYWN0aW9uGAIgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsQWN0aW9uEhIKCmRlY2lkZWRfYXQYAyABKAkSEgoKZGVjaWRlZF9ieRgEIAEoCRIPCgdjb21tZW50GAUgASgJIp4DCg1BcHByb3ZhbEV2ZW50EhAKCGV2ZW50X2lkGAEgASgJEhsKE2FwcHJvdmFsX3JlcXVlc3RfaWQYAiABKAkSSwoKZXZlbnRfdHlwZRgDIAEoDjI3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbEV2ZW50VHlwZRIRCgl0aW1lc3RhbXAYBCABKAkSDQoFYWN0b3IYBSABKAkSSgoJcmVxdWVzdGVkGAYgASgLMjUuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsUmVxdWVzdEgAEkkKB2RlY2lkZWQYByABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXBwcm92YWxEZWNpc2lvbkgAEk0KCXJldHJhY3RlZBgIIAEoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFJldHJhY3Rpb25IAEIJCgdwYXlsb2FkInAKE0FwcHJvdmFsRXZlbnRTdHJlYW0SFAoMZXhlY3V0aW9uX2lkGAEgASgJEkMKBmV2ZW50cxgCIAMoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbEV2ZW50YgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum]),PendingApprovalSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_approval,0);var ApprovalEventSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_approval,5),ApprovalEventStreamSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_approval,6);var file_ai_stigmer_agentic_agentexecution_v1_artifact=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvYXJ0aWZhY3QucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSKEAgoRRXhlY3V0aW9uQXJ0aWZhY3QSDAoEbmFtZRgBIAEoCRIUCgxzYW5kYm94X3BhdGgYAiABKAkSUwoEa2luZBgDIAEoDjI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25BcnRpZmFjdEtpbmRCCLpIBYIBAhABEhIKCnNpemVfYnl0ZXMYBCABKAMSEwoLc3RvcmFnZV9rZXkYBSABKAkSEgoKY3JlYXRlZF9hdBgHIAEoCRISCgpleHBpcmVzX2F0GAggASgJEg8KB2VudHJpZXMYCSADKAkSFAoMY29udGVudF9oYXNoGAogASgJYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_buf_validate_validate]);var file_ai_stigmer_agentic_agentexecution_v1_context=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvY29udGV4dC5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIoYDChJTdW1tYXJpemF0aW9uRXZlbnQSEQoJdGltZXN0YW1wGAEgASgJEhUKDXRva2Vuc19iZWZvcmUYAiABKAUSFAoMdG9rZW5zX2FmdGVyGAMgASgFEhkKEWNvbXByZXNzaW9uX3JhdGlvGAQgASgCEhMKC2R1cmF0aW9uX21zGAUgASgFEhsKE3N1bW1hcml6YXRpb25fbW9kZWwYBiABKAkSFwoPbWVzc2FnZXNfYmVmb3JlGAcgASgFEhYKDm1lc3NhZ2VzX2FmdGVyGAggASgFEkkKBnNvdXJjZRgJIAEoDjI5LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5TdW1tYXJpemF0aW9uU291cmNlEiIKGnN1bW1hcml6YXRpb25faW5wdXRfdG9rZW5zGAogASgFEiMKG3N1bW1hcml6YXRpb25fb3V0cHV0X3Rva2VucxgLIAEoBRIeChZzdW1tYXJpemF0aW9uX2Nvc3RfdXNkGAwgASgBIqoCCgtDb250ZXh0SW5mbxIbChNjdXJyZW50X3Rva2VuX2NvdW50GAEgASgFEhwKFGNvbnRleHRfd2luZG93X2xpbWl0GAIgASgFEicKH3N1bW1hcml6YXRpb25fdHJpZ2dlcl90aHJlc2hvbGQYAyABKAUSIwobc3VtbWFyaXphdGlvbl90YXJnZXRfdG9rZW5zGAQgASgFEh0KFXN1bW1hcml6YXRpb25fZW5hYmxlZBgFIAEoCBJWChRzdW1tYXJpemF0aW9uX2V2ZW50cxgGIAMoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5TdW1tYXJpemF0aW9uRXZlbnQSGwoTdXRpbGl6YXRpb25fcGVyY2VudBgHIAEoAmIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_enum]);var file_ai_stigmer_agentic_agentexecution_v1_message=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvbWVzc2FnZS5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIoICCgxBZ2VudE1lc3NhZ2USSQoEdHlwZRgBIAEoDjIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5NZXNzYWdlVHlwZUIIukgFggECEAESDwoHY29udGVudBgCIAEoCRIRCgl0aW1lc3RhbXAYAyABKAkSQgoKdG9vbF9jYWxscxgEIAMoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub29sQ2FsbBIpCghtZXRhZGF0YRgFIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSFAoMaXNfc3RyZWFtaW5nGAYgASgIIqUHCghUb29sQ2FsbBIKCgJpZBgBIAEoCRIMCgRuYW1lGAIgASgJEiUKBGFyZ3MYAyABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0Eg4KBnJlc3VsdBgEIAEoCRJOCgZzdGF0dXMYBSABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVG9vbENhbGxTdGF0dXNCCLpIBYIBAhABEhIKCnN0YXJ0ZWRfYXQYByABKAkSFAoMY29tcGxldGVkX2F0GAggASgJEg0KBWVycm9yGAkgASgJEhkKEXJlcXVpcmVzX2FwcHJvdmFsGAogASgIEhgKEGFwcHJvdmFsX21lc3NhZ2UYCyABKAkSHQoVYXBwcm92YWxfcmVxdWVzdGVkX2F0GAwgASgJEhsKE2FwcHJvdmFsX2RlY2lkZWRfYXQYDSABKAkSEwoLYXBwcm92ZWRfYnkYDiABKAkSTQoPYXBwcm92YWxfYWN0aW9uGA8gASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsQWN0aW9uEhQKDGlzX3N0cmVhbWluZxgQIAEoCBJXChBzdHJlYW1pbmdfc291cmNlGBMgASgOMj0uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xDYWxsU3RyZWFtaW5nU291cmNlEhcKD21jcF9zZXJ2ZXJfc2x1ZxgRIAEoCRIUCgxhcmdzX3ByZXZpZXcYEiABKAkSQQoJdG9vbF9raW5kGBQgASgOMi4uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xLaW5kEksKCm91dHB1dF9yZWYYFSABKAsyNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVG9vbENhbGxPdXRwdXRSZWYSWgoWYXBwcm92YWxfcG9saWN5X3NvdXJjZRgXIAEoDjI6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BcHByb3ZhbFBvbGljeVNvdXJjZRIdChVwb2xpY3lfZW5naW5lX3ZlcnNpb24YGCABKAkSHwoXYXBwcm92YWxfY29udGVudF9kaWdlc3QYGSABKAkSGgoSZmlsZV9jaGFuZ2Vfc2V0X2lkGBogASgJSgQIFhAXIpIBChFUb29sQ2FsbE91dHB1dFJlZhITCgtzdG9yYWdlX2tleRgBIAEoCRISCgpzaXplX2J5dGVzGAMgASgDEhQKDGNvbnRlbnRfaGFzaBgEIAEoCRIRCgltaW1lX3R5cGUYBSABKAkSEAoIaXNfaW1hZ2UYBiABKAgSGQoRdHJ1bmNhdGVkX3ByZXZpZXcYByABKAkiwQMKCkZpbGVDaGFuZ2USDAoEcGF0aBgBIAEoCRIVCg1hYnNvbHV0ZV9wYXRoGAIgASgJElMKC2NoYW5nZV90eXBlGAMgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVDaGFuZ2VUeXBlQgi6SAWCAQIQARJdCg1jYXB0dXJlX2xldmVsGAQgASgOMjwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVDaGFuZ2VDYXB0dXJlTGV2ZWxCCLpIBYIBAhABEkEKBmJlZm9yZRgFIAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ29udGVudBJACgVhZnRlchgGIAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ29udGVudBIUCgx1bmlmaWVkX2RpZmYYByABKAkSEwoLbGluZXNfYWRkZWQYCCABKAUSFQoNbGluZXNfcmVtb3ZlZBgJIAEoBRITCgtyZW5hbWVfZnJvbRgKIAEoCSKCAQoLRmlsZUNvbnRlbnQSEAoGaW5saW5lGAEgASgJSAASRgoDcmVmGAIgASgLMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xDYWxsT3V0cHV0UmVmSAASEQoJaXNfYmluYXJ5GAMgASgIQgYKBGJvZHliBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_buf_validate_validate,file_google_protobuf_struct]),AgentMessageSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_message,0);var file_ai_stigmer_agentic_agentexecution_v1_filereview=fileDesc("CjVhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvZmlsZXJldmlldy5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIokFCg1GaWxlQ2hhbmdlU2V0EgoKAmlkGAEgASgJEg8KB3R1cm5faWQYAiABKAkSEgoKaGFybmVzc19pZBgDIAEoCRJTCgZzdGF0dXMYBCABKA4yOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNoYW5nZVNldFN0YXR1c0IIukgFggECEAESTAoRYmFzZWxpbmVfc25hcHNob3QYBSABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU25hcHNob3RSZWYSTQoSY2FuZGlkYXRlX3NuYXBzaG90GAYgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmEkwKEWFwcHJvdmVkX3NuYXBzaG90GAcgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmEkkKB2NoYW5nZXMYCCADKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ2FwdHVyZWRGaWxlQ2hhbmdlEhgKEGFnZ3JlZ2F0ZV9kaWdlc3QYCSABKAkSWwoRZGlmZl9jb21wbGV0ZW5lc3MYCiABKA4yNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRGlmZkNvbXBsZXRlbmVzc0IIukgFggECEAESRQoJZGVjaXNpb25zGAsgAygLMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVEZWNpc2lvbiKoBQoSQ2FwdHVyZWRGaWxlQ2hhbmdlEgoKAmlkGAEgASgJEhMKC3BhdGhfYmVmb3JlGAIgASgJEhIKCnBhdGhfYWZ0ZXIYAyABKAkSTAoEa2luZBgEIAEoDjI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ2hhbmdlS2luZEIIukgFggECEAESVwoNY2FwdHVyZV9jbGFzcxgFIAEoDjI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ2FwdHVyZUNsYXNzQgi6SAWCAQIQARJBCgZiZWZvcmUYBiABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNvbnRlbnQSQAoFYWZ0ZXIYByABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNvbnRlbnQSFQoNYmVmb3JlX3NoYTI1NhgIIAEoCRIUCgxhZnRlcl9zaGEyNTYYCSABKAkSTQoMdW5pZmllZF9kaWZmGAogASgLMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvb2xDYWxsT3V0cHV0UmVmEhUKDWRpZmZfY29tcGxldGUYCyABKAgSEwoLZmlsZV9kaWdlc3QYDCABKAkSXQoOYmxvY2tlZF9yZWFzb24YDSABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZVJldmlld0Jsb2NrUmVhc29uQgi6SAWCAQIQARITCgtsaW5lc19hZGRlZBgOIAEoBRIVCg1saW5lc19yZW1vdmVkGA8gASgFItsBCgtTbmFwc2hvdFJlZhJKCgRraW5kGAEgASgOMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90S2luZEIIukgFggECEAESPQoDZ2l0GAIgASgLMjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkdpdFRyZWVSZWYSQQoDY2FzGAMgASgLMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkNhc01hbmlmZXN0UmVmIisKCkdpdFRyZWVSZWYSEAoIdHJlZV9vaWQYASABKAkSCwoDcmVmGAIgASgJIj8KDkNhc01hbmlmZXN0UmVmEhcKD21hbmlmZXN0X2RpZ2VzdBgBIAEoCRIUCgxhcnRpZmFjdF91cmkYAiABKAkitwMKDEZpbGVEZWNpc2lvbhIKCgJpZBgBIAEoCRIVCg1jaGFuZ2Vfc2V0X2lkGAIgASgJElAKBXNjb3BlGAMgASgOMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVEZWNpc2lvblNjb3BlQgi6SAWCAQIQARIWCg5maWxlX2NoYW5nZV9pZBgEIAEoCRJSCgZhY3Rpb24YBSABKA4yOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZURlY2lzaW9uQWN0aW9uQgi6SAWCAQIQARIXCg9leHBlY3RlZF9kaWdlc3QYBiABKAkSEwoLcmV2aWV3ZXJfaWQYByABKAkSEgoKZGVjaWRlZF9hdBgIIAEoCRIOCgZyZWFzb24YCSABKAkSIAoYYWNrbm93bGVkZ2VfdW5yZXZpZXdhYmxlGAogASgIElIKBm9yaWdpbhgLIAEoDjI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlRGVjaXNpb25PcmlnaW5CCLpIBYIBAhABIqYBChpGaWxlUmV2aWV3QmFzZWxpbmVDYXB0dXJlZBIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJEg8KB3R1cm5faWQYAiABKAkSEgoKaGFybmVzc19pZBgDIAEoCRJMChFiYXNlbGluZV9zbmFwc2hvdBgEIAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5TbmFwc2hvdFJlZiJeChVUdXJuQ29tbWFuZFByb3ZlbmFuY2USHQoVY29uc2VudF90b29sX2NhbGxfaWRzGAEgAygJEiYKHmF1dGhvcml6ZWRfYnlfYXV0b19hcHByb3ZlX2FsbBgCIAEoCCKeAwobRmlsZVJldmlld0NhbmRpZGF0ZUNhcHR1cmVkEhUKDWNoYW5nZV9zZXRfaWQYASABKAkSTQoSY2FuZGlkYXRlX3NuYXBzaG90GAIgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmEkkKB2NoYW5nZXMYAyADKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ2FwdHVyZWRGaWxlQ2hhbmdlEhgKEGFnZ3JlZ2F0ZV9kaWdlc3QYBCABKAkSWwoRZGlmZl9jb21wbGV0ZW5lc3MYBSABKA4yNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRGlmZkNvbXBsZXRlbmVzc0IIukgFggECEAESVwoSY29tbWFuZF9wcm92ZW5hbmNlGAYgASgLMjsuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlR1cm5Db21tYW5kUHJvdmVuYW5jZSJ7ChRGaWxlUmV2aWV3UmVjb25jaWxlZBIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJEkwKEWFwcHJvdmVkX3NuYXBzaG90GAIgASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNuYXBzaG90UmVmIo8BChFGaWxlUmV2aWV3RmFpbHVyZRIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJElMKBGtpbmQYAiABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZVJldmlld0ZhaWx1cmVLaW5kQgi6SAWCAQIQARIOCgZkZXRhaWwYAyABKAki6QQKD0ZpbGVSZXZpZXdFdmVudBIQCghldmVudF9pZBgBIAEoCRIVCg1jaGFuZ2Vfc2V0X2lkGAIgASgJElcKCmV2ZW50X3R5cGUYAyABKA4yOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZVJldmlld0V2ZW50VHlwZUIIukgFggECEAESEQoJdGltZXN0YW1wGAQgASgJEg0KBWFjdG9yGAUgASgJEl0KEWJhc2VsaW5lX2NhcHR1cmVkGAYgASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdCYXNlbGluZUNhcHR1cmVkSAASXwoSY2FuZGlkYXRlX2NhcHR1cmVkGAcgASgLMkEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdDYW5kaWRhdGVDYXB0dXJlZEgAEkoKDGZpbGVfZGVjaWRlZBgIIAEoCzIyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlRGVjaXNpb25IABJQCgpyZWNvbmNpbGVkGAkgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdSZWNvbmNpbGVkSAASSQoGZmFpbGVkGAogASgLMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVSZXZpZXdGYWlsdXJlSABCCQoHcGF5bG9hZCJ0ChVGaWxlUmV2aWV3RXZlbnRTdHJlYW0SFAoMZXhlY3V0aW9uX2lkGAEgASgJEkUKBmV2ZW50cxgCIAMoCzI1LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlUmV2aWV3RXZlbnQi0wEKEkZpbGVDaGFuZ2VQcm9ncmVzcxIVCg1jaGFuZ2Vfc2V0X2lkGAEgASgJEhUKDWZpbGVzX2NoYW5nZWQYAiABKAUSEwoLbGluZXNfYWRkZWQYAyABKAUSFQoNbGluZXNfcmVtb3ZlZBgEIAEoBRJOCgdlbnRyaWVzGAUgAygLMj0uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVDaGFuZ2VQcm9ncmVzc0VudHJ5EhMKC2NhcHR1cmVkX2F0GAYgASgJIrwBChdGaWxlQ2hhbmdlUHJvZ3Jlc3NFbnRyeRITCgtwYXRoX2JlZm9yZRgBIAEoCRISCgpwYXRoX2FmdGVyGAIgASgJEkwKBGtpbmQYAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNoYW5nZUtpbmRCCLpIBYIBAhABEhMKC2xpbmVzX2FkZGVkGAQgASgFEhUKDWxpbmVzX3JlbW92ZWQYBSABKAViBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_agentexecution_v1_message,file_buf_validate_validate]),FileChangeSetSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,0);var FileDecisionSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,5);var FileReviewEventSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,11),FileReviewEventStreamSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_filereview,12);var file_ai_stigmer_agentic_executioncontext_v1_spec=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9zcGVjLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MSLwAQoURXhlY3V0aW9uQ29udGV4dFNwZWMSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABElQKBGRhdGEYAiADKAsyRi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0U3BlYy5EYXRhRW50cnkaYwoJRGF0YUVudHJ5EgsKA2tleRgBIAEoCRJFCgV2YWx1ZRgCIAEoCzI2LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvblZhbHVlOgI4ASIyCg5FeGVjdXRpb25WYWx1ZRINCgV2YWx1ZRgBIAEoCRIRCglpc19zZWNyZXQYAiABKAhiBnByb3RvMw",[file_buf_validate_validate]);var ExecutionValueSchema=messageDesc2(file_ai_stigmer_agentic_executioncontext_v1_spec,1);var file_ai_stigmer_agentic_session_v1_spec=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9zcGVjLnByb3RvEh1haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MSKWBwoLU2Vzc2lvblNwZWMSGQoRYWdlbnRfaW5zdGFuY2VfaWQYASABKAkSDwoHc3ViamVjdBgCIAEoCRIYChBoYXJuZXNzX3N0YXRlX2lkGAMgASgJEiAKGGhhcm5lc3Nfc3RhdGVfaWRfaGlzdG9yeRgNIAMoCRJKCghtZXRhZGF0YRgFIAMoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25TcGVjLk1ldGFkYXRhRW50cnkSSAoRd29ya3NwYWNlX2VudHJpZXMYBiADKAsyLS5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5Xb3Jrc3BhY2VFbnRyeRLZAQoRbWNwX3NlcnZlcl91c2FnZXMYByADKAsyKy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuTWNwU2VydmVyVXNhZ2VCkAG6SIwBkgGIASKFAboBgQEKHnNlc3Npb25fbWNwX3NlcnZlcl91c2FnZXMua2luZBI/bWNwX3NlcnZlcl91c2FnZXMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1tY3Bfc2VydmVyGh50aGlzLm1jcF9zZXJ2ZXJfcmVmLmtpbmQgPT0gNDQSuAEKCnNraWxsX3JlZnMYCCADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCbrpIZ5IBZCJiugFfChdzZXNzaW9uX3NraWxsX3JlZnMua2luZBIzc2tpbGxfcmVmcyBtdXN0IHJlZmVyZW5jZSByZXNvdXJjZXMgd2l0aCBraW5kPXNraWxsGg90aGlzLmtpbmQgPT0gNDPghSwrEjcKB2hhcm5lc3MYCiABKA4yJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5IYXJuZXNzEj4KC2N1cnNvcl9tb2RlGAsgASgOMikuYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuQ3Vyc29yTW9kZRJIChBleGVjdXRpb25fdGFyZ2V0GAwgASgOMi4uYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuRXhlY3V0aW9uVGFyZ2V0Gi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4AWIGcHJvdG8z",[file_ai_stigmer_agentic_agent_v1_spec,file_ai_stigmer_agentic_session_v1_enum,file_ai_stigmer_agentic_session_v1_workspace,file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]),SessionSpecSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_spec,0);var file_ai_stigmer_agentic_agentexecution_v1_spec=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvc3BlYy5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIuEKChJBZ2VudEV4ZWN1dGlvblNwZWMSEgoKc2Vzc2lvbl9pZBgBIAEoCRIQCghhZ2VudF9pZBgCIAEoCRJACgxzZXNzaW9uX3NwZWMYDSABKAsyKi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uU3BlYxIYCgdtZXNzYWdlGAMgASgJQge6SARyAhABEk8KEGV4ZWN1dGlvbl9jb25maWcYBCABKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRXhlY3V0aW9uQ29uZmlnEl0KC3J1bnRpbWVfZW52GAUgAygLMkguYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uU3BlYy5SdW50aW1lRW52RW50cnkSFgoOY2FsbGJhY2tfdG9rZW4YBiABKAwSGAoQYXV0b19hcHByb3ZlX2FsbBgHIAEoCBIaChJwYXJlbnRfd29ya2Zsb3dfaWQYCCABKAkSRQoLYXR0YWNobWVudHMYCSADKAsyMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXR0YWNobWVudBIbChN3b3Jrc3BhY2VfZmlsZV9yZWZzGAogAygJEhsKE2FjdGl2aXR5X3Rhc2tfcXVldWUYCyABKAkSHwoXc3VwZXJzZWRlc19leGVjdXRpb25faWQYDCABKAkSVwoUY29udmVyc2F0aW9uX2NhdGNodXAYDiABKAsyOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29udmVyc2F0aW9uQ2F0Y2h1cBJXChRkZWNsYXJlZF9wcmVmZXJlbmNlcxgPIAEoCzI5LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5EZWNsYXJlZFByZWZlcmVuY2VzElEKEXJlY2FsbGVkX21lbW9yaWVzGBAgASgLMjYuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlJlY2FsbGVkTWVtb3JpZXMaaQoPUnVudGltZUVudkVudHJ5EgsKA2tleRgBIAEoCRJFCgV2YWx1ZRgCIAEoCzI2LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvblZhbHVlOgI4ATq4A7pItAMaywEKIWFnZW50X2V4ZWN1dGlvbi5zZXNzaW9uX2V4Y2x1c2l2ZRJyc2Vzc2lvbl9pZCBhbmQgc2Vzc2lvbl9zcGVjIGFyZSBtdXR1YWxseSBleGNsdXNpdmUg4oCUIHJlZmVyZW5jZSBhbiBleGlzdGluZyBzZXNzaW9uIG9yIGRlZmluZSBhIG5ldyBvbmUsIG5vdCBib3RoGjIhKHRoaXMuc2Vzc2lvbl9pZCAhPSAnJyAmJiBoYXModGhpcy5zZXNzaW9uX3NwZWMpKRrjAQoqYWdlbnRfZXhlY3V0aW9uLnNlc3Npb25fc3BlY19oYXJuZXNzX3N0YXRlEnBzZXNzaW9uX3NwZWMuaGFybmVzc19zdGF0ZV9pZCBtdXN0IGJlIGVtcHR5IOKAlCBoYXJuZXNzIHN0YXRlIGlzIGNyZWF0ZWQgYnkgdGhlIHJ1bm5lciBhZnRlciB0aGUgZmlyc3QgZXhlY3V0aW9uGkMhaGFzKHRoaXMuc2Vzc2lvbl9zcGVjKSB8fCB0aGlzLnNlc3Npb25fc3BlYy5oYXJuZXNzX3N0YXRlX2lkID09ICcnIvoECg9FeGVjdXRpb25Db25maWcSEgoKbW9kZWxfbmFtZRgBIAEoCRJZChJjb250ZXh0X21hbmFnZW1lbnQYAiABKAsyPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29udGV4dE1hbmFnZW1lbnRDb25maWcSFwoPbWF4X3Rvb2xfcm91bmRzGAMgASgFEh0KFW1heF90b29sX3Jlc3VsdF9jaGFycxgEIAEoBRIUCgxtYXhfY29zdF91c2QYBSABKAESWQoQaW50ZXJhY3Rpb25fbW9kZRgGIAEoDjI1LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5JbnRlcmFjdGlvbk1vZGVCCLpIBYIBAhABEjkKGHN0cnVjdHVyZWRfb3V0cHV0X3NjaGVtYRgHIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSFwoPYnVpbGRfZnJvbV9wbGFuGAggASgIElMKDWFwcHJvdmFsX21vZGUYCSABKA4yMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXBwcm92YWxNb2RlQgi6SAWCAQIQARJRCgxzZXJ2aWNlX3RpZXIYCiABKA4yMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU2VydmljZVRpZXJCCLpIBYIBAhABElMKDXRoaW5raW5nX21vZGUYCyABKA4yMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVGhpbmtpbmdNb2RlQgi6SAWCAQIQASKKAQoXQ29udGV4dE1hbmFnZW1lbnRDb25maWcSHQoVZGlzYWJsZV9zdW1tYXJpemF0aW9uGAEgASgIEikKGGN1c3RvbV90cmlnZ2VyX3RocmVzaG9sZBgCIAEoBUIHukgEGgIoABIlChRjdXN0b21fdGFyZ2V0X3Rva2VucxgDIAEoBUIHukgEGgIoACLUAgoKQXR0YWNobWVudBLYAQoIZmlsZW5hbWUYASABKAlCxQG6SMEBugG5AQobYXR0YWNobWVudC5maWxlbmFtZS5ub19wYXRoEk5maWxlbmFtZSBtdXN0IGJlIGEgYmFyZSBmaWxlbmFtZSB3aXRob3V0IHBhdGggc2VwYXJhdG9ycyBvciB0cmF2ZXJzYWwgc2VnbWVudHMaSiF0aGlzLmNvbnRhaW5zKCcvJykgJiYgIXRoaXMuY29udGFpbnMoJ1xcJykgJiYgdGhpcyAhPSAnLicgJiYgdGhpcyAhPSAnLi4ncgIQARIcCgtzdG9yYWdlX2tleRgCIAEoCUIHukgEcgIQARISCgptb3VudF9wYXRoGAMgASgJEhQKDGNvbnRlbnRfdHlwZRgEIAEoCRIPCgdleHRyYWN0GAUgASgIEhIKCmxvY2FsX3BhdGgYBiABKAkiVQoTQ29udmVyc2F0aW9uQ2F0Y2h1cBIOCgZkaWdlc3QYASABKAkSLgoKd2luZG93X2VuZBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiQAoTRGVjbGFyZWRQcmVmZXJlbmNlcxITCgtvcmdfY29udGV4dBgBIAEoCRIUCgx1c2VyX2NvbnRleHQYAiABKAkibAoQUmVjYWxsZWRNZW1vcmllcxIPCgdlbmFibGVkGAEgASgIEkcKBWZhY3RzGAIgAygLMjguYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlJlY2FsbGVkTWVtb3J5RmFjdCI4ChJSZWNhbGxlZE1lbW9yeUZhY3QSEQoJbWVtb3J5X2lkGAEgASgJEg8KB2NvbnRlbnQYAiABKAliBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_executioncontext_v1_spec,file_ai_stigmer_agentic_session_v1_spec,file_buf_validate_validate,file_google_protobuf_struct,file_google_protobuf_timestamp]),AgentExecutionSpecSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,0),ExecutionConfigSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,1);var DeclaredPreferencesSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,5),RecalledMemoriesSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,6),RecalledMemoryFactSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_spec,7);var file_ai_stigmer_agentic_agentexecution_v1_todo=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvdG9kby5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxIpEBCghUb2RvSXRlbRIKCgJpZBgBIAEoCRIPCgdjb250ZW50GAIgASgJEkAKBnN0YXR1cxgDIAEoDjIwLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub2RvU3RhdHVzEhIKCmNyZWF0ZWRfYXQYBCABKAkSEgoKdXBkYXRlZF9hdBgFIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_enum]);var file_ai_stigmer_agentic_agentexecution_v1_subagent=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvc3ViYWdlbnQucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSKIBAoRU3ViQWdlbnRFeGVjdXRpb24SCgoCaWQYASABKAkSDAoEbmFtZRgCIAEoCRINCgVpbnB1dBgDIAEoCRIOCgZvdXRwdXQYBCABKAkSTgoGc3RhdHVzGAUgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlN1YkFnZW50U3RhdHVzQgi6SAWCAQIQARISCgpzdGFydGVkX2F0GAYgASgJEhQKDGNvbXBsZXRlZF9hdBgHIAEoCRINCgVlcnJvchgIIAEoCRIpCghtZXRhZGF0YRgJIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSRAoIbWVzc2FnZXMYCyADKAsyMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRNZXNzYWdlEg8KB3N1YmplY3QYDSABKAkSUQoFdG9kb3MYDiADKAsyQi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU3ViQWdlbnRFeGVjdXRpb24uVG9kb3NFbnRyeRpcCgpUb2Rvc0VudHJ5EgsKA2tleRgBIAEoCRI9CgV2YWx1ZRgCIAEoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub2RvSXRlbToCOAFiBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_agentexecution_v1_message,file_ai_stigmer_agentic_agentexecution_v1_todo,file_buf_validate_validate,file_google_protobuf_struct]);var file_ai_stigmer_agentic_agentexecution_v1_usage=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvdXNhZ2UucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSKxAwoKVG9rZW5Vc2FnZRIUCgxpbnB1dF90b2tlbnMYASABKAMSFQoNb3V0cHV0X3Rva2VucxgCIAEoAxIUCgx0b3RhbF90b2tlbnMYAyABKAMSIwobY2FjaGVfY3JlYXRpb25faW5wdXRfdG9rZW5zGAQgASgDEh8KF2NhY2hlX3JlYWRfaW5wdXRfdG9rZW5zGAUgASgDEhgKEHJlYXNvbmluZ190b2tlbnMYBiABKAMSHgoWdG9vbF91c2VfcHJvbXB0X3Rva2VucxgHIAEoAxIaChJhdWRpb19pbnB1dF90b2tlbnMYCCABKAMSGwoTYXVkaW9fb3V0cHV0X3Rva2VucxgJIAEoAxJqChZwcm92aWRlcl90b2tlbl9kZXRhaWxzGBQgAygLMkouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRva2VuVXNhZ2UuUHJvdmlkZXJUb2tlbkRldGFpbHNFbnRyeRo7ChlQcm92aWRlclRva2VuRGV0YWlsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoAzoCOAEiugMKD1ByaWNpbmdTbmFwc2hvdBIgChhwcmljaW5nX3JlZ2lzdHJ5X3ZlcnNpb24YASABKAkSOAoUcHJpY2luZ19lZmZlY3RpdmVfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhAKCGN1cnJlbmN5GAMgASgJEiYKHmlucHV0X3ByaWNlX21pY3Jvc19wZXJfbWlsbGlvbhgKIAEoAxInCh9vdXRwdXRfcHJpY2VfbWljcm9zX3Blcl9taWxsaW9uGAsgASgDEi8KJ2NhY2hlX2NyZWF0aW9uX3ByaWNlX21pY3Jvc19wZXJfbWlsbGlvbhgMIAEoAxIrCiNjYWNoZV9yZWFkX3ByaWNlX21pY3Jvc19wZXJfbWlsbGlvbhgNIAEoAxIqCiJyZWFzb25pbmdfcHJpY2VfbWljcm9zX3Blcl9taWxsaW9uGA4gASgDEiwKJGN1cnNvcl90b2tlbl9yYXRlX21pY3Jvc19wZXJfbWlsbGlvbhgPIAEoAxIdChVtYXJrdXBfcG9saWN5X3ZlcnNpb24YHiABKAkSEQoJY29zdF90aWVyGB8gASgJIqkCCglDb3N0U3RhbXASEAoIY3VycmVuY3kYASABKAkSHAoUcHJvdmlkZXJfY29zdF9taWNyb3MYAiABKAMSJwofY3VzdG9tZXJfYmlsbGFibGVfYW1vdW50X21pY3JvcxgDIAEoAxJXChJjYWxjdWxhdGlvbl9zdGF0dXMYBCABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29zdENhbGN1bGF0aW9uU3RhdHVzEkYKB3ByaWNpbmcYBSABKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUHJpY2luZ1NuYXBzaG90EiIKGmN1cnNvcl9wbGF0Zm9ybV9mZWVfbWljcm9zGAYgASgDItQDCgtQcm94eVRpbWluZxI1ChFwcm94eV9yZWNlaXZlZF9hdBgBIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASPwobdXBzdHJlYW1fcmVxdWVzdF9zdGFydGVkX2F0GAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI6ChZmaXJzdF9yZXNwb25zZV9ieXRlX2F0GAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI5ChVsYXN0X3Jlc3BvbnNlX2J5dGVfYXQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjYKEnByb3h5X2NvbXBsZXRlZF9hdBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGAoQdXBzdHJlYW1fdHRmYl9tcxgKIAEoAxIYChB1cHN0cmVhbV90dGxiX21zGAsgASgDEhoKEnN0cmVhbV9kdXJhdGlvbl9tcxgMIAEoAxIfChdwcm94eV90b3RhbF9kdXJhdGlvbl9tcxgNIAEoAxIVCg1yZXF1ZXN0X2J5dGVzGBQgASgDEhYKDnJlc3BvbnNlX2J5dGVzGBUgASgDIvoBCgtCaWxsaW5nTGluaxJOCgxkZWJpdF9zdGF0dXMYASABKA4yOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQmlsbGluZ0RlYml0U3RhdHVzEhYKDnJlc2VydmF0aW9uX2lkGAIgASgJEhgKEGJpbGxpbmdfZGViaXRfaWQYAyABKAkSLgoKZGViaXRlZF9hdBgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASHQoVYmlsbGluZ19hdHRlbXB0X2NvdW50GAUgASgFEhoKEmxhc3RfYmlsbGluZ19lcnJvchgGIAEoCSL+CgoSTGxtQ2FsbFVzYWdlUmVjb3JkEhcKD3VzYWdlX3JlY29yZF9pZBgBIAEoCRIUCgxleGVjdXRpb25faWQYAiABKAkSGQoRcm9vdF9leGVjdXRpb25faWQYAyABKAkSEAoIc2VxdWVuY2UYBCABKAUSFwoPaWRlbXBvdGVuY3lfa2V5GAUgASgJEh4KFmNhbm9uaWNhbF9wYXlsb2FkX2hhc2gYBiABKAkSDwoHY2FsbF9pZBgJIAEoCRIvCgtvYnNlcnZlZF9hdBgKIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLgoKY3JlYXRlZF9hdBgLIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASUgoPbWV0ZXJpbmdfc291cmNlGBQgASgOMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlVzYWdlTWV0ZXJpbmdTb3VyY2USSgoLdHJ1c3RfbGV2ZWwYFSABKA4yNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVXNhZ2VUcnVzdExldmVsElEKDHVzYWdlX3N0YXR1cxgWIAEoDjI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Vc2FnZUNvbXBsZXRpb25TdGF0dXMSEwoLaXNfYmlsbGFibGUYFyABKAgSEAoIcHJvdmlkZXIYHiABKAkSFwoPcmVxdWVzdGVkX21vZGVsGB8gASgJEhYKDnJlc29sdmVkX21vZGVsGCAgASgJEhAKCGVuZHBvaW50GCEgASgJEhEKCXN0cmVhbWluZxgiIAEoCBIUCgxzZXJ2aWNlX3RpZXIYIyABKAkSGwoTcHJvdmlkZXJfcmVxdWVzdF9pZBgkIAEoCRIPCgdoYXJuZXNzGCUgASgJEhkKEWN1cnNvcl9hY2NvdW50X2lkGCYgASgJEhUKDWN1cnNvcl9rZXlfaWQYJyABKAkSGAoQaHR0cF9zdGF0dXNfY29kZRgoIAEoBRIVCg1maW5pc2hfcmVhc29uGCkgASgJEhIKCmVycm9yX2NvZGUYKiABKAkSUAoRY3Vyc29yX2tleV9zb3VyY2UYKyABKA4yNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ3Vyc29yS2V5U291cmNlEhAKCHRoaW5raW5nGCwgASgJEkAKBnRva2VucxgyIAEoCzIwLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Ub2tlblVzYWdlEj0KBGNvc3QYMyABKAsyLy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ29zdFN0YW1wEkcKDHByb3h5X3RpbWluZxg8IAEoCzIxLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Qcm94eVRpbWluZxIbChNwcm92aWRlcl91c2FnZV9qc29uGEYgASgJEkIKB2JpbGxpbmcYUCABKAsyMS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQmlsbGluZ0xpbmsSDgoGb3JnX2lkGAcgASgJEhIKCnNlc3Npb25faWQYCCABKAkSVAoGbGFiZWxzGFogAygLMkQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkxsbUNhbGxVc2FnZVJlY29yZC5MYWJlbHNFbnRyeRotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIr4CChRVc2FnZVJlcG9ydEFnZ3JlZ2F0ZRIUCgxpbnB1dF90b2tlbnMYASABKAMSFQoNb3V0cHV0X3Rva2VucxgCIAEoAxIUCgx0b3RhbF90b2tlbnMYAyABKAMSIwobY2FjaGVfY3JlYXRpb25faW5wdXRfdG9rZW5zGAQgASgDEh8KF2NhY2hlX3JlYWRfaW5wdXRfdG9rZW5zGAUgASgDEhgKEHJlYXNvbmluZ190b2tlbnMYBiABKAMSFgoObGxtX2NhbGxfY291bnQYCiABKAUSHAoUYmlsbGFibGVfY29zdF9taWNyb3MYFCABKAMSHAoUcHJvdmlkZXJfY29zdF9taWNyb3MYFSABKAMSFQoNcHJpbWFyeV9tb2RlbBgeIAEoCRIYChBwcmltYXJ5X3Byb3ZpZGVyGB8gASgJIvABCgpNb2RlbFVzYWdlEg0KBW1vZGVsGAEgASgJEhAKCHByb3ZpZGVyGAIgASgJEhQKDGlucHV0X3Rva2VucxgDIAEoAxIVCg1vdXRwdXRfdG9rZW5zGAQgASgDEiMKG2NhY2hlX2NyZWF0aW9uX2lucHV0X3Rva2VucxgFIAEoAxIfChdjYWNoZV9yZWFkX2lucHV0X3Rva2VucxgGIAEoAxISCgpjYWxsX2NvdW50GAcgASgFEhwKFGJpbGxhYmxlX2Nvc3RfbWljcm9zGAggASgDEhwKFHByb3ZpZGVyX2Nvc3RfbWljcm9zGAkgASgDIq0DChVTdHJlYW1pbmdVc2FnZVN1bW1hcnkSFAoMaW5wdXRfdG9rZW5zGAEgASgDEhUKDW91dHB1dF90b2tlbnMYAiABKAMSGQoRY2FjaGVfcmVhZF90b2tlbnMYAyABKAMSGgoSY2FjaGVfd3JpdGVfdG9rZW5zGAQgASgDEhQKDHRvdGFsX3Rva2VucxgFIAEoAxISCgp0dXJuX2NvdW50GAYgASgFEhoKEmVzdGltYXRlZF9jb3N0X3VzZBgHIAEoARINCgVtb2RlbBgIIAEoCRITCgtvYnNlcnZlZF9hdBgJIAEoCRJRChZyZXF1ZXN0ZWRfc2VydmljZV90aWVyGAogASgOMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNlcnZpY2VUaWVyEh4KFnJlcXVlc3RlZF9tb2RlbF9wYXJhbXMYCyABKAkSUwoXcmVxdWVzdGVkX3RoaW5raW5nX21vZGUYDCABKA4yMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVGhpbmtpbmdNb2RlKq4CChNVc2FnZU1ldGVyaW5nU291cmNlEiUKIVVTQUdFX01FVEVSSU5HX1NPVVJDRV9VTlNQRUNJRklFRBAAEjEKLVVTQUdFX01FVEVSSU5HX1NPVVJDRV9QUk9YWV9QUk9WSURFUl9SRVBPUlRFRBABEjYKMlVTQUdFX01FVEVSSU5HX1NPVVJDRV9SVU5ORVJfUFJPVklERVJfUkVQT1JURURfT1NTEAISIwofVVNBR0VfTUVURVJJTkdfU09VUkNFX0VTVElNQVRFRBADEjMKL1VTQUdFX01FVEVSSU5HX1NPVVJDRV9QUk9WSURFUl9BRE1JTl9SRUNPTkNJTEVEEAQSKwonVVNBR0VfTUVURVJJTkdfU09VUkNFX01BTlVBTF9BREpVU1RNRU5UEAUqqAEKD1VzYWdlVHJ1c3RMZXZlbBIhCh1VU0FHRV9UUlVTVF9MRVZFTF9VTlNQRUNJRklFRBAAEicKI1VTQUdFX1RSVVNUX0xFVkVMX0JJTExJTkdfQVVUSE9SSVRZEAESJQohVVNBR0VfVFJVU1RfTEVWRUxfU0VSVkVSX09CU0VSVkVEEAISIgoeVVNBR0VfVFJVU1RfTEVWRUxfRElTUExBWV9PTkxZEAMq/AIKFVVzYWdlQ29tcGxldGlvblN0YXR1cxInCiNVU0FHRV9DT01QTEVUSU9OX1NUQVRVU19VTlNQRUNJRklFRBAAEiQKIFVTQUdFX0NPTVBMRVRJT05fU1RBVFVTX0NPTVBMRVRFEAESLgoqVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfU1RSRUFNX0lOVEVSUlVQVEVEEAISNQoxVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfUFJPVklERVJfRVJST1JfV0lUSF9VU0FHRRADEjMKL1VTQUdFX0NPTVBMRVRJT05fU1RBVFVTX1BST1ZJREVSX0VSUk9SX05PX1VTQUdFEAQSKgomVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfRVNUSU1BVEVEX09OTFkQBRImCiJVU0FHRV9DT01QTEVUSU9OX1NUQVRVU19SRUNPTkNJTEVEEAYSJAogVVNBR0VfQ09NUExFVElPTl9TVEFUVVNfQ09ORkxJQ1QQByqfAgoSQmlsbGluZ0RlYml0U3RhdHVzEiQKIEJJTExJTkdfREVCSVRfU1RBVFVTX1VOU1BFQ0lGSUVEEAASJwojQklMTElOR19ERUJJVF9TVEFUVVNfTk9UX0FQUExJQ0FCTEUQARIgChxCSUxMSU5HX0RFQklUX1NUQVRVU19QRU5ESU5HEAISIAocQklMTElOR19ERUJJVF9TVEFUVVNfREVCSVRFRBADEikKJUJJTExJTkdfREVCSVRfU1RBVFVTX0ZBSUxFRF9SRVRSWUFCTEUQBBIoCiRCSUxMSU5HX0RFQklUX1NUQVRVU19GQUlMRURfVEVSTUlOQUwQBRIhCh1CSUxMSU5HX0RFQklUX1NUQVRVU19DT05GTElDVBAGKo8CChVDb3N0Q2FsY3VsYXRpb25TdGF0dXMSJwojQ09TVF9DQUxDVUxBVElPTl9TVEFUVVNfVU5TUEVDSUZJRUQQABIkCiBDT1NUX0NBTENVTEFUSU9OX1NUQVRVU19DT01QVVRFRBABEiUKIUNPU1RfQ0FMQ1VMQVRJT05fU1RBVFVTX0VTVElNQVRFRBACEisKJ0NPU1RfQ0FMQ1VMQVRJT05fU1RBVFVTX1BSSUNFX05PVF9GT1VORBADEiYKIkNPU1RfQ0FMQ1VMQVRJT05fU1RBVFVTX1JFQ09OQ0lMRUQQBBIrCidDT1NUX0NBTENVTEFUSU9OX1NUQVRVU19NQU5VQUxfQURKVVNURUQQBSpXCg9DdXJzb3JLZXlTb3VyY2USIQodQ1VSU09SX0tFWV9TT1VSQ0VfVU5TUEVDSUZJRUQQABIhCh1DVVJTT1JfS0VZX1NPVVJDRV9NQU5BR0VEX0tFWRABYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_google_protobuf_timestamp]);var UsageReportAggregateSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_usage,6);var UsageMeteringSource;(function(UsageMeteringSource2){UsageMeteringSource2[UsageMeteringSource2.UNSPECIFIED=0]="UNSPECIFIED",UsageMeteringSource2[UsageMeteringSource2.PROXY_PROVIDER_REPORTED=1]="PROXY_PROVIDER_REPORTED",UsageMeteringSource2[UsageMeteringSource2.RUNNER_PROVIDER_REPORTED_OSS=2]="RUNNER_PROVIDER_REPORTED_OSS",UsageMeteringSource2[UsageMeteringSource2.ESTIMATED=3]="ESTIMATED",UsageMeteringSource2[UsageMeteringSource2.PROVIDER_ADMIN_RECONCILED=4]="PROVIDER_ADMIN_RECONCILED",UsageMeteringSource2[UsageMeteringSource2.MANUAL_ADJUSTMENT=5]="MANUAL_ADJUSTMENT"})(UsageMeteringSource||(UsageMeteringSource={}));var UsageTrustLevel;(function(UsageTrustLevel2){UsageTrustLevel2[UsageTrustLevel2.UNSPECIFIED=0]="UNSPECIFIED",UsageTrustLevel2[UsageTrustLevel2.BILLING_AUTHORITY=1]="BILLING_AUTHORITY",UsageTrustLevel2[UsageTrustLevel2.SERVER_OBSERVED=2]="SERVER_OBSERVED",UsageTrustLevel2[UsageTrustLevel2.DISPLAY_ONLY=3]="DISPLAY_ONLY"})(UsageTrustLevel||(UsageTrustLevel={}));var UsageCompletionStatus;(function(UsageCompletionStatus2){UsageCompletionStatus2[UsageCompletionStatus2.UNSPECIFIED=0]="UNSPECIFIED",UsageCompletionStatus2[UsageCompletionStatus2.COMPLETE=1]="COMPLETE",UsageCompletionStatus2[UsageCompletionStatus2.STREAM_INTERRUPTED=2]="STREAM_INTERRUPTED",UsageCompletionStatus2[UsageCompletionStatus2.PROVIDER_ERROR_WITH_USAGE=3]="PROVIDER_ERROR_WITH_USAGE",UsageCompletionStatus2[UsageCompletionStatus2.PROVIDER_ERROR_NO_USAGE=4]="PROVIDER_ERROR_NO_USAGE",UsageCompletionStatus2[UsageCompletionStatus2.ESTIMATED_ONLY=5]="ESTIMATED_ONLY",UsageCompletionStatus2[UsageCompletionStatus2.RECONCILED=6]="RECONCILED",UsageCompletionStatus2[UsageCompletionStatus2.CONFLICT=7]="CONFLICT"})(UsageCompletionStatus||(UsageCompletionStatus={}));var BillingDebitStatus;(function(BillingDebitStatus2){BillingDebitStatus2[BillingDebitStatus2.UNSPECIFIED=0]="UNSPECIFIED",BillingDebitStatus2[BillingDebitStatus2.NOT_APPLICABLE=1]="NOT_APPLICABLE",BillingDebitStatus2[BillingDebitStatus2.PENDING=2]="PENDING",BillingDebitStatus2[BillingDebitStatus2.DEBITED=3]="DEBITED",BillingDebitStatus2[BillingDebitStatus2.FAILED_RETRYABLE=4]="FAILED_RETRYABLE",BillingDebitStatus2[BillingDebitStatus2.FAILED_TERMINAL=5]="FAILED_TERMINAL",BillingDebitStatus2[BillingDebitStatus2.CONFLICT=6]="CONFLICT"})(BillingDebitStatus||(BillingDebitStatus={}));var CostCalculationStatus;(function(CostCalculationStatus2){CostCalculationStatus2[CostCalculationStatus2.UNSPECIFIED=0]="UNSPECIFIED",CostCalculationStatus2[CostCalculationStatus2.COMPUTED=1]="COMPUTED",CostCalculationStatus2[CostCalculationStatus2.ESTIMATED=2]="ESTIMATED",CostCalculationStatus2[CostCalculationStatus2.PRICE_NOT_FOUND=3]="PRICE_NOT_FOUND",CostCalculationStatus2[CostCalculationStatus2.RECONCILED=4]="RECONCILED",CostCalculationStatus2[CostCalculationStatus2.MANUAL_ADJUSTED=5]="MANUAL_ADJUSTED"})(CostCalculationStatus||(CostCalculationStatus={}));var CursorKeySource;(function(CursorKeySource2){CursorKeySource2[CursorKeySource2.UNSPECIFIED=0]="UNSPECIFIED",CursorKeySource2[CursorKeySource2.MANAGED_KEY=1]="MANAGED_KEY"})(CursorKeySource||(CursorKeySource={}));var file_ai_stigmer_agentic_agentexecution_v1_writeback=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvd3JpdGViYWNrLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEimgIKEldvcmtzcGFjZVdyaXRlQmFjaxIcChR3b3Jrc3BhY2VfZW50cnlfbmFtZRgBIAEoCRITCgticmFuY2hfbmFtZRgCIAEoCRITCgtiYXNlX2JyYW5jaBgDIAEoCRISCgpjb21taXRfc2hhGAQgASgJEhgKEHB1bGxfcmVxdWVzdF91cmwYBSABKAkSGwoTcHVsbF9yZXF1ZXN0X251bWJlchgGIAEoBRIUCgxkaWZmX3N1bW1hcnkYByABKAkSTAoFcGhhc2UYCCABKA4yPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuV29ya3NwYWNlV3JpdGVCYWNrUGhhc2USDQoFZXJyb3IYCSABKAkq0AEKF1dvcmtzcGFjZVdyaXRlQmFja1BoYXNlEioKJldPUktTUEFDRV9XUklURV9CQUNLX1BIQVNFX1VOU1BFQ0lGSUVEEAASIgoeV09SS1NQQUNFX1dSSVRFX0JBQ0tfQ09NTUlUVEVEEAESHwobV09SS1NQQUNFX1dSSVRFX0JBQ0tfUFVTSEVEEAISIwofV09SS1NQQUNFX1dSSVRFX0JBQ0tfUFJfQ1JFQVRFRBADEh8KG1dPUktTUEFDRV9XUklURV9CQUNLX0ZBSUxFRBAEYgZwcm90bzM");var WorkspaceWriteBackPhase;(function(WorkspaceWriteBackPhase2){WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_PHASE_UNSPECIFIED=0]="WORKSPACE_WRITE_BACK_PHASE_UNSPECIFIED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_COMMITTED=1]="WORKSPACE_WRITE_BACK_COMMITTED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_PUSHED=2]="WORKSPACE_WRITE_BACK_PUSHED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_PR_CREATED=3]="WORKSPACE_WRITE_BACK_PR_CREATED",WorkspaceWriteBackPhase2[WorkspaceWriteBackPhase2.WORKSPACE_WRITE_BACK_FAILED=4]="WORKSPACE_WRITE_BACK_FAILED"})(WorkspaceWriteBackPhase||(WorkspaceWriteBackPhase={}));var file_ai_stigmer_agentic_agentexecution_v1_api=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvYXBpLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEiywIKDkFnZW50RXhlY3V0aW9uEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiMKBGtpbmQYAiABKAlCFbpIEnIQCg5BZ2VudEV4ZWN1dGlvbhJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESRgoEc3BlYxgEIAEoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvblNwZWMSSgoGc3RhdHVzGAUgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uU3RhdHVzIrcMChRBZ2VudEV4ZWN1dGlvblN0YXR1cxI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0EkQKCG1lc3NhZ2VzGAEgAygLMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50TWVzc2FnZRJNCgVwaGFzZRgCIAEoDjI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25QaGFzZUIIukgFggECEAESVQoUc3ViX2FnZW50X2V4ZWN1dGlvbnMYBCADKAsyNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU3ViQWdlbnRFeGVjdXRpb24SDQoFZXJyb3IYBiABKAkSEgoKc3RhcnRlZF9hdBgHIAEoCRIUCgxjb21wbGV0ZWRfYXQYCCABKAkSVAoFdG9kb3MYCSADKAsyRS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb25TdGF0dXMuVG9kb3NFbnRyeRIWCg5jYWxsYmFja190b2tlbhgKIAEoDBJQChFwZW5kaW5nX2FwcHJvdmFscxgQIAMoCzI1LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5QZW5kaW5nQXBwcm92YWwSWAoVYXBwcm92YWxfZXZlbnRfc3RyZWFtGBYgASgLMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsRXZlbnRTdHJlYW0SRwoMY29udGV4dF9pbmZvGA4gASgLMjEuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkNvbnRleHRJbmZvEkoKCWFydGlmYWN0cxgPIAMoCzI3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25BcnRpZmFjdBJXChV3b3Jrc3BhY2Vfd3JpdGVfYmFja3MYESADKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuV29ya3NwYWNlV3JpdGVCYWNrEksKDnNldHVwX3Byb2dyZXNzGBIgASgLMjMuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNldHVwUHJvZ3Jlc3MSVAoPc3RyZWFtaW5nX3VzYWdlGBQgASgLMjsuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlN0cmVhbWluZ1VzYWdlU3VtbWFyeRIyChFzdHJ1Y3R1cmVkX291dHB1dBgVIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSTQoQZmlsZV9jaGFuZ2Vfc2V0cxgXIAMoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlQ2hhbmdlU2V0El0KGGZpbGVfcmV2aWV3X2V2ZW50X3N0cmVhbRgYIAEoCzI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlUmV2aWV3RXZlbnRTdHJlYW0SVgoUZmlsZV9jaGFuZ2VfcHJvZ3Jlc3MYGSABKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZUNoYW5nZVByb2dyZXNzEl4KGHJlY2FsbGVkX21lbW9yaWVzX3JlcG9ydBgaIAEoCzI8LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5SZWNhbGxlZE1lbW9yaWVzUmVwb3J0GlwKClRvZG9zRW50cnkSCwoDa2V5GAEgASgJEj0KBXZhbHVlGAIgASgLMi4uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRvZG9JdGVtOgI4AUoECAwQDVIQcmVzb2x2ZWRfY29udGV4dCImCg1TZXR1cFByb2dyZXNzEhUKDWN1cnJlbnRfcGhhc2UYASABKAkiaAoWUmVjYWxsZWRNZW1vcmllc1JlcG9ydBIYChBzZWxlY3Rpb25fYWN0aXZlGAEgASgIEhsKE2luamVjdGVkX21lbW9yeV9pZHMYAiADKAkSFwoPZW1iZWRkaW5nX21vZGVsGAMgASgJYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_approval,file_ai_stigmer_agentic_agentexecution_v1_artifact,file_ai_stigmer_agentic_agentexecution_v1_context,file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_agentexecution_v1_filereview,file_ai_stigmer_agentic_agentexecution_v1_message,file_ai_stigmer_agentic_agentexecution_v1_spec,file_ai_stigmer_agentic_agentexecution_v1_subagent,file_ai_stigmer_agentic_agentexecution_v1_todo,file_ai_stigmer_agentic_agentexecution_v1_usage,file_ai_stigmer_agentic_agentexecution_v1_writeback,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_struct]),AgentExecutionSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_api,0),AgentExecutionStatusSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_api,1);var file_ai_stigmer_agentic_agentinstance_v1_spec=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRpbnN0YW5jZS92MS9zcGVjLnByb3RvEiNhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRpbnN0YW5jZS52MSKpAgoRQWdlbnRJbnN0YW5jZVNwZWMSGQoIYWdlbnRfaWQYASABKAlCB7pIBHICEAESEwoLZGVzY3JpcHRpb24YAiABKAkSyAEKEGVudmlyb25tZW50X3JlZnMYAyADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCeLpIcZIBbiJsugFpChVlbnZpcm9ubWVudF9yZWZzLmtpbmQSP2Vudmlyb25tZW50X3JlZnMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1lbnZpcm9ubWVudBoPdGhpcy5raW5kID09IDUz4IUsNUoECAQQBVITZGF0YXN0b3JlX3BhcnRpdGlvbmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]);var file_ai_stigmer_agentic_agentinstance_v1_api=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRpbnN0YW5jZS92MS9hcGkucHJvdG8SI2FpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxIsMCCg1BZ2VudEluc3RhbmNlEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiIKBGtpbmQYAiABKAlCFLpIEXIPCg1BZ2VudEluc3RhbmNlEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJECgRzcGVjGAQgASgLMjYuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuQWdlbnRJbnN0YW5jZVNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_agentinstance_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),AgentInstanceSchema=messageDesc2(file_ai_stigmer_agentic_agentinstance_v1_api,0);var file_ai_stigmer_agentic_agentshare_v1_spec=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9zcGVjLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MSLWCQoOQWdlbnRTaGFyZVNwZWMSrAEKCWFnZW50X3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUJjukhcugFWCg5hZ2VudF9yZWYua2luZBIzYWdlbnRfcmVmIG11c3QgcmVmZXJlbmNlIGEgcmVzb3VyY2Ugd2l0aCBraW5kPWFnZW50Gg90aGlzLmtpbmQgPT0gNDDIAQHghSwoEg8KB2VuYWJsZWQYAiABKAgSRgoIYXVkaWVuY2UYAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MS5BZ2VudFNoYXJlQXVkaWVuY2USsAIKD2FsbG93ZWRfb3JpZ2lucxgEIAMoCUKWArpIkgKSAY4CECAiiQK6AYUCChZhbGxvd2VkX29yaWdpbnMuZm9ybWF0Em5hbGxvd2VkX29yaWdpbnMgZW50cmllcyBtdXN0IGJlIGV4YWN0IHdlYiBvcmlnaW5zIGxpa2UgaHR0cHM6Ly9leGFtcGxlLmNvbSAobm8gcGF0aCwgcXVlcnksIG9yIHRyYWlsaW5nIHNsYXNoKRp7dGhpcy5tYXRjaGVzKCdeaHR0cHM/Oi8vW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8oXFwuW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8pKig6WzAtOV17MSw1fSk/JCcpEkYKCG1lc3NhZ2VzGAUgASgLMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZU1lc3NhZ2VzEsgBChBlbnZpcm9ubWVudF9yZWZzGAYgAygLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlQni6SHGSAW4ibLoBaQoVZW52aXJvbm1lbnRfcmVmcy5raW5kEj9lbnZpcm9ubWVudF9yZWZzIG11c3QgcmVmZXJlbmNlIHJlc291cmNlcyB3aXRoIGtpbmQ9ZW52aXJvbm1lbnQaD3RoaXMua2luZCA9PSA1M+CFLDUSQwoKcnVuX2NvbmZpZxgHIAEoCzIvLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5SdW5Db25maWc6sAK6SKwCGp8BCihhZ2VudF9zaGFyZS5lbnZpcm9ubWVudF9yZWZzX3B1YmxpY19vbmx5EjplbnZpcm9ubWVudF9yZWZzIGNhbiBvbmx5IGJlIHNldCBvbiBwdWJsaWMtYXVkaWVuY2Ugc2hhcmVzGjd0aGlzLmF1ZGllbmNlICE9IDIgfHwgdGhpcy5lbnZpcm9ubWVudF9yZWZzLnNpemUoKSA9PSAwGocBCiJhZ2VudF9zaGFyZS5ydW5fY29uZmlnX3B1YmxpY19vbmx5EjRydW5fY29uZmlnIGNhbiBvbmx5IGJlIHNldCBvbiBwdWJsaWMtYXVkaWVuY2Ugc2hhcmVzGit0aGlzLmF1ZGllbmNlICE9IDIgfHwgIWhhcyh0aGlzLnJ1bl9jb25maWcpInkKEkFnZW50U2hhcmVNZXNzYWdlcxIeCgxyYXRlX2xpbWl0ZWQYASABKAlCCLpIBXIDGKwCEh0KC3VuYXZhaWxhYmxlGAIgASgJQgi6SAVyAxisAhIkChJjb252ZXJzYXRpb25fZW5kZWQYAyABKAlCCLpIBXIDGKwCKnkKEkFnZW50U2hhcmVBdWRpZW5jZRIkCiBhZ2VudF9zaGFyZV9hdWRpZW5jZV91bnNwZWNpZmllZBAAEh8KG2FnZW50X3NoYXJlX2F1ZGllbmNlX3B1YmxpYxABEhwKGGFnZW50X3NoYXJlX2F1ZGllbmNlX29yZxACYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_invocation,file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]);var AgentShareAudience;(function(AgentShareAudience2){AgentShareAudience2[AgentShareAudience2.unspecified=0]="unspecified",AgentShareAudience2[AgentShareAudience2.public=1]="public",AgentShareAudience2[AgentShareAudience2.org=2]="org"})(AgentShareAudience||(AgentShareAudience={}));var file_ai_stigmer_agentic_agentshare_v1_status=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9zdGF0dXMucHJvdG8SIGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxIn8KEEFnZW50U2hhcmVTdGF0dXMSPwoFYXVkaXQYYyABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdBIYChBzaGFyZV9saW5rX3Rva2VuGAEgASgJEhAKCGFnZW50X2lkGAIgASgJYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_status]),AgentShareStatusSchema=messageDesc2(file_ai_stigmer_agentic_agentshare_v1_status,0);var file_ai_stigmer_agentic_agentshare_v1_api=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9hcGkucHJvdG8SIGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxIrMCCgpBZ2VudFNoYXJlEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEh8KBGtpbmQYAiABKAlCEbpIDnIMCgpBZ2VudFNoYXJlEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARI+CgRzcGVjGAQgASgLMjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZVNwZWMSQgoGc3RhdHVzGAUgASgLMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZVN0YXR1c2IGcHJvdG8z",[file_ai_stigmer_agentic_agentshare_v1_spec,file_ai_stigmer_agentic_agentshare_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),AgentShareSchema=messageDesc2(file_ai_stigmer_agentic_agentshare_v1_api,0);var file_ai_stigmer_agentic_artifact_v1_enum=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvZW51bS5wcm90bxIeYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxKoUBChRBcnRpZmFjdFN0b3JhZ2VTdGF0ZRIdChlzdG9yYWdlX3N0YXRlX3Vuc3BlY2lmaWVkEAASGQoVc3RvcmFnZV9zdGF0ZV9wZW5kaW5nEAESGAoUc3RvcmFnZV9zdGF0ZV9zdG9yZWQQAhIZChVzdG9yYWdlX3N0YXRlX2RlbGV0ZWQQA2IGcHJvdG8z"),ArtifactStorageState;(function(ArtifactStorageState2){ArtifactStorageState2[ArtifactStorageState2.storage_state_unspecified=0]="storage_state_unspecified",ArtifactStorageState2[ArtifactStorageState2.storage_state_pending=1]="storage_state_pending",ArtifactStorageState2[ArtifactStorageState2.storage_state_stored=2]="storage_state_stored",ArtifactStorageState2[ArtifactStorageState2.storage_state_deleted=3]="storage_state_deleted"})(ArtifactStorageState||(ArtifactStorageState={}));var file_ai_stigmer_agentic_artifact_v1_spec=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvc3BlYy5wcm90bxIeYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxIuQBCgxBcnRpZmFjdFNwZWMSIwoMY29udGVudF90eXBlGAEgASgJQg26SArIAQFyBRABGP8BEiMKDGRpc3BsYXlfbmFtZRgCIAEoCUINukgKyAEBcgUQARj/ARJGCgZzb3VyY2UYAyABKAsyLi5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuQXJ0aWZhY3RTb3VyY2VCBrpIA8gBARJCCglyZXRlbnRpb24YBCABKAsyLy5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuUmV0ZW50aW9uUG9saWN5Il4KDkFydGlmYWN0U291cmNlEh0KFXdvcmtmbG93X2V4ZWN1dGlvbl9pZBgBIAEoCRIaChJhZ2VudF9leGVjdXRpb25faWQYAiABKAkSEQoJdGFza19uYW1lGAMgASgJIiMKD1JldGVudGlvblBvbGljeRIQCgh0dGxfZGF5cxgBIAEoBWIGcHJvdG8z",[file_buf_validate_validate]);var file_ai_stigmer_agentic_artifact_v1_api=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvYXBpLnByb3RvEh5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEipwIKCEFydGlmYWN0EjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEh0KBGtpbmQYAiABKAlCD7pIDHIKCghBcnRpZmFjdBJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESOgoEc3BlYxgEIAEoCzIsLmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5BcnRpZmFjdFNwZWMSPgoGc3RhdHVzGAUgASgLMi4uYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxLkFydGlmYWN0U3RhdHVzItwBCg5BcnRpZmFjdFN0YXR1cxI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0EhQKDGNvbnRlbnRfaGFzaBgBIAEoCRISCgpzaXplX2J5dGVzGAIgASgDEksKDXN0b3JhZ2Vfc3RhdGUYAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuQXJ0aWZhY3RTdG9yYWdlU3RhdGUSEgoKZXhwaXJlc19hdBgEIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_artifact_v1_enum,file_ai_stigmer_agentic_artifact_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),ArtifactSchema=messageDesc2(file_ai_stigmer_agentic_artifact_v1_api,0),ArtifactStatusSchema=messageDesc2(file_ai_stigmer_agentic_artifact_v1_api,1);var file_ai_stigmer_agentic_channelapp_v1_spec=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9zcGVjLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MSLEAQoOQ2hhbm5lbEFwcFNwZWMSSAoFc2xhY2sYASABKAsyNy5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5TbGFja0NoYW5uZWxBcHBDb25maWdIABJOCgh3aGF0c2FwcBgCIAEoCzI6LmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLldoYXRzQXBwQ2hhbm5lbEFwcENvbmZpZ0gAQhgKD3Byb3ZpZGVyX2NvbmZpZxIFukgCCAEidAoVU2xhY2tDaGFubmVsQXBwQ29uZmlnEhoKCWNsaWVudF9pZBgBIAEoCUIHukgEcgIQARIeCg1jbGllbnRfc2VjcmV0GAIgASgJQge6SARyAhABEh8KDnNpZ25pbmdfc2VjcmV0GAMgASgJQge6SARyAhABIo4BChhXaGF0c0FwcENoYW5uZWxBcHBDb25maWcSFwoGYXBwX2lkGAEgASgJQge6SARyAhABEhsKCmFwcF9zZWNyZXQYAiABKAlCB7pIBHICEAESHQoMYWNjZXNzX3Rva2VuGAMgASgJQge6SARyAhABEh0KDHZlcmlmeV90b2tlbhgEIAEoCUIHukgEcgIQAWIGcHJvdG8z",[file_buf_validate_validate]);var file_ai_stigmer_agentic_channelapp_v1_api=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9hcGkucHJvdG8SIGFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxIrcCCgpDaGFubmVsQXBwEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEh8KBGtpbmQYAiABKAlCEbpIDnIMCgpDaGFubmVsQXBwEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARI+CgRzcGVjGAQgASgLMjAuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcFNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_channelapp_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),ChannelAppSchema=messageDesc2(file_ai_stigmer_agentic_channelapp_v1_api,0);var file_ai_stigmer_agentic_executioncontext_v1_api=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9hcGkucHJvdG8SJmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxIs8CChBFeGVjdXRpb25Db250ZXh0EjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiUKBGtpbmQYAiABKAlCF7pIFHISChBFeGVjdXRpb25Db250ZXh0Ek0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJKCgRzcGVjGAQgASgLMjwuYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dFNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),ExecutionContextSchema=messageDesc2(file_ai_stigmer_agentic_executioncontext_v1_api,0);var file_ai_stigmer_agentic_memory_v1_spec=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3NwZWMucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEikgEKCk1lbW9yeVNwZWMSGwoHY29udGVudBgBIAEoCUIKukgHcgUQARj0AxIjChtzdWJqZWN0X2lkZW50aXR5X2FjY291bnRfaWQYAiABKAkSQgoKcHJvdmVuYW5jZRgDIAEoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5UHJvdmVuYW5jZSJqChBNZW1vcnlQcm92ZW5hbmNlEhAKCGFnZW50X2lkGAEgASgJEhIKCnNlc3Npb25faWQYAiABKAkSGgoSYWdlbnRfZXhlY3V0aW9uX2lkGAMgASgJEhQKDHRvb2xfY2FsbF9pZBgEIAEoCWIGcHJvdG8z",[file_buf_validate_validate]);var MemoryProvenanceSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_spec,1);var file_ai_stigmer_agentic_memory_v1_enum=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2VudW0ucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEqkgEKFE1lbW9yeUxpZmVjeWNsZVN0YXRlEh8KG2xpZmVjeWNsZV9zdGF0ZV91bnNwZWNpZmllZBAAEhwKGGxpZmVjeWNsZV9zdGF0ZV9wcm9wb3NlZBABEh0KGWxpZmVjeWNsZV9zdGF0ZV9jb25maXJtZWQQAhIcChhsaWZlY3ljbGVfc3RhdGVfcmVqZWN0ZWQQA2IGcHJvdG8z"),MemoryLifecycleState;(function(MemoryLifecycleState2){MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_unspecified=0]="lifecycle_state_unspecified",MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_proposed=1]="lifecycle_state_proposed",MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_confirmed=2]="lifecycle_state_confirmed",MemoryLifecycleState2[MemoryLifecycleState2.lifecycle_state_rejected=3]="lifecycle_state_rejected"})(MemoryLifecycleState||(MemoryLifecycleState={}));var file_ai_stigmer_agentic_memory_v1_status=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3N0YXR1cy5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MSLSAQoMTWVtb3J5U3RhdHVzEksKD2xpZmVjeWNsZV9zdGF0ZRgBIAEoDjIyLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5TGlmZWN5Y2xlU3RhdGUSNAoQc3RhdGVfY2hhbmdlZF9hdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASPwoFYXVkaXQYYyABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdGIGcHJvdG8z",[file_ai_stigmer_agentic_memory_v1_enum,file_ai_stigmer_commons_apiresource_status,file_google_protobuf_timestamp]),MemoryStatusSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_status,0);var file_ai_stigmer_agentic_memory_v1_api=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2FwaS5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MSKbAgoGTWVtb3J5EjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEhsKBGtpbmQYAiABKAlCDbpICnIICgZNZW1vcnkSTQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YUIGukgDyAEBEjYKBHNwZWMYBCABKAsyKC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeVNwZWMSOgoGc3RhdHVzGAUgASgLMiouYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_memory_v1_spec,file_ai_stigmer_agentic_memory_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),MemorySchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_api,0);var file_ai_stigmer_agentic_plugin_v1_spec=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3NwZWMucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEigwIKClBsdWdpblNwZWMSDAoEbmFtZRgBIAEoCRIPCgd2ZXJzaW9uGAIgASgJEhMKC2Rlc2NyaXB0aW9uGAMgASgJEjoKBmF1dGhvchgEIAEoCzIqLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luQXV0aG9yEhAKCGhvbWVwYWdlGAUgASgJEhIKCnJlcG9zaXRvcnkYBiABKAkSDwoHbGljZW5zZRgHIAEoCRIQCghrZXl3b3JkcxgIIAMoCRI8CgdkaWFsZWN0GAkgASgOMisuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5EaWFsZWN0IjgKDFBsdWdpbkF1dGhvchIMCgRuYW1lGAEgASgJEg0KBWVtYWlsGAIgASgJEgsKA3VybBgDIAEoCSqhAQoNUGx1Z2luRGlhbGVjdBIeChpQTFVHSU5fRElBTEVDVF9VTlNQRUNJRklFRBAAEiAKHFBMVUdJTl9ESUFMRUNUX0FHRU5UX1BMVUdJTlMQARIZChVQTFVHSU5fRElBTEVDVF9DTEFVREUQAhIZChVQTFVHSU5fRElBTEVDVF9DVVJTT1IQAxIYChRQTFVHSU5fRElBTEVDVF9DT0RFWBAEYgZwcm90bzM"),PluginSpecSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_spec,0),PluginAuthorSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_spec,1),PluginDialect;(function(PluginDialect2){PluginDialect2[PluginDialect2.UNSPECIFIED=0]="UNSPECIFIED",PluginDialect2[PluginDialect2.AGENT_PLUGINS=1]="AGENT_PLUGINS",PluginDialect2[PluginDialect2.CLAUDE=2]="CLAUDE",PluginDialect2[PluginDialect2.CURSOR=3]="CURSOR",PluginDialect2[PluginDialect2.CODEX=4]="CODEX"})(PluginDialect||(PluginDialect={}));var file_ai_stigmer_agentic_plugin_v1_status=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3N0YXR1cy5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MSLqAgoMUGx1Z2luU3RhdHVzEj8KBWF1ZGl0GGMgASgLMjAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXQSKAoGZGlnZXN0GAEgASgJQhi6SBVyEzIRXiR8XlthLWYwLTldezY0fSQSHAoUYXJ0aWZhY3Rfc3RvcmFnZV9rZXkYAiABKAkSOAoFc3RhdGUYAyABKA4yKS5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpblN0YXRlEg0KBWVycm9yGAQgASgJEkkKDG1hdGVyaWFsaXplZBgFIAEoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luTWF0ZXJpYWxpemF0aW9uEj0KCHdhcm5pbmdzGAYgAygLMisuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5XYXJuaW5nIl8KFVBsdWdpbk1hdGVyaWFsaXphdGlvbhIOCgZza2lsbHMYASABKAUSEwoLbWNwX3NlcnZlcnMYAiABKAUSDgoGYWdlbnRzGAMgASgFEhEKCXdvcmtmbG93cxgEIAEoBSI8Cg1QbHVnaW5XYXJuaW5nEgwKBGtpbmQYASABKAkSDwoHbWVzc2FnZRgCIAEoCRIMCgRwYXRoGAMgASgJKnkKC1BsdWdpblN0YXRlEhwKGFBMVUdJTl9TVEFURV9VTlNQRUNJRklFRBAAEhsKF1BMVUdJTl9TVEFURV9JTlNUQUxMSU5HEAESFgoSUExVR0lOX1NUQVRFX1JFQURZEAISFwoTUExVR0lOX1NUQVRFX0ZBSUxFRBADYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),PluginStatusSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_status,0),PluginMaterializationSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_status,1),PluginWarningSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_status,2),PluginState;(function(PluginState2){PluginState2[PluginState2.UNSPECIFIED=0]="UNSPECIFIED",PluginState2[PluginState2.INSTALLING=1]="INSTALLING",PluginState2[PluginState2.READY=2]="READY",PluginState2[PluginState2.FAILED=3]="FAILED"})(PluginState||(PluginState={}));var file_ai_stigmer_agentic_plugin_v1_api=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2FwaS5wcm90bxIcYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MSKbAgoGUGx1Z2luEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEhsKBGtpbmQYAiABKAlCDbpICnIICgZQbHVnaW4STQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YUIGukgDyAEBEjYKBHNwZWMYBCABKAsyKC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpblNwZWMSOgoGc3RhdHVzGAUgASgLMiouYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5TdGF0dXMiZAoKUGx1Z2luTGlzdBITCgthcGlfdmVyc2lvbhgBIAEoCRIMCgRraW5kGAIgASgJEjMKBWl0ZW1zGAMgAygLMiQuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5iBnByb3RvMw",[file_ai_stigmer_agentic_plugin_v1_spec,file_ai_stigmer_agentic_plugin_v1_status,file_ai_stigmer_commons_apiresource_metadata,file_buf_validate_validate]),PluginSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_api,0);var file_ai_stigmer_agentic_session_v1_api=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9hcGkucHJvdG8SHWFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxIqsCCgdTZXNzaW9uEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEhwKBGtpbmQYAiABKAlCDrpIC3IJCgdTZXNzaW9uEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARI4CgRzcGVjGAQgASgLMiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvblNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_session_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),SessionSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_api,0);var file_ai_stigmer_agentic_workflowexecution_v1_enum=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvZW51bS5wcm90bxInYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxKtsBCg5FeGVjdXRpb25QaGFzZRIfChtFWEVDVVRJT05fUEhBU0VfVU5TUEVDSUZJRUQQABIVChFFWEVDVVRJT05fUEVORElORxABEhkKFUVYRUNVVElPTl9JTl9QUk9HUkVTUxACEhcKE0VYRUNVVElPTl9DT01QTEVURUQQAxIUChBFWEVDVVRJT05fRkFJTEVEEAQSFwoTRVhFQ1VUSU9OX0NBTkNFTExFRBAFEhgKFEVYRUNVVElPTl9URVJNSU5BVEVEEAYSFAoQRVhFQ1VUSU9OX1BBVVNFRBAHKoQCChBXb3JrZmxvd1Rhc2tUeXBlEiIKHldPUktGTE9XX1RBU0tfVFlQRV9VTlNQRUNJRklFRBAAEiIKHldPUktGTE9XX1RBU0tfQUdFTlRfSU5WT0NBVElPThABEhoKFldPUktGTE9XX1RBU0tfQVBQUk9WQUwQAhIaChZXT1JLRkxPV19UQVNLX0FQSV9DQUxMEAMSHQoZV09SS0ZMT1dfVEFTS19DT05ESVRJT05BTBAEEhoKFldPUktGTE9XX1RBU0tfUEFSQUxMRUwQBRIbChdXT1JLRkxPV19UQVNLX1RSQU5TRk9STRAGEhgKFFdPUktGTE9XX1RBU0tfQ1VTVE9NEAcq6gEKEldvcmtmbG93VGFza1N0YXR1cxIkCiBXT1JLRkxPV19UQVNLX1NUQVRVU19VTlNQRUNJRklFRBAAEhkKFVdPUktGTE9XX1RBU0tfUEVORElORxABEh0KGVdPUktGTE9XX1RBU0tfSU5fUFJPR1JFU1MQAhIbChdXT1JLRkxPV19UQVNLX0NPTVBMRVRFRBADEhgKFFdPUktGTE9XX1RBU0tfRkFJTEVEEAQSGQoVV09SS0ZMT1dfVEFTS19TS0lQUEVEEAUSIgoeV09SS0ZMT1dfVEFTS19XQUlUSU5HX0FQUFJPVkFMEAZiBnByb3RvMw"),ExecutionPhase2;(function(ExecutionPhase3){ExecutionPhase3[ExecutionPhase3.EXECUTION_PHASE_UNSPECIFIED=0]="EXECUTION_PHASE_UNSPECIFIED",ExecutionPhase3[ExecutionPhase3.EXECUTION_PENDING=1]="EXECUTION_PENDING",ExecutionPhase3[ExecutionPhase3.EXECUTION_IN_PROGRESS=2]="EXECUTION_IN_PROGRESS",ExecutionPhase3[ExecutionPhase3.EXECUTION_COMPLETED=3]="EXECUTION_COMPLETED",ExecutionPhase3[ExecutionPhase3.EXECUTION_FAILED=4]="EXECUTION_FAILED",ExecutionPhase3[ExecutionPhase3.EXECUTION_CANCELLED=5]="EXECUTION_CANCELLED",ExecutionPhase3[ExecutionPhase3.EXECUTION_TERMINATED=6]="EXECUTION_TERMINATED",ExecutionPhase3[ExecutionPhase3.EXECUTION_PAUSED=7]="EXECUTION_PAUSED"})(ExecutionPhase2||(ExecutionPhase2={}));var WorkflowTaskType;(function(WorkflowTaskType2){WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_TYPE_UNSPECIFIED=0]="WORKFLOW_TASK_TYPE_UNSPECIFIED",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_AGENT_INVOCATION=1]="WORKFLOW_TASK_AGENT_INVOCATION",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_APPROVAL=2]="WORKFLOW_TASK_APPROVAL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_API_CALL=3]="WORKFLOW_TASK_API_CALL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_CONDITIONAL=4]="WORKFLOW_TASK_CONDITIONAL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_PARALLEL=5]="WORKFLOW_TASK_PARALLEL",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_TRANSFORM=6]="WORKFLOW_TASK_TRANSFORM",WorkflowTaskType2[WorkflowTaskType2.WORKFLOW_TASK_CUSTOM=7]="WORKFLOW_TASK_CUSTOM"})(WorkflowTaskType||(WorkflowTaskType={}));var WorkflowTaskStatus;(function(WorkflowTaskStatus2){WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_STATUS_UNSPECIFIED=0]="WORKFLOW_TASK_STATUS_UNSPECIFIED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_PENDING=1]="WORKFLOW_TASK_PENDING",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_IN_PROGRESS=2]="WORKFLOW_TASK_IN_PROGRESS",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_COMPLETED=3]="WORKFLOW_TASK_COMPLETED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_FAILED=4]="WORKFLOW_TASK_FAILED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_SKIPPED=5]="WORKFLOW_TASK_SKIPPED",WorkflowTaskStatus2[WorkflowTaskStatus2.WORKFLOW_TASK_WAITING_APPROVAL=6]="WORKFLOW_TASK_WAITING_APPROVAL"})(WorkflowTaskStatus||(WorkflowTaskStatus={}));var file_ai_stigmer_agentic_workflowexecution_v1_spec=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvc3BlYy5wcm90bxInYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxIrwEChVXb3JrZmxvd0V4ZWN1dGlvblNwZWMSHAoUd29ya2Zsb3dfaW5zdGFuY2VfaWQYASABKAkSEwoLd29ya2Zsb3dfaWQYBiABKAkSFwoPdHJpZ2dlcl9tZXNzYWdlGAMgASgJEm0KEHRyaWdnZXJfbWV0YWRhdGEYBCADKAsyUy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb25TcGVjLlRyaWdnZXJNZXRhZGF0YUVudHJ5EmMKC3J1bnRpbWVfZW52GAUgAygLMk4uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uU3BlYy5SdW50aW1lRW52RW50cnkSFgoOY2FsbGJhY2tfdG9rZW4YByABKAwSSAoQZXhlY3V0aW9uX3RhcmdldBgIIAEoDjIuLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLkV4ZWN1dGlvblRhcmdldBo2ChRUcmlnZ2VyTWV0YWRhdGFFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBGmkKD1J1bnRpbWVFbnZFbnRyeRILCgNrZXkYASABKAkSRQoFdmFsdWUYAiABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25WYWx1ZToCOAFiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_spec,file_ai_stigmer_agentic_session_v1_enum]);var file_ai_stigmer_agentic_workflowexecution_v1_api=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvYXBpLnByb3RvEidhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEi3QIKEVdvcmtmbG93RXhlY3V0aW9uEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiYKBGtpbmQYAiABKAlCGLpIFXITChFXb3JrZmxvd0V4ZWN1dGlvbhJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESTAoEc3BlYxgEIAEoCzI+LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvblNwZWMSUAoGc3RhdHVzGAUgASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uU3RhdHVzIqQFChdXb3JrZmxvd0V4ZWN1dGlvblN0YXR1cxI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0ElAKBXBoYXNlGAEgASgOMjcuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvblBoYXNlQgi6SAWCAQIQARJECgV0YXNrcxgCIAMoCzI1LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd1Rhc2sSJwoGb3V0cHV0GAMgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBINCgVlcnJvchgEIAEoCRISCgpzdGFydGVkX2F0GAUgASgJEhQKDGNvbXBsZXRlZF9hdBgGIAEoCRIcChR0ZW1wb3JhbF93b3JrZmxvd19pZBgHIAEoCRJbChFwZW5kaW5nX2FwcHJvdmFscxgJIAMoCzJALmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd1BlbmRpbmdBcHByb3ZhbBIZChF0b3RhbF9jb3N0X21pY3JvcxgKIAEoAxIaChJ0b3RhbF9pbnB1dF90b2tlbnMYCyABKAMSGwoTdG90YWxfb3V0cHV0X3Rva2VucxgMIAEoAxIdChV3b3JrZmxvd192ZXJzaW9uX2hhc2gYDSABKAkSYAoUcGVuZGluZ19maWxlX3Jldmlld3MYDiADKAsyQi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dQZW5kaW5nRmlsZVJldmlldyKEAQoXV29ya2Zsb3dQZW5kaW5nQXBwcm92YWwSRwoIYXBwcm92YWwYASABKAsyNS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUGVuZGluZ0FwcHJvdmFsEiAKGGNoaWxkX2FnZW50X2V4ZWN1dGlvbl9pZBgCIAEoCSJUChlXb3JrZmxvd1BlbmRpbmdGaWxlUmV2aWV3EiAKGGNoaWxkX2FnZW50X2V4ZWN1dGlvbl9pZBgBIAEoCRIVCg1jaGFuZ2Vfc2V0X2lkGAIgAygJIv8DCgxXb3JrZmxvd1Rhc2sSDwoHdGFza19pZBgBIAEoCRIRCgl0YXNrX25hbWUYAiABKAkSVgoJdGFza190eXBlGAMgASgOMjkuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93VGFza1R5cGVCCLpIBYIBAhABEiYKBWlucHV0GAQgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBInCgZvdXRwdXQYBSABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0ElUKBnN0YXR1cxgGIAEoDjI7LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd1Rhc2tTdGF0dXNCCLpIBYIBAhABEhIKCnN0YXJ0ZWRfYXQYByABKAkSFAoMY29tcGxldGVkX2F0GAggASgJEg0KBWVycm9yGAkgASgJEikKCG1ldGFkYXRhGAogASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBIUCgxhcnRpZmFjdF9pZHMYCyADKAkSEwoLY29zdF9taWNyb3MYDCABKAMSFAoMaW5wdXRfdG9rZW5zGA0gASgDEhUKDW91dHB1dF90b2tlbnMYDiABKAMSDwoHdWlfaGludBgPIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_approval,file_ai_stigmer_agentic_workflowexecution_v1_enum,file_ai_stigmer_agentic_workflowexecution_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_struct]),WorkflowExecutionSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_api,0),WorkflowExecutionStatusSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_api,1);var file_ai_stigmer_agentic_workflowinstance_v1_spec=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dpbnN0YW5jZS92MS9zcGVjLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MSKBAwoUV29ya2Zsb3dJbnN0YW5jZVNwZWMSHAoLd29ya2Zsb3dfaWQYASABKAlCB7pIBHICEAESEwoLZGVzY3JpcHRpb24YAiABKAkSyAEKEGVudmlyb25tZW50X3JlZnMYAyADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCeLpIcZIBbiJsugFpChVlbnZpcm9ubWVudF9yZWZzLmtpbmQSP2Vudmlyb25tZW50X3JlZnMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1lbnZpcm9ubWVudBoPdGhpcy5raW5kID09IDUz4IUsNRJrChRleGVjdXRpb25fdmlzaWJpbGl0eRgEIAEoDjJDLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93RXhlY3V0aW9uVmlzaWJpbGl0eUIIukgFggECEAEqpwEKG1dvcmtmbG93RXhlY3V0aW9uVmlzaWJpbGl0eRItCil3b3JrZmxvd19leGVjdXRpb25fdmlzaWJpbGl0eV91bnNwZWNpZmllZBAAEikKJXdvcmtmbG93X2V4ZWN1dGlvbl92aXNpYmlsaXR5X3ByaXZhdGUQARIuCip3b3JrZmxvd19leGVjdXRpb25fdmlzaWJpbGl0eV9vcmdhbml6YXRpb24QAmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate]),WorkflowInstanceSpecSchema=messageDesc2(file_ai_stigmer_agentic_workflowinstance_v1_spec,0),WorkflowExecutionVisibility;(function(WorkflowExecutionVisibility2){WorkflowExecutionVisibility2[WorkflowExecutionVisibility2.unspecified=0]="unspecified",WorkflowExecutionVisibility2[WorkflowExecutionVisibility2.private=1]="private",WorkflowExecutionVisibility2[WorkflowExecutionVisibility2.organization=2]="organization"})(WorkflowExecutionVisibility||(WorkflowExecutionVisibility={}));var file_ai_stigmer_agentic_workflowinstance_v1_api=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dpbnN0YW5jZS92MS9hcGkucHJvdG8SJmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxIs8CChBXb3JrZmxvd0luc3RhbmNlEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEiUKBGtpbmQYAiABKAlCF7pIFHISChBXb3JrZmxvd0luc3RhbmNlEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJKCgRzcGVjGAQgASgLMjwuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEuV29ya2Zsb3dJbnN0YW5jZVNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw",[file_ai_stigmer_agentic_workflowinstance_v1_spec,file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate]),WorkflowInstanceSchema=messageDesc2(file_ai_stigmer_agentic_workflowinstance_v1_api,0);var file_ai_stigmer_iam_apikey_v1_spec=fileDesc("CiNhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvc3BlYy5wcm90bxIYYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxIoYBCgpBcGlLZXlTcGVjEhYKCGtleV9oYXNoGAEgASgJQgTIhSwBEhkKC2ZpbmdlcnByaW50GAIgASgJQgTIhSwBEi4KCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhUKDW5ldmVyX2V4cGlyZXMYBCABKAhiBnByb3RvMw",[file_ai_stigmer_commons_apiresource_field_options,file_google_protobuf_timestamp]);var file_ai_stigmer_iam_apikey_v1_api=fileDesc("CiJhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvYXBpLnByb3RvEhhhaS5zdGlnbWVyLmlhbS5hcGlrZXkudjEihwIKBkFwaUtleRItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEhsKBGtpbmQYAiABKAlCDbpICnIICgZBcGlLZXkSRQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YRIyCgRzcGVjGAQgASgLMiQuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleVNwZWMSNgoGc3RhdHVzGAUgASgLMiYuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleVN0YXR1cyKBAQoMQXBpS2V5U3RhdHVzEj8KBWF1ZGl0GGMgASgLMjAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXQSMAoMbGFzdF91c2VkX2F0GAEgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_apikey_v1_spec,file_buf_validate_validate,file_google_protobuf_timestamp]),ApiKeySchema=messageDesc2(file_ai_stigmer_iam_apikey_v1_api,0),ApiKeyStatusSchema=messageDesc2(file_ai_stigmer_iam_apikey_v1_api,1);var file_ai_stigmer_iam_iampolicy_v1_api=fileDesc("CiVhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvYXBpLnByb3RvEhthaS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEimQIKCUlhbVBvbGljeRItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEh4KBGtpbmQYAiABKAlCELpIDXILCglJYW1Qb2xpY3kSRQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YRI4CgRzcGVjGAQgASgLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMSPAoGc3RhdHVzGAUgASgLMiwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVN0YXR1cyJSCg9JYW1Qb2xpY3lTdGF0dXMSPwoFYXVkaXQYASABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_iampolicy_v1_spec,file_buf_validate_validate]),IamPolicySchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_api,0);var file_ai_stigmer_iam_identityprovider_v1_spec=fileDesc("Ci1haS9zdGlnbWVyL2lhbS9pZGVudGl0eXByb3ZpZGVyL3YxL3NwZWMucHJvdG8SImFpLnN0aWdtZXIuaWFtLmlkZW50aXR5cHJvdmlkZXIudjEihQYKFElkZW50aXR5UHJvdmlkZXJTcGVjEh4KDGRpc3BsYXlfbmFtZRgBIAEoCUIIukgFcgMYyAESGgoIandrc191cmkYAiABKAlCCLpIBXIDGIAQEioKD2FsbG93ZWRfaXNzdWVycxgDIAMoCUIRukgOkgELEAoiB3IFEAEYgBASJQoRZXhwZWN0ZWRfYXVkaWVuY2UYBCABKAlCCrpIB3IFEAEYyAESGQoRcmF0ZV9saW1pdF9idWRnZXQYBSABKAUSIwoRdXNlcmluZm9fZW5kcG9pbnQYBiABKAlCCLpIBXIDGIAQEhcKD2lzX3Nzb19wcm92aWRlchgHIAEoCBIgCg5vaWRjX2NsaWVudF9pZBgIIAEoCUIIukgFcgMYgAISHwoXYXV0b19wcm92aXNpb25fYWNjb3VudHMYCSABKAgSGQoRYXV0b19ncmFudF9vbl9vcmcYCiABKAgSMwoPYXV0b19ncmFudF9yb2xlGAsgASgOMhouYWkuc3RpZ21lci5pYW0udjEuSWFtUm9sZRIiChB0ZW5hbnRfb3JnX2NsYWltGAwgASgJQgi6SAVyAxiAAjrNArpIyQIanQEKK2lkZW50aXR5X3Byb3ZpZGVyLmF1dG9fZ3JhbnRfcm9sZV9ub3Rfb3duZXISU2F1dG9fZ3JhbnRfcm9sZSBjYW5ub3QgYmUgb3duZXI7IG9yZ2FuaXphdGlvbiBvd25lcnNoaXAgbXVzdCBiZSBhc3NpZ25lZCBleHBsaWNpdGx5Ghl0aGlzLmF1dG9fZ3JhbnRfcm9sZSAhPSAxGqYBCjBpZGVudGl0eV9wcm92aWRlci5qd2tzX3VyaV9yZXF1aXJlZF93aXRoX2lzc3VlcnMSOWp3a3NfdXJpIGlzIHJlcXVpcmVkIHdoZW4gYWxsb3dlZF9pc3N1ZXJzIG5hbWVzIGFuIGlzc3Vlcho3dGhpcy5hbGxvd2VkX2lzc3VlcnMuc2l6ZSgpID09IDAgfHwgdGhpcy5qd2tzX3VyaSAhPSAnJ2IGcHJvdG8z",[file_ai_stigmer_iam_v1_enum,file_buf_validate_validate]);var file_ai_stigmer_iam_identityprovider_v1_api=fileDesc("CixhaS9zdGlnbWVyL2lhbS9pZGVudGl0eXByb3ZpZGVyL3YxL2FwaS5wcm90bxIiYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlwcm92aWRlci52MSLHAgoQSWRlbnRpdHlQcm92aWRlchItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEiUKBGtpbmQYAiABKAlCF7pIFHISChBJZGVudGl0eVByb3ZpZGVyEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJGCgRzcGVjGAQgASgLMjguYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlwcm92aWRlci52MS5JZGVudGl0eVByb3ZpZGVyU3BlYxJGCgZzdGF0dXMYBSABKAsyNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdFN0YXR1c2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_identityprovider_v1_spec,file_buf_validate_validate]),IdentityProviderSchema=messageDesc2(file_ai_stigmer_iam_identityprovider_v1_api,0);var file_ai_stigmer_iam_invitation_v1_enum=fileDesc("CidhaS9zdGlnbWVyL2lhbS9pbnZpdGF0aW9uL3YxL2VudW0ucHJvdG8SHGFpLnN0aWdtZXIuaWFtLmludml0YXRpb24udjEqbQoPSW52aXRhdGlvblN0YXRlEiAKHGludml0YXRpb25fc3RhdGVfdW5zcGVjaWZpZWQQABIKCgZhY3RpdmUQARILCgdleHBpcmVkEAISCwoHcmV2b2tlZBADEhIKDmZ1bGx5X3JlZGVlbWVkEARiBnByb3RvMw"),InvitationState;(function(InvitationState2){InvitationState2[InvitationState2.invitation_state_unspecified=0]="invitation_state_unspecified",InvitationState2[InvitationState2.active=1]="active",InvitationState2[InvitationState2.expired=2]="expired",InvitationState2[InvitationState2.revoked=3]="revoked",InvitationState2[InvitationState2.fully_redeemed=4]="fully_redeemed"})(InvitationState||(InvitationState={}));var file_ai_stigmer_iam_invitation_v1_spec=fileDesc("CidhaS9zdGlnbWVyL2lhbS9pbnZpdGF0aW9uL3YxL3NwZWMucHJvdG8SHGFpLnN0aWdtZXIuaWFtLmludml0YXRpb24udjEirAEKDkludml0YXRpb25TcGVjEjAKBHJvbGUYASABKA4yGi5haS5zdGlnbWVyLmlhbS52MS5JYW1Sb2xlQga6SAPIAQESFwoPbWF4X3JlZGVtcHRpb25zGAIgASgFEjYKCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQga6SAPIAQESFwoFbGFiZWwYBCABKAlCCLpIBXIDGMgBYgZwcm90bzM",[file_ai_stigmer_iam_v1_enum,file_buf_validate_validate,file_google_protobuf_timestamp]);var file_ai_stigmer_iam_invitation_v1_api=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9pbnZpdGF0aW9uL3YxL2FwaS5wcm90bxIcYWkuc3RpZ21lci5pYW0uaW52aXRhdGlvbi52MSKnAgoKSW52aXRhdGlvbhItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEh8KBGtpbmQYAiABKAlCEbpIDnIMCgpJbnZpdGF0aW9uEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARI6CgRzcGVjGAQgASgLMiwuYWkuc3RpZ21lci5pYW0uaW52aXRhdGlvbi52MS5JbnZpdGF0aW9uU3BlYxI+CgZzdGF0dXMYBSABKAsyLi5haS5zdGlnbWVyLmlhbS5pbnZpdGF0aW9uLnYxLkludml0YXRpb25TdGF0dXMigwIKEEludml0YXRpb25TdGF0dXMSDQoFdG9rZW4YASABKAkSPAoFc3RhdGUYAiABKA4yLS5haS5zdGlnbWVyLmlhbS5pbnZpdGF0aW9uLnYxLkludml0YXRpb25TdGF0ZRIYChByZWRlbXB0aW9uX2NvdW50GAMgASgFEkcKC3JlZGVtcHRpb25zGAQgAygLMjIuYWkuc3RpZ21lci5pYW0uaW52aXRhdGlvbi52MS5JbnZpdGF0aW9uUmVkZW1wdGlvbhI/CgVhdWRpdBhjIAEoCzIwLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0ImQKFEludml0YXRpb25SZWRlbXB0aW9uEhsKE2lkZW50aXR5X2FjY291bnRfaWQYASABKAkSLwoLcmVkZWVtZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_invitation_v1_enum,file_ai_stigmer_iam_invitation_v1_spec,file_buf_validate_validate,file_google_protobuf_timestamp]),InvitationSchema=messageDesc2(file_ai_stigmer_iam_invitation_v1_api,0);var file_ai_stigmer_iam_oauthapp_v1_api=fileDesc("CiRhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9hcGkucHJvdG8SGmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxIqcCCghPQXV0aEFwcBItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEh0KBGtpbmQYAiABKAlCD7pIDHIKCghPQXV0aEFwcBJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESNgoEc3BlYxgEIAEoCzIoLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwU3BlYxJGCgZzdGF0dXMYBSABKAsyNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdFN0YXR1c2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_oauthapp_v1_spec,file_buf_validate_validate]),OAuthAppSchema=messageDesc2(file_ai_stigmer_iam_oauthapp_v1_api,0);var file_ai_stigmer_iam_platformclient_v1_spec=fileDesc("CithaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9zcGVjLnByb3RvEiBhaS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MSKQBwoSUGxhdGZvcm1DbGllbnRTcGVjEhcKCWNsaWVudF9pZBgBIAEoCUIEyIUsARIgChJjbGllbnRfc2VjcmV0X2hhc2gYAiABKAlCBMiFLAESIAoSc2VjcmV0X2ZpbmdlcnByaW50GAMgASgJQgTIhSwBEi4KCmV4cGlyZXNfYXQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhUKDW5ldmVyX2V4cGlyZXMYBSABKAgSHwoXYXV0b19wcm92aXNpb25fYWNjb3VudHMYBiABKAgSGQoRYXV0b19ncmFudF9vbl9vcmcYByABKAgSMwoPYXV0b19ncmFudF9yb2xlGAggASgOMhouYWkuc3RpZ21lci5pYW0udjEuSWFtUm9sZRIXCg9hbGxvd2VkX29yaWdpbnMYCSADKAkSyAEKEGVudmlyb25tZW50X3JlZnMYCiADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCeLpIcZIBbiJsugFpChVlbnZpcm9ubWVudF9yZWZzLmtpbmQSP2Vudmlyb25tZW50X3JlZnMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1lbnZpcm9ubWVudBoPdGhpcy5raW5kID09IDUz4IUsNTqAA7pI/AIa2wEKMnBsYXRmb3JtX2NsaWVudC5hdXRvX2dyYW50X3JlcXVpcmVzX2F1dG9fcHJvdmlzaW9uEmxhdXRvX2dyYW50X29uX29yZyByZXF1aXJlcyBhdXRvX3Byb3Zpc2lvbl9hY2NvdW50czogb25seSBhbiBhY2NvdW50IHRoZSBjbGllbnQgcHJvdmlzaW9ucyByZWNlaXZlcyB0aGUgZ3JhbnQaNyF0aGlzLmF1dG9fZ3JhbnRfb25fb3JnIHx8IHRoaXMuYXV0b19wcm92aXNpb25fYWNjb3VudHMamwEKKXBsYXRmb3JtX2NsaWVudC5hdXRvX2dyYW50X3JvbGVfbm90X293bmVyElNhdXRvX2dyYW50X3JvbGUgY2Fubm90IGJlIG93bmVyOyBvcmdhbml6YXRpb24gb3duZXJzaGlwIG11c3QgYmUgYXNzaWduZWQgZXhwbGljaXRseRoZdGhpcy5hdXRvX2dyYW50X3JvbGUgIT0gMWIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_iam_v1_enum,file_buf_validate_validate,file_google_protobuf_timestamp]),PlatformClientSpecSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_spec,0);var file_ai_stigmer_iam_platformclient_v1_api=fileDesc("CiphaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9hcGkucHJvdG8SIGFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxIr8CCg5QbGF0Zm9ybUNsaWVudBItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEiMKBGtpbmQYAiABKAlCFbpIEnIQCg5QbGF0Zm9ybUNsaWVudBJNCghtZXRhZGF0YRgDIAEoCzIzLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZU1ldGFkYXRhQga6SAPIAQESQgoEc3BlYxgEIAEoCzI0LmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50U3BlYxJGCgZzdGF0dXMYBSABKAsyNi5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5QbGF0Zm9ybUNsaWVudFN0YXR1cyKJAQoUUGxhdGZvcm1DbGllbnRTdGF0dXMSPwoFYXVkaXQYYyABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdBIwCgxsYXN0X3VzZWRfYXQYASABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_platformclient_v1_spec,file_buf_validate_validate,file_google_protobuf_timestamp]),PlatformClientSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_api,0),PlatformClientStatusSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_api,1);var file_ai_stigmer_iam_team_v1_spec=fileDesc("CiFhaS9zdGlnbWVyL2lhbS90ZWFtL3YxL3NwZWMucHJvdG8SFmFpLnN0aWdtZXIuaWFtLnRlYW0udjEiKQoIVGVhbVNwZWMSHQoLZGVzY3JpcHRpb24YASABKAlCCLpIBXIDGPQDYgZwcm90bzM",[file_buf_validate_validate]);var file_ai_stigmer_iam_team_v1_api=fileDesc("CiBhaS9zdGlnbWVyL2lhbS90ZWFtL3YxL2FwaS5wcm90bxIWYWkuc3RpZ21lci5pYW0udGVhbS52MSKXAgoEVGVhbRItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEhkKBGtpbmQYAiABKAlCC7pICHIGCgRUZWFtEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARIuCgRzcGVjGAQgASgLMiAuYWkuc3RpZ21lci5pYW0udGVhbS52MS5UZWFtU3BlYxJGCgZzdGF0dXMYBSABKAsyNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdFN0YXR1c2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_metadata,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_iam_team_v1_spec,file_buf_validate_validate]),TeamSchema=messageDesc2(file_ai_stigmer_iam_team_v1_api,0);function defaultOfBlueprint(blueprint){let blueprintType=kindEnumName(blueprint.kind);return async(object,row,loader2)=>{let blueprintId=parentIdOf(row,blueprintSpecFieldOf(object.type,blueprint.kind));if(blueprintId==="")return[];let loaded=await loader2.load({type:blueprintType,id:blueprintId});return loaded===void 0||!isMessage2(loaded,blueprint.schema)||blueprint.defaultInstanceIdOf(loaded)!==object.id?[]:[{object,relation:"default_of",subject:{form:"object",object:{type:blueprintType,id:blueprintId}}}]}}function blueprintSpecFieldOf(instanceType,blueprintKind){let instanceKind=kindByEnumName(instanceType),entry=getKindMeta(instanceKind).authorization?.additionalParents?.find(parent=>getKindEnum(parent.kind)===blueprintKind);if(entry===void 0)throw new Error(`${instanceType} declares default_of but kind_meta names no ${kindEnumName(blueprintKind)} parent`);return entry.specField}var executionViewer=(object,row)=>{if(!isMessage2(row,WorkflowInstanceSchema))return Promise.resolve([]);let level=row.spec?.executionVisibility??WorkflowExecutionVisibility.unspecified;switch(level){case WorkflowExecutionVisibility.organization:{let org=row.metadata?.org??"";return Promise.resolve(org===""?[]:[{object,relation:"execution_viewer",subject:{form:"userset",object:{type:"organization",id:org},relation:"viewer"}}])}case WorkflowExecutionVisibility.private:case WorkflowExecutionVisibility.unspecified:return Promise.resolve([]);default:{let exhaustive=level;throw new Error(`unknown execution visibility: ${String(exhaustive)}`)}}};var ROWLESS=void 0,KIND_BINDINGS=new Map([[ApiResourceKind.platform,{schema:ROWLESS}],[ApiResourceKind.identity_account,{schema:IdentityAccountSchema}],[ApiResourceKind.identity_provider,{schema:IdentityProviderSchema}],[ApiResourceKind.iam_policy,{schema:IamPolicySchema}],[ApiResourceKind.api_key,{schema:ApiKeySchema}],[ApiResourceKind.oauth_app,{schema:OAuthAppSchema}],[ApiResourceKind.platform_client,{schema:PlatformClientSchema}],[ApiResourceKind.invitation,{schema:InvitationSchema}],[ApiResourceKind.team,{schema:TeamSchema}],[ApiResourceKind.organization,{schema:OrganizationSchema}],[ApiResourceKind.agent,{schema:AgentSchema}],[ApiResourceKind.agent_channel,{schema:AgentChannelSchema}],[ApiResourceKind.agent_share,{schema:AgentShareSchema}],[ApiResourceKind.channel_app,{schema:ChannelAppSchema}],[ApiResourceKind.agent_instance,{schema:AgentInstanceSchema,derived:{default_of:defaultOfBlueprint({kind:ApiResourceKind.agent,schema:AgentSchema,defaultInstanceIdOf:agent=>agent.status?.defaultInstanceId??""})}}],[ApiResourceKind.agent_execution,{schema:AgentExecutionSchema}],[ApiResourceKind.artifact,{schema:ArtifactSchema}],[ApiResourceKind.environment,{schema:EnvironmentSchema}],[ApiResourceKind.execution_context,{schema:ExecutionContextSchema}],[ApiResourceKind.mcp_server,{schema:McpServerSchema}],[ApiResourceKind.memory,{schema:MemorySchema}],[ApiResourceKind.plugin,{schema:PluginSchema}],[ApiResourceKind.schedule,{schema:ScheduleSchema}],[ApiResourceKind.session,{schema:SessionSchema}],[ApiResourceKind.skill,{schema:SkillSchema}],[ApiResourceKind.workflow,{schema:WorkflowSchema}],[ApiResourceKind.workflow_instance,{schema:WorkflowInstanceSchema,derived:{default_of:defaultOfBlueprint({kind:ApiResourceKind.workflow,schema:WorkflowSchema,defaultInstanceIdOf:workflow=>workflow.status?.defaultInstanceId??""}),execution_viewer:executionViewer}}],[ApiResourceKind.workflow_execution,{schema:WorkflowExecutionSchema}]]);var authorization_model_default={schema_version:"1.2",type_definitions:[{metadata:{module:"stigmer",relations:{can_bootstrap_iam:{},can_execute_billing_ops:{},can_grant_access:{},can_impersonate:{},can_issue_license:{},can_manage_credits:{},can_manage_cursor_accounts:{},can_manage_identity_accounts:{},can_manage_model_pricing:{},can_manage_plans:{},can_update_usage:{},can_view_access:{},can_view_provider_standing:{},can_write_reserved_labels:{},credit_issuer:{directly_related_user_types:[{type:"identity_account"}]},operator:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"platform.fga"}},relations:{can_bootstrap_iam:{computedUserset:{relation:"operator"}},can_execute_billing_ops:{computedUserset:{relation:"operator"}},can_grant_access:{computedUserset:{relation:"operator"}},can_impersonate:{computedUserset:{relation:"operator"}},can_issue_license:{computedUserset:{relation:"operator"}},can_manage_credits:{union:{child:[{computedUserset:{relation:"operator"}},{computedUserset:{relation:"credit_issuer"}}]}},can_manage_cursor_accounts:{computedUserset:{relation:"operator"}},can_manage_identity_accounts:{computedUserset:{relation:"operator"}},can_manage_model_pricing:{computedUserset:{relation:"operator"}},can_manage_plans:{computedUserset:{relation:"operator"}},can_update_usage:{computedUserset:{relation:"operator"}},can_view_access:{computedUserset:{relation:"operator"}},can_view_provider_standing:{computedUserset:{relation:"operator"}},can_write_reserved_labels:{computedUserset:{relation:"operator"}},credit_issuer:{this:{}},operator:{this:{}}},type:"platform"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},owner:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"iam/identity_account.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"owner"}},can_view_access:{computedUserset:{relation:"owner"}},owner:{this:{}}},type:"identity_account"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},managed_org:{directly_related_user_types:[{type:"organization"}]},organization:{directly_related_user_types:[{type:"organization"}]},owner:{},platform_user:{},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"iam/identity_provider.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},managed_org:{this:{}},organization:{this:{}},owner:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}},platform_user:{tupleToUserset:{computedUserset:{relation:"member"},tupleset:{relation:"managed_org"}}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}}},type:"identity_provider"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{}},source_info:{file:"iam/iam_policy.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},viewer:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}},type:"iam_policy"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_revoke:{},can_rotate:{},can_use:{},can_view:{},can_view_access:{},owner:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"iam/api_key.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_revoke:{computedUserset:{relation:"owner"}},can_rotate:{computedUserset:{relation:"owner"}},can_use:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"owner"}},can_view_access:{computedUserset:{relation:"owner"}},owner:{this:{}}},type:"api_key"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"iam/oauth_app.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}}},type:"oauth_app"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"iam/platform_client.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}}},type:"platform_client"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_view:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{},viewer:{}},source_info:{file:"iam/invitation.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}},viewer:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}},type:"invitation"},{metadata:{module:"iam",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},member:{directly_related_user_types:[{type:"identity_account"}]},organization:{directly_related_user_types:[{type:"organization"}]},viewer:{}},source_info:{file:"iam/team.fga"}},relations:{can_delete:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}},can_edit:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}},can_grant_access:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},member:{intersection:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"organization"}}}]}},organization:{this:{}},viewer:{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"organization"}}}},type:"team"},{metadata:{module:"tenancy",relations:{admin:{directly_related_user_types:[{type:"identity_account"}]},can_assign_roles:{},can_create_agent:{},can_create_agent_instance:{},can_create_agent_share:{},can_create_channel_app:{},can_create_environment:{},can_create_execution_in:{},can_create_identity_account:{},can_create_idp:{},can_create_mcp_server:{},can_create_oauth_app:{},can_create_platform_client:{},can_create_plugin:{},can_create_session:{},can_create_skill:{},can_create_team:{},can_create_workflow:{},can_delete:{},can_edit:{},can_grant_access:{},can_manage_billing:{},can_manage_members:{},can_view:{},can_view_access:{},can_view_billing:{},guest:{directly_related_user_types:[{type:"identity_account"}]},member:{directly_related_user_types:[{type:"identity_account"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"tenancy/organization.fga"}},relations:{admin:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}},can_assign_roles:{computedUserset:{relation:"owner"}},can_create_agent:{computedUserset:{relation:"admin"}},can_create_agent_instance:{computedUserset:{relation:"member"}},can_create_agent_share:{computedUserset:{relation:"admin"}},can_create_channel_app:{computedUserset:{relation:"admin"}},can_create_environment:{computedUserset:{relation:"member"}},can_create_execution_in:{union:{child:[{computedUserset:{relation:"member"}},{computedUserset:{relation:"guest"}}]}},can_create_identity_account:{computedUserset:{relation:"admin"}},can_create_idp:{computedUserset:{relation:"admin"}},can_create_mcp_server:{computedUserset:{relation:"admin"}},can_create_oauth_app:{computedUserset:{relation:"admin"}},can_create_platform_client:{computedUserset:{relation:"admin"}},can_create_plugin:{computedUserset:{relation:"admin"}},can_create_session:{union:{child:[{computedUserset:{relation:"member"}},{computedUserset:{relation:"guest"}}]}},can_create_skill:{computedUserset:{relation:"admin"}},can_create_team:{computedUserset:{relation:"admin"}},can_create_workflow:{computedUserset:{relation:"admin"}},can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"admin"}},can_grant_access:{computedUserset:{relation:"admin"}},can_manage_billing:{computedUserset:{relation:"admin"}},can_manage_members:{computedUserset:{relation:"admin"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},can_view_billing:{computedUserset:{relation:"viewer"}},guest:{this:{}},member:{union:{child:[{this:{}},{computedUserset:{relation:"admin"}}]}},owner:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"member"}}]}}},type:"organization"},{metadata:{module:"agentic",relations:{can_clone:{},can_create_instance:{},can_delete:{},can_edit:{},can_execute:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},platform_viewer:{directly_related_user_types:[{relation:"platform_user",type:"identity_provider"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/agent.fga"}},relations:{can_clone:{computedUserset:{relation:"viewer"}},can_create_instance:{computedUserset:{relation:"can_execute"}},can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_execute:{computedUserset:{relation:"viewer"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},platform_viewer:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{computedUserset:{relation:"platform_viewer"}}]}}},type:"agent"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_participate:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},participant:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"team"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/agent_channel.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_participate:{computedUserset:{relation:"participant"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},participant:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"participant"}}]}}},type:"agent_channel"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"agentic/agent_share.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}}},type:"agent_share"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"agentic/channel_app.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}}},type:"channel_app"},{metadata:{module:"agentic",relations:{agent:{directly_related_user_types:[{type:"agent"}]},can_delete:{},can_edit:{},can_execute:{},can_grant_access:{},can_view:{},can_view_access:{},default_of:{directly_related_user_types:[{type:"agent"}]},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/agent_instance.fga"}},relations:{agent:{this:{}},can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_execute:{computedUserset:{relation:"can_view"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},default_of:{this:{}},organization:{this:{}},owner:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"default_of"}}}]}}},type:"agent_instance"},{metadata:{module:"agentic",relations:{can_edit:{},can_view:{},owner:{},session:{directly_related_user_types:[{type:"session"}]},viewer:{}},source_info:{file:"agentic/agent_execution.fga"}},relations:{can_edit:{computedUserset:{relation:"owner"}},can_view:{union:{child:[{computedUserset:{relation:"viewer"}},{tupleToUserset:{computedUserset:{relation:"can_view"},tupleset:{relation:"session"}}}]}},owner:{tupleToUserset:{computedUserset:{relation:"owner"},tupleset:{relation:"session"}}},session:{this:{}},viewer:{union:{child:[{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"session"}}},{computedUserset:{relation:"owner"}}]}}},type:"agent_execution"},{metadata:{module:"agentic",relations:{can_edit:{},can_view:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"agentic/artifact.fga"}},relations:{can_edit:{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}},can_view:{union:{child:[{computedUserset:{relation:"owner"}},{computedUserset:{relation:"viewer"}}]}},organization:{this:{}},owner:{this:{}},viewer:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"organization"}}}]}}},type:"artifact"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_read_secrets:{},can_view:{},can_view_access:{},creator:{directly_related_user_types:[{type:"identity_account"}]},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"}]}},source_info:{file:"agentic/environment.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_read_secrets:{computedUserset:{relation:"creator"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},creator:{this:{}},organization:{this:{}},owner:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}}},type:"environment"},{metadata:{module:"agentic",relations:{can_edit:{},can_view:{},owner:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"agentic/execution_context.fga"}},relations:{can_edit:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"owner"}},owner:{this:{}}},type:"execution_context"},{metadata:{module:"agentic",relations:{can_clone:{},can_connect:{},can_delete:{},can_edit:{},can_grant_access:{},can_use:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},platform_viewer:{directly_related_user_types:[{relation:"platform_user",type:"identity_provider"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/mcp_server.fga"}},relations:{can_clone:{computedUserset:{relation:"viewer"}},can_connect:{computedUserset:{relation:"viewer"}},can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_use:{computedUserset:{relation:"viewer"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},platform_viewer:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{computedUserset:{relation:"platform_viewer"}}]}}},type:"mcp_server"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_view:{},organization:{directly_related_user_types:[{type:"organization"}]},subject:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"agentic/memory.fga"}},relations:{can_delete:{computedUserset:{relation:"subject"}},can_edit:{computedUserset:{relation:"subject"}},can_view:{computedUserset:{relation:"subject"}},organization:{this:{}},subject:{this:{}}},type:"memory"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_use:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},platform_viewer:{directly_related_user_types:[{relation:"platform_user",type:"identity_provider"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/plugin.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_use:{computedUserset:{relation:"viewer"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},platform_viewer:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{computedUserset:{relation:"platform_viewer"}}]}}},type:"plugin"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/schedule.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}}},type:"schedule"},{metadata:{module:"agentic",relations:{agent_instance:{directly_related_user_types:[{type:"agent_instance"}]},can_create_execution_in:{},can_delete:{},can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},channel:{directly_related_user_types:[{type:"agent_channel"}]},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},schedule:{directly_related_user_types:[{type:"schedule"}]},viewer:{directly_related_user_types:[{type:"identity_account"}]}},source_info:{file:"agentic/session.fga"}},relations:{agent_instance:{this:{}},can_create_execution_in:{computedUserset:{relation:"viewer"}},can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{union:{child:[{computedUserset:{relation:"viewer"}},{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"channel"}}},{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"schedule"}}}]}},can_view_access:{computedUserset:{relation:"viewer"}},channel:{this:{}},organization:{this:{}},owner:{this:{}},schedule:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}}]}}},type:"session"},{metadata:{module:"agentic",relations:{can_clone:{},can_delete:{},can_edit:{},can_grant_access:{},can_use:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},platform_viewer:{directly_related_user_types:[{relation:"platform_user",type:"identity_provider"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/skill.fga"}},relations:{can_clone:{computedUserset:{relation:"viewer"}},can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_use:{computedUserset:{relation:"viewer"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},platform_viewer:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{computedUserset:{relation:"platform_viewer"}}]}}},type:"skill"},{metadata:{module:"agentic",relations:{can_clone:{},can_delete:{},can_edit:{},can_execute:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},platform_viewer:{directly_related_user_types:[{relation:"platform_user",type:"identity_provider"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"},{relation:"member",type:"team"}]}},source_info:{file:"agentic/workflow.fga"}},relations:{can_clone:{computedUserset:{relation:"viewer"}},can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_execute:{computedUserset:{relation:"viewer"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{union:{child:[{this:{}},{tupleToUserset:{computedUserset:{relation:"admin"},tupleset:{relation:"organization"}}}]}},platform_viewer:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{computedUserset:{relation:"platform_viewer"}}]}}},type:"workflow"},{metadata:{module:"agentic",relations:{can_delete:{},can_edit:{},can_execute:{},can_grant_access:{},can_view:{},can_view_access:{},default_of:{directly_related_user_types:[{type:"workflow"}]},execution_viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"}]},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"organization"},{relation:"viewer",type:"organization"},{relation:"member",type:"team"}]},workflow:{directly_related_user_types:[{type:"workflow"}]}},source_info:{file:"agentic/workflow_instance.fga"}},relations:{can_delete:{computedUserset:{relation:"owner"}},can_edit:{computedUserset:{relation:"owner"}},can_execute:{computedUserset:{relation:"can_view"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},default_of:{this:{}},execution_viewer:{this:{}},organization:{this:{}},owner:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{tupleToUserset:{computedUserset:{relation:"viewer"},tupleset:{relation:"default_of"}}}]}},workflow:{this:{}}},type:"workflow_instance"},{metadata:{module:"agentic",relations:{can_edit:{},can_grant_access:{},can_view:{},can_view_access:{},organization:{directly_related_user_types:[{type:"organization"}]},owner:{directly_related_user_types:[{type:"identity_account"}]},viewer:{directly_related_user_types:[{type:"identity_account"},{relation:"member",type:"team"}]},workflow_instance:{directly_related_user_types:[{type:"workflow_instance"}]}},source_info:{file:"agentic/workflow_execution.fga"}},relations:{can_edit:{computedUserset:{relation:"owner"}},can_grant_access:{computedUserset:{relation:"owner"}},can_view:{computedUserset:{relation:"viewer"}},can_view_access:{computedUserset:{relation:"viewer"}},organization:{this:{}},owner:{this:{}},viewer:{union:{child:[{this:{}},{computedUserset:{relation:"owner"}},{tupleToUserset:{computedUserset:{relation:"execution_viewer"},tupleset:{relation:"workflow_instance"}}}]}},workflow_instance:{this:{}}},type:"workflow_execution"}]};function record(value,where,allowedKeys){if(value===null||typeof value!="object"||Array.isArray(value))throw new Error(`${where}: expected a mapping`);let entry=value;if(allowedKeys!==void 0){for(let key of Object.keys(entry))if(!allowedKeys.includes(key))throw new Error(`${where}: unknown key '${key}'`)}return entry}function list(value,where){if(!Array.isArray(value))throw new Error(`${where}: expected a list`);return value}function text(value,where){if(typeof value!="string")throw new Error(`${where}: expected a string`);return value}var SUPPORTED_SCHEMA_VERSION="1.2",MODEL_SOURCE_DIR="fga/model";function readOpenFgaModel(value,where="authorization-model.json"){let root5=record(value,where,["schema_version","type_definitions","conditions"]);if(root5.conditions!==void 0)throw new Error(`${where}: conditions are not evaluated by this server`);let version=text(root5.schema_version,`${where}: schema_version`);if(version!==SUPPORTED_SCHEMA_VERSION)throw new Error(`${where}: schema_version '${version}' is not ${SUPPORTED_SCHEMA_VERSION}, the only version this server reads`);let types3=[],seen=new Set;return list(root5.type_definitions,`${where}: type_definitions`).forEach((entry,index2)=>{let parsed=readType(entry,`${where}: type_definitions[${index2}]`);if(seen.has(parsed.type))throw new Error(`${where}: type '${parsed.type}' is defined twice`);seen.add(parsed.type),types3.push(parsed)}),assertReferencesResolve(types3,where),types3}function readType(value,where){let entry=record(value,where,["type","relations","metadata"]),type2=text(entry.type,`${where}.type`),at2=`${where} (${type2})`,metadata=record(entry.metadata,`${at2}.metadata`,["module","relations","source_info"]);text(metadata.module,`${at2}.metadata.module`);let sourceInfo=record(metadata.source_info,`${at2}.metadata.source_info`,["file"]),file=text(sourceInfo.file,`${at2}.metadata.source_info.file`),directTypes=readDirectTypes(metadata.relations,`${at2}.metadata.relations`),rewrites=entry.relations===void 0?{}:record(entry.relations,`${at2}.relations`);for(let relation of directTypes.keys())if(!(relation in rewrites))throw new Error(`${at2}.metadata.relations.${relation}: metadata for a relation ${type2} does not define`);let relations=new Map;for(let name of Object.keys(rewrites).sort()){let subjects=directTypes.get(name),rewrite=readRewrite(rewrites[name],`${at2}.relations.${name}`,subjects),hasThis=containsThis(rewrite);if(hasThis&&subjects===void 0)throw new Error(`${at2}.relations.${name}: a direct relation with no directly_related_user_types`);if(!hasThis&&subjects!==void 0)throw new Error(`${at2}.relations.${name}: directly_related_user_types on a relation with no direct node`);relations.set(name,rewrite)}return{type:type2,source:`${MODEL_SOURCE_DIR}/${file}`,relations}}function readDirectTypes(value,where){let out=new Map;if(value===void 0)return out;for(let[relation,meta]of Object.entries(record(value,where))){let entry=record(meta,`${where}.${relation}`,["directly_related_user_types"]);if(entry.directly_related_user_types===void 0)continue;let at2=`${where}.${relation}.directly_related_user_types`;out.set(relation,list(entry.directly_related_user_types,at2).map((item,index2)=>readSubjectType(item,`${at2}[${index2}]`)))}return out}function readSubjectType(value,where){let entry=record(value,where,["type","relation","wildcard","condition"]);if(entry.wildcard!==void 0)throw new Error(`${where}: wildcard subject types are not evaluated by this server`);if(entry.condition!==void 0)throw new Error(`${where}: conditional subject types are not evaluated by this server`);let type2=text(entry.type,`${where}.type`);return entry.relation===void 0?{form:"object",type:type2}:{form:"userset",type:type2,relation:text(entry.relation,`${where}.relation`)}}function readRewrite(value,where,subjects){let node=record(value,where,["this","computedUserset","tupleToUserset","union","intersection","difference"]),keys=Object.keys(node);if(keys.length!==1)throw new Error(`${where}: a rewrite node has exactly one form, found ${keys.length}`);let form=keys[0];switch(form){case"this":return record(node.this,`${where}.this`,[]),{node:"this",subjects:subjects??[]};case"computedUserset":return{node:"computed",relation:localRelation(node.computedUserset,`${where}.computedUserset`)};case"tupleToUserset":{let ttu=record(node.tupleToUserset,`${where}.tupleToUserset`,["tupleset","computedUserset"]);return{node:"from",tupleset:localRelation(ttu.tupleset,`${where}.tupleToUserset.tupleset`),relation:localRelation(ttu.computedUserset,`${where}.tupleToUserset.computedUserset`)}}case"union":case"intersection":{let operator=record(node[form],`${where}.${form}`,["child"]),members=list(operator.child,`${where}.${form}.child`).map((child,index2)=>readRewrite(child,`${where}.${form}.child[${index2}]`,subjects));if(members.length===0)throw new Error(`${where}.${form}: an operator with no children`);return{node:form,members}}case"difference":throw new Error(`${where}: 'but not' (difference) is not evaluated by this server`);default:throw new Error(`${where}: unknown rewrite form '${String(form)}'`)}}function localRelation(value,where){let entry=record(value,where,["relation","object"]);if(entry.object!==void 0)throw new Error(`${where}: a relation on another object is not evaluated by this server`);return text(entry.relation,`${where}.relation`)}function containsThis(rewrite){switch(rewrite.node){case"this":return!0;case"computed":case"from":return!1;case"union":case"intersection":return rewrite.members.some(containsThis);default:{let exhaustive=rewrite;throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`)}}}function assertReferencesResolve(types3,where){let byType=new Map(types3.map(entry=>[entry.type,entry]));for(let entry of types3)for(let[name,rewrite]of entry.relations){let at2=`${where}: ${entry.type}#${name}`;walk(rewrite,node=>{switch(node.node){case"computed":if(!entry.relations.has(node.relation))throw new Error(`${at2}: names relation '${node.relation}', which ${entry.type} does not define`);return;case"from":if(!entry.relations.has(node.tupleset))throw new Error(`${at2}: names tupleset '${node.tupleset}', which ${entry.type} does not define`);return;case"this":for(let subject of node.subjects){let target=byType.get(subject.type);if(target===void 0)throw new Error(`${at2}: admits subject type '${subject.type}', which the model does not define`);if(subject.form==="userset"&&!target.relations.has(subject.relation))throw new Error(`${at2}: admits '${subject.type}#${subject.relation}', which ${subject.type} does not define`)}return;case"union":case"intersection":return;default:{let exhaustive=node;throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`)}}})}}function walk(rewrite,visit2){if(visit2(rewrite),rewrite.node==="union"||rewrite.node==="intersection")for(let member2 of rewrite.members)walk(member2,visit2)}function newModel(declarations){let byKind=new Map,byType=new Map;for(let declaration of declarations){if(byKind.has(declaration.kind))throw new Error(`${declaration.type} is declared twice in the model`);byKind.set(declaration.kind,declaration),byType.set(declaration.type,declaration)}return{declarations,byKind:kind=>byKind.get(kind),byType:type2=>byType.get(type2)}}function bindModel(types3,bindings){let bound=new Set,declarations=types3.map(entry=>{let kind=kindByEnumName(entry.type);if(kind===ApiResourceKind.api_resource_kind_unknown)throw new Error(`${entry.source}: type '${entry.type}' names no ApiResourceKind`);let binding=bindings.get(kind);if(binding===void 0)throw new Error(`${entry.source}: type '${entry.type}' has no binding (model/bindings.ts)`);bound.add(kind);let derived=new Map;for(let[relation,rule]of Object.entries(binding.derived??{})){if(!entry.relations.has(relation))throw new Error(`model/bindings.ts: a derived rule for '${entry.type}#${relation}', which ${entry.source} does not define`);derived.set(relation,rule)}return{kind,type:entry.type,schema:binding.schema,source:entry.source,relations:entry.relations,derived}});for(let kind of bindings.keys())if(!bound.has(kind))throw new Error(`model/bindings.ts: a binding for '${ApiResourceKind[kind]}', which the model does not define`);return declarations}var builtInModel=newModel(bindModel(readOpenFgaModel(authorization_model_default),KIND_BINDINGS));var ACCOUNT_TYPE="identity_account";function formatObjectRef(object){return`${object.type}:${object.id}`}function pairKey(object,relation){return`${formatObjectRef(object)}#${relation}`}var ROW_RECORDED_OWNER_KINDS=new Set([ApiResourceKind.organization]),TEAM_TYPE=kindEnumName(ApiResourceKind.team),TEAM_MEMBER_RELATION="member";function account(id){return{form:"object",object:{type:ACCOUNT_TYPE,id}}}function deriveTuples(facts){let object={type:kindEnumName(facts.kind),id:facts.id},config2=getKindMeta(facts.kind).authorization;if(config2===void 0)return[];let tuples=[];for(let link of facts.parentLinks)tuples.push({object,relation:link.relation,subject:{form:"object",object:{type:kindEnumName(link.parentKind),id:link.parentId}}});let stampIsPerson=isPersonStamp(facts.createdBy);switch(config2.ownerType){case OwnerAttributionType.DIRECT:stampIsPerson&&!ROW_RECORDED_OWNER_KINDS.has(facts.kind)&&tuples.push({object,relation:"owner",subject:account(facts.createdBy)});break;case OwnerAttributionType.SELF:tuples.push({object,relation:"owner",subject:account(facts.id)});break;case OwnerAttributionType.INHERITED:case OwnerAttributionType.NONE:case OwnerAttributionType.UNSPECIFIED:break;default:{let exhaustive=config2.ownerType;throw new Error(`unknown owner attribution: ${String(exhaustive)}`)}}config2.requiresCreatorTuple&&stampIsPerson&&tuples.push({object,relation:"creator",subject:account(facts.createdBy)});for(let shape of visibilityShapesFor(facts.kind,facts.visibility)){let subject=visibilitySubject(shape,facts.org);subject!==void 0&&tuples.push({object,relation:"viewer",subject})}return tuples}function visibilitySubject(shape,org){switch(shape){case"org-viewer":return org===""?void 0:{form:"userset",object:{type:"organization",id:org},relation:"viewer"};case"platform-viewer":return;default:{let exhaustive=shape;throw new Error(`unknown visibility shape: ${String(exhaustive)}`)}}}function newDerivedTupleSource(deps,person,seed){let model=deps.model??builtInModel,rows=new Map,derived=new Map,seeded=new Map;for(let facts of seed?.facts??[])seeded.set(formatObjectRef({type:kindEnumName(facts.kind),id:facts.id}),facts);let personRows,reachableRows,loader2={load(object){let key=formatObjectRef(object),held=rows.get(key);if(held!==void 0)return held;let loading=loadRow(deps,model,object);return rows.set(key,loading),loading}};function derivedTuplesOf(object){let key=formatObjectRef(object),held=derived.get(key);if(held!==void 0)return held;let declaration=model.byType(object.type),known=seeded.get(key),deriving;return declaration===void 0?deriving=Promise.resolve([]):known!==void 0?deriving=Promise.resolve(deriveTuples(known)):deriving=loader2.load(object).then(row=>row===void 0?[]:deriveTuples(rowFactsOf(declaration.kind,row))),derived.set(key,deriving),deriving}function rowTuples(){return personRows===void 0&&(personRows=deps.policies.findByPrincipal(ACCOUNT_TYPE,person.accountId).then(found=>found.map(tupleOfRow))),personRows}function reachableTuples(){return reachableRows===void 0&&(reachableRows=rowTuples().then(async own=>{let teams=new Set;for(let tuple of own)tuple.object.type===TEAM_TYPE&&tuple.relation===TEAM_MEMBER_RELATION&&tuple.object.id!==""&&teams.add(tuple.object.id);let granted=await Promise.all([...teams].map(team=>deps.policies.findByPrincipal(TEAM_TYPE,team)));return indexByPair([...own,...granted.flat().map(tupleOfRow)])})),reachableRows}return{loader:loader2,personTuples:rowTuples,async tuplesOf(object,relation){let onPair=tuple=>tuple.relation===relation&&tuple.object.type===object.type&&tuple.object.id===object.id,fromRows=(await reachableTuples()).get(pairKey2(object,relation))??[],declaration=model.byType(object.type);if(declaration===void 0)return fromRows;let fromRow=(await derivedTuplesOf(object)).filter(onPair),rule=declaration.derived.get(relation);if(rule===void 0)return[...fromRows,...fromRow];let row=await loader2.load(object),fromRule=row===void 0?[]:await rule(object,row,loader2);return[...fromRows,...fromRow,...fromRule]}}}async function loadRow(deps,model,object){let declaration=model.byType(object.type),kind=kindByEnumName(object.type);if(!(declaration===void 0||declaration.schema===void 0||kind===ApiResourceKind.api_resource_kind_unknown||object.id==="")){if(kind===ApiResourceKind.identity_account)return deps.accounts.findById(object.id);try{return await deps.store.getResource(kind,object.id,declaration.schema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}}function pairKey2(object,relation){return`${formatObjectRef(object)}#${relation}`}function indexByPair(tuples){let index2=new Map;for(let tuple of tuples){let key=pairKey2(tuple.object,tuple.relation),held=index2.get(key);held===void 0?index2.set(key,[tuple]):held.push(tuple)}return index2}function tupleOfRow(row){let spec=row.spec,principal=spec?.principal,resource=spec?.resource,object={type:resource?.kind??"",id:resource?.id??""},principalObject={type:principal?.kind??"",id:principal?.id??""},subject=principal!==void 0&&principal.relation!==""?{form:"userset",object:principalObject,relation:principal.relation}:{form:"object",object:principalObject};return{object,relation:spec?.relation??"",subject}}var MAX_RESOLUTION_DEPTH=25,AuthorizationEvaluationError=class extends Error{reason;constructor(reason,message6){super(message6),this.name="AuthorizationEvaluationError",this.reason=reason}};async function checkRelation(deps,object,relation,person){if(deps.model.byType(object.type)===void 0)throw new AuthorizationEvaluationError("undeclared-target-kind",`no declaration for kind '${object.type}' (target ${formatObjectRef(object)})`);return new Walk(deps,person).resolve(object,relation,0)}var Walk=class{deps;person;memo=new Map;inProgress=new Set;constructor(deps,person){this.deps=deps,this.person=person}resolve(object,relation,depth){let key=pairKey(object,relation);if(this.inProgress.has(key))throw new AuthorizationEvaluationError("resolution-cycle",`'${key}' re-entered while being resolved \u2014 the declarations cycle`);if(depth>MAX_RESOLUTION_DEPTH)throw new AuthorizationEvaluationError("resolution-depth-exceeded",`resolving '${key}' exceeded ${MAX_RESOLUTION_DEPTH} hops`);let held=this.memo.get(key);if(held!==void 0)return held;let declaration=this.deps.model.byType(object.type),rewrite=declaration?.relations.get(relation);if(declaration===void 0||rewrite===void 0)return Promise.resolve(!1);this.inProgress.add(key);let result=this.evaluate(rewrite,object,relation,depth).finally(()=>this.inProgress.delete(key));return this.memo.set(key,result),result}async evaluate(rewrite,object,relation,depth){switch(rewrite.node){case"this":{let tuples=await this.deps.source.tuplesOf(object,relation);for(let tuple of tuples)if(await this.subjectHolds(tuple.subject,rewrite.subjects,depth))return!0;return!1}case"computed":return this.resolve(object,rewrite.relation,depth+1);case"from":{let linkTypes=this.objectTypesOf(object,rewrite.tupleset),links=await this.deps.source.tuplesOf(object,rewrite.tupleset);for(let link of links)if(link.subject.form==="object"&&linkTypes.has(link.subject.object.type)&&await this.resolve(link.subject.object,rewrite.relation,depth+1))return!0;return!1}case"union":{for(let member2 of rewrite.members)if(await this.evaluate(member2,object,relation,depth))return!0;return!1}case"intersection":{for(let member2 of rewrite.members)if(!await this.evaluate(member2,object,relation,depth))return!1;return!0}default:{let exhaustive=rewrite;throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`)}}}async subjectHolds(subject,restriction,depth){switch(subject.form){case"object":return subject.object.type===ACCOUNT_TYPE&&restriction.some(allowed=>allowed.form==="object"&&allowed.type===ACCOUNT_TYPE)&&this.person.aliases.has(subject.object.id);case"userset":return restriction.some(allowed=>allowed.form==="userset"&&allowed.type===subject.object.type&&allowed.relation===subject.relation)&&await this.resolve(subject.object,subject.relation,depth+1);default:{let exhaustive=subject;throw new Error(`unknown subject form: ${JSON.stringify(exhaustive)}`)}}}objectTypesOf(object,tupleset){let rewrite=this.deps.model.byType(object.type)?.relations.get(tupleset),types3=new Set,collect=node=>{if(node.node==="this")for(let subject of node.subjects)subject.form==="object"&&types3.add(subject.type);else node.node==="union"&&node.members.forEach(collect)};return rewrite!==void 0&&collect(rewrite),types3}};var ACCOUNT_ID_PREFIX="ida";function accountIdFor(idpId){if(idpId==="")throw new Error("idp_id must not be empty");return derivedId(ACCOUNT_ID_PREFIX,idpId)}var LOCAL_IDP_ID_PREFIX="local|";function localIdpIdFor(identityId){return`${LOCAL_IDP_ID_PREFIX}${identityId}`}function idpIdOf(caller){return caller.issuer===""&&caller.rawToken===""?localIdpIdFor(caller.identityId):jwtSubjectOf(caller.rawToken)}function jwtSubjectOf(rawToken){let segments=rawToken.split(".");if(segments.length!==3)return"";try{let payload=JSON.parse(Buffer.from(segments[1]??"","base64url").toString("utf8"));return typeof payload.sub=="string"?payload.sub:""}catch{return""}}var MACHINE_ACCOUNT_SUFFIX="@clients";function isMachineSubject(idpId){return idpId.endsWith(MACHINE_ACCOUNT_SUFFIX)}var PLATFORM_CLIENT_SUBJECT_PREFIX="stgm_pc|";function isPlatformClientSubject(idpId){return idpId.startsWith(PLATFORM_CLIENT_SUBJECT_PREFIX)}function reservedSubjectMessage(idpId){return`subject '${idpId}' uses the '${PLATFORM_CLIENT_SUBJECT_PREFIX}' prefix reserved for accounts a platform client provisions`}var ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE="Identity account not found for the authenticated user",NO_IDP_ID_MESSAGE="Cannot provision account: no IDP ID in authentication context",USERINFO_UNAVAILABLE_PREFIX="Failed to fetch user profile from identity provider: ";function accountNotFoundMessage(handle){return`Identity account not found: ${handle}`}var CREATE_IS_INTERNAL_MESSAGE="this RPC is internal to the platform",FEDERATION_UNIMPLEMENTED_REASON="federated identity accounts are served by the Enterprise and Cloud editions";function federationUnimplementedMessage(method){return`${method} is not implemented: ${FEDERATION_UNIMPLEMENTED_REASON}`}function idpIdImmutableMessage(existingIdpId){return`spec.idp_id is immutable (account subject is '${existingIdpId}') \u2014 create a new account for a different subject`}async function identityIdForSubject(accounts,subject){let account2=await accounts.findDirectByIdpId(subject);if(account2===void 0)return subject;let id=account2.metadata?.id??"";if(id==="")throw new Error(`identity account for subject '${subject}' carries no id \u2014 refusing to stamp an empty principal`);return id}async function accountForCaller(accounts,caller){let byId=await accounts.findById(caller.identityId);if(byId!==void 0)return byId;let subject=idpIdOf(caller);if(subject!=="")return accounts.findDirectByIdpId(subject)}async function accountForStamp(accounts,stamp2){if(stamp2!=="")return await accounts.findById(stamp2)??await accounts.findDirectByIdpId(stamp2)}function personFor(caller,account2){let accountId=account2?.metadata?.id??caller.identityId;if(!isPersonStamp(accountId))throw new Error(`caller '${accountId}' names no person \u2014 the built-in authorizer evaluates people only`);let aliases=new Set([accountId]),subject=account2?.spec?.idpId??"";return subject!==""&&aliases.add(subject),{accountId,aliases}}async function resolvePerson(accounts,caller){return personFor(caller,await accountForCaller(accounts,caller))}var NOT_FOUND_EXEMPT_KINDS=new Set([ApiResourceKind.identity_account,ApiResourceKind.iam_policy,ApiResourceKind.platform_client]),UNKNOWN_PERMISSION_DENY_REASON="authorization cannot be performed with unknown permission",EMPTY_IDENTITY_DENY_REASON="authorization cannot be performed on empty identity string",EMPTY_RESOURCE_ID_DENY_REASON="authorization cannot be performed on empty api-resource-id",UNKNOWN_KIND_DENY_REASON="authorization cannot be performed on unknown api-resource-kind",UNSERVED_KIND_DENY_REASON="authorization cannot be performed on a kind this edition does not serve";function newBuiltInAuthorizer(deps){let model=deps.model??builtInModel;return{async authorize(caller,check){if(check.permission===IamPermission.unspecified)return deny(UNKNOWN_PERMISSION_DENY_REASON);if(caller.identityId==="")return deny(EMPTY_IDENTITY_DENY_REASON);if(check.resourceId==="")return deny(EMPTY_RESOURCE_ID_DENY_REASON);if(check.resourceKind===ApiResourceKind.api_resource_kind_unknown)return deny(UNKNOWN_KIND_DENY_REASON);if(!kindServedByEdition(check.resourceKind,deps.edition))return deny(UNSERVED_KIND_DENY_REASON);let object={type:kindEnumName(check.resourceKind),id:check.resourceId},relation=IamPermission[check.permission];try{let person=await resolvePerson(deps.accounts,caller),source=newDerivedTupleSource({store:deps.store,policies:deps.policies,accounts:deps.accounts,model},person);return await source.loader.load(object)===void 0&&!NOT_FOUND_EXEMPT_KINDS.has(check.resourceKind)?(deps.logger.debug("authorization target not found",{account:person.accountId,permission:relation,object:formatObjectRef(object)}),{kind:"not-found"}):await checkRelation({model,source},object,relation,person)?{kind:"allow"}:(deps.logger.debug("authorization denied",{account:person.accountId,permission:relation,object:formatObjectRef(object)}),deny(""))}catch(error2){return{kind:"unavailable",cause:error2 instanceof Error?error2:new Error(String(error2))}}}}}function deny(reason){return{kind:"deny",reason}}var AUTHORIZATION_UNAVAILABLE_MESSAGE="authorization check could not be completed",AUTHORIZATION_DENIED_FALLBACK_MESSAGE="permission denied";function newPermissiveSingleTeamAuthorizer(){return{authorize(){return Promise.resolve({kind:"allow"})}}}function newAuthorizeStep(method,authorizer){return{name:"Authorize",execute(ctx){return authorizeDirect(method,authorizer,ctx.callerIdentity,ctx.input)}}}function resolveAnnotatedCheck(method,input,override){if(getOption(method,is_public)||getOption(method,is_skip_authorization)||!hasOption(method,config))return;let config2=getOption(method,config);return{permission:config2.permission,resourceKind:override?.resourceKind??resolveResourceKind(input,config2),resourceId:override?.resourceId??resolveResourceId(input,config2),deniedMessage:config2.errorMsg}}async function authorizeDirect(method,authorizer,identity2,input,override){if(identity2.callerClass==="internal")return;let target=resolveAnnotatedCheck(method,input,override);if(target!==void 0)return authorizeTarget(authorizer,identity2,target)}function authorizeTarget(authorizer,identity2,target){return authorizeResolvedResource(authorizer,identity2,{permission:target.permission,resourceKind:target.resourceKind,resourceId:target.resourceId},target.deniedMessage)}async function authorizeResolvedResource(authorizer,identity2,check,errorMsg){if(identity2.callerClass==="internal")return;let decision=await evaluateAuthorizer(authorizer,identity2,check);switch(decision.kind){case"allow":return;case"deny":throw new ConnectError(errorMsg!==""?errorMsg:decision.reason!==""?decision.reason:AUTHORIZATION_DENIED_FALLBACK_MESSAGE,Code.PermissionDenied);case"not-found":throw check.resourceId===""||check.resourceKind===ApiResourceKind.api_resource_kind_unknown?internalError(new Error("authorizer answered not-found for a non-resource-scoped check"),AUTHORIZATION_UNAVAILABLE_MESSAGE):notFoundError(getKindName(check.resourceKind),check.resourceId);case"unavailable":throw internalError(decision.cause,AUTHORIZATION_UNAVAILABLE_MESSAGE);default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),AUTHORIZATION_UNAVAILABLE_MESSAGE)}}}async function evaluateAuthorizer(authorizer,identity2,check){try{return await authorizer.authorize(identity2,check)}catch(error2){return{kind:"unavailable",cause:error2 instanceof Error?error2:new Error(String(error2))}}}function resolveResourceKind(input,config2){if(config2.resourceKindPath==="")return config2.resourceKind;let value=resolveDotPath(input,config2.resourceKindPath);return typeof value=="number"?value:typeof value=="string"?kindByEnumName(value):ApiResourceKind.api_resource_kind_unknown}function resolveResourceId(input,config2){if(config2.resourceId!=="")return config2.resourceId;if(config2.fieldPath==="")return"";let value=resolveDotPath(input,config2.fieldPath);return typeof value=="string"?value:""}function resolveDotPath(input,path14){let current=input;for(let segment of path14.split(".")){if(current===null||typeof current!="object")return;current=current[snakeToCamel(segment)]}return current}function snakeToCamel(segment){return segment.replace(/_([a-z0-9])/g,(_,ch)=>ch.toUpperCase())}var RUN_GATE_CHECKS={agent:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.agent},agentInstance:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.agent_instance},session:{permission:IamPermission.can_create_execution_in,resourceKind:ApiResourceKind.session},workflow:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.workflow},workflowInstance:{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.workflow_instance}},RUN_GATE_CHECK_LIST=Object.values(RUN_GATE_CHECKS);function isRunGateCheck(check){return RUN_GATE_CHECK_LIST.some(candidate=>candidate.permission===check.permission&&candidate.resourceKind===check.resourceKind)}function newAuthorizeRunTargetStep(authorizer,resolveRunTarget){return{name:"AuthorizeRunTarget",async execute(ctx){let target=resolveRunTarget(ctx.newState);target!==void 0&&await authorizeResolvedResource(authorizer,ctx.callerIdentity,{permission:target.permission,resourceKind:target.resourceKind,resourceId:target.resourceId},target.deniedMessage)}}}var ADMITTED={kind:"allow"};function newLaneAdmittedAuthorizer(inner,isAdmittedLane){return{authorize(caller,check){return isRunGateCheck(check)&&isAdmittedLane(caller)?Promise.resolve(ADMITTED):inner.authorize(caller,check)}}}var InternalCallerOfferedError=class extends Error{kind;constructor(kind){super(`the internal caller class was offered to the list scope for kind '${kindEnumName(kind)}' \u2014 the shared helper answers that class before any driver; a list lane reached the driver around it`),this.name="InternalCallerOfferedError",this.kind=kind}};async function restrictListByReadScope(scope,caller,kind,resources,requestOrg){if(scope===void 0)return[...resources];let offered=requestOrg===""?resources:resources.filter(resource=>resource.metadata?.org===requestOrg);if(caller.callerClass==="internal")return[...offered];let parentOf=authorizationParentReader(kind),entries=offered.map(resource=>{let entry={...rowAuthorizationFactsOf(kind,resource),labels:resource.metadata?.labels??{}},authorizationParent=parentOf(entry.parentLinks);return authorizationParent===void 0?entry:{...entry,authorizationParent}}),keptIds=await scope.restrictListEntries(caller,kind,entries);return offered.filter(resource=>keptIds.has(resource.metadata?.id??""))}function authorizationParentReader(kind){let parent=inheritedAuthorizationParentOf(kind);return parent===void 0?()=>{}:parentLinks=>parentLinks.find(link=>link.relation===parent.relation)}var LIST_RELATION="can_view";function newBuiltInListReadScope(deps){let model=deps.model??builtInModel;async function visibleAmong(caller,kind,candidates){if(candidates.length===0)return new Set;let started=performance.now(),person=await resolvePerson(deps.accounts,caller),source=newDerivedTupleSource({store:deps.store,policies:deps.policies,accounts:deps.accounts,model},person,{facts:candidates}),type2=kindEnumName(kind),answers=await Promise.all(candidates.map(async facts=>{let object={type:type2,id:facts.id};return await checkRelation({model,source},object,LIST_RELATION,person)?facts.id:void 0})),kept=new Set;for(let id of answers)id!==void 0&&kept.add(id);return deps.logger.debug("list scope evaluated candidates",{account:person.accountId,kind:type2,offered:candidates.length,kept:kept.size,elapsedMs:Math.round(performance.now()-started)}),kept}function requireListable(kind){let declaration=model.byKind(kind);if(declaration===void 0)throw new AuthorizationEvaluationError("undeclared-target-kind",`no declaration for kind '${kindEnumName(kind)}' \u2014 a list lane asked the scope about a kind the model does not declare`);let schema2=declaration.schema;if(schema2===void 0)throw new AuthorizationEvaluationError("undeclared-target-kind",`kind '${kindEnumName(kind)}' has no stored rows \u2014 a list lane asked the scope about a rowless kind`);return{...declaration,schema:schema2}}async function everyRowOf(declaration){let kind=declaration.kind,rows=await deps.store.listResources(kind),facts=[];for(let bytes of rows)try{facts.push(rowFactsOf(kind,fromBinary2(declaration.schema,bytes)))}catch(error2){deps.logger.warn("list scope skipped a row that does not decode",{kind:kindEnumName(kind),error:error2 instanceof Error?error2.message:String(error2)})}return facts}return{async restrictListEntries(caller,kind,entries){if(requireListable(kind),caller.callerClass==="internal")throw new InternalCallerOfferedError(kind);let unique2=new Map;for(let entry of entries)unique2.has(entry.id)||unique2.set(entry.id,rowFactsOfEntry(kind,entry));return visibleAmong(caller,kind,[...unique2.values()])},async authorizedResourceIds(caller,kind){let candidates=await everyRowOf(requireListable(kind));return caller.callerClass==="internal"?new Set(candidates.map(facts=>facts.id)):visibleAmong(caller,kind,candidates)}}}var ORGANIZATION2=kindEnumName(ApiResourceKind.organization);function newBuiltInOrganizationDirectory(deps){let model=deps.model??builtInModel;return{refusesEnumeration:!0,async listMyOrganizationIds(caller){if(caller.callerClass==="internal")return"all";let person=await resolvePerson(deps.accounts,caller),source=newDerivedTupleSource({store:deps.store,policies:deps.policies,accounts:deps.accounts,model},person),candidates=new Set;for(let tuple of await source.personTuples())tuple.object.type===ORGANIZATION2&&tuple.object.id!==""&&candidates.add(tuple.object.id);let visible=[];for(let id of candidates)await checkRelation({model,source},{type:ORGANIZATION2,id},"can_view",person)&&visible.push(id);return visible}}}function authorizationPostureOf(inputs){return inputs.unitAuthorizer?"unit-authorizer":inputs.requireAuthentication?"built-in":"trusted-local"}var ScheduleFireCallerRefusedError=class extends Error{constructor(reason){super(reason),this.name="ScheduleFireCallerRefusedError"}};function scheduleHasNoPersonMessage(scheduleId){return`schedule ${scheduleId} was created by nobody this server recognizes as a person; recreate it while signed in`}function newBuiltInScheduleFireCaller(deps){return{async mintFireCaller(_org,scheduleId){let schedule=await deps.store.getResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema),stamp2=auditOf(ScheduleSchema,schedule)?.specAudit?.createdBy?.id??"",account2=await accountForStamp(deps.accounts,stamp2);if(account2===void 0)throw new ScheduleFireCallerRefusedError(scheduleHasNoPersonMessage(scheduleId));return accountAsCaller(account2)}}}var ABSENT_LICENSE_STATUS={status:()=>Promise.resolve({state:LicenseState.absent})};var import_node_net=require("node:net");function egressPolicyForPosture(posture){return{name:posture,blockedReason:address=>blockedReason(address,posture)}}function blockedReason(address,posture){let family=(0,import_node_net.isIP)(address);if(family===4)return blockedReasonV4(address,posture);if(family===6){let groups=expandV6(address);if(!groups)return"unrecognized";let embedded=extractMappedV4(groups);return embedded?blockedReasonV4(embedded,posture):blockedReasonV6(groups,posture)}return"unrecognized"}function blockedReasonV4(address,posture){let octets=address.split(".").map(Number);if(octets.length!==4||octets.some(o3=>Number.isNaN(o3)||o3<0||o3>255))return"unrecognized";let a5=octets[0],b7=octets[1];return a5===169&&b7===254?"link-local (cloud metadata)":posture==="relaxed"?null:a5===127?"loopback":a5===0?"unspecified":a5===10||a5===172&&b7!==void 0&&b7>=16&&b7<=31||a5===192&&b7===168?"private (RFC 1918)":null}function blockedReasonV6(groups,posture){let first=groups[0]??0;return(first&65472)===65152?"link-local (cloud metadata)":posture==="relaxed"?null:groups.every(g5=>g5===0)?"unspecified":groups.slice(0,7).every(g5=>g5===0)&&groups[7]===1?"loopback":(first&65024)===64512?"private (unique local)":null}function expandV6(address){let text2=address.toLowerCase().split("%")[0]??"",tail4=/(\d+\.\d+\.\d+\.\d+)$/.exec(text2)?.[1];if(tail4!==void 0){let octets=tail4.split(".").map(Number);if(octets.length!==4||octets.some(o4=>o4>255))return null;let[o0=0,o1=0,o22=0,o3=0]=octets,hex=`${(o0<<8|o1).toString(16)}:${(o22<<8|o3).toString(16)}`;text2=text2.slice(0,-tail4.length)+hex}let halves=text2.split("::");if(halves.length>2)return null;let parseHalf=half=>half===""?[]:half.split(":").map(g5=>parseInt(g5,16)),head=parseHalf(halves[0]??""),tail=halves.length===2?parseHalf(halves[1]??""):[],fill=8-head.length-tail.length;if(halves.length===2?fill<0:head.length!==8)return null;let groups=[...head,...halves.length===2?Array(fill).fill(0):[],...tail];return groups.length!==8||groups.some(g5=>Number.isNaN(g5)||g5<0||g5>65535)?null:groups}function extractMappedV4(groups){if(!(groups.slice(0,5).every(g5=>g5===0)&&groups[5]===65535))return null;let hi=groups[6]??0,lo=groups[7]??0;return`${hi>>8}.${hi&255}.${lo>>8}.${lo&255}`}var import_node_net2=require("node:net");function describeRefusal(refusal2){switch(refusal2.kind){case"invalid-url":return`Invalid URL: ${refusal2.url}`;case"unsupported-scheme":return`Unsupported URL scheme "${refusal2.scheme}": only http and https are allowed.`;case"unresolvable":return`Could not resolve hostname: ${refusal2.hostname}`;case"blocked":return`Refusing to reach ${refusal2.hostname}: it resolves to ${refusal2.address}, a ${refusal2.reason} address the ${refusal2.policy} egress policy does not dial.`;case"too-many-redirects":return`Refusing to follow more than ${refusal2.hops} redirects from ${refusal2.url.href}.`;case"response-too-large":return`Refusing to read more than ${refusal2.maxBytes} bytes from ${refusal2.url.href}.`;default:return refusal2}}var EgressError=class extends Error{refusal;constructor(refusal2){super(describeRefusal(refusal2)),this.refusal=refusal2,this.name="EgressError"}};async function checkEgress(rawUrl,policy,options){let url;try{url=new URL(rawUrl)}catch{return{ok:!1,refusal:{kind:"invalid-url",url:String(rawUrl)}}}if(url.protocol!=="http:"&&url.protocol!=="https:")return{ok:!1,refusal:{kind:"unsupported-scheme",url,scheme:url.protocol.replace(/:$/,"")}};let addresses=await resolveAddresses(url.hostname,options);if(addresses===void 0)return{ok:!1,refusal:{kind:"unresolvable",url,hostname:url.hostname}};for(let address of addresses){let reason=policy.blockedReason(address);if(reason!==null)return{ok:!1,refusal:{kind:"blocked",url,hostname:url.hostname,address,reason,policy:policy.name}}}return{ok:!0,url,addresses}}async function resolveAddresses(hostname,options){let literal=hostname.replace(/^\[|\]$/g,"");if((0,import_node_net2.isIP)(literal)!==0)return[literal];try{let records=await raceSignal2(options.lookup(hostname),options.signal);return records.length===0?void 0:records}catch(error2){if(options.signal?.aborted===!0)throw error2;return}}function raceSignal2(promise,signal3){return signal3==null?promise:signal3.aborted?(promise.catch(()=>{}),Promise.reject(abortReason(signal3))):new Promise((resolve,reject2)=>{let onAbort=()=>{promise.catch(()=>{}),reject2(abortReason(signal3))};signal3.addEventListener("abort",onAbort,{once:!0}),promise.then(value=>{signal3.removeEventListener("abort",onAbort),resolve(value)},error2=>{signal3.removeEventListener("abort",onAbort),reject2(error2)})})}function abortReason(signal3){return signal3.reason??new DOMException("The operation was aborted.","AbortError")}var DEFAULT_MAX_REDIRECTS=3,DEFAULT_MAX_RESPONSE_BYTES=1024*1024,REDIRECT_STATUSES=new Set([301,302,303,307,308]),NULL_BODY_STATUSES=new Set([101,204,205,304]);function asFetch(outbound){return(input,init)=>typeof input=="string"||input instanceof URL?outbound(input,init):Promise.reject(new TypeError("OutboundFetch takes a URL, not a Request"))}function guardedFetch(policy,options){let maxRedirects=options.maxRedirects??DEFAULT_MAX_REDIRECTS,maxResponseBytes=options.maxResponseBytes??DEFAULT_MAX_RESPONSE_BYTES;return async(input,init)=>{let url=new URL(input),method=(init?.method??"GET").toUpperCase(),body=init?.body,headers2=new Headers(init?.headers),callerRedirect=init?.redirect??"follow";for(let hop=0;;hop+=1){let check=await checkEgress(url,policy,{lookup:options.lookup,signal:init?.signal});if(!check.ok)throw new EgressError(check.refusal);let response=await options.fetchImpl(url,{...init,method,body,headers:headers2,redirect:"manual"}),location=response.headers.get("location");if(!REDIRECT_STATUSES.has(response.status)||location===null||callerRedirect==="manual")return boundedResponse(response,url,maxResponseBytes);if(callerRedirect==="error")throw await response.body?.cancel(),new TypeError(`fetch refused to follow a redirect from ${url.href}`);if(hop>=maxRedirects)throw await response.body?.cancel(),new EgressError({kind:"too-many-redirects",url,hops:maxRedirects});await response.body?.cancel();let next=new URL(location,url);next.origin!==url.origin&&headers2.delete("authorization"),(response.status===303||(response.status===301||response.status===302)&&method!=="GET"&&method!=="HEAD")&&(method="GET",body=void 0,headers2.delete("content-type"),headers2.delete("content-length")),url=next}}}function boundedResponse(response,url,maxBytes){if(response.body===null||NULL_BODY_STATUSES.has(response.status)||!Number.isFinite(maxBytes))return response;let tooLarge=()=>new EgressError({kind:"response-too-large",url,maxBytes}),declared=Number(response.headers.get("content-length")??Number.NaN),read3=0,body=response.body.pipeThrough(new TransformStream({start(controller){Number.isFinite(declared)&&declared>maxBytes&&controller.error(tooLarge())},transform(chunk,controller){if(read3+=chunk.byteLength,read3>maxBytes){controller.error(tooLarge());return}controller.enqueue(chunk)}}));return new Response(body,{status:response.status,statusText:response.statusText,headers:response.headers})}var import_promises=require("node:dns/promises");function nodeLookup(){return async hostname=>(await(0,import_promises.lookup)(hostname,{all:!0,verbatim:!0})).map(record2=>record2.address)}function relaxedEgressPolicy(){return egressPolicyForPosture("relaxed")}var file_ai_stigmer_agentic_agent_v1_io=fileDesc("CiRhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnQvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MSIgCgdBZ2VudElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQFiBnByb3RvMw",[file_buf_validate_validate]),AgentIdSchema=messageDesc2(file_ai_stigmer_agentic_agent_v1_io,0);var file_ai_stigmer_commons_apiresource_rpc_service_options=fileDesc("CjhhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvcnBjX3NlcnZpY2Vfb3B0aW9ucy5wcm90bxIeYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlOo4BChFhcGlfcmVzb3VyY2Vfa2luZBIfLmdvb2dsZS5wcm90b2J1Zi5TZXJ2aWNlT3B0aW9ucxj0vwUgASgOMj8uYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUtpbmRSD2FwaVJlc291cmNlS2luZGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind,file_google_protobuf_descriptor]),api_resource_kind=extDesc(file_ai_stigmer_commons_apiresource_rpc_service_options,0);var file_ai_stigmer_agentic_agent_v1_command=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnQvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxMskFChZBZ2VudENvbW1hbmRDb250cm9sbGVyEk8KBWFwcGx5EiIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50GiIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50EpsBCgZjcmVhdGUSIi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuQWdlbnQaIi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuQWdlbnQiScK4GEUIBhAeIgxtZXRhZGF0YS5vcmcqMXVuYXV0aG9yaXplZCB0byBjcmVhdGUgYWdlbnQgaW4gdGhpcyBvcmdhbml6YXRpb24ShQEKBnVwZGF0ZRIiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudBoiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudCIzwrgYLwgCECgiC21ldGFkYXRhLmlkKhx1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGFnZW50Eq0BChB1cGRhdGVWaXNpYmlsaXR5EjUuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlVwZGF0ZVZpc2liaWxpdHlJbnB1dBoiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudCI+wrgYOggCECgiC3Jlc291cmNlX2lkKid1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGFnZW50IHZpc2liaWxpdHkSgQEKBmRlbGV0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudElkGiIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50Ii3CuBgpCAMQKCIFdmFsdWUqHHVuYXV0aG9yaXplZCB0byBkZWxldGUgYWdlbnQaBKD/KyhiBnByb3RvMw",[file_ai_stigmer_agentic_agent_v1_api,file_ai_stigmer_agentic_agent_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentCommandController=serviceDesc(file_ai_stigmer_agentic_agent_v1_command,0);var file_ai_stigmer_agentic_agent_v1_query=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnQvdjEvcXVlcnkucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MTKLAgoUQWdlbnRRdWVyeUNvbnRyb2xsZXISewoDZ2V0EiQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50LnYxLkFnZW50SWQaIi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnQudjEuQWdlbnQiKsK4GCYIARAoIgV2YWx1ZSoZdW5hdXRob3JpemVkIHRvIGdldCBhZ2VudBJwCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRoiLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudC52MS5BZ2VudCIE0LgYARoEoP8rKGIGcHJvdG8z",[file_ai_stigmer_agentic_agent_v1_api,file_ai_stigmer_agentic_agent_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentQueryController=serviceDesc(file_ai_stigmer_agentic_agent_v1_query,0);var apiResourceKindKey=createContextKey(ApiResourceKind.api_resource_kind_unknown,{description:"api_resource_kind service option of the target service"});function createApiResourceInterceptor(){return next=>request=>{if(!request.stream&&hasOption(request.service,api_resource_kind)){let kind=getOption(request.service,api_resource_kind);kind!==ApiResourceKind.api_resource_kind_unknown&&request.contextValues.set(apiResourceKindKey,kind)}return next(request)}}var INTERNAL_FALLBACK_MESSAGE="internal server error",Pipeline=class{pipelineName;steps;logger;constructor(pipelineName,steps,logger2){this.pipelineName=pipelineName,this.steps=steps,this.logger=logger2}get name(){return this.pipelineName}get stepCount(){return this.steps.length}async execute(ctx){for(let step of this.steps){let startedAt=performance.now();try{await step.execute(ctx)}catch(error2){throw this.logger.warn("pipeline step failed",{pipeline:this.pipelineName,step:step.name,durationMs:Math.round(performance.now()-startedAt),error:error2 instanceof Error?error2.message:String(error2)}),error2 instanceof ConnectError?error2:internalError(error2,INTERNAL_FALLBACK_MESSAGE)}this.logger.debug("pipeline step completed",{pipeline:this.pipelineName,step:step.name,durationMs:Math.round(performance.now()-startedAt)})}}},PipelineBuilder=class{name;logger;steps=[];constructor(name,logger2){this.name=name,this.logger=logger2}addStep(step){return this.steps.push(step),this}build(){return new Pipeline(this.name,this.steps,this.logger)}};function newPipeline(name,logger2){return new PipelineBuilder(name,logger2)}var LOADED_EXECUTION_KEY="loadedExecution",RequestContext=class{input;schema;callerIdentity;apiResourceKind;state;metadata=new Map;constructor(schema2,input,callerIdentity,apiResourceKind=ApiResourceKind.api_resource_kind_unknown){this.schema=schema2,this.input=input,this.state=clone(schema2,input),this.callerIdentity=callerIdentity,this.apiResourceKind=apiResourceKind}get newState(){return this.state}setNewState(state2){this.state=state2}get(key){return this.metadata.get(key)}set(key,value){this.metadata.set(key,value)}};var TARGET_RESOURCE_KEY="targetResource";function newLoadTargetStep(store,targetSchema){return{name:"LoadTarget",async execute(ctx){let resourceId=idValueOf(ctx.input);if(resourceId==="")throw invalidArgumentError("resource id is required");let target;try{target=await store.getResource(ctx.apiResourceKind,resourceId,targetSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError(getKindName(ctx.apiResourceKind),resourceId):error2}ctx.set(TARGET_RESOURCE_KEY,target)}}}var AUTHORIZE_RESOLVED_TARGET_STEP="AuthorizeResolvedTarget";function newAuthorizeResolvedTargetStep(authorizer,resolve,stepName=AUTHORIZE_RESOLVED_TARGET_STEP){return{name:stepName,async execute(ctx){for(let target of resolve(ctx))await authorizeTarget(authorizer,ctx.callerIdentity,target)}}}function loadedTargetAsMethod(get26){return ctx=>{let loaded=ctx.get(TARGET_RESOURCE_KEY),id=loaded===void 0?void 0:metadataOf(loaded)?.id;if(id===void 0)throw new Error(`${AUTHORIZE_RESOLVED_TARGET_STEP}: no loaded target with metadata under ${TARGET_RESOURCE_KEY}; the loader must run first`);let target=resolveAnnotatedCheck(get26,ctx.input,{resourceId:id});return target===void 0?[]:[target]}}function isPlatformPipelineCaller(caller){return caller.callerClass==="machine"||isServerComposedRequest(caller)}function isServerComposedRequest(caller){return caller.callerClass==="internal"||caller.origin==="in-process"}var STAMPED_KEYS_CONTEXT_KEY="serverStampedReservedLabels";function recordServerStampedReservedLabels(ctx,...keys){let existing=ctx.get(STAMPED_KEYS_CONTEXT_KEY),stamped=existing instanceof Set?existing:new Set;for(let key of keys)stamped.add(key);ctx.set(STAMPED_KEYS_CONTEXT_KEY,stamped)}function serverStampedReservedLabels(ctx){let stamped=ctx.get(STAMPED_KEYS_CONTEXT_KEY);return stamped instanceof Set?stamped:new Set}var RESERVED_LABEL_PREFIX="stigmer.ai/",CLIENT_CONTRACT_ALLOWLIST=new Map([[ApiResourceKind.environment,new Set(["stigmer.ai/personal"])]]);function reservedLabelMutations(stored,requested){let mutations=[];for(let[key,value]of Object.entries(requested))key.startsWith(RESERVED_LABEL_PREFIX)&&stored[key]!==value&&mutations.push(key);return mutations.sort()}function newGuardReservedLabelsStep(authorizer,positions={}){let stateOf=positions.stateOf??(ctx=>ctx.newState),existingKey=positions.existingKey??EXISTING_RESOURCE_KEY;return{name:"GuardReservedLabels",async execute(ctx){if(isServerComposedRequest(ctx.callerIdentity))return;let state2=stateOf(ctx),requested=state2===void 0?{}:metadataOf(state2)?.labels??{},existing=ctx.get(existingKey),stored=existing===void 0?{}:metadataOf(existing)?.labels??{},allowlist=CLIENT_CONTRACT_ALLOWLIST.get(ctx.apiResourceKind)??new Set,stamped=serverStampedReservedLabels(ctx),mutations=reservedLabelMutations(stored,requested).filter(key=>!allowlist.has(key)&&!stamped.has(key));if(mutations.length===0)return;let decision;try{decision=await authorizer.authorize(ctx.callerIdentity,{permission:IamPermission.can_write_reserved_labels,resourceKind:ApiResourceKind.platform,resourceId:"stigmer"})}catch(error2){throw reservedLabelCheckFailure(error2)}switch(decision.kind){case"allow":return;case"deny":case"not-found":throw new ConnectError(`Labels in the reserved '${RESERVED_LABEL_PREFIX}' namespace are platform-managed and cannot be set or changed by this request: ${mutations.join(", ")}. Stored reserved labels may be echoed back unchanged or removed.`,Code.InvalidArgument);case"unavailable":throw reservedLabelCheckFailure(decision.cause);default:{let exhaustive=decision;throw reservedLabelCheckFailure(new Error(`unknown decision ${JSON.stringify(exhaustive)}`))}}}}}function reservedLabelCheckFailure(error2){return internalError(error2 instanceof Error?error2:new Error(String(error2)),"reserved-label validation could not be completed")}function newBuildUpdateStateStep(){return{name:"BuildUpdateState",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not found in context - LoadExisting must run first"),"build update state");let merged=clone(ctx.schema,ctx.input);preserveImmutableFields(merged,existing),hasStatusField(ctx.schema)&&(clearStatusField(ctx.schema,merged),copyStatusFromExisting(ctx.schema,merged,existing),updateAuditFields(ctx.schema,merged,existing,ctx.callerIdentity)),ctx.setNewState(merged)}}}function preserveImmutableFields(merged,existing){let mergedMeta=metadataOf(merged),existingMeta=metadataOf(existing);if(mergedMeta===void 0||existingMeta===void 0)throw internalError(new Error("metadata is nil"),"preserve immutable fields");mergedMeta.id=existingMeta.id,mergedMeta.slug=existingMeta.slug,mergedMeta.org=existingMeta.org,mergedMeta.visibility=existingMeta.visibility}function copyStatusFromExisting(schema2,merged,existing){let existingRoot=reflect2(schema2,existing),statusField=messageFieldByName(existingRoot,"status");if(statusField===void 0||!existingRoot.isSet(statusField))return;let statusCopy=reflect2(statusField.message,clone(statusField.message,existingRoot.get(statusField).message));reflect2(schema2,merged).set(statusField,statusCopy)}function updateAuditFields(schema2,resource,existing,identity2){let now=timestampNow(),actor=auditActorFor(identity2),{createdBy,createdAt}=creationAuditOf(schema2,existing,"spec_audit");setAuditReflect(schema2,resource,create2(ApiResourceAuditSchema,{specAudit:updatedAuditInfo(createdBy,createdAt,actor,now),statusAudit:create2(ApiResourceAuditInfoSchema,{createdBy:actor,createdAt:now,updatedBy:actor,updatedAt:now,event:"updated"})}))}function newCheckDuplicateStep(store){return{name:"CheckDuplicate",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"duplicate check");if(metadata.slug==="")throw internalError(new Error("resource slug is empty"),"duplicate check");let existing;try{existing=await findResourceBySlug(store,ctx.apiResourceKind,ctx.schema,metadata.slug,metadata.org)}catch(error2){throw internalError(error2,"failed to check for duplicates")}if(existing!==void 0){let existingMetadata=metadataOf(existing);throw alreadyExistsError(getKindName(ctx.apiResourceKind),`slug '${metadata.slug}' in org '${existingMetadata?.org??""}' (id: ${existingMetadata?.id??""})`)}}}}var RESOURCE_ID_KEY="resourceId";function newExtractResourceIdStep(){return{name:"ExtractResourceId",execute(ctx){let id=idValueOf(ctx.input);if(id==="")throw invalidArgumentError("resource id is required");ctx.set(RESOURCE_ID_KEY,id)}}}function newLoadExistingForDeleteStep(store,resourceSchema){return{name:"LoadExistingForDelete",async execute(ctx){let id=requireResourceId(ctx),resource;try{resource=await store.getResource(ctx.apiResourceKind,id,resourceSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError(getKindName(ctx.apiResourceKind),id):error2}ctx.set(EXISTING_RESOURCE_KEY,resource)}}}function newDeleteResourceStep(store){return{name:"DeleteResource",async execute(ctx){let id=requireResourceId(ctx);try{await store.deleteResource(ctx.apiResourceKind,id)}catch(error2){throw internalError(error2,`failed to delete ${getKindName(ctx.apiResourceKind)}`)}}}}function requireResourceId(ctx){let id=ctx.get(RESOURCE_ID_KEY);if(typeof id!="string"||id==="")throw internalError(new Error("resource id not found in context (ExtractResourceId must run first)"),"delete pipeline ordering");return id}function apiResourceKindName(kind){return enumToJson(ApiResourceKindSchema,kind)}function extractFieldValue(schema2,msg,fieldPath){let parts=fieldPath.split("."),current=reflect2(schema2,msg);for(let i6=0;i6<parts.length;i6++){let part=parts[i6],field3=findFieldByProtoName(current,part);if(field3===void 0)return"";if(i6===parts.length-1)return scalarString(current,field3);if(field3.fieldKind!=="message")return"";current=current.get(field3)}return""}function extractLabelValue(schema2,msg,labelKey){let root5=reflect2(schema2,msg),metadataField=root5.fields.find(f5=>f5.name==="metadata");if(metadataField===void 0||metadataField.fieldKind!=="message")return"";let metadata=root5.get(metadataField),labelsField=metadata.fields.find(f5=>f5.name==="labels");if(labelsField===void 0||labelsField.fieldKind!=="map")return"";let value=metadata.get(labelsField).get(labelKey);return typeof value=="string"?value:""}function scanForFieldMatch(rows,schema2,fieldPath,value){for(let data of rows){let msg;try{msg=fromBinary2(schema2,data)}catch{continue}if(extractFieldValue(schema2,msg,fieldPath)===value)return msg}}function filterRowsByLabel(rows,schema2,labelKey,labelValue){let results=[];for(let data of rows){let msg;try{msg=fromBinary2(schema2,data)}catch{continue}extractLabelValue(schema2,msg,labelKey)===labelValue&&results.push(data)}return results}function findFieldByProtoName(message6,part){return message6.fields.find(f5=>f5.name===part)??message6.fields.find(f5=>f5.name===toSnakeCase(part))}function scalarString(message6,field3){if(field3.fieldKind==="list"||field3.fieldKind==="map"||field3.fieldKind==="message")return"";let value=message6.get(field3);return typeof value=="string"?value:typeof value=="number"||typeof value=="bigint"?String(value):typeof value=="boolean"?value?"true":"false":value instanceof Uint8Array?Buffer.from(value).toString("latin1"):""}function toSnakeCase(value){let result="";for(let i6=0;i6<value.length;i6++){let ch=value[i6];i6>0&&ch>="A"&&ch<="Z"&&(result+="_"),result+=ch}return result.toLowerCase()}function newIndexSearchStep(store,extractor,logger2){return{name:"IndexSearch",async execute(ctx){let resource=ctx.newState,metadata=metadataOf(resource);if(metadata===void 0||metadata.id===""){logger2.warn("IndexSearch: resource has no metadata or ID, skipping indexing");return}let entry=extractor.getSearchIndexEntry(resource);if(entry===void 0){logger2.warn("IndexSearch: extractor returned no entry, skipping indexing",{id:metadata.id});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,metadata.id,entry)}catch(error2){logger2.warn("IndexSearch: failed to update search index (best-effort)",{id:metadata.id,kind:apiResourceKindName(ctx.apiResourceKind),error:error2 instanceof Error?error2.message:String(error2)})}}}}function newDeleteSearchIndexStep(store,logger2){return{name:"DeleteSearchIndex",async execute(ctx){let id=ctx.get(RESOURCE_ID_KEY);if(typeof id!="string"||id==="")throw internalError(new Error("resource id not found in context (ExtractResourceId must run first)"),"delete search index ordering");try{await store.deleteSearchIndex(ctx.apiResourceKind,id)}catch(error2){logger2.warn("DeleteSearchIndex: failed to remove search index entry (best-effort)",{id,kind:apiResourceKindName(ctx.apiResourceKind),error:error2 instanceof Error?error2.message:String(error2)})}}}}var RESERVED_LABEL_PREFIX2="stigmer.ai/",DEFAULT_INSTANCE_LABEL=`${RESERVED_LABEL_PREFIX2}default-instance`,SYSTEM_MANAGED_LABEL=`${RESERVED_LABEL_PREFIX2}system-managed`,SYSTEM_LABEL=`${RESERVED_LABEL_PREFIX2}system`,RESERVED_LABEL_TRUE="true",PLUGIN_LABEL=`${RESERVED_LABEL_PREFIX2}plugin`,PLUGIN_VERSION_LABEL=`${RESERVED_LABEL_PREFIX2}plugin-version`,MCP_AUTH_LABEL=`${RESERVED_LABEL_PREFIX2}mcp-auth`,MCP_AUTH_ENDPOINT="endpoint";function pluginIdOf(metadata){let value=metadata?.labels[PLUGIN_LABEL];return value===void 0||value===""?void 0:value}function isDefaultInstance(metadata){return metadata?.labels[DEFAULT_INSTANCE_LABEL]===RESERVED_LABEL_TRUE}function isSystemContent(metadata){return metadata?.labels[SYSTEM_LABEL]===RESERVED_LABEL_TRUE}var MANAGED_KIND_NOUNS=new Map([[ApiResourceKind.skill,"skill"],[ApiResourceKind.mcp_server,"MCP server"],[ApiResourceKind.agent,"agent"],[ApiResourceKind.workflow,"workflow"]]);function pluginManagedRefusal(kind,slug,pluginSlug){return`${MANAGED_KIND_NOUNS.get(kind)??ApiResourceKind[kind]??String(kind)} '${slug}' is managed by plugin '${pluginSlug}'; change the plugin and push it again, or compose your own agent over it`}function newGuardPluginManagedStep(store,positions={}){let existingKey=positions.existingKey??EXISTING_RESOURCE_KEY;return{name:"GuardPluginManaged",async execute(ctx){if(ctx.callerIdentity.callerClass==="internal"||ctx.callerIdentity.origin==="in-process")return;let existing=ctx.get(existingKey);if(existing===void 0)return;let metadata=metadataOf(existing),pluginId=pluginIdOf(metadata);if(pluginId===void 0)return;let pluginSlug;try{pluginSlug=(await store.getResource(ApiResourceKind.plugin,pluginId,PluginSchema)).metadata?.slug??pluginId}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw internalError(error2,"plugin ownership could not be checked")}throw new ConnectError(pluginManagedRefusal(ctx.apiResourceKind,metadata?.slug??"",pluginSlug),Code.FailedPrecondition)}}}var EXISTS_IN_DATABASE_KEY="existsInDatabase",SHOULD_CREATE_KEY="shouldCreate";function newLoadForApplyStep(store){return{name:"LoadForApply",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0||metadata.slug===""){ctx.set(EXISTS_IN_DATABASE_KEY,!1),ctx.set(SHOULD_CREATE_KEY,!0);return}let existing=await findResourceBySlug(store,ctx.apiResourceKind,ctx.schema,metadata.slug,metadata.org);if(existing===void 0){ctx.set(EXISTS_IN_DATABASE_KEY,!1),ctx.set(SHOULD_CREATE_KEY,!0);return}ctx.set(EXISTING_RESOURCE_KEY,existing),ctx.set(EXISTS_IN_DATABASE_KEY,!0),ctx.set(SHOULD_CREATE_KEY,!1),metadata.id===""&&(metadata.id=metadataOf(existing)?.id??"")}}}function withResolvedApplyId(schema2,original,resolved){let enriched=clone(schema2,original),metadata=metadataOf(enriched),resolvedId=metadataOf(resolved.newState)?.id??"";return metadata!==void 0&&metadata.id===""&&resolvedId!==""&&(metadata.id=resolvedId),enriched}function newLoadByReferenceStep(store,targetSchema){return{name:"LoadByReference",async execute(ctx){let ref=ctx.input;if(ref.slug==="")throw invalidArgumentError("slug is required in reference");let kind=ctx.apiResourceKind;if(ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==kind)throw invalidArgumentError(`kind mismatch: expected ${apiResourceKindName(kind)}, got ${apiResourceKindName(ref.kind)}`);requireOrgForReference(kind,ref.org);let target=await findResourceBySlug(store,kind,targetSchema,ref.slug,ref.org);if(target===void 0)throw notFoundError(getKindName(kind),ref.slug);ctx.set(TARGET_RESOURCE_KEY,target)}}}var API_RESOURCE_REFERENCE_TYPE="ai.stigmer.commons.apiresource.ApiResourceReference",REFERENCE_TARGET_KINDS=[{kind:ApiResourceKind.skill,schema:SkillSchema,readByRun:!0,label:"skill(s)",listHint:"stigmer list skills"},{kind:ApiResourceKind.mcp_server,schema:McpServerSchema,readByRun:!0,label:"MCP server(s)",listHint:"stigmer get mcp-servers"},{kind:ApiResourceKind.agent,schema:AgentSchema,readByRun:!0,label:"agent(s)",listHint:"stigmer list agents"},{kind:ApiResourceKind.environment,schema:EnvironmentSchema,readByRun:!1,label:"environment(s)",listHint:"stigmer list environments"},{kind:ApiResourceKind.channel_app,schema:ChannelAppSchema,readByRun:!1,label:"channel app(s)",listHint:"stigmer list channel-app"},{kind:ApiResourceKind.oauth_app,schema:OAuthAppSchema,readByRun:!1,label:"OAuth app(s)",listHint:void 0}];function referenceTargetKind(kind){return REFERENCE_TARGET_KINDS.find(entry=>entry.kind===kind)}async function loadReferenceTargets(store,refs){let byKind=new Map;for(let kind of new Set(refs.map(ref=>ref.kind))){let entry=referenceTargetKind(kind);if(entry===void 0)throw internalError(new Error(`kind ${ApiResourceKind[kind]??kind} is not a reference target`),"reference rule table has no entry for the referenced kind");let index2=new Map;for(let data of await store.listResources(kind)){let metadata;try{metadata=metadataOf(fromBinary2(entry.schema,data))}catch{continue}metadata===void 0||metadata.slug===""||index2.set(targetKey(metadata.org,metadata.slug),metadata.visibility)}byKind.set(kind,index2)}return{visibilityOf(ref){return byKind.get(ref.kind)?.get(targetKey(ref.org,ref.slug))}}}function targetKey(org,slug){return`${org}/${slug}`}function checkReference(targets,parent,ref){if(ref.org==="")return{kind:"no-org"};let target=targets.visibilityOf(ref);return ref.org!==parent.org?target===ApiResourceVisibility.visibility_platform?{kind:"ok"}:{kind:"not-available"}:target===void 0?{kind:"missing"}:referenceTargetKind(ref.kind)?.readByRun===!0&&visibilityRank(target)<visibilityRank(floorOf(parent,ref))?{kind:"below-floor",targetVisibility:target}:{kind:"ok"}}function floorOf(parent,ref){return ref.resolvesIn==="running-organization"&&visibilityRank(parent.visibility)>visibilityRank(ApiResourceVisibility.visibility_org)?ApiResourceVisibility.visibility_org:parent.visibility}function visibilityRank(level){switch(level){case ApiResourceVisibility.api_resource_visibility_unspecified:case ApiResourceVisibility.visibility_private:return 0;case ApiResourceVisibility.visibility_org:return 1;case ApiResourceVisibility.visibility_platform:return 2;case ApiResourceVisibility.visibility_public:throw new Error("the retired public level has no rank");default:{let exhaustive=level;throw new Error(`unknown visibility level: ${String(exhaustive)}`)}}}function noOrgReferenceMessage(entry,slug){return`referenced ${entry.label} '${slug}' names no organization; a reference is 'org/slug', or 'slug' for a resource of this organization.`}function missingReferencesMessage(entry,handles){let list12=handles.map(h5=>`'${h5.slug}' (org: ${h5.org})`).join(", "),hint=entry.listHint===void 0?"":` Use '${entry.listHint}' to list available ${plural(entry)}.`;return`referenced ${entry.label} not found: ${list12}. Verify the slug and org are correct.${hint}`}function belowFloorMessage(entry,ref,targetVisibility,parentVisibility){return`referenced ${singular(entry)} '${ref.org}/${ref.slug}' is ${levelWord(targetVisibility)} while this resource is ${levelWord(parentVisibility)}; a resource may not be more visible than the ${plural(entry)} it runs with. Widen the referenced resource's visibility or narrow this one.`}function levelWord(level){return level===ApiResourceVisibility.api_resource_visibility_unspecified?ApiResourceVisibility[ApiResourceVisibility.visibility_private]:ApiResourceVisibility[level]}function notAvailableReferenceMessage(entry,ref){return`referenced ${singular(entry)} '${ref.org}/${ref.slug}' is not available to this organization; another organization's resource can be referenced only when that organization shares it at platform visibility.`}function singular(entry){return entry.label.replace("(s)","")}function plural(entry){return entry.label.replace("(s)","s")}function referenceRefusal(parent,verdicts){let missingByKind=new Map;for(let{ref,verdict}of verdicts)if(verdict.kind==="missing"){let held=missingByKind.get(ref.kind);held===void 0?missingByKind.set(ref.kind,[ref]):held.push(ref)}let sentences=[],groupedKindsSaid=new Set,malformed=!1;for(let{ref,verdict}of verdicts){let entry=referenceTargetKind(ref.kind);if(entry!==void 0)switch(verdict.kind){case"ok":break;case"no-org":malformed=!0,sentences.push(noOrgReferenceMessage(entry,ref.slug));break;case"missing":groupedKindsSaid.has(ref.kind)||(groupedKindsSaid.add(ref.kind),sentences.push(missingReferencesMessage(entry,missingByKind.get(ref.kind)??[])));break;case"below-floor":sentences.push(belowFloorMessage(entry,ref,verdict.targetVisibility,parent.visibility));break;case"not-available":sentences.push(notAvailableReferenceMessage(entry,ref));break;default:{let exhaustive=verdict;throw new Error(`unknown verdict: ${JSON.stringify(exhaustive)}`)}}}if(sentences.length===0)return;let text2=sentences.join(" ");return malformed?invalidArgumentError(text2):failedPreconditionError(text2)}function newNormalizeReferencesStep(){return{name:"NormalizeReferences",execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"normalize references");metadata.org!==""&&forEachSpecReference(ctx.schema,ctx.newState,ref=>{let orgField=ref.fields.find(f5=>f5.name==="org");orgField!==void 0&&ref.get(orgField)===""&&ref.set(orgField,metadata.org)})}}}function newValidateReferencesStep(store){return{name:"ValidateReferences",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"validate references");let refs=collectSpecReferences(ctx.schema,ctx.newState).filter(ref=>ref.slug!=="");if(refs.length===0)return;let parent={org:metadata.org,visibility:metadata.visibility},refusal2=await checkReferences(store,parent,refs);if(refusal2!==void 0)throw refusal2}}}async function checkReferences(store,parent,refs){let targets=await loadReferenceTargets(store,refs);return referenceRefusal(parent,refs.map(ref=>({ref,verdict:checkReference(targets,parent,ref)})))}function newGuardReferenceFloorOnEscalationStep(store,targetKey2,collectors){return{name:"GuardReferenceFloorOnEscalation",async execute(ctx){let row=ctx.get(targetKey2);if(row===void 0)throw internalError(new Error("GuardReferenceFloorOnEscalation ran without a loaded target \u2014 the step must follow the load step"),"reference floor requires the loaded resource");let metadata=metadataOf(row);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"reference floor requires the loaded resource");let requested=ctx.input.visibility;if(visibilityRank(requested)<=visibilityRank(metadata.visibility))return;let refs=collectors.flatMap(collect=>collect(row)).filter(ref=>ref.slug!=="");if(refs.length===0)return;let parent={org:metadata.org,visibility:requested},targets=await loadReferenceTargets(store,refs),refusal2=referenceRefusal(parent,refs.map(ref=>({ref,verdict:checkReference(targets,parent,ref)})).filter(({verdict})=>verdict.kind==="below-floor"));if(refusal2!==void 0)throw refusal2}}}function collectSpecReferences(schema2,msg){let refs=[];return forEachSpecReference(schema2,msg,(ref,field3)=>{refs.push({kind:declaredKind(field3,ref),slug:stringField(ref,"slug"),org:stringField(ref,"org")})}),refs}function declaredKind(field3,ref){return hasOption(field3,reference_kind)?getOption(field3,reference_kind):numberField(ref,"kind")}function forEachSpecReference(schema2,msg,fn){let root5=reflect2(schema2,msg),specField=messageFieldByName(root5,"spec");specField===void 0||!root5.isSet(specField)||walk2(root5.get(specField),fn)}function walk2(msg,fn){for(let field3 of msg.fields)if(field3.fieldKind==="list"){if(field3.listKind!=="message")continue;for(let item of msg.get(field3))visit(item,field3,fn)}else if(field3.fieldKind==="map"){if(field3.mapKind!=="message")continue;let map5=msg.get(field3);for(let[,value]of map5)visit(value,field3,fn)}else if(field3.fieldKind==="message"){if(!msg.isSet(field3))continue;visit(msg.get(field3),field3,fn)}}function visit(sub,field3,fn){sub.desc.typeName===API_RESOURCE_REFERENCE_TYPE?fn(sub,field3):walk2(sub,fn)}function stringField(msg,name){let field3=msg.fields.find(f5=>f5.name===name);if(field3===void 0)return"";let value=msg.get(field3);return typeof value=="string"?value:""}function numberField(msg,name){let field3=msg.fields.find(f5=>f5.name===name);if(field3===void 0)return 0;let value=msg.get(field3);return typeof value=="number"?value:0}function newPersistStep(store){return{name:"Persist",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"persist");if(metadata.id==="")throw internalError(new Error("resource ID is empty, cannot persist"),"persist");try{await store.saveResource(ctx.apiResourceKind,metadata.id,ctx.schema,ctx.newState)}catch(error2){throw internalError(error2,"failed to save resource to store")}}}}function newResolveSlugStep(){return{name:"ResolveSlug",execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("resource metadata is nil"),"slug resolution");if(metadata.slug===""){if(metadata.name==="")throw invalidArgumentError("resource name is required");metadata.slug=generateSlug(metadata.name)}}}}function generateSlug(name){let slug=name.toLowerCase();return slug=slug.replaceAll(" ","-").replaceAll(".","-"),slug=slug.replace(/[^a-z0-9\- ]/g,""),slug=slug.replace(/-{2,}/g,"-"),slug.replace(/^-+|-+$/g,"")}var file_buf_validate_validate2=fileDesc2("ChtidWYvdmFsaWRhdGUvdmFsaWRhdGUucHJvdG8SDGJ1Zi52YWxpZGF0ZSI3CgRSdWxlEgoKAmlkGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEgoKZXhwcmVzc2lvbhgDIAEoCSKGAQoMTWVzc2FnZVJ1bGVzEhYKDmNlbF9leHByZXNzaW9uGAUgAygJEh8KA2NlbBgDIAMoCzISLmJ1Zi52YWxpZGF0ZS5SdWxlEi0KBW9uZW9mGAQgAygLMh4uYnVmLnZhbGlkYXRlLk1lc3NhZ2VPbmVvZlJ1bGVKBAgBEAJSCGRpc2FibGVkIjQKEE1lc3NhZ2VPbmVvZlJ1bGUSDgoGZmllbGRzGAEgAygJEhAKCHJlcXVpcmVkGAIgASgIIh4KCk9uZW9mUnVsZXMSEAoIcmVxdWlyZWQYASABKAgiiwkKCkZpZWxkUnVsZXMSFgoOY2VsX2V4cHJlc3Npb24YHSADKAkSHwoDY2VsGBcgAygLMhIuYnVmLnZhbGlkYXRlLlJ1bGUSEAoIcmVxdWlyZWQYGSABKAgSJAoGaWdub3JlGBsgASgOMhQuYnVmLnZhbGlkYXRlLklnbm9yZRIpCgVmbG9hdBgBIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GbG9hdFJ1bGVzSAASKwoGZG91YmxlGAIgASgLMhkuYnVmLnZhbGlkYXRlLkRvdWJsZVJ1bGVzSAASKQoFaW50MzIYAyABKAsyGC5idWYudmFsaWRhdGUuSW50MzJSdWxlc0gAEikKBWludDY0GAQgASgLMhguYnVmLnZhbGlkYXRlLkludDY0UnVsZXNIABIrCgZ1aW50MzIYBSABKAsyGS5idWYudmFsaWRhdGUuVUludDMyUnVsZXNIABIrCgZ1aW50NjQYBiABKAsyGS5idWYudmFsaWRhdGUuVUludDY0UnVsZXNIABIrCgZzaW50MzIYByABKAsyGS5idWYudmFsaWRhdGUuU0ludDMyUnVsZXNIABIrCgZzaW50NjQYCCABKAsyGS5idWYudmFsaWRhdGUuU0ludDY0UnVsZXNIABItCgdmaXhlZDMyGAkgASgLMhouYnVmLnZhbGlkYXRlLkZpeGVkMzJSdWxlc0gAEi0KB2ZpeGVkNjQYCiABKAsyGi5idWYudmFsaWRhdGUuRml4ZWQ2NFJ1bGVzSAASLwoIc2ZpeGVkMzIYCyABKAsyGy5idWYudmFsaWRhdGUuU0ZpeGVkMzJSdWxlc0gAEi8KCHNmaXhlZDY0GAwgASgLMhsuYnVmLnZhbGlkYXRlLlNGaXhlZDY0UnVsZXNIABInCgRib29sGA0gASgLMhcuYnVmLnZhbGlkYXRlLkJvb2xSdWxlc0gAEisKBnN0cmluZxgOIAEoCzIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlc0gAEikKBWJ5dGVzGA8gASgLMhguYnVmLnZhbGlkYXRlLkJ5dGVzUnVsZXNIABInCgRlbnVtGBAgASgLMhcuYnVmLnZhbGlkYXRlLkVudW1SdWxlc0gAEi8KCHJlcGVhdGVkGBIgASgLMhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXNIABIlCgNtYXAYEyABKAsyFi5idWYudmFsaWRhdGUuTWFwUnVsZXNIABIlCgNhbnkYFCABKAsyFi5idWYudmFsaWRhdGUuQW55UnVsZXNIABIvCghkdXJhdGlvbhgVIAEoCzIbLmJ1Zi52YWxpZGF0ZS5EdXJhdGlvblJ1bGVzSAASMgoKZmllbGRfbWFzaxgcIAEoCzIcLmJ1Zi52YWxpZGF0ZS5GaWVsZE1hc2tSdWxlc0gAEjEKCXRpbWVzdGFtcBgWIAEoCzIcLmJ1Zi52YWxpZGF0ZS5UaW1lc3RhbXBSdWxlc0gAQgYKBHR5cGVKBAgYEBlKBAgaEBtSB3NraXBwZWRSDGlnbm9yZV9lbXB0eSJVCg9QcmVkZWZpbmVkUnVsZXMSHwoDY2VsGAEgAygLMhIuYnVmLnZhbGlkYXRlLlJ1bGVKBAgYEBlKBAgaEBtSB3NraXBwZWRSDGlnbm9yZV9lbXB0eSL4FgoKRmxvYXRSdWxlcxJ9CgVjb25zdBgBIAEoAkJuwkhrCmkKC2Zsb2F0LmNvbnN0Glp0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICdtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSmQEKAmx0GAIgASgCQooBwkiGAQqDAQoIZmxvYXQubHQadyFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPj0gcnVsZXMubHQpPyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASqQEKA2x0ZRgDIAEoAkKZAcJIlQEKkgEKCWZsb2F0Lmx0ZRqEASFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUpPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEtAHCgJndBgEIAEoAkLBB8JIvQcKhgEKCGZsb2F0Lmd0GnohaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwq9AQoLZmxvYXQuZ3RfbHQarQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrHAQoVZmxvYXQuZ3RfbHRfZXhjbHVzaXZlGq0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKzQEKDGZsb2F0Lmd0X2x0ZRq8AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCtcBChZmbG9hdC5ndF9sdGVfZXhjbHVzaXZlGrwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARKcCAoDZ3RlGAUgASgCQowIwkiICAqVAQoJZmxvYXQuZ3RlGocBIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCswBCgxmbG9hdC5ndGVfbHQauwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCtYBChZmbG9hdC5ndGVfbHRfZXhjbHVzaXZlGrsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrcAQoNZmxvYXQuZ3RlX2x0ZRrKAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK5gEKF2Zsb2F0Lmd0ZV9sdGVfZXhjbHVzaXZlGsoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEnkKAmluGAYgAygCQm3CSGoKaAoIZmxvYXQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnAKBm5vdF9pbhgHIAMoAkJgwkhdClsKDGZsb2F0Lm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEm8KBmZpbml0ZRgIIAEoCEJfwkhcCloKDGZsb2F0LmZpbml0ZRpKcnVsZXMuZmluaXRlID8gKHRoaXMuaXNOYW4oKSB8fCB0aGlzLmlzSW5mKCkgPyAnbXVzdCBiZSBmaW5pdGUnIDogJycpIDogJycSKwoHZXhhbXBsZRgJIAMoAkIawkgXChUKDWZsb2F0LmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIooXCgtEb3VibGVSdWxlcxJ+CgVjb25zdBgBIAEoAUJvwkhsCmoKDGRvdWJsZS5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEpoBCgJsdBgCIAEoAUKLAcJIhwEKhAEKCWRvdWJsZS5sdBp3IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+PSBydWxlcy5sdCk/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKqAQoDbHRlGAMgASgBQpoBwkiWAQqTAQoKZG91YmxlLmx0ZRqEASFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUpPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEtUHCgJndBgEIAEoAULGB8JIwgcKhwEKCWRvdWJsZS5ndBp6IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKvgEKDGRvdWJsZS5ndF9sdBqtAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCsgBChZkb3VibGUuZ3RfbHRfZXhjbHVzaXZlGq0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKzgEKDWRvdWJsZS5ndF9sdGUavAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrYAQoXZG91YmxlLmd0X2x0ZV9leGNsdXNpdmUavAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEqEICgNndGUYBSABKAFCkQjCSI0ICpYBCgpkb3VibGUuZ3RlGocBIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCs0BCg1kb3VibGUuZ3RlX2x0GrsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrXAQoXZG91YmxlLmd0ZV9sdF9leGNsdXNpdmUauwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSkpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCt0BCg5kb3VibGUuZ3RlX2x0ZRrKAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK5wEKGGRvdWJsZS5ndGVfbHRlX2V4Y2x1c2l2ZRrKAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ6CgJpbhgGIAMoAUJuwkhrCmkKCWRvdWJsZS5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAcgAygBQmHCSF4KXAoNZG91YmxlLm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEnAKBmZpbml0ZRgIIAEoCEJgwkhdClsKDWRvdWJsZS5maW5pdGUaSnJ1bGVzLmZpbml0ZSA/ICh0aGlzLmlzTmFuKCkgfHwgdGhpcy5pc0luZigpID8gJ211c3QgYmUgZmluaXRlJyA6ICcnKSA6ICcnEiwKB2V4YW1wbGUYCSADKAFCG8JIGAoWCg5kb3VibGUuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4isBQKCkludDMyUnVsZXMSfQoFY29uc3QYASABKAVCbsJIawppCgtpbnQzMi5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEoQBCgJsdBgCIAEoBUJ2wkhzCnEKCGludDMyLmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpUBCgNsdGUYAyABKAVChQHCSIEBCn8KCWludDMyLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAAS+QYKAmd0GAQgASgFQuoGwkjmBgp0CghpbnQzMi5ndBpoIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKrQEKC2ludDMyLmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq1AQoVaW50MzIuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvQEKDGludDMyLmd0X2x0ZRqsAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKxQEKFmludDMyLmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEsUHCgNndGUYBSABKAVCtQfCSLEHCoIBCglpbnQzMi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq8AQoMaW50MzIuZ3RlX2x0GqsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCsQBChZpbnQzMi5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrMAQoNaW50MzIuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrUAQoXaW50MzIuZ3RlX2x0ZV9leGNsdXNpdmUauAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESeQoCaW4YBiADKAVCbcJIagpoCghpbnQzMi5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScAoGbm90X2luGAcgAygFQmDCSF0KWwoMaW50MzIubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSKwoHZXhhbXBsZRgIIAMoBUIawkgXChUKDWludDMyLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIrAUCgpJbnQ2NFJ1bGVzEn0KBWNvbnN0GAEgASgDQm7CSGsKaQoLaW50NjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKEAQoCbHQYAiABKANCdsJIcwpxCghpbnQ2NC5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKVAQoDbHRlGAMgASgDQoUBwkiBAQp/CglpbnQ2NC5sdGUaciFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEvkGCgJndBgEIAEoA0LqBsJI5gYKdAoIaW50NjQuZ3QaaCFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCq0BCgtpbnQ2NC5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtQEKFWludDY0Lmd0X2x0X2V4Y2x1c2l2ZRqbAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr0BCgxpbnQ2NC5ndF9sdGUarAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCsUBChZpbnQ2NC5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLFBwoDZ3RlGAUgASgDQrUHwkixBwqCAQoJaW50NjQuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKvAEKDGludDY0Lmd0ZV9sdBqrAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrEAQoWaW50NjQuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzAEKDWludDY0Lmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK1AEKF2ludDY0Lmd0ZV9sdGVfZXhjbHVzaXZlGrgBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEnkKAmluGAYgAygDQm3CSGoKaAoIaW50NjQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnAKBm5vdF9pbhgHIAMoA0JgwkhdClsKDGludDY0Lm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEisKB2V4YW1wbGUYCSADKANCGsJIFwoVCg1pbnQ2NC5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiLCFAoLVUludDMyUnVsZXMSfgoFY29uc3QYASABKA1Cb8JIbApqCgx1aW50MzIuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKFAQoCbHQYAiABKA1Cd8JIdApyCgl1aW50MzIubHQaZSFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASlwEKA2x0ZRgDIAEoDUKHAcJIgwEKgAEKCnVpbnQzMi5sdGUaciFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEv4GCgJndBgEIAEoDULvBsJI6wYKdQoJdWludDMyLmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwquAQoMdWludDMyLmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq2AQoWdWludDMyLmd0X2x0X2V4Y2x1c2l2ZRqbAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr4BCg11aW50MzIuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrGAQoXdWludDMyLmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEsoHCgNndGUYBSABKA1CugfCSLYHCoMBCgp1aW50MzIuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKvQEKDXVpbnQzMi5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxQEKF3VpbnQzMi5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrNAQoOdWludDMyLmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK1QEKGHVpbnQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ6CgJpbhgGIAMoDUJuwkhrCmkKCXVpbnQzMi5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAcgAygNQmHCSF4KXAoNdWludDMyLm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEiwKB2V4YW1wbGUYCCADKA1CG8JIGAoWCg51aW50MzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4iwhQKC1VJbnQ2NFJ1bGVzEn4KBWNvbnN0GAEgASgEQm/CSGwKagoMdWludDY0LmNvbnN0Glp0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICdtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycShQEKAmx0GAIgASgEQnfCSHQKcgoJdWludDY0Lmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpcBCgNsdGUYAyABKARChwHCSIMBCoABCgp1aW50NjQubHRlGnIhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ211c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABL+BgoCZ3QYBCABKARC7wbCSOsGCnUKCXVpbnQ2NC5ndBpoIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKrgEKDHVpbnQ2NC5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtgEKFnVpbnQ2NC5ndF9sdF9leGNsdXNpdmUamwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq+AQoNdWludDY0Lmd0X2x0ZRqsAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKxgEKF3VpbnQ2NC5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLKBwoDZ3RlGAUgASgEQroHwki2BwqDAQoKdWludDY0Lmd0ZRp1IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCr0BCg11aW50NjQuZ3RlX2x0GqsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCsUBChd1aW50NjQuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzQEKDnVpbnQ2NC5ndGVfbHRlGroBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtUBChh1aW50NjQuZ3RlX2x0ZV9leGNsdXNpdmUauAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESegoCaW4YBiADKARCbsJIawppCgl1aW50NjQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnEKBm5vdF9pbhgHIAMoBEJhwkheClwKDXVpbnQ2NC5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIsCgdleGFtcGxlGAggAygEQhvCSBgKFgoOdWludDY0LmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIsIUCgtTSW50MzJSdWxlcxJ+CgVjb25zdBgBIAEoEUJvwkhsCmoKDHNpbnQzMi5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEoUBCgJsdBgCIAEoEUJ3wkh0CnIKCXNpbnQzMi5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKXAQoDbHRlGAMgASgRQocBwkiDAQqAAQoKc2ludDMyLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAAS/gYKAmd0GAQgASgRQu8GwkjrBgp1CglzaW50MzIuZ3QaaCFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCq4BCgxzaW50MzIuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrYBChZzaW50MzIuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvgEKDXNpbnQzMi5ndF9sdGUarAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCsYBChdzaW50MzIuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAESygcKA2d0ZRgFIAEoEUK6B8JItgcKgwEKCnNpbnQzMi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq9AQoNc2ludDMyLmd0ZV9sdBqrAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrFAQoXc2ludDMyLmd0ZV9sdF9leGNsdXNpdmUaqQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs0BCg5zaW50MzIuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrVAQoYc2ludDMyLmd0ZV9sdGVfZXhjbHVzaXZlGrgBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEnoKAmluGAYgAygRQm7CSGsKaQoJc2ludDMyLmluGlwhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJxCgZub3RfaW4YByADKBFCYcJIXgpcCg1zaW50MzIubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLAoHZXhhbXBsZRgIIAMoEUIbwkgYChYKDnNpbnQzMi5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiLCFAoLU0ludDY0UnVsZXMSfgoFY29uc3QYASABKBJCb8JIbApqCgxzaW50NjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKFAQoCbHQYAiABKBJCd8JIdApyCglzaW50NjQubHQaZSFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASlwEKA2x0ZRgDIAEoEkKHAcJIgwEKgAEKCnNpbnQ2NC5sdGUaciFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAnbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEv4GCgJndBgEIAEoEkLvBsJI6wYKdQoJc2ludDY0Lmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwquAQoMc2ludDY0Lmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq2AQoWc2ludDY0Lmd0X2x0X2V4Y2x1c2l2ZRqbAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr4BCg1zaW50NjQuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrGAQoXc2ludDY0Lmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEsoHCgNndGUYBSABKBJCugfCSLYHCoMBCgpzaW50NjQuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKvQEKDXNpbnQ2NC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxQEKF3NpbnQ2NC5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrNAQoOc2ludDY0Lmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK1QEKGHNpbnQ2NC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ6CgJpbhgGIAMoEkJuwkhrCmkKCXNpbnQ2NC5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAcgAygSQmHCSF4KXAoNc2ludDY0Lm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEiwKB2V4YW1wbGUYCCADKBJCG8JIGAoWCg5zaW50NjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i0xQKDEZpeGVkMzJSdWxlcxJ/CgVjb25zdBgBIAEoB0JwwkhtCmsKDWZpeGVkMzIuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKGAQoCbHQYAiABKAdCeMJIdQpzCgpmaXhlZDMyLmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpgBCgNsdGUYAyABKAdCiAHCSIQBCoEBCgtmaXhlZDMyLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASgwcKAmd0GAQgASgHQvQGwkjwBgp2CgpmaXhlZDMyLmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqvAQoNZml4ZWQzMi5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtwEKF2ZpeGVkMzIuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvwEKDmZpeGVkMzIuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrHAQoYZml4ZWQzMi5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLPBwoDZ3RlGAUgASgHQr8Hwki7BwqEAQoLZml4ZWQzMi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq+AQoOZml4ZWQzMi5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxgEKGGZpeGVkMzIuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzgEKD2ZpeGVkMzIuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrWAQoZZml4ZWQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ7CgJpbhgGIAMoB0JvwkhsCmoKCmZpeGVkMzIuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnIKBm5vdF9pbhgHIAMoB0JiwkhfCl0KDmZpeGVkMzIubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLQoHZXhhbXBsZRgIIAMoB0IcwkgZChcKD2ZpeGVkMzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i0xQKDEZpeGVkNjRSdWxlcxJ/CgVjb25zdBgBIAEoBkJwwkhtCmsKDWZpeGVkNjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKGAQoCbHQYAiABKAZCeMJIdQpzCgpmaXhlZDY0Lmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpgBCgNsdGUYAyABKAZCiAHCSIQBCoEBCgtmaXhlZDY0Lmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASgwcKAmd0GAQgASgGQvQGwkjwBgp2CgpmaXhlZDY0Lmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqvAQoNZml4ZWQ2NC5ndF9sdBqdAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKtwEKF2ZpeGVkNjQuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvwEKDmZpeGVkNjQuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrHAQoYZml4ZWQ2NC5ndF9sdGVfZXhjbHVzaXZlGqoBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLPBwoDZ3RlGAUgASgGQr8Hwki7BwqEAQoLZml4ZWQ2NC5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq+AQoOZml4ZWQ2NC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxgEKGGZpeGVkNjQuZ3RlX2x0X2V4Y2x1c2l2ZRqpAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzgEKD2ZpeGVkNjQuZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrWAQoZZml4ZWQ2NC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ7CgJpbhgGIAMoBkJvwkhsCmoKCmZpeGVkNjQuaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnIKBm5vdF9pbhgHIAMoBkJiwkhfCl0KDmZpeGVkNjQubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLQoHZXhhbXBsZRgIIAMoBkIcwkgZChcKD2ZpeGVkNjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i5RQKDVNGaXhlZDMyUnVsZXMSgAEKBWNvbnN0GAEgASgPQnHCSG4KbAoOc2ZpeGVkMzIuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKHAQoCbHQYAiABKA9CecJIdgp0CgtzZml4ZWQzMi5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKZAQoDbHRlGAMgASgPQokBwkiFAQqCAQoMc2ZpeGVkMzIubHRlGnIhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ211c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKIBwoCZ3QYBCABKA9C+QbCSPUGCncKC3NmaXhlZDMyLmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqwAQoOc2ZpeGVkMzIuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrgBChhzZml4ZWQzMi5ndF9sdF9leGNsdXNpdmUamwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrAAQoPc2ZpeGVkMzIuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrIAQoZc2ZpeGVkMzIuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES1AcKA2d0ZRgFIAEoD0LEB8JIwAcKhQEKDHNmaXhlZDMyLmd0ZRp1IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCr8BCg9zZml4ZWQzMi5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxwEKGXNmaXhlZDMyLmd0ZV9sdF9leGNsdXNpdmUaqQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs8BChBzZml4ZWQzMi5ndGVfbHRlGroBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtcBChpzZml4ZWQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ8CgJpbhgGIAMoD0JwwkhtCmsKC3NmaXhlZDMyLmluGlwhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJzCgZub3RfaW4YByADKA9CY8JIYApeCg9zZml4ZWQzMi5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIuCgdleGFtcGxlGAggAygPQh3CSBoKGAoQc2ZpeGVkMzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i5RQKDVNGaXhlZDY0UnVsZXMSgAEKBWNvbnN0GAEgASgQQnHCSG4KbAoOc2ZpeGVkNjQuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKHAQoCbHQYAiABKBBCecJIdgp0CgtzZml4ZWQ2NC5sdBplIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICdtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKZAQoDbHRlGAMgASgQQokBwkiFAQqCAQoMc2ZpeGVkNjQubHRlGnIhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ211c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKIBwoCZ3QYBCABKBBC+QbCSPUGCncKC3NmaXhlZDY0Lmd0GmghaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqwAQoOc2ZpeGVkNjQuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrgBChhzZml4ZWQ2NC5ndF9sdF9leGNsdXNpdmUamwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrAAQoPc2ZpeGVkNjQuZ3RfbHRlGqwBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrIAQoZc2ZpeGVkNjQuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES1AcKA2d0ZRgFIAEoEELEB8JIwAcKhQEKDHNmaXhlZDY0Lmd0ZRp1IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCr8BCg9zZml4ZWQ2NC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKxwEKGXNmaXhlZDY0Lmd0ZV9sdF9leGNsdXNpdmUaqQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs8BChBzZml4ZWQ2NC5ndGVfbHRlGroBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtcBChpzZml4ZWQ2NC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ8CgJpbhgGIAMoEEJwwkhtCmsKC3NmaXhlZDY0LmluGlwhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJzCgZub3RfaW4YByADKBBCY8JIYApeCg9zZml4ZWQ2NC5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIuCgdleGFtcGxlGAggAygQQh3CSBoKGAoQc2ZpeGVkNjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4iwAEKCUJvb2xSdWxlcxJ8CgVjb25zdBgBIAEoCEJtwkhqCmgKCmJvb2wuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxIqCgdleGFtcGxlGAIgAygIQhnCSBYKFAoMYm9vbC5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAIi6jwKC1N0cmluZ1J1bGVzEoABCgVjb25zdBgBIAEoCUJxwkhuCmwKDHN0cmluZy5jb25zdBpcdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCBgJXNgJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycScQoDbGVuGBMgASgEQmTCSGEKXwoKc3RyaW5nLmxlbhpRdWludCh0aGlzLnNpemUoKSkgIT0gcnVsZXMubGVuID8gJ211c3QgYmUgJXMgY2hhcmFjdGVycycuZm9ybWF0KFtydWxlcy5sZW5dKSA6ICcnEokBCgdtaW5fbGVuGAIgASgEQnjCSHUKcwoOc3RyaW5nLm1pbl9sZW4aYXVpbnQodGhpcy5zaXplKCkpIDwgcnVsZXMubWluX2xlbiA/ICdtdXN0IGJlIGF0IGxlYXN0ICVzIGNoYXJhY3RlcnMnLmZvcm1hdChbcnVsZXMubWluX2xlbl0pIDogJycSiAEKB21heF9sZW4YAyABKARCd8JIdApyCg5zdHJpbmcubWF4X2xlbhpgdWludCh0aGlzLnNpemUoKSkgPiBydWxlcy5tYXhfbGVuID8gJ211c3QgYmUgYXQgbW9zdCAlcyBjaGFyYWN0ZXJzJy5mb3JtYXQoW3J1bGVzLm1heF9sZW5dKSA6ICcnEosBCglsZW5fYnl0ZXMYFCABKARCeMJIdQpzChBzdHJpbmcubGVuX2J5dGVzGl91aW50KGJ5dGVzKHRoaXMpLnNpemUoKSkgIT0gcnVsZXMubGVuX2J5dGVzID8gJ211c3QgYmUgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubGVuX2J5dGVzXSkgOiAnJxKUAQoJbWluX2J5dGVzGAQgASgEQoABwkh9CnsKEHN0cmluZy5taW5fYnl0ZXMaZ3VpbnQoYnl0ZXModGhpcykuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9ieXRlcyA/ICdtdXN0IGJlIGF0IGxlYXN0ICVzIGJ5dGVzJy5mb3JtYXQoW3J1bGVzLm1pbl9ieXRlc10pIDogJycSkgEKCW1heF9ieXRlcxgFIAEoBEJ/wkh8CnoKEHN0cmluZy5tYXhfYnl0ZXMaZnVpbnQoYnl0ZXModGhpcykuc2l6ZSgpKSA+IHJ1bGVzLm1heF9ieXRlcyA/ICdtdXN0IGJlIGF0IG1vc3QgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubWF4X2J5dGVzXSkgOiAnJxKHAQoHcGF0dGVybhgGIAEoCUJ2wkhzCnEKDnN0cmluZy5wYXR0ZXJuGl8hdGhpcy5tYXRjaGVzKHJ1bGVzLnBhdHRlcm4pID8gJ2RvZXMgbm90IG1hdGNoIHJlZ2V4IHBhdHRlcm4gYCVzYCcuZm9ybWF0KFtydWxlcy5wYXR0ZXJuXSkgOiAnJxJ+CgZwcmVmaXgYByABKAlCbsJIawppCg1zdHJpbmcucHJlZml4GlghdGhpcy5zdGFydHNXaXRoKHJ1bGVzLnByZWZpeCkgPyAnZG9lcyBub3QgaGF2ZSBwcmVmaXggYCVzYCcuZm9ybWF0KFtydWxlcy5wcmVmaXhdKSA6ICcnEnwKBnN1ZmZpeBgIIAEoCUJswkhpCmcKDXN0cmluZy5zdWZmaXgaViF0aGlzLmVuZHNXaXRoKHJ1bGVzLnN1ZmZpeCkgPyAnZG9lcyBub3QgaGF2ZSBzdWZmaXggYCVzYCcuZm9ybWF0KFtydWxlcy5zdWZmaXhdKSA6ICcnEooBCghjb250YWlucxgJIAEoCUJ4wkh1CnMKD3N0cmluZy5jb250YWlucxpgIXRoaXMuY29udGFpbnMocnVsZXMuY29udGFpbnMpID8gJ2RvZXMgbm90IGNvbnRhaW4gc3Vic3RyaW5nIGAlc2AnLmZvcm1hdChbcnVsZXMuY29udGFpbnNdKSA6ICcnEpEBCgxub3RfY29udGFpbnMYFyABKAlCe8JIeAp2ChNzdHJpbmcubm90X2NvbnRhaW5zGl90aGlzLmNvbnRhaW5zKHJ1bGVzLm5vdF9jb250YWlucykgPyAnY29udGFpbnMgc3Vic3RyaW5nIGAlc2AnLmZvcm1hdChbcnVsZXMubm90X2NvbnRhaW5zXSkgOiAnJxJ6CgJpbhgKIAMoCUJuwkhrCmkKCXN0cmluZy5pbhpcISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAnbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycScQoGbm90X2luGAsgAygJQmHCSF4KXAoNc3RyaW5nLm5vdF9pbhpLdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAnbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEtkBCgVlbWFpbBgMIAEoCELHAcJIwwEKWwoMc3RyaW5nLmVtYWlsEh1tdXN0IGJlIGEgdmFsaWQgZW1haWwgYWRkcmVzcxosIXJ1bGVzLmVtYWlsIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc0VtYWlsKCkKZAoSc3RyaW5nLmVtYWlsX2VtcHR5EjJ2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgZW1haWwgYWRkcmVzcxoaIXJ1bGVzLmVtYWlsIHx8IHRoaXMgIT0gJydIABLhAQoIaG9zdG5hbWUYDSABKAhCzAHCSMgBCl8KD3N0cmluZy5ob3N0bmFtZRIYbXVzdCBiZSBhIHZhbGlkIGhvc3RuYW1lGjIhcnVsZXMuaG9zdG5hbWUgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSG9zdG5hbWUoKQplChVzdHJpbmcuaG9zdG5hbWVfZW1wdHkSLXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBob3N0bmFtZRodIXJ1bGVzLmhvc3RuYW1lIHx8IHRoaXMgIT0gJydIABLBAQoCaXAYDiABKAhCsgHCSK4BCk8KCXN0cmluZy5pcBIabXVzdCBiZSBhIHZhbGlkIElQIGFkZHJlc3MaJiFydWxlcy5pcCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcCgpClsKD3N0cmluZy5pcF9lbXB0eRIvdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIGFkZHJlc3MaFyFydWxlcy5pcCB8fCB0aGlzICE9ICcnSAAS0AEKBGlwdjQYDyABKAhCvwHCSLsBClYKC3N0cmluZy5pcHY0EhxtdXN0IGJlIGEgdmFsaWQgSVB2NCBhZGRyZXNzGikhcnVsZXMuaXB2NCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcCg0KQphChFzdHJpbmcuaXB2NF9lbXB0eRIxdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjQgYWRkcmVzcxoZIXJ1bGVzLmlwdjQgfHwgdGhpcyAhPSAnJ0gAEtABCgRpcHY2GBAgASgIQr8Bwki7AQpWCgtzdHJpbmcuaXB2NhIcbXVzdCBiZSBhIHZhbGlkIElQdjYgYWRkcmVzcxopIXJ1bGVzLmlwdjYgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXAoNikKYQoRc3RyaW5nLmlwdjZfZW1wdHkSMXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBJUHY2IGFkZHJlc3MaGSFydWxlcy5pcHY2IHx8IHRoaXMgIT0gJydIABK5AQoDdXJpGBEgASgIQqkBwkilAQpLCgpzdHJpbmcudXJpEhNtdXN0IGJlIGEgdmFsaWQgVVJJGighcnVsZXMudXJpIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc1VyaSgpClYKEHN0cmluZy51cmlfZW1wdHkSKHZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBVUkkaGCFydWxlcy51cmkgfHwgdGhpcyAhPSAnJ0gAEmoKB3VyaV9yZWYYEiABKAhCV8JIVApSCg5zdHJpbmcudXJpX3JlZhIdbXVzdCBiZSBhIHZhbGlkIFVSSSBSZWZlcmVuY2UaISFydWxlcy51cmlfcmVmIHx8IHRoaXMuaXNVcmlSZWYoKUgAEokCCgdhZGRyZXNzGBUgASgIQvUBwkjxAQp7Cg5zdHJpbmcuYWRkcmVzcxInbXVzdCBiZSBhIHZhbGlkIGhvc3RuYW1lLCBvciBpcCBhZGRyZXNzGkAhcnVsZXMuYWRkcmVzcyB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNIb3N0bmFtZSgpIHx8IHRoaXMuaXNJcCgpCnIKFHN0cmluZy5hZGRyZXNzX2VtcHR5Ejx2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgaG9zdG5hbWUsIG9yIGlwIGFkZHJlc3MaHCFydWxlcy5hZGRyZXNzIHx8IHRoaXMgIT0gJydIABKSAgoEdXVpZBgWIAEoCEKBAsJI/QEKnwEKC3N0cmluZy51dWlkEhRtdXN0IGJlIGEgdmFsaWQgVVVJRBp6IXJ1bGVzLnV1aWQgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykKWQoRc3RyaW5nLnV1aWRfZW1wdHkSKXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBVVUlEGhkhcnVsZXMudXVpZCB8fCB0aGlzICE9ICcnSAAS6gEKBXR1dWlkGCEgASgIQtgBwkjUAQptCgxzdHJpbmcudHV1aWQSHG11c3QgYmUgYSB2YWxpZCB0cmltbWVkIFVVSUQaPyFydWxlcy50dXVpZCB8fCB0aGlzID09ICcnIHx8IHRoaXMubWF0Y2hlcygnXlswLTlhLWZBLUZdezMyfSQnKQpjChJzdHJpbmcudHV1aWRfZW1wdHkSMXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCB0cmltbWVkIFVVSUQaGiFydWxlcy50dXVpZCB8fCB0aGlzICE9ICcnSAASkAIKEWlwX3dpdGhfcHJlZml4bGVuGBogASgIQvIBwkjuAQpyChhzdHJpbmcuaXBfd2l0aF9wcmVmaXhsZW4SGW11c3QgYmUgYSB2YWxpZCBJUCBwcmVmaXgaOyFydWxlcy5pcF93aXRoX3ByZWZpeGxlbiB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCgpCngKHnN0cmluZy5pcF93aXRoX3ByZWZpeGxlbl9lbXB0eRIudmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIHByZWZpeBomIXJ1bGVzLmlwX3dpdGhfcHJlZml4bGVuIHx8IHRoaXMgIT0gJydIABLJAgoTaXB2NF93aXRoX3ByZWZpeGxlbhgbIAEoCEKpAsJIpQIKjQEKGnN0cmluZy5pcHY0X3dpdGhfcHJlZml4bGVuEi9tdXN0IGJlIGEgdmFsaWQgSVB2NCBhZGRyZXNzIHdpdGggcHJlZml4IGxlbmd0aBo+IXJ1bGVzLmlwdjRfd2l0aF9wcmVmaXhsZW4gfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXBQcmVmaXgoNCkKkgEKIHN0cmluZy5pcHY0X3dpdGhfcHJlZml4bGVuX2VtcHR5EkR2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBhZGRyZXNzIHdpdGggcHJlZml4IGxlbmd0aBooIXJ1bGVzLmlwdjRfd2l0aF9wcmVmaXhsZW4gfHwgdGhpcyAhPSAnJ0gAEskCChNpcHY2X3dpdGhfcHJlZml4bGVuGBwgASgIQqkCwkilAgqNAQoac3RyaW5nLmlwdjZfd2l0aF9wcmVmaXhsZW4SL211c3QgYmUgYSB2YWxpZCBJUHY2IGFkZHJlc3Mgd2l0aCBwcmVmaXggbGVuZ3RoGj4hcnVsZXMuaXB2Nl93aXRoX3ByZWZpeGxlbiB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCg2KQqSAQogc3RyaW5nLmlwdjZfd2l0aF9wcmVmaXhsZW5fZW1wdHkSRHZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBJUHY2IGFkZHJlc3Mgd2l0aCBwcmVmaXggbGVuZ3RoGighcnVsZXMuaXB2Nl93aXRoX3ByZWZpeGxlbiB8fCB0aGlzICE9ICcnSAAS7AEKCWlwX3ByZWZpeBgdIAEoCELWAcJI0gEKZgoQc3RyaW5nLmlwX3ByZWZpeBIZbXVzdCBiZSBhIHZhbGlkIElQIHByZWZpeBo3IXJ1bGVzLmlwX3ByZWZpeCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCh0cnVlKQpoChZzdHJpbmcuaXBfcHJlZml4X2VtcHR5Ei52YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVAgcHJlZml4Gh4hcnVsZXMuaXBfcHJlZml4IHx8IHRoaXMgIT0gJydIABL9AQoLaXB2NF9wcmVmaXgYHiABKAhC5QHCSOEBCm8KEnN0cmluZy5pcHY0X3ByZWZpeBIbbXVzdCBiZSBhIHZhbGlkIElQdjQgcHJlZml4GjwhcnVsZXMuaXB2NF9wcmVmaXggfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXBQcmVmaXgoNCwgdHJ1ZSkKbgoYc3RyaW5nLmlwdjRfcHJlZml4X2VtcHR5EjB2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBwcmVmaXgaICFydWxlcy5pcHY0X3ByZWZpeCB8fCB0aGlzICE9ICcnSAAS/QEKC2lwdjZfcHJlZml4GB8gASgIQuUBwkjhAQpvChJzdHJpbmcuaXB2Nl9wcmVmaXgSG211c3QgYmUgYSB2YWxpZCBJUHY2IHByZWZpeBo8IXJ1bGVzLmlwdjZfcHJlZml4IHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc0lwUHJlZml4KDYsIHRydWUpCm4KGHN0cmluZy5pcHY2X3ByZWZpeF9lbXB0eRIwdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjYgcHJlZml4GiAhcnVsZXMuaXB2Nl9wcmVmaXggfHwgdGhpcyAhPSAnJ0gAEq8CCg1ob3N0X2FuZF9wb3J0GCAgASgIQpUCwkiRAgqTAQoUc3RyaW5nLmhvc3RfYW5kX3BvcnQSO211c3QgYmUgYSB2YWxpZCBob3N0IChob3N0bmFtZSBvciBJUCBhZGRyZXNzKSBhbmQgcG9ydCBwYWlyGj4hcnVsZXMuaG9zdF9hbmRfcG9ydCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNIb3N0QW5kUG9ydCh0cnVlKQp5ChpzdHJpbmcuaG9zdF9hbmRfcG9ydF9lbXB0eRI3dmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIGhvc3QgYW5kIHBvcnQgcGFpchoiIXJ1bGVzLmhvc3RfYW5kX3BvcnQgfHwgdGhpcyAhPSAnJ0gAEu4BCgR1bGlkGCMgASgIQt0BwkjZAQp8CgtzdHJpbmcudWxpZBIUbXVzdCBiZSBhIHZhbGlkIFVMSUQaVyFydWxlcy51bGlkIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5tYXRjaGVzKCdeWzAtN11bMC05QS1ISktNTlAtVFYtWmEtaGprbW5wLXR2LXpdezI1fSQnKQpZChFzdHJpbmcudWxpZF9lbXB0eRIpdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIFVMSUQaGSFydWxlcy51bGlkIHx8IHRoaXMgIT0gJydIABLUAgoMcHJvdG9idWZfZnFuGCUgASgIQrsCwki3AgqvAQoTc3RyaW5nLnByb3RvYnVmX2ZxbhItbXVzdCBiZSBhIHZhbGlkIGZ1bGx5LXF1YWxpZmllZCBQcm90b2J1ZiBuYW1lGmkhcnVsZXMucHJvdG9idWZfZnFuIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5tYXRjaGVzKCdeW0EtWmEtel9dW0EtWmEtel8wLTldKihcXC5bQS1aYS16X11bQS1aYS16XzAtOV0qKSokJykKggEKGXN0cmluZy5wcm90b2J1Zl9mcW5fZW1wdHkSQnZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBmdWxseS1xdWFsaWZpZWQgUHJvdG9idWYgbmFtZRohIXJ1bGVzLnByb3RvYnVmX2ZxbiB8fCB0aGlzICE9ICcnSAASkQMKEHByb3RvYnVmX2RvdF9mcW4YJiABKAhC9ALCSPACCs0BChdzdHJpbmcucHJvdG9idWZfZG90X2ZxbhJAbXVzdCBiZSBhIHZhbGlkIGZ1bGx5LXF1YWxpZmllZCBQcm90b2J1ZiBuYW1lIHdpdGggYSBsZWFkaW5nIGRvdBpwIXJ1bGVzLnByb3RvYnVmX2RvdF9mcW4gfHwgdGhpcyA9PSAnJyB8fCB0aGlzLm1hdGNoZXMoJ15cXC5bQS1aYS16X11bQS1aYS16XzAtOV0qKFxcLltBLVphLXpfXVtBLVphLXpfMC05XSopKiQnKQqdAQodc3RyaW5nLnByb3RvYnVmX2RvdF9mcW5fZW1wdHkSVXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBmdWxseS1xdWFsaWZpZWQgUHJvdG9idWYgbmFtZSB3aXRoIGEgbGVhZGluZyBkb3QaJSFydWxlcy5wcm90b2J1Zl9kb3RfZnFuIHx8IHRoaXMgIT0gJydIABKcBQoQd2VsbF9rbm93bl9yZWdleBgYIAEoDjIYLmJ1Zi52YWxpZGF0ZS5Lbm93blJlZ2V4QuUEwkjhBArqAQojc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX25hbWUSIG11c3QgYmUgYSB2YWxpZCBIVFRQIGhlYWRlciBuYW1lGqABcnVsZXMud2VsbF9rbm93bl9yZWdleCAhPSAxIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5tYXRjaGVzKCFoYXMocnVsZXMuc3RyaWN0KSB8fCBydWxlcy5zdHJpY3QgPydeOj9bMC05YS16QS1aISMkJSZcJyorLS5eX3x+XHg2MF0rJCcgOideW15cdTAwMDBcdTAwMEFcdTAwMERdKyQnKQqNAQopc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX25hbWVfZW1wdHkSNXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBIVFRQIGhlYWRlciBuYW1lGilydWxlcy53ZWxsX2tub3duX3JlZ2V4ICE9IDEgfHwgdGhpcyAhPSAnJwrhAQokc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX3ZhbHVlEiFtdXN0IGJlIGEgdmFsaWQgSFRUUCBoZWFkZXIgdmFsdWUalQFydWxlcy53ZWxsX2tub3duX3JlZ2V4ICE9IDIgfHwgdGhpcy5tYXRjaGVzKCFoYXMocnVsZXMuc3RyaWN0KSB8fCBydWxlcy5zdHJpY3QgPydeW15cdTAwMDAtXHUwMDA4XHUwMDBBLVx1MDAxRlx1MDA3Rl0qJCcgOideW15cdTAwMDBcdTAwMEFcdTAwMERdKiQnKUgAEg4KBnN0cmljdBgZIAEoCBIsCgdleGFtcGxlGCIgAygJQhvCSBgKFgoOc3RyaW5nLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkIMCgp3ZWxsX2tub3duIt0RCgpCeXRlc1J1bGVzEnoKBWNvbnN0GAEgASgMQmvCSGgKZgoLYnl0ZXMuY29uc3QaV3RoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgYmUgJXgnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxJrCgNsZW4YDSABKARCXsJIWwpZCglieXRlcy5sZW4aTHVpbnQodGhpcy5zaXplKCkpICE9IHJ1bGVzLmxlbiA/ICdtdXN0IGJlICVzIGJ5dGVzJy5mb3JtYXQoW3J1bGVzLmxlbl0pIDogJycSgwEKB21pbl9sZW4YAiABKARCcsJIbwptCg1ieXRlcy5taW5fbGVuGlx1aW50KHRoaXMuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9sZW4gPyAnbXVzdCBiZSBhdCBsZWFzdCAlcyBieXRlcycuZm9ybWF0KFtydWxlcy5taW5fbGVuXSkgOiAnJxKCAQoHbWF4X2xlbhgDIAEoBEJxwkhuCmwKDWJ5dGVzLm1heF9sZW4aW3VpbnQodGhpcy5zaXplKCkpID4gcnVsZXMubWF4X2xlbiA/ICdtdXN0IGJlIGF0IG1vc3QgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubWF4X2xlbl0pIDogJycSigEKB3BhdHRlcm4YBCABKAlCecJIdgp0Cg1ieXRlcy5wYXR0ZXJuGmMhc3RyaW5nKHRoaXMpLm1hdGNoZXMocnVsZXMucGF0dGVybikgPyAnbXVzdCBtYXRjaCByZWdleCBwYXR0ZXJuIGAlc2AnLmZvcm1hdChbcnVsZXMucGF0dGVybl0pIDogJycSewoGcHJlZml4GAUgASgMQmvCSGgKZgoMYnl0ZXMucHJlZml4GlYhdGhpcy5zdGFydHNXaXRoKHJ1bGVzLnByZWZpeCkgPyAnZG9lcyBub3QgaGF2ZSBwcmVmaXggJXgnLmZvcm1hdChbcnVsZXMucHJlZml4XSkgOiAnJxJ5CgZzdWZmaXgYBiABKAxCacJIZgpkCgxieXRlcy5zdWZmaXgaVCF0aGlzLmVuZHNXaXRoKHJ1bGVzLnN1ZmZpeCkgPyAnZG9lcyBub3QgaGF2ZSBzdWZmaXggJXgnLmZvcm1hdChbcnVsZXMuc3VmZml4XSkgOiAnJxJ9Cghjb250YWlucxgHIAEoDEJrwkhoCmYKDmJ5dGVzLmNvbnRhaW5zGlQhdGhpcy5jb250YWlucyhydWxlcy5jb250YWlucykgPyAnZG9lcyBub3QgY29udGFpbiAleCcuZm9ybWF0KFtydWxlcy5jb250YWluc10pIDogJycSoQEKAmluGAggAygMQpQBwkiQAQqNAQoIYnl0ZXMuaW4agAFnZXRGaWVsZChydWxlcywgJ2luJykuc2l6ZSgpID4gMCAmJiAhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICdtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJwCgZub3RfaW4YCSADKAxCYMJIXQpbCgxieXRlcy5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxLlAQoCaXAYCiABKAhC1gHCSNIBCm4KCGJ5dGVzLmlwEhptdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcxpGIXJ1bGVzLmlwIHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gNCB8fCB0aGlzLnNpemUoKSA9PSAxNgpgCg5ieXRlcy5pcF9lbXB0eRIvdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIGFkZHJlc3MaHSFydWxlcy5pcCB8fCB0aGlzLnNpemUoKSAhPSAwSAAS3gEKBGlwdjQYCyABKAhCzQHCSMkBCl8KCmJ5dGVzLmlwdjQSHG11c3QgYmUgYSB2YWxpZCBJUHY0IGFkZHJlc3MaMyFydWxlcy5pcHY0IHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gNApmChBieXRlcy5pcHY0X2VtcHR5EjF2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBhZGRyZXNzGh8hcnVsZXMuaXB2NCB8fCB0aGlzLnNpemUoKSAhPSAwSAAS3wEKBGlwdjYYDCABKAhCzgHCSMoBCmAKCmJ5dGVzLmlwdjYSHG11c3QgYmUgYSB2YWxpZCBJUHY2IGFkZHJlc3MaNCFydWxlcy5pcHY2IHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gMTYKZgoQYnl0ZXMuaXB2Nl9lbXB0eRIxdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjYgYWRkcmVzcxofIXJ1bGVzLmlwdjYgfHwgdGhpcy5zaXplKCkgIT0gMEgAEs8BCgR1dWlkGA8gASgIQr4Bwki6AQpYCgpieXRlcy51dWlkEhRtdXN0IGJlIGEgdmFsaWQgVVVJRBo0IXJ1bGVzLnV1aWQgfHwgdGhpcy5zaXplKCkgPT0gMCB8fCB0aGlzLnNpemUoKSA9PSAxNgpeChBieXRlcy51dWlkX2VtcHR5Eil2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgVVVJRBofIXJ1bGVzLnV1aWQgfHwgdGhpcy5zaXplKCkgIT0gMEgAEisKB2V4YW1wbGUYDiADKAxCGsJIFwoVCg1ieXRlcy5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCDAoKd2VsbF9rbm93biLBAwoJRW51bVJ1bGVzEnwKBWNvbnN0GAEgASgFQm3CSGoKaAoKZW51bS5jb25zdBpadGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAnbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEhQKDGRlZmluZWRfb25seRgCIAEoCBJ4CgJpbhgDIAMoBUJswkhpCmcKB2VudW0uaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEm8KBm5vdF9pbhgEIAMoBUJfwkhcCloKC2VudW0ubm90X2luGkt0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICdtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSKgoHZXhhbXBsZRgFIAMoBUIZwkgWChQKDGVudW0uZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACIu0DCg1SZXBlYXRlZFJ1bGVzEpYBCgltaW5faXRlbXMYASABKARCggHCSH8KfQoScmVwZWF0ZWQubWluX2l0ZW1zGmd1aW50KHRoaXMuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9pdGVtcyA/ICdtdXN0IGNvbnRhaW4gYXQgbGVhc3QgJWQgaXRlbShzKScuZm9ybWF0KFtydWxlcy5taW5faXRlbXNdKSA6ICcnEpwBCgltYXhfaXRlbXMYAiABKARCiAHCSIQBCoEBChJyZXBlYXRlZC5tYXhfaXRlbXMaa3VpbnQodGhpcy5zaXplKCkpID4gcnVsZXMubWF4X2l0ZW1zID8gJ211c3QgY29udGFpbiBubyBtb3JlIHRoYW4gJXMgaXRlbShzKScuZm9ybWF0KFtydWxlcy5tYXhfaXRlbXNdKSA6ICcnEnAKBnVuaXF1ZRgDIAEoCEJgwkhdClsKD3JlcGVhdGVkLnVuaXF1ZRIocmVwZWF0ZWQgdmFsdWUgbXVzdCBjb250YWluIHVuaXF1ZSBpdGVtcxoeIXJ1bGVzLnVuaXF1ZSB8fCB0aGlzLnVuaXF1ZSgpEicKBWl0ZW1zGAQgASgLMhguYnVmLnZhbGlkYXRlLkZpZWxkUnVsZXMqCQjoBxCAgICAAiKKAwoITWFwUnVsZXMSjwEKCW1pbl9wYWlycxgBIAEoBEJ8wkh5CncKDW1hcC5taW5fcGFpcnMaZnVpbnQodGhpcy5zaXplKCkpIDwgcnVsZXMubWluX3BhaXJzID8gJ21hcCBtdXN0IGJlIGF0IGxlYXN0ICVkIGVudHJpZXMnLmZvcm1hdChbcnVsZXMubWluX3BhaXJzXSkgOiAnJxKOAQoJbWF4X3BhaXJzGAIgASgEQnvCSHgKdgoNbWFwLm1heF9wYWlycxpldWludCh0aGlzLnNpemUoKSkgPiBydWxlcy5tYXhfcGFpcnMgPyAnbWFwIG11c3QgYmUgYXQgbW9zdCAlZCBlbnRyaWVzJy5mb3JtYXQoW3J1bGVzLm1heF9wYWlyc10pIDogJycSJgoEa2V5cxgEIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GaWVsZFJ1bGVzEigKBnZhbHVlcxgFIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GaWVsZFJ1bGVzKgkI6AcQgICAgAIiJgoIQW55UnVsZXMSCgoCaW4YAiADKAkSDgoGbm90X2luGAMgAygJIr8WCg1EdXJhdGlvblJ1bGVzEpsBCgVjb25zdBgCIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkJxwkhuCmwKDmR1cmF0aW9uLmNvbnN0Glp0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICdtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSogEKAmx0GAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQnnCSHYKdAoLZHVyYXRpb24ubHQaZSFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAnbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAAStAEKA2x0ZRgEIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkKJAcJIhQEKggEKDGR1cmF0aW9uLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASowcKAmd0GAUgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQvkGwkj1Bgp3CgtkdXJhdGlvbi5ndBpoIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKsAEKDmR1cmF0aW9uLmd0X2x0Gp0BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq4AQoYZHVyYXRpb24uZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKwAEKD2R1cmF0aW9uLmd0X2x0ZRqsAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKyAEKGWR1cmF0aW9uLmd0X2x0ZV9leGNsdXNpdmUaqgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEu8HCgNndGUYBiABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CxAfCSMAHCoUBCgxkdXJhdGlvbi5ndGUadSFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwq/AQoPZHVyYXRpb24uZ3RlX2x0GqsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCscBChlkdXJhdGlvbi5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrPAQoQZHVyYXRpb24uZ3RlX2x0ZRq6AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrXAQoaZHVyYXRpb24uZ3RlX2x0ZV9leGNsdXNpdmUauAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESlwEKAmluGAcgAygLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQnDCSG0KawoLZHVyYXRpb24uaW4aXCEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ211c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEo4BCgZub3RfaW4YCCADKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CY8JIYApeCg9kdXJhdGlvbi5ub3RfaW4aS3RoaXMgaW4gcnVsZXMubm90X2luID8gJ211c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxJJCgdleGFtcGxlGAkgAygLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQh3CSBoKGAoQZHVyYXRpb24uZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i6wUKDkZpZWxkTWFza1J1bGVzErkBCgVjb25zdBgBIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCjQHCSIkBCoYBChBmaWVsZF9tYXNrLmNvbnN0GnJ0aGlzLnBhdGhzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKS5wYXRocyA/ICdtdXN0IGVxdWFsIHBhdGhzICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKS5wYXRoc10pIDogJycS0wEKAmluGAIgAygJQsYBwkjCAQq/AQoNZmllbGRfbWFzay5pbhqtASF0aGlzLnBhdGhzLmFsbChwLCBwIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSB8fCBnZXRGaWVsZChydWxlcywgJ2luJykuZXhpc3RzKGYsIHAuc3RhcnRzV2l0aChmKycuJykpKSA/ICdtdXN0IG9ubHkgY29udGFpbiBwYXRocyBpbiAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEu0BCgZub3RfaW4YAyADKAlC3AHCSNgBCtUBChFmaWVsZF9tYXNrLm5vdF9pbhq/ASF0aGlzLnBhdGhzLmFsbChwLCAhKHAgaW4gZ2V0RmllbGQocnVsZXMsICdub3RfaW4nKSB8fCBnZXRGaWVsZChydWxlcywgJ25vdF9pbicpLmV4aXN0cyhmLCBwLnN0YXJ0c1dpdGgoZisnLicpKSkpID8gJ211c3Qgbm90IGNvbnRhaW4gYW55IHBhdGhzIGluICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnbm90X2luJyldKSA6ICcnEkwKB2V4YW1wbGUYBCADKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQh/CSBwKGgoSZmllbGRfbWFzay5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAIisBcKDlRpbWVzdGFtcFJ1bGVzEp0BCgVjb25zdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCcsJIbwptCg90aW1lc3RhbXAuY29uc3QaWnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ211c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKkAQoCbHQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQnrCSHcKdQoMdGltZXN0YW1wLmx0GmUhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ211c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAErYBCgNsdGUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQooBwkiGAQqDAQoNdGltZXN0YW1wLmx0ZRpyIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICdtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASZgoGbHRfbm93GAcgASgIQlTCSFEKTwoQdGltZXN0YW1wLmx0X25vdxo7KHJ1bGVzLmx0X25vdyAmJiB0aGlzID4gbm93KSA/ICdtdXN0IGJlIGxlc3MgdGhhbiBub3cnIDogJydIABKpBwoCZ3QYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQv4Gwkj6Bgp4Cgx0aW1lc3RhbXAuZ3QaaCFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCrEBCg90aW1lc3RhbXAuZ3RfbHQanQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrkBChl0aW1lc3RhbXAuZ3RfbHRfZXhjbHVzaXZlGpsBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKwQEKEHRpbWVzdGFtcC5ndF9sdGUarAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICdtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCskBChp0aW1lc3RhbXAuZ3RfbHRlX2V4Y2x1c2l2ZRqqAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES9QcKA2d0ZRgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCyQfCSMUHCoYBCg10aW1lc3RhbXAuZ3RlGnUhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKwAEKEHRpbWVzdGFtcC5ndGVfbHQaqwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKyAEKGnRpbWVzdGFtcC5ndGVfbHRfZXhjbHVzaXZlGqkBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrQAQoRdGltZXN0YW1wLmd0ZV9sdGUaugFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAnbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK2AEKG3RpbWVzdGFtcC5ndGVfbHRlX2V4Y2x1c2l2ZRq4AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJpCgZndF9ub3cYCCABKAhCV8JIVApSChB0aW1lc3RhbXAuZ3Rfbm93Gj4ocnVsZXMuZ3Rfbm93ICYmIHRoaXMgPCBub3cpID8gJ211c3QgYmUgZ3JlYXRlciB0aGFuIG5vdycgOiAnJ0gBErEBCgZ3aXRoaW4YCSABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25ChQHCSIEBCn8KEHRpbWVzdGFtcC53aXRoaW4aa3RoaXMgPCBub3ctcnVsZXMud2l0aGluIHx8IHRoaXMgPiBub3crcnVsZXMud2l0aGluID8gJ211c3QgYmUgd2l0aGluICVzIG9mIG5vdycuZm9ybWF0KFtydWxlcy53aXRoaW5dKSA6ICcnEksKB2V4YW1wbGUYCiADKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQh7CSBsKGQoRdGltZXN0YW1wLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIjkKClZpb2xhdGlvbnMSKwoKdmlvbGF0aW9ucxgBIAMoCzIXLmJ1Zi52YWxpZGF0ZS5WaW9sYXRpb24inwEKCVZpb2xhdGlvbhImCgVmaWVsZBgFIAEoCzIXLmJ1Zi52YWxpZGF0ZS5GaWVsZFBhdGgSJQoEcnVsZRgGIAEoCzIXLmJ1Zi52YWxpZGF0ZS5GaWVsZFBhdGgSDwoHcnVsZV9pZBgCIAEoCRIPCgdtZXNzYWdlGAMgASgJEg8KB2Zvcl9rZXkYBCABKAhKBAgBEAJSCmZpZWxkX3BhdGgiPQoJRmllbGRQYXRoEjAKCGVsZW1lbnRzGAEgAygLMh4uYnVmLnZhbGlkYXRlLkZpZWxkUGF0aEVsZW1lbnQi6QIKEEZpZWxkUGF0aEVsZW1lbnQSFAoMZmllbGRfbnVtYmVyGAEgASgFEhIKCmZpZWxkX25hbWUYAiABKAkSPgoKZmllbGRfdHlwZRgDIAEoDjIqLmdvb2dsZS5wcm90b2J1Zi5GaWVsZERlc2NyaXB0b3JQcm90by5UeXBlEjwKCGtleV90eXBlGAQgASgOMiouZ29vZ2xlLnByb3RvYnVmLkZpZWxkRGVzY3JpcHRvclByb3RvLlR5cGUSPgoKdmFsdWVfdHlwZRgFIAEoDjIqLmdvb2dsZS5wcm90b2J1Zi5GaWVsZERlc2NyaXB0b3JQcm90by5UeXBlEg8KBWluZGV4GAYgASgESAASEgoIYm9vbF9rZXkYByABKAhIABIRCgdpbnRfa2V5GAggASgDSAASEgoIdWludF9rZXkYCSABKARIABIUCgpzdHJpbmdfa2V5GAogASgJSABCCwoJc3Vic2NyaXB0KqEBCgZJZ25vcmUSFgoSSUdOT1JFX1VOU1BFQ0lGSUVEEAASGAoUSUdOT1JFX0lGX1pFUk9fVkFMVUUQARIRCg1JR05PUkVfQUxXQVlTEAMiBAgCEAIqDElHTk9SRV9FTVBUWSoOSUdOT1JFX0RFRkFVTFQqF0lHTk9SRV9JRl9ERUZBVUxUX1ZBTFVFKhVJR05PUkVfSUZfVU5QT1BVTEFURUQqbgoKS25vd25SZWdleBIbChdLTk9XTl9SRUdFWF9VTlNQRUNJRklFRBAAEiAKHEtOT1dOX1JFR0VYX0hUVFBfSEVBREVSX05BTUUQARIhCh1LTk9XTl9SRUdFWF9IVFRQX0hFQURFUl9WQUxVRRACOlYKB21lc3NhZ2USHy5nb29nbGUucHJvdG9idWYuTWVzc2FnZU9wdGlvbnMYhwkgASgLMhouYnVmLnZhbGlkYXRlLk1lc3NhZ2VSdWxlc1IHbWVzc2FnZTpOCgVvbmVvZhIdLmdvb2dsZS5wcm90b2J1Zi5PbmVvZk9wdGlvbnMYhwkgASgLMhguYnVmLnZhbGlkYXRlLk9uZW9mUnVsZXNSBW9uZW9mOk4KBWZpZWxkEh0uZ29vZ2xlLnByb3RvYnVmLkZpZWxkT3B0aW9ucxiHCSABKAsyGC5idWYudmFsaWRhdGUuRmllbGRSdWxlc1IFZmllbGQ6XQoKcHJlZGVmaW5lZBIdLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE9wdGlvbnMYiAkgASgLMh0uYnVmLnZhbGlkYXRlLlByZWRlZmluZWRSdWxlc1IKcHJlZGVmaW5lZEJuChJidWlsZC5idWYudmFsaWRhdGVCDVZhbGlkYXRlUHJvdG9QAVpHYnVmLmJ1aWxkL2dlbi9nby9idWZidWlsZC9wcm90b3ZhbGlkYXRlL3Byb3RvY29sYnVmZmVycy9nby9idWYvdmFsaWRhdGU",[file_google_protobuf_descriptor2,file_google_protobuf_duration2,file_google_protobuf_field_mask2,file_google_protobuf_timestamp2]),RuleSchema=messageDesc3(file_buf_validate_validate2,0);var FieldRulesSchema=messageDesc3(file_buf_validate_validate2,4);var FloatRulesSchema=messageDesc3(file_buf_validate_validate2,6),DoubleRulesSchema=messageDesc3(file_buf_validate_validate2,7),Int32RulesSchema=messageDesc3(file_buf_validate_validate2,8),Int64RulesSchema=messageDesc3(file_buf_validate_validate2,9),UInt32RulesSchema=messageDesc3(file_buf_validate_validate2,10),UInt64RulesSchema=messageDesc3(file_buf_validate_validate2,11),SInt32RulesSchema=messageDesc3(file_buf_validate_validate2,12),SInt64RulesSchema=messageDesc3(file_buf_validate_validate2,13),Fixed32RulesSchema=messageDesc3(file_buf_validate_validate2,14),Fixed64RulesSchema=messageDesc3(file_buf_validate_validate2,15),SFixed32RulesSchema=messageDesc3(file_buf_validate_validate2,16),SFixed64RulesSchema=messageDesc3(file_buf_validate_validate2,17),BoolRulesSchema=messageDesc3(file_buf_validate_validate2,18),StringRulesSchema=messageDesc3(file_buf_validate_validate2,19),BytesRulesSchema=messageDesc3(file_buf_validate_validate2,20),EnumRulesSchema=messageDesc3(file_buf_validate_validate2,21),RepeatedRulesSchema=messageDesc3(file_buf_validate_validate2,22),MapRulesSchema=messageDesc3(file_buf_validate_validate2,23),AnyRulesSchema=messageDesc3(file_buf_validate_validate2,24),DurationRulesSchema=messageDesc3(file_buf_validate_validate2,25),FieldMaskRulesSchema=messageDesc3(file_buf_validate_validate2,26),TimestampRulesSchema=messageDesc3(file_buf_validate_validate2,27);var ViolationSchema=messageDesc3(file_buf_validate_validate2,29),FieldPathSchema=messageDesc3(file_buf_validate_validate2,30),FieldPathElementSchema=messageDesc3(file_buf_validate_validate2,31),Ignore2;(function(Ignore3){Ignore3[Ignore3.UNSPECIFIED=0]="UNSPECIFIED",Ignore3[Ignore3.IF_ZERO_VALUE=1]="IF_ZERO_VALUE",Ignore3[Ignore3.ALWAYS=3]="ALWAYS"})(Ignore2||(Ignore2={}));var KnownRegex2;(function(KnownRegex3){KnownRegex3[KnownRegex3.UNSPECIFIED=0]="UNSPECIFIED",KnownRegex3[KnownRegex3.HTTP_HEADER_NAME=1]="HTTP_HEADER_NAME",KnownRegex3[KnownRegex3.HTTP_HEADER_VALUE=2]="HTTP_HEADER_VALUE"})(KnownRegex2||(KnownRegex2={}));var message=extDesc2(file_buf_validate_validate2,0),oneof=extDesc2(file_buf_validate_validate2,1),field=extDesc2(file_buf_validate_validate2,2),predefined=extDesc2(file_buf_validate_validate2,3);var CompilationError=class extends Error{constructor(message6,options){super(message6,options),this.name="CompilationError",Object.setPrototypeOf(this,new.target.prototype)}},RuntimeError=class extends Error{constructor(message6,options){super(message6,options),this.name="RuntimeError",Object.setPrototypeOf(this,new.target.prototype)}},ValidationError=class extends Error{constructor(violations){super(validationErrorMessage(violations)),this.name="ValidationError",Object.setPrototypeOf(this,new.target.prototype),this.violations=violations}};function validationErrorMessage(violations){return violations.length==0?"validation failed":violations.length==1?violations[0].toString():violations[0].toString()+`, and ${violations.length-1} more violation${violations.length>2?"s":""}`}var Violation=class{constructor(message6,ruleId,field3,rule,forKey){this.message=message6,this.ruleId=ruleId,this.field=field3,this.rule=rule,this.forKey=forKey}toString(){let path14=pathToString(this.field);return path14.length>0&&(path14+=": "),path14+`${this.message} [${this.ruleId}]`}};function violationToProto(violation){return[create2(ViolationSchema,{field:violation.field.length>0?pathToProto(violation.field):void 0,rule:violation.rule.length>0?pathToProto(violation.rule):void 0,ruleId:violation.ruleId,message:violation.message.length>0?violation.message:void 0,forKey:violation.forKey}),ViolationSchema]}function pathToProto(path14){let elements=[];for(let[i6,e6]of path14.entries())switch(e6.kind){case"field":elements.push(create2(FieldPathElementSchema,{fieldName:e6.name,fieldNumber:e6.number,fieldType:fieldType(e6)}));break;case"extension":elements.push(create2(FieldPathElementSchema,{fieldName:"["+e6.typeName+"]",fieldNumber:e6.number,fieldType:e6.proto.type}));break;case"oneof":elements.push(create2(FieldPathElementSchema,{fieldName:e6.name}));break;case"list_sub":{let prevProto=elements[elements.length-1];if(prevProto){let prevPath=path14[i6-1];prevProto.subscript=getListSub(e6.index,prevPath)}break}case"map_sub":{let prevProto=elements[elements.length-1];if(prevProto){let prevPath=path14[i6-1];setMapSub(prevProto,e6.key,prevPath)}break}}return create2(FieldPathSchema,{elements})}function fieldType(field3){return field3.fieldKind=="message"&&field3.delimitedEncoding?FieldDescriptorProto_Type2.GROUP:field3.proto.type}function getListSub(index2,prevPath){return prevPath?.kind=="field"&&prevPath.fieldKind=="list"?{case:"index",value:BigInt(index2)}:{case:void 0}}function setMapSub(proto2,key,prevPath){if(!(prevPath?.kind!="field"||prevPath.fieldKind!="map")){switch(proto2.keyType=prevPath.mapKey,prevPath.mapKind){case"scalar":proto2.valueType=prevPath.scalar;break;case"enum":proto2.valueType=FieldDescriptorProto_Type2.ENUM;break;case"message":proto2.valueType=FieldDescriptorProto_Type2.MESSAGE;break}switch(typeof key){case"boolean":prevPath.mapKey===ScalarType2.BOOL&&(proto2.subscript={case:"boolKey",value:key});break;case"string":prevPath.mapKey===ScalarType2.STRING&&(proto2.subscript={case:"stringKey",value:key});break;case"number":case"bigint":switch(prevPath.mapKey){case ScalarType2.INT32:case ScalarType2.SINT32:case ScalarType2.SFIXED32:case ScalarType2.INT64:case ScalarType2.SINT64:case ScalarType2.SFIXED64:proto2.subscript={case:"intKey",value:BigInt(key)};break;case ScalarType2.UINT32:case ScalarType2.FIXED32:case ScalarType2.UINT64:case ScalarType2.FIXED64:proto2.subscript={case:"uintKey",value:BigInt(key)};break}break}}}var Cursor=class _Cursor{static create(root5,failFast){return new _Cursor(root5,failFast,[],buildPath(root5))}constructor(root5,failFast,violations,builder2){this.root=root5,this.failFast=failFast,this.violations=violations,this.builder=builder2}get violated(){return this.violations.length>0}violate(message6,ruleId,rulePath,forMapKey=!1){this.violations.push(new Violation(message6,ruleId,this.builder.toPath(),rulePath,forMapKey)),this.failFast&&this.throwIfViolated()}throwIfViolated(){if(this.violated)throw new ValidationError(this.violations)}getPath(){return this.builder.toPath()}add(path14){return this.cloneWith(this.builder.clone().add(path14))}field(field3){return this.cloneWith(this.builder.clone().field(field3))}oneof(oneof2){return this.cloneWith(this.builder.clone().oneof(oneof2))}extension(ext){return this.cloneWith(this.builder.clone().extension(ext))}list(index2){return this.cloneWith(this.builder.clone().list(index2))}mapKey(key){return this.cloneWith(this.builder.clone().map(key))}cloneWith(path14){return new _Cursor(this.root,this.failFast,this.violations,path14)}};var EvalNoop=class _EvalNoop{static get(){return _EvalNoop.instance}eval(){}prune(){return!0}};EvalNoop.instance=new EvalNoop;var EvalMany=class{constructor(...evals){this.many=evals.flat()}add(...evals){return this.many.push(...evals),this}eval(val,cursor){for(let e6 of this.many)e6.eval(val,cursor)}prune(){return this.many=this.many.filter(e6=>!e6.prune()),this.many.length==0}},EvalListItems=class{constructor(condition,pass2){this.condition=condition,this.pass=pass2}eval(val,cursor){for(let i6=0;i6<val.size;i6++){let t=val.get(i6);this.condition.check(t)&&this.pass.eval(t,cursor.list(i6))}}prune(){return this.pass.prune()||this.condition.never}},EvalMapEntries=class{constructor(keyCondition,key,valueCondition,value){this.keyCondition=keyCondition,this.key=key,this.valueCondition=valueCondition,this.value=value}eval(val,cursor){if(!(this.keyCondition.never&&this.valueCondition.never))for(let[key,value]of val){let c5=cursor.mapKey(key);this.keyCondition.check(key)&&this.key.eval(key,c5),this.valueCondition.check(value)&&this.value.eval(value,c5)}}prune(){let key=this.key.prune()||this.keyCondition.never,value=this.value.prune()||this.valueCondition.never;return key&&value}},EvalField=class{constructor(field3,required,legacyRequired,condition,pass2){this.field=field3,this.required=required,this.legacyRequired=legacyRequired,this.condition=condition,this.pass=pass2}eval(val,cursor){if((this.required||this.legacyRequired)&&!val.isSet(this.field)){this.required?cursor.field(this.field).violate("value is required","required",[FieldRulesSchema.field.required]):cursor.field(this.field).violate("value is required","legacy_required",[]);return}if(this.condition.check(val)){let fieldVal=val.get(this.field);this.pass.eval(fieldVal,cursor.field(this.field))}}prune(){return this.condition.never&&!this.required&&!this.legacyRequired}},EvalOneofRequired=class{constructor(oneof2){this.oneof=oneof2}eval(val,cursor){this.oneof.fields.some(f5=>val.isSet(f5))||cursor.oneof(this.oneof).violate("exactly one field is required in oneof","required",[])}prune(){return!1}},EvalEnumDefinedOnly=class{constructor(descEnum,rulePath,rules){this.rulePath=rulePath,this.definedOnly=rules.definedOnly?new Set(descEnum.values.map(v=>v.number)):void 0}eval(val,cursor){this.definedOnly!==void 0&&!this.definedOnly.has(val)&&cursor.violate("value must be one of the defined enum values","enum.defined_only",this.rulePath.clone().field(EnumRulesSchema.field.definedOnly).toPath())}prune(){return this.definedOnly==null}},EvalAnyRules=class{constructor(rulePath,rules){this.rulePath=rulePath,this.in=rules.in,this.notIn=rules.notIn}eval(val,cursor){let any=val.message;this.in.length>0&&!this.in.includes(any.typeUrl)&&cursor.violate("type URL must be in the allow list","any.in",this.rulePath.clone().field(AnyRulesSchema.field.in).toPath()),this.notIn.length>0&&this.notIn.includes(any.typeUrl)&&cursor.violate("type URL must not be in the block list","any.not_in",this.rulePath.clone().field(AnyRulesSchema.field.notIn).toPath())}prune(){return this.in.length+this.notIn.length==0}},EvalMessageOneofRule=class{constructor(fields2,required){this.fields=fields2,this.required=required}eval(val,cursor){let setFields=this.fields.filter(field3=>val.isSet(field3));if(setFields.length>1){let oneofNames=this.fields.map(f5=>f5.name).join(", ");cursor.violate(`only one of ${oneofNames} can be set`,"message.oneof",[])}if(this.required&&setFields.length==0){let oneofNames=this.fields.map(f5=>f5.name).join(", ");cursor.violate(`one of ${oneofNames} must be set`,"message.oneof",[])}}prune(){return this.fields.length==0}};var messageToRuleType=new Map([[AnySchema.typeName,"any"],[DurationSchema.typeName,"duration"],[TimestampSchema.typeName,"timestamp"],[FloatValueSchema.typeName,"float"],[DoubleValueSchema.typeName,"double"],[Int32ValueSchema.typeName,"int32"],[Int64ValueSchema.typeName,"int64"],[UInt32ValueSchema.typeName,"uint32"],[UInt64ValueSchema.typeName,"uint64"],[BoolValueSchema.typeName,"bool"],[StringValueSchema.typeName,"string"],[FieldMaskSchema.typeName,"fieldMask"],[BytesValueSchema.typeName,"bytes"]]),scalarToRuleType=new Map([[ScalarType2.FLOAT,"float"],[ScalarType2.DOUBLE,"double"],[ScalarType2.INT32,"int32"],[ScalarType2.INT64,"int64"],[ScalarType2.UINT32,"uint32"],[ScalarType2.UINT64,"uint64"],[ScalarType2.SINT32,"sint32"],[ScalarType2.SINT64,"sint64"],[ScalarType2.FIXED32,"fixed32"],[ScalarType2.FIXED64,"fixed64"],[ScalarType2.SFIXED32,"sfixed32"],[ScalarType2.SFIXED64,"sfixed64"],[ScalarType2.BOOL,"bool"],[ScalarType2.STRING,"string"],[ScalarType2.BYTES,"bytes"]]),ruleMessageTypeToScalarType=new Map([[DoubleRulesSchema.typeName,ScalarType2.DOUBLE],[FloatRulesSchema.typeName,ScalarType2.FLOAT],[Int64RulesSchema.typeName,ScalarType2.INT64],[UInt64RulesSchema.typeName,ScalarType2.UINT64],[Int32RulesSchema.typeName,ScalarType2.INT32],[Fixed64RulesSchema.typeName,ScalarType2.FIXED64],[Fixed32RulesSchema.typeName,ScalarType2.FIXED32],[BoolRulesSchema.typeName,ScalarType2.BOOL],[BytesRulesSchema.typeName,ScalarType2.BYTES],[UInt32RulesSchema.typeName,ScalarType2.UINT32],[SFixed32RulesSchema.typeName,ScalarType2.SFIXED32],[SFixed64RulesSchema.typeName,ScalarType2.SFIXED64],[SInt32RulesSchema.typeName,ScalarType2.SINT32],[SInt64RulesSchema.typeName,ScalarType2.SINT64]]);function getRuleScalarType(rule){return ruleMessageTypeToScalarType.get(rule.$typeName)}function getRuleDescriptor(typeName){for(let d5 of[FloatRulesSchema,DoubleRulesSchema,Int32RulesSchema,Int64RulesSchema,UInt32RulesSchema,UInt64RulesSchema,SInt32RulesSchema,SInt64RulesSchema,Fixed32RulesSchema,Fixed64RulesSchema,SFixed32RulesSchema,SFixed64RulesSchema,BoolRulesSchema,StringRulesSchema,BytesRulesSchema,EnumRulesSchema,RepeatedRulesSchema,MapRulesSchema,AnyRulesSchema,DurationRulesSchema,FieldMaskRulesSchema,TimestampRulesSchema])if(typeName==d5.typeName)return d5;throw new Error(`unable to find descriptor for ${typeName}`)}function getListRules(rulePath,fieldRules,fieldContext){let listRules=getRulePath(rulePath,"repeated");return[getRules(fieldRules,"repeated",fieldContext),listRules,listRules.clone().field(RepeatedRulesSchema.field.items)]}function getMapRules(rulePath,fieldRules,fieldContext){let mapRules=getRulePath(rulePath,"map");return[getRules(fieldRules,"map",fieldContext),mapRules,mapRules.clone().field(MapRulesSchema.field.keys),mapRules.clone().field(MapRulesSchema.field.values)]}function getEnumRules(rulePath,fieldRules,fieldContext){return[getRules(fieldRules,"enum",fieldContext),getRulePath(rulePath,"enum")]}function getMessageRules(descMessage,rulePath,fieldRules,fieldContext){let type2=messageToRuleType.get(descMessage.typeName);return[getRules(fieldRules,type2,fieldContext),getRulePath(rulePath,type2)]}function getScalarRules(scalar,rulePath,fieldRules,fieldContext){let type2=scalarToRuleType.get(scalar);return[getRules(fieldRules,type2,fieldContext),getRulePath(rulePath,type2)]}function getRulePath(base,type2){if(type2==null)return base;let field3=FieldRulesSchema.field[type2];if(field3==null)throw new CompilationError(`cannot find rule "${type2}"`);return base.clone().field(field3)}function getRules(fieldRules,want,context2){let got=fieldRules?.type.case;if(!(fieldRules==null||got==null)){if(got!=want)throw new CompilationError(want==null?`rule "${got}" cannot be used on ${context2.toString()}`:`expected rule "${want}", got "${got}" on ${context2.toString()}`);return fieldRules.type.value}}var always={check(){return!0},always:!0,never:!1},never={check(){return!1},always:!1,never:!0};function ignoreListOrMapField(field3,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new FieldIsSet(field3);case Ignore2.ALWAYS:return never}}function ignoreMessageField(field3,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:case Ignore2.IF_ZERO_VALUE:return new FieldIsSet(field3);case Ignore2.ALWAYS:return never}}function ignoreScalarOrEnumField(field3,ignore){if(ignore==Ignore2.ALWAYS)return never;if(field3.presence==FeatureSet_FieldPresence2.IMPLICIT)switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new FieldIsSet(field3)}return new FieldIsSet(field3)}function ignoreEnumValue(enu,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new ScalarNot(ScalarType2.INT32,enu.values[0].number);case Ignore2.ALWAYS:return never}}function ignoreScalarValue(scalar,ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:return always;case Ignore2.IF_ZERO_VALUE:return new ScalarNot(scalar,scalarZeroValue2(scalar,!1));case Ignore2.ALWAYS:return never}}function ignoreMessageValue(ignore){switch(ignore){case void 0:case Ignore2.UNSPECIFIED:case Ignore2.IF_ZERO_VALUE:return always;case Ignore2.ALWAYS:return never}}var ScalarNot=class{constructor(scalar,not2){this.scalar=scalar,this.not=not2,this.always=!1,this.never=!1}check(val){return!scalarEquals(this.scalar,this.not,val)}},FieldIsSet=class{constructor(field3){this.field=field3,this.always=!1,this.never=!1}check(val){return val.isSet(this.field)}};var privateSymbol=Symbol.for("@bufbuild/cel/error");function celError(value,exprId){return isCelError(value)?value:(typeof exprId=="number"&&(exprId=BigInt(exprId)),value instanceof Error?new _CelError(value.message,value,exprId):typeof value=="string"?new _CelError(value,void 0,exprId):new _CelError(`${value}`,value,exprId))}function celErrorMerge(first,...rest){return new _CelError(first.message,rest,first.exprId)}function isCelError(v){return typeof v=="object"&&v!==null&&privateSymbol in v}var _CelError=class extends Error{_cause;_exprId;[privateSymbol]={};constructor(message6,_cause,_exprId){super(message6),this._cause=_cause,this._exprId=_exprId}get exprId(){return this._exprId}get cause(){return this._cause}};var privateSymbol2=Symbol.for("@bufbuild/cel/uint");function celUint(v){return new Uint(v)}function isCelUint(v){return typeof v=="object"&&v!==null&&privateSymbol2 in v}var Uint=class{_value;[privateSymbol2]={};constructor(_value){this._value=_value}get value(){return this._value}};function celFromScalar(type2,v){switch(type2){case ScalarType2.UINT32:case ScalarType2.UINT64:case ScalarType2.FIXED32:case ScalarType2.FIXED64:return celUint(BigInt(v));case ScalarType2.INT32:case ScalarType2.SINT32:case ScalarType2.SFIXED32:return BigInt(v);default:return v}}var privateSymbol3=Symbol.for("@bufbuild/cel/list");function celList(arrayOrReflectList){return isReflectList2(arrayOrReflectList)?new RepeatedFieldList(arrayOrReflectList):new ArrayList(arrayOrReflectList)}function celListConcat(...lists){return new ConcatList(lists)}function isCelList(v){return typeof v=="object"&&v!==null&&privateSymbol3 in v}var ArrayList=class{_array;[privateSymbol3]={};constructor(_array){this._array=_array}get size(){return this._array.length}get(index2){if(!(index2<0||index2>=this.size))return toCel(this._array[index2])}*values(){for(let element of this._array.values())yield toCel(element)}[Symbol.iterator](){return this.values()}},RepeatedFieldList=class{_list;[privateSymbol3]={};constructor(_list){this._list=_list}get size(){return this._list.size}get(index2){let val=this._list.get(index2);if(val!==void 0)return celFromListElem(this._list.field(),val)}*values(){for(let val of this._list)yield celFromListElem(this._list.field(),val)}[Symbol.iterator](){return this.values()}},ConcatList=class{_lists;[privateSymbol3]={};_size;constructor(_lists){this._lists=_lists;let size=0;for(let list12 of _lists)size+=list12.size;this._size=size}get size(){return this._size}get(index2){if(!(index2<0||index2>=this.size))for(let list12 of this._lists){if(index2<list12.size)return list12.get(index2);index2=index2-list12.size}}*values(){for(let list12 of this._lists)yield*list12.values()}[Symbol.iterator](){return this.values()}};function celFromListElem(desc,v){switch(desc.listKind){case"enum":return BigInt(v);case"message":return reflectMsgToCel(v);case"scalar":return celFromScalar(desc.scalar,v)}}var EMPTY_LIST=celList([]);var contextStack=[];function setEvalContext(context2){return contextStack.push(context2),()=>contextStack.pop()}function getEvalContext(){if(contextStack.length===0)throw new Error("cannot use `getEvalContext` outside of an evaluation");return contextStack[contextStack.length-1]}function withEvalContext(context2,next){return{id:next.id,eval(ctx){let unset=setEvalContext(context2);try{return next.eval(ctx)}finally{unset()}}}}function getMsgDesc(typeName){let schema2=getEvalContext().registry.getMessage(typeName);if(!schema2)throw new Error(`Message ${typeName} not found in registry`);return schema2}var privateSymbol4=Symbol.for("@bufbuild/cel/type"),CelScalar={INT:celScalarType("int"),UINT:celScalarType("uint"),BOOL:celScalarType("bool"),STRING:celScalarType("string"),BYTES:celScalarType("bytes"),DOUBLE:celScalarType("double"),NULL:celScalarType("null_type"),DYN:celScalarType("dyn"),TYPE:celScalarType("type")},TIMESTAMP=objectType(TimestampSchema),DURATION=objectType(DurationSchema);function mapType(key,value){return{[privateSymbol4]:{},kind:"map",key,value,name:"map",toString(){return`map(${key}, ${value})`}}}function listType(element){return{[privateSymbol4]:{},kind:"list",element,name:"list",toString(){return`list(${element})`}}}function objectType(descOrTypeName){let name,desc;return typeof descOrTypeName=="string"?(name=descOrTypeName,desc=void 0):(name=descOrTypeName.typeName,desc=descOrTypeName),{[privateSymbol4]:{},kind:"object",desc,name,toString(){return name}}}function celScalarType(scalar){return{[privateSymbol4]:{},kind:"scalar",scalar,name:scalar,toString(){return scalar}}}function celType(v){switch(typeof v){case"bigint":return CelScalar.INT;case"boolean":return CelScalar.BOOL;case"number":return CelScalar.DOUBLE;case"string":return CelScalar.STRING;case"object":switch(!0){case v===null:return CelScalar.NULL;case v instanceof Uint8Array:return CelScalar.BYTES;case isReflectMessage2(v):return celTypeOfMessage(v);case isCelList(v):return listType(CelScalar.DYN);case isCelMap(v):return mapType(CelScalar.DYN,CelScalar.DYN);case isCelUint(v):return CelScalar.UINT;default:if(isObjectCelType(v))return CelScalar.TYPE}}throw new Error(`Not a CEL value: ${v}`)}function isCelType(v){return typeof v=="object"&&v!==null&&isObjectCelType(v)}function isObjectCelType(v){return privateSymbol4 in v}function celTypeOfMessage(v){let typeName=v.desc.typeName;if(isReflectMessageAny(v)&&(typeName=typeUrlToName2(v.message.typeUrl),typeName===ValueSchema.typeName)){let value=anyUnpack(v.message,ValueSchema);return value?valueToType(value):CelScalar.NULL}switch(typeName){case FloatValueSchema.typeName:case DoubleValueSchema.typeName:return CelScalar.DOUBLE;case UInt64ValueSchema.typeName:case UInt32ValueSchema.typeName:return CelScalar.UINT;case Int32ValueSchema.typeName:case Int64ValueSchema.typeName:return CelScalar.INT;case StringValueSchema.typeName:return CelScalar.STRING;case BytesValueSchema.typeName:return CelScalar.BYTES;case BoolValueSchema.typeName:return CelScalar.BOOL;case StructSchema.typeName:return mapType(CelScalar.STRING,CelScalar.DYN);case ListValueSchema.typeName:return listType(CelScalar.DYN);case ValueSchema.typeName:return valueToType(v.message)}return typeName===v.desc.typeName?objectType(v.desc):objectType(typeName)}function valueToType(v){switch(v.kind.case){case"boolValue":return CelScalar.BOOL;case"listValue":return listType(CelScalar.DYN);case"nullValue":case void 0:return CelScalar.NULL;case"numberValue":return CelScalar.DOUBLE;case"stringValue":return CelScalar.STRING;case"structValue":return mapType(CelScalar.STRING,CelScalar.DYN)}}function isReflectMessageAny(v){return v.desc.typeName===AnySchema.typeName}function typeUrlToName2(url){let slash=url.lastIndexOf("/"),name=slash>=0?url.substring(slash+1):url;if(!name.length)throw new Error(`invalid type url: ${url}`);return name}function toCel(v){switch(typeof v){case"bigint":case"boolean":case"number":case"string":return v;case"object":break;default:throw new Error(`unsupported input ${typeof v}`)}switch(!0){case v===null:case v instanceof Uint8Array:case isCelList(v):case isCelMap(v):case isCelUint(v):case isCelType(v):return v}if(isArray(v)||isReflectList2(v))return celList(v);if(isMap(v)||isReflectMap2(v))return celMap(v);if(isMessage2(v)){let value=wktToCel(v);return value!==void 0?value:reflect2(getMsgDesc(v.$typeName),v)}if(isReflectMessage2(v))return reflectMsgToCel(v);if(v.constructor.name==="Object")return celMap(new Map(Object.entries(v)));throw new Error(`Unsupported input ${v}`)}function unwrapAny(v){if(!isReflectAny(v))return v;let unpacked=anyUnpack(v.message,getEvalContext().registry);if(unpacked===void 0)throw new Error(`invalid Any or ${v.message.typeUrl} not found in registry`);let value=wktToCel(unpacked);return value!==void 0?value:reflect2(getMsgDesc(unpacked.$typeName),unpacked)}function reflectMsgToCel(v){let value=wktToCel(v.message);return value!==void 0?value:v}function isReflectAny(v){return isReflectMessage2(v,AnySchema)}function isArray(v){return Array.isArray(v)}function isMap(v){return v instanceof Map}function wktToCel(msg){return isWrapper2(msg)?unwrapWrapper(msg):jsonWrapperToCel(msg)}function unwrapWrapper(v){switch(v.$typeName){case Int32ValueSchema.typeName:return BigInt(v.value);case UInt32ValueSchema.typeName:return celUint(BigInt(v.value));case UInt64ValueSchema.typeName:return celUint(v.value)}return v.value}function jsonWrapperToCel(msg){switch(!0){case isMessage2(msg,StructSchema):return structToCel(msg);case isMessage2(msg,ValueSchema):return valueToCel(msg);case isMessage2(msg,ListValueSchema):return listValueToCel(msg)}}function structToCel(s2){let map5=new Map;for(let[k5,v]of Object.entries(s2.fields))map5.set(k5,valueToCel(v));return celMap(map5)}function valueToCel(v){switch(v.kind.case){case"boolValue":case"numberValue":case"stringValue":return v.kind.value;case"nullValue":case void 0:return null;case"structValue":return structToCel(v.kind.value);case"listValue":return listValueToCel(v.kind.value)}}function listValueToCel(l3){return celList(l3.values)}var privateSymbol5=Symbol.for("@bufbuild/cel/map");function celMap(mapOrReflectMap){return isReflectMap2(mapOrReflectMap)?new ProtoMap(mapOrReflectMap):new NativeMap(mapOrReflectMap)}function isCelMap(v){return typeof v=="object"&&v!==null&&privateSymbol5 in v}var NativeMap=class{_map;[privateSymbol5]={};constructor(_map){this._map=_map}get size(){return this._map.size}get(key){if(isCelUint(key)&&(key=key.value),typeof key=="number"){if(!Number.isInteger(key))return;key=BigInt(key)}let value=this._map.get(key);if(value!==void 0)return toCel(value);if(typeof key=="bigint"){for(let mapKey of this._map.keys())if(isCelUint(mapKey)&&mapKey.value===key)return toCel(this._map.get(mapKey))}}has(key){return this.get(key)!=null}forEach(callback,thisArg){this._map.forEach((value,key,_)=>callback.call(thisArg,toCel(value),key,this))}*entries(){for(let[key,value]of this._map.entries())yield[key,toCel(value)]}keys(){return this._map.keys()}*values(){for(let value of this._map.values())yield toCel(value)}[Symbol.iterator](){return this.entries()}},ProtoMap=class{_map;[privateSymbol5]={};constructor(_map){this._map=_map}get size(){return this._map.size}get(key){let value=this._map.get(mapKeyFromCel(this._map.field(),key));if(value!==void 0)return celFromMapValue(this._map.field(),value)}has(key){return this._map.has(mapKeyFromCel(this._map.field(),key))}forEach(callback,thisArg){this._map.forEach((value,key,_)=>callback.call(thisArg,celFromMapValue(this._map.field(),value),celFromMapKey(this._map.field(),key),this))}*entries(){for(let[key,value]of this._map.entries())yield[celFromMapKey(this._map.field(),key),celFromMapValue(this._map.field(),value)]}*keys(){for(let key of this._map.keys())yield celFromMapKey(this._map.field(),key)}*values(){for(let value of this._map.keys())yield celFromMapValue(this._map.field(),value)}[Symbol.iterator](){return this.entries()}};function mapKeyFromCel(desc,v){switch(isCelUint(v)&&(v=v.value),desc.mapKey){case ScalarType2.SINT32:case ScalarType2.INT32:case ScalarType2.FIXED32:case ScalarType2.UINT32:case ScalarType2.SFIXED32:return typeof v=="bigint"?Number(v):v;case ScalarType2.SINT64:case ScalarType2.INT64:case ScalarType2.FIXED64:case ScalarType2.UINT64:case ScalarType2.SFIXED64:return v==="number"&&Number.isInteger(v)?BigInt(v):v;default:return v}}function celFromMapKey(desc,v){return celFromScalar(desc.mapKey,v)}function celFromMapValue(desc,v){switch(desc.mapKind){case"enum":return BigInt(v);case"message":return reflectMsgToCel(v);case"scalar":return celFromScalar(desc.scalar,v)}}var EMPTY_MAP=celMap(new Map);var wktRegistry=createRegistry(TimestampSchema,DurationSchema,AnySchema,file_google_protobuf_wrappers,file_google_protobuf_struct2);function createRegistryWithWKT(...inputs){return createRegistry(wktRegistry,...inputs)}var Namespace=class _Namespace{_name;_aliases;constructor(name=""){this._name=name,this._aliases=new Map}static ROOT=new _Namespace;name(){return this._name}aliases(){return this._aliases}resolveCandidateNames(name){if(name.startsWith(".")){let qn=name.substring(1),alias2=this.findAlias(qn);return alias2!==void 0?[alias2]:[qn]}let alias=this.findAlias(name);if(alias!==void 0)return[alias];if(this.name()==="")return[name];let nextCont=this.name(),candidates=[nextCont+"."+name];for(let i6=nextCont.lastIndexOf(".");i6>=0;i6=nextCont.lastIndexOf("."))nextCont=nextCont.substring(0,i6),candidates.push(nextCont+"."+name);return candidates.push(name),candidates}findAlias(name){let simple=name,qualifier="",dot=name.indexOf(".");dot>=0&&(simple=name.substring(0,dot),qualifier=name.substring(dot));let alias=this._aliases.get(simple);if(alias!==void 0)return alias+qualifier}};var privateSymbol6=Symbol.for("@bufbuild/cel/resolver");function createResolver(...inputs){let groups=new Map;for(let input of inputs){let funcs=isFuncResolver(input)||Array.isArray(input)?input:[input];for(let func of funcs){let group4=groups.get(func.name);group4===void 0&&(group4=[],groups.set(func.name,group4)),group4.push(func)}}return new Resolver(new Map(new Array(...groups.entries()).map(([name,funcs])=>[name,createFuncGroup(name,funcs)])))}function isFuncResolver(v){return typeof v=="object"&&v!==null&&privateSymbol6 in v}var Resolver=class{_groups;[privateSymbol6]={};constructor(_groups){this._groups=_groups}*[Symbol.iterator](){for(let group4 of this._groups.values())yield*group4}find(name){return this._groups.get(name)}};function createFuncGroup(name,funcs){let set2=[];for(let func of funcs){for(let i6=0;i6<set2.length;i6++)if(func.id===set2[i6].id){set2.splice(i6,1);break}set2.push(func)}return new Group(name,set2)}var Group=class{_name;_funcs;constructor(_name,_funcs){this._name=_name,this._funcs=_funcs}*[Symbol.iterator](){yield*this._funcs}get name(){return this._name}call(id,target,args){args=args.map(arg=>unwrapAny(arg));for(let func of this._funcs){let result=func.call(id,target,args);if(result!==void 0)return result}}};var CONDITIONAL="_?_:_";var EQUALS="_==_";var GREATER_EQUALS="_>=_";var INDEX="_[_]";var LESS_EQUALS="_<=_",LOGICAL_AND="_&&_";var LOGICAL_OR="_||_";var NOT_EQUALS="_!=_",NOT_STRICTLY_FALSE="@not_strictly_false";var OLD_NOT_STRICTLY_FALSE="__not_strictly_false__",OPT_INDEX="_[?_]",OPT_SELECT="_?._";var ONE_SECOND=1000000000n,MAX_DURATION_NANOS=9223372036854775807n,MIN_DURATION_NANOS=-9223372036854775808n;function createDuration(seconds=0n,ns=0n){let fullNanos=seconds*ONE_SECOND+BigInt(ns);if(fullNanos>MAX_DURATION_NANOS||fullNanos<MIN_DURATION_NANOS)throw new Error("duration out of range");return create2(DurationSchema,{seconds:fullNanos/ONE_SECOND,nanos:Number(fullNanos%ONE_SECOND)})}var DURATION_STRING_LENGTH_LIMIT=128,UNITS=Object.freeze({ns:1n,us:1000n,\u00B5s:1000n,ms:1000n*1000n,s:1000n*1000n*1000n,m:1000n*1000n*1000n*60n,h:1000n*1000n*1000n*60n*60n}),INT_REGEXP=/^\d+/,UNIT_REGEXP=new RegExp(`^(${Object.keys(UNITS).join("|")})`);function parseDuration(str2){if(str2.length>DURATION_STRING_LENGTH_LIMIT)throw badDurationStr(`duration string exceeds ${DURATION_STRING_LENGTH_LIMIT} characters`);if(/^[-+]?0$/.test(str2))return createDuration();let[sign4,values]=/^[+-]/.test(str2)?[str2[0]==="+"?1n:-1n,str2.slice(1)]:[1n,str2],fullNanos=0n,remainder=values;for(;remainder.length>0;){let int3=INT_REGEXP.exec(remainder)?.[0];remainder=remainder.slice(int3?.length??0),remainder[0]==="."&&(remainder=remainder.slice(1));let fraction=INT_REGEXP.exec(remainder)?.[0];remainder=remainder.slice(fraction?.length??0);let unit=UNIT_REGEXP.exec(remainder)?.[0];if(remainder=remainder.slice(unit?.length??0),(int3??fraction)===void 0||unit===void 0)throw badDurationStr("invalid syntax");let factor=UNITS[unit];fullNanos+=BigInt(int3??0)*factor,fullNanos+=BigInt(fraction??0)*factor/10n**BigInt(fraction?.length??0)}return createDuration(0n,sign4*fullNanos)}function badDurationStr(e6){return new Error(`Failed to parse duration: ${e6}`)}var MAX_TIMESTAMP_SECONDS=253402300799n,MIN_TIMESTAMP_SECONDS=-62135596800n,ONE_SECOND2=1000000000n;function createTimestamp(s2=0n,ns=0n){let fullNanos=s2*ONE_SECOND2+BigInt(ns),shift=fullNanos%ONE_SECOND2<0n?1n:0n,seconds=fullNanos/ONE_SECOND2-shift,nanos=Number(fullNanos%ONE_SECOND2+shift*ONE_SECOND2);if(seconds>MAX_TIMESTAMP_SECONDS||seconds<MIN_TIMESTAMP_SECONDS)throw new Error("timestamp out of range");return create2(TimestampSchema,{seconds,nanos})}function equals2(lhs,rhs){if(lhs===rhs)return!0;if(isCelUint(lhs)&&(lhs=lhs.value),isCelUint(rhs)&&(rhs=rhs.value),(typeof lhs=="number"||typeof lhs=="bigint")&&(typeof rhs=="number"||typeof rhs=="bigint"))return lhs==rhs;switch(!0){case lhs instanceof Uint8Array:return rhs instanceof Uint8Array&&equalsBytes(lhs,rhs);case isCelList(lhs):return isCelList(rhs)&&equalsList(lhs,rhs);case isCelMap(lhs):return isCelMap(rhs)&&equalsMap(lhs,rhs);case isCelType(lhs):return isCelType(rhs)&&equalsType(lhs,rhs)}return isReflectMessage2(lhs)?!isReflectMessage2(rhs)||lhs.desc.typeName!==rhs.desc.typeName?!1:equals(lhs.desc,lhs.message,rhs.message,{registry:getEvalContext().registry,unpackAny:!0,unknown:!0,extensions:!0}):!1}function equalsType(lhs,rhs){return lhs.kind===rhs.kind&&lhs.name===rhs.name}function equalsList(lhs,rhs){if(lhs.size!==rhs.size)return!1;for(let i6=0;i6<lhs.size;i6++)if(!equals2(lhs.get(i6),rhs.get(i6)))return!1;return!0}function equalsMap(lhs,rhs){if(lhs.size!==rhs.size)return!1;for(let[k5,v]of lhs){let rv=rhs.get(k5);if(rv===void 0||!equals2(v,rv))return!1}return!0}function equalsBytes(lhs,rhs){if(lhs.length!==rhs.length)return!1;for(let i6=0;i6<lhs.length;i6++)if(lhs[i6]!==rhs[i6])return!1;return!0}var privateSymbol7=Symbol.for("@bufbuild/cel/func");function celFunc(name,args,result,impl){return new Func(name,void 0,args,result,impl)}function celMethod(name,target,args,result,impl){return new Method(name,target,args,result,impl)}var Callable=class{_name;_target;_args;_result;_impl;_id;[privateSymbol7]={};constructor(_name,_target,_args,_result,_impl,_id=""){this._name=_name,this._target=_target,this._args=_args,this._result=_result,this._impl=_impl,this._id=_id}get id(){if(this._id===""){let qualifier=this.target?`${this.target.name}.`:"";this._id=`${qualifier}${this.name}(${this.arguments.map(p3=>p3.name).join(",")})`}return this._id}get name(){return this._name}get target(){return this._target}get arguments(){return this._args}get result(){return this._result}call(id,target,args){if(args.length==this.arguments.length){for(let i6=0;i6<args.length;i6++)if(!isSubtypeOf(args[i6],this.arguments[i6]))return;try{return toCel(this._impl.apply(target,args))}catch(ex){return celError(ex,id)}}}},Func=class extends Callable{call(id,target,args){if(target===void 0)return super.call(id,void 0,args)}},Method=class extends Callable{call(id,target,args){if(!(target===void 0||!isSubtypeOf(target,this.target)))return super.call(id,target,args)}};function isSubtypeOf(val,typ){return typ===CelScalar.DYN||equalsType(celType(val),typ)}var MAX_INT=9223372036854775807n,MIN_INT=-9223372036854775808n,MAX_UINT=18446744073709551615n;function safeInt(value,op2="type conversion"){let numeric=typeof value=="string"?BigInt(value):value;if(typeof numeric=="bigint"){if(numeric>=MIN_INT&&numeric<=MAX_INT)return numeric}else if(Number.isFinite(numeric)&&numeric>Number(MIN_INT)&&numeric<Number(MAX_INT))return BigInt(Math.trunc(numeric));throw celError(`int overflow during ${op2}`)}function safeUint(value,op2="type conversion"){let numeric=typeof value=="string"?BigInt(value):value;if(typeof numeric=="bigint"||Number.isFinite(numeric)){let int3=typeof numeric=="number"?BigInt(Math.trunc(numeric)):numeric;if(numeric>=0&&int3<=MAX_UINT)return celUint(int3)}throw celError(`uint overflow during ${op2}`)}function bytesConcat(l3,r5){let val=new Uint8Array(l3.length+r5.length);return val.set(l3),val.set(r5,l3.length),val}function timestampSum(l3,r5){return createTimestamp(l3.message.seconds+r5.message.seconds,l3.message.nanos+r5.message.nanos)}function durationSum(l3,r5){return createDuration(l3.message.seconds+r5.message.seconds,l3.message.nanos+r5.message.nanos)}function durationDifference(l3,r5){return createDuration(l3.message.seconds-r5.message.seconds,l3.message.nanos-r5.message.nanos)}function timestampDifference(l3,r5){return createTimestamp(l3.message.seconds-r5.message.seconds,l3.message.nanos-r5.message.nanos)}function safeDivide(type2,l3,r5){if(r5===0n)throw celError(`${type2.name} divide by zero`);return safeInt(l3/r5,`divide by ${r5}`)}function safeModulo(type2,l3,r5){if(r5===0n)throw celError(`${type2.name} modulus by zero`);return l3%r5}var LIST=listType(CelScalar.DYN),{BYTES,DOUBLE,INT,STRING,UINT}=CelScalar,math_default=[celFunc("_+_",[INT,INT],INT,(l3,r5)=>safeInt(l3+r5,"_+_")),celFunc("_+_",[UINT,UINT],UINT,(l3,r5)=>safeUint(l3.value+r5.value,"_+_")),celFunc("_+_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3+r5),celFunc("_+_",[DURATION,DURATION],DURATION,durationSum),celFunc("_+_",[TIMESTAMP,DURATION],TIMESTAMP,timestampSum),celFunc("_+_",[DURATION,TIMESTAMP],TIMESTAMP,timestampSum),celFunc("_+_",[STRING,STRING],STRING,(l3,r5)=>l3+r5),celFunc("_+_",[BYTES,BYTES],BYTES,bytesConcat),celFunc("_+_",[LIST,LIST],LIST,celListConcat),celFunc("_-_",[INT,INT],INT,(l3,r5)=>safeInt(l3-r5,"_-_")),celFunc("_-_",[UINT,UINT],UINT,(l3,r5)=>safeUint(l3.value-r5.value,"_-_")),celFunc("_-_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3-r5),celFunc("_-_",[TIMESTAMP,TIMESTAMP],DURATION,durationDifference),celFunc("_-_",[DURATION,DURATION],DURATION,durationDifference),celFunc("_-_",[TIMESTAMP,DURATION],TIMESTAMP,timestampDifference),celFunc("_*_",[INT,INT],INT,(l3,r5)=>safeInt(l3*r5,"_*_")),celFunc("_*_",[UINT,UINT],UINT,(l3,r5)=>safeUint(l3.value*r5.value,"_*_")),celFunc("_*_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3*r5),celFunc("_/_",[INT,INT],INT,(l3,r5)=>safeDivide(INT,l3,r5)),celFunc("_/_",[UINT,UINT],UINT,(l3,r5)=>celUint(safeDivide(UINT,l3.value,r5.value))),celFunc("_/_",[DOUBLE,DOUBLE],DOUBLE,(l3,r5)=>l3/r5),celFunc("_%_",[INT,INT],INT,(l3,r5)=>safeModulo(INT,l3,r5)),celFunc("_%_",[UINT,UINT],UINT,(l3,r5)=>celUint(safeModulo(UINT,l3.value,r5.value))),celFunc("-_",[INT],INT,x2=>safeInt(-x2)),celFunc("-_",[DOUBLE],DOUBLE,x2=>-x2)];var encoder=new TextEncoder,decoder=new TextDecoder(void 0,{fatal:!0});function stringToBool(x2){switch(x2){case"true":case"True":case"TRUE":case"t":case"1":return!0;case"false":case"False":case"FALSE":case"f":case"0":return!1}throw new Error(`Unable to convert string '${x2}' to bool`)}function bytesToString(x2){try{return decoder.decode(x2)}catch(e6){throw new Error(`Failed to decode bytes as string: ${e6}`)}}function stringToTimestamp(x2){try{return fromJson(TimestampSchema,x2)}catch(e6){throw new Error(`Failed to parse timestamp: ${e6}`)}}function toType(x2){return isMessage2(x2)?objectType(getMsgDesc(x2.$typeName)):celType(x2)}function identity(x2){return x2}var{BOOL,BYTES:BYTES2,DOUBLE:DOUBLE2,DYN,INT:INT2,STRING:STRING2,TYPE,UINT:UINT2}=CelScalar,cast_default=[celFunc("int",[INT2],INT2,identity),celFunc("int",[UINT2],INT2,x2=>safeInt(x2.value)),celFunc("int",[DOUBLE2],INT2,safeInt),celFunc("int",[STRING2],INT2,safeInt),celFunc("int",[TIMESTAMP],INT2,x2=>safeInt(x2.message.seconds)),celFunc("int",[DURATION],INT2,x2=>safeInt(x2.message.seconds)),celFunc("uint",[UINT2],UINT2,identity),celFunc("uint",[INT2],UINT2,safeUint),celFunc("uint",[DOUBLE2],UINT2,safeUint),celFunc("uint",[STRING2],UINT2,safeUint),celFunc("double",[DOUBLE2],DOUBLE2,identity),celFunc("double",[INT2],DOUBLE2,x2=>Number(x2)),celFunc("double",[UINT2],DOUBLE2,x2=>Number(x2.value)),celFunc("double",[STRING2],DOUBLE2,x2=>Number(x2)),celFunc("bool",[BOOL],BOOL,identity),celFunc("bool",[STRING2],BOOL,stringToBool),celFunc("bytes",[BYTES2],BYTES2,identity),celFunc("bytes",[STRING2],BYTES2,x2=>encoder.encode(x2)),celFunc("string",[STRING2],STRING2,identity),celFunc("string",[BOOL],STRING2,x2=>x2.toString()),celFunc("string",[INT2],STRING2,x2=>x2.toString()),celFunc("string",[UINT2],STRING2,x2=>x2.value.toString()),celFunc("string",[DOUBLE2],STRING2,x2=>x2.toString()),celFunc("string",[BYTES2],STRING2,bytesToString),celFunc("string",[TIMESTAMP],STRING2,x2=>toJson(TimestampSchema,x2.message)),celFunc("string",[DURATION],STRING2,x2=>toJson(DurationSchema,x2.message)),celFunc("timestamp",[TIMESTAMP],TIMESTAMP,identity),celFunc("timestamp",[STRING2],TIMESTAMP,stringToTimestamp),celFunc("timestamp",[INT2],TIMESTAMP,x2=>timestampFromMs(Number(x2))),celFunc("duration",[DURATION],DURATION,identity),celFunc("duration",[STRING2],DURATION,parseDuration),celFunc("duration",[INT2],DURATION,x2=>create2(DurationSchema,{seconds:x2})),celFunc("type",[DYN],TYPE,toType),celFunc("dyn",[DYN],DYN,identity)];var CONTAINS="contains";var ENDS_WITH="endsWith";var MATCHES="matches";var SIZE="size";var STARTS_WITH="startsWith";var TIME_GET_DATE="getDate",TIME_GET_DAY_OF_MONTH="getDayOfMonth",TIME_GET_DAY_OF_WEEK="getDayOfWeek",TIME_GET_DAY_OF_YEAR="getDayOfYear",TIME_GET_FULL_YEAR="getFullYear",TIME_GET_HOURS="getHours",TIME_GET_MILLISECONDS="getMilliseconds",TIME_GET_MINUTES="getMinutes",TIME_GET_MONTH="getMonth",TIME_GET_SECONDS="getSeconds";var invalidPatterns=[/\\[1-9]/,/\\k<.>/,/\(\?\=/,/\(\?\!/,/\(\?\<\=/,/\(\?\<\!/,/\\c[A-Z]/,/\\u[0-9a-fA-F]{4}/,/\\0(?!\d)/,/\[\\b.*\]/],flagPattern=new RegExp(/^\(\?(?<flags>[ims\-]+)\)/);function matches(pattern){for(let invalidPattern of invalidPatterns)if(invalidPattern.test(pattern))throw new Error(`Error evaluating pattern ${pattern}, invalid RE2 syntax`);let flags="",flagMatches=pattern.match(flagPattern);if(flagMatches){for(let flag of flagMatches?.groups?.flags??""){if(flag=="-")break;flags+=flag}pattern=pattern.substring(flagMatches[0].length)}return new RegExp(pattern,flags).test(this)}function compareDuration(lhs,rhs){let cmp=lhs.message.seconds-rhs.message.seconds;return cmp==0n?lhs.message.nanos-rhs.message.nanos:cmp<0n?-1:1}function compareTimestamp(lhs,rhs){let cmp=lhs.message.seconds-rhs.message.seconds;return cmp==0n?lhs.message.nanos-rhs.message.nanos:cmp<0n?-1:1}function compareBytes(lhs,rhs){let minLen=Math.min(lhs.length,rhs.length);for(let i6=0;i6<minLen;i6++){if(lhs[i6]<rhs[i6])return-1;if(lhs[i6]>rhs[i6])return 1}return lhs.length-rhs.length}function inList(value,list12){for(let v of list12)if(equals2(v,value))return!0;return!1}function inMap(value,map5){return map5.has(value)}var{BOOL:BOOL2,BYTES:BYTES3,DOUBLE:DOUBLE3,DYN:DYN2,INT:INT3,STRING:STRING3,UINT:UINT3}=CelScalar,LIST2=listType(CelScalar.DYN),MAP=mapType(CelScalar.DYN,CelScalar.DYN),logic_default=[celFunc("!_",[BOOL2],BOOL2,x2=>!x2),celFunc(EQUALS,[DYN2,DYN2],BOOL2,equals2),celFunc(NOT_EQUALS,[DYN2,DYN2],BOOL2,(l3,r5)=>!equals2(l3,r5)),celFunc("_<_",[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)<0),celFunc("_<_",[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[STRING3,STRING3],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[INT3,INT3],BOOL2,(l3,r5)=>l3<r5),celFunc("_<_",[INT3,UINT3],BOOL2,(l3,r5)=>l3<r5.value),celFunc("_<_",[UINT3,INT3],BOOL2,(l3,r5)=>l3.value<r5),celFunc("_<_",[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value<r5.value),celFunc("_<_",[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)<r5),celFunc("_<_",[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3<Number(r5)),celFunc("_<_",[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3<Number(r5.value)),celFunc("_<_",[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)<r5),celFunc("_<_",[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)<0),celFunc("_<_",[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)<0),celFunc(LESS_EQUALS,[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)<=0),celFunc(LESS_EQUALS,[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[STRING3,STRING3],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[INT3,INT3],BOOL2,(l3,r5)=>l3<=r5),celFunc(LESS_EQUALS,[INT3,UINT3],BOOL2,(l3,r5)=>l3<=r5.value),celFunc(LESS_EQUALS,[UINT3,INT3],BOOL2,(l3,r5)=>l3.value<=r5),celFunc(LESS_EQUALS,[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value<=r5.value),celFunc(LESS_EQUALS,[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)<=r5),celFunc(LESS_EQUALS,[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3<=Number(r5)),celFunc(LESS_EQUALS,[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3<=Number(r5.value)),celFunc(LESS_EQUALS,[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)<=r5),celFunc(LESS_EQUALS,[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)<=0),celFunc(LESS_EQUALS,[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)<=0),celFunc("_>_",[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)>0),celFunc("_>_",[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[STRING3,STRING3],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[INT3,INT3],BOOL2,(l3,r5)=>l3>r5),celFunc("_>_",[INT3,UINT3],BOOL2,(l3,r5)=>l3>r5.value),celFunc("_>_",[UINT3,INT3],BOOL2,(l3,r5)=>l3.value>r5),celFunc("_>_",[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value>r5.value),celFunc("_>_",[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)>r5),celFunc("_>_",[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3>Number(r5)),celFunc("_>_",[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3>Number(r5.value)),celFunc("_>_",[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)>r5),celFunc("_>_",[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)>0),celFunc("_>_",[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)>0),celFunc(GREATER_EQUALS,[BOOL2,BOOL2],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[BYTES3,BYTES3],BOOL2,(l3,r5)=>compareBytes(l3,r5)>=0),celFunc(GREATER_EQUALS,[DOUBLE3,DOUBLE3],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[STRING3,STRING3],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[INT3,INT3],BOOL2,(l3,r5)=>l3>=r5),celFunc(GREATER_EQUALS,[INT3,UINT3],BOOL2,(l3,r5)=>l3>=r5.value),celFunc(GREATER_EQUALS,[UINT3,INT3],BOOL2,(l3,r5)=>l3.value>=r5),celFunc(GREATER_EQUALS,[UINT3,UINT3],BOOL2,(l3,r5)=>l3.value>=r5.value),celFunc(GREATER_EQUALS,[INT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3)>=r5),celFunc(GREATER_EQUALS,[DOUBLE3,INT3],BOOL2,(l3,r5)=>l3>=Number(r5)),celFunc(GREATER_EQUALS,[DOUBLE3,UINT3],BOOL2,(l3,r5)=>l3>=Number(r5.value)),celFunc(GREATER_EQUALS,[UINT3,DOUBLE3],BOOL2,(l3,r5)=>Number(l3.value)>=r5),celFunc(GREATER_EQUALS,[DURATION,DURATION],BOOL2,(l3,r5)=>compareDuration(l3,r5)>=0),celFunc(GREATER_EQUALS,[TIMESTAMP,TIMESTAMP],BOOL2,(l3,r5)=>compareTimestamp(l3,r5)>=0),celFunc(SIZE,[BYTES3],INT3,x2=>BigInt(x2.length)),celFunc(SIZE,[LIST2],INT3,x2=>BigInt(x2.size)),celFunc(SIZE,[STRING3],INT3,x2=>BigInt([...x2].length)),celFunc(SIZE,[MAP],INT3,x2=>BigInt(x2.size)),celMethod(SIZE,BYTES3,[],INT3,function(){return BigInt(this.length)}),celMethod(SIZE,LIST2,[],INT3,function(){return BigInt(this.size)}),celMethod(SIZE,STRING3,[],INT3,function(){return BigInt([...this].length)}),celMethod(SIZE,MAP,[],INT3,function(){return BigInt(this.size)}),celFunc("@in",[DYN2,LIST2],BOOL2,inList),celFunc("@in",[STRING3,MAP],BOOL2,inMap),celFunc("@in",[DOUBLE3,MAP],BOOL2,inMap),celFunc("@in",[INT3,MAP],BOOL2,inMap),celFunc("@in",[BOOL2,MAP],BOOL2,inMap),celFunc("@in",[UINT3,MAP],BOOL2,inMap),celMethod(CONTAINS,STRING3,[STRING3],BOOL2,String.prototype.includes),celMethod(ENDS_WITH,STRING3,[STRING3],BOOL2,String.prototype.endsWith),celMethod(STARTS_WITH,STRING3,[STRING3],BOOL2,String.prototype.startsWith),celMethod(MATCHES,STRING3,[STRING3],BOOL2,matches)];function getDayOfYear(date2){let start=new Date(0,0,1);start.setFullYear(date2.getFullYear());let diff=date2.getTime()-start.getTime(),oneDay=1e3*60*60*24;return Math.floor(diff/oneDay)}function convertToDate(msg,tz){let ts=msg.message,val=timestampDate(ts);if(tz===void 0)return new Date(val.getUTCFullYear(),val.getUTCMonth(),val.getUTCDate(),val.getUTCHours(),val.getUTCMinutes(),val.getUTCSeconds(),val.getUTCMilliseconds());let timeOffset=tz.match(/^(?<sign>[+-]?)(?<hours>\d\d):(?<minutes>\d\d)$/);if(timeOffset?.groups){let sign4=timeOffset.groups.sign=="-"?1:-1,hours=parseInt(timeOffset.groups.hours),minutes=parseInt(timeOffset.groups.minutes),offset=sign4*(hours*60*60*1e3+minutes*60*1e3);return val=new Date(val.getTime()-offset),new Date(val.getUTCFullYear(),val.getUTCMonth(),val.getUTCDate(),val.getUTCHours(),val.getUTCMinutes(),val.getUTCSeconds(),val.getUTCMilliseconds())}let format3=new Intl.DateTimeFormat("en-US",{hourCycle:"h23",hour12:!1,timeZone:tz,year:"numeric",month:"numeric",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit"}),year2,month,day,hour,minute,second;for(let part of format3.formatToParts(val))switch(part.type){case"year":year2=parseInt(part.value);break;case"month":month=parseInt(part.value)-1;break;case"day":day=parseInt(part.value);break;case"hour":hour=parseInt(part.value);break;case"minute":minute=parseInt(part.value);break;case"second":second=parseInt(part.value);break}if(year2===void 0||month===void 0||day===void 0||hour===void 0||minute===void 0||second===void 0)throw new Error(`Error converting ${toJson(TimestampSchema,ts)} to IANA timezone ${tz}`);return new Date(year2,month,day,hour,minute,second,val.getUTCMilliseconds())}var{STRING:STRING4,INT:INT4}=CelScalar;function celTimeMethods(name,func){function method(tz){let date2=convertToDate(this,tz),result=func(date2);try{return BigInt(result)}catch{throw new Error(`Error converting ${result} of ${String(date2)} of ${toJson(TimestampSchema,this.message)} to BigInt`)}}return[celMethod(name,TIMESTAMP,[],INT4,method),celMethod(name,TIMESTAMP,[STRING4],INT4,method)]}var time_default=[celMethod(TIME_GET_SECONDS,DURATION,[],INT4,function(){return this.message.seconds}),celMethod(TIME_GET_MINUTES,DURATION,[],INT4,function(){return this.message.seconds/60n}),celMethod(TIME_GET_HOURS,DURATION,[],INT4,function(){return this.message.seconds/3600n}),celMethod(TIME_GET_MILLISECONDS,DURATION,[],INT4,function(){return BigInt(this.message.nanos)/1000000n}),...celTimeMethods(TIME_GET_FULL_YEAR,x2=>x2.getFullYear()),...celTimeMethods(TIME_GET_MONTH,x2=>x2.getMonth()),...celTimeMethods(TIME_GET_DATE,x2=>x2.getDate()),...celTimeMethods(TIME_GET_DAY_OF_MONTH,x2=>x2.getDate()-1),...celTimeMethods(TIME_GET_DAY_OF_WEEK,x2=>x2.getDay()),...celTimeMethods(TIME_GET_DAY_OF_YEAR,x2=>getDayOfYear(x2)),...celTimeMethods(TIME_GET_SECONDS,x2=>x2.getSeconds()),...celTimeMethods(TIME_GET_MINUTES,x2=>x2.getMinutes()),...celTimeMethods(TIME_GET_HOURS,x2=>x2.getHours()),...celTimeMethods(TIME_GET_MILLISECONDS,x2=>x2.getMilliseconds())];var privateSymbol8=Symbol.for("@bufbuild/cel/env");function celEnv(options){return new _CelEnv(options?.namespace?new Namespace(options?.namespace):void 0,options?.registry?createRegistryWithWKT(options.registry):createRegistryWithWKT(),createResolver(math_default,cast_default,time_default,logic_default,options?.funcs??[]))}var _CelEnv=class{_namespace;_registry;_funcs;[privateSymbol8]={};constructor(_namespace,_registry,_funcs){this._namespace=_namespace,this._registry=_registry,this._funcs=_funcs}get namespace(){return this._namespace}get registry(){return this._registry}get funcs(){return this._funcs}};var file_cel_expr_syntax=fileDesc2("ChVjZWwvZXhwci9zeW50YXgucHJvdG8SCGNlbC5leHByIlUKClBhcnNlZEV4cHISHAoEZXhwchgCIAEoCzIOLmNlbC5leHByLkV4cHISKQoLc291cmNlX2luZm8YAyABKAsyFC5jZWwuZXhwci5Tb3VyY2VJbmZvItoICgRFeHByEgoKAmlkGAIgASgDEigKCmNvbnN0X2V4cHIYAyABKAsyEi5jZWwuZXhwci5Db25zdGFudEgAEioKCmlkZW50X2V4cHIYBCABKAsyFC5jZWwuZXhwci5FeHByLklkZW50SAASLAoLc2VsZWN0X2V4cHIYBSABKAsyFS5jZWwuZXhwci5FeHByLlNlbGVjdEgAEigKCWNhbGxfZXhwchgGIAEoCzITLmNlbC5leHByLkV4cHIuQ2FsbEgAEi4KCWxpc3RfZXhwchgHIAEoCzIZLmNlbC5leHByLkV4cHIuQ3JlYXRlTGlzdEgAEjIKC3N0cnVjdF9leHByGAggASgLMhsuY2VsLmV4cHIuRXhwci5DcmVhdGVTdHJ1Y3RIABI6ChJjb21wcmVoZW5zaW9uX2V4cHIYCSABKAsyHC5jZWwuZXhwci5FeHByLkNvbXByZWhlbnNpb25IABoVCgVJZGVudBIMCgRuYW1lGAEgASgJGksKBlNlbGVjdBIfCgdvcGVyYW5kGAEgASgLMg4uY2VsLmV4cHIuRXhwchINCgVmaWVsZBgCIAEoCRIRCgl0ZXN0X29ubHkYAyABKAgaVgoEQ2FsbBIeCgZ0YXJnZXQYASABKAsyDi5jZWwuZXhwci5FeHByEhAKCGZ1bmN0aW9uGAIgASgJEhwKBGFyZ3MYAyADKAsyDi5jZWwuZXhwci5FeHByGkgKCkNyZWF0ZUxpc3QSIAoIZWxlbWVudHMYASADKAsyDi5jZWwuZXhwci5FeHByEhgKEG9wdGlvbmFsX2luZGljZXMYAiADKAUa6QEKDENyZWF0ZVN0cnVjdBIUCgxtZXNzYWdlX25hbWUYASABKAkSMgoHZW50cmllcxgCIAMoCzIhLmNlbC5leHByLkV4cHIuQ3JlYXRlU3RydWN0LkVudHJ5Go4BCgVFbnRyeRIKCgJpZBgBIAEoAxITCglmaWVsZF9rZXkYAiABKAlIABIhCgdtYXBfa2V5GAMgASgLMg4uY2VsLmV4cHIuRXhwckgAEh0KBXZhbHVlGAQgASgLMg4uY2VsLmV4cHIuRXhwchIWCg5vcHRpb25hbF9lbnRyeRgFIAEoCEIKCghrZXlfa2luZBr4AQoNQ29tcHJlaGVuc2lvbhIQCghpdGVyX3ZhchgBIAEoCRIRCglpdGVyX3ZhcjIYCCABKAkSIgoKaXRlcl9yYW5nZRgCIAEoCzIOLmNlbC5leHByLkV4cHISEAoIYWNjdV92YXIYAyABKAkSIQoJYWNjdV9pbml0GAQgASgLMg4uY2VsLmV4cHIuRXhwchImCg5sb29wX2NvbmRpdGlvbhgFIAEoCzIOLmNlbC5leHByLkV4cHISIQoJbG9vcF9zdGVwGAYgASgLMg4uY2VsLmV4cHIuRXhwchIeCgZyZXN1bHQYByABKAsyDi5jZWwuZXhwci5FeHByQgsKCWV4cHJfa2luZCLNAgoIQ29uc3RhbnQSMAoKbnVsbF92YWx1ZRgBIAEoDjIaLmdvb2dsZS5wcm90b2J1Zi5OdWxsVmFsdWVIABIUCgpib29sX3ZhbHVlGAIgASgISAASFQoLaW50NjRfdmFsdWUYAyABKANIABIWCgx1aW50NjRfdmFsdWUYBCABKARIABIWCgxkb3VibGVfdmFsdWUYBSABKAFIABIWCgxzdHJpbmdfdmFsdWUYBiABKAlIABIVCgtieXRlc192YWx1ZRgHIAEoDEgAEjcKDmR1cmF0aW9uX3ZhbHVlGAggASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQgIYAUgAEjkKD3RpbWVzdGFtcF92YWx1ZRgJIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCAhgBSABCDwoNY29uc3RhbnRfa2luZCKcBQoKU291cmNlSW5mbxIWCg5zeW50YXhfdmVyc2lvbhgBIAEoCRIQCghsb2NhdGlvbhgCIAEoCRIUCgxsaW5lX29mZnNldHMYAyADKAUSNgoJcG9zaXRpb25zGAQgAygLMiMuY2VsLmV4cHIuU291cmNlSW5mby5Qb3NpdGlvbnNFbnRyeRI5CgttYWNyb19jYWxscxgFIAMoCzIkLmNlbC5leHByLlNvdXJjZUluZm8uTWFjcm9DYWxsc0VudHJ5EjIKCmV4dGVuc2lvbnMYBiADKAsyHi5jZWwuZXhwci5Tb3VyY2VJbmZvLkV4dGVuc2lvbhowCg5Qb3NpdGlvbnNFbnRyeRILCgNrZXkYASABKAMSDQoFdmFsdWUYAiABKAU6AjgBGkEKD01hY3JvQ2FsbHNFbnRyeRILCgNrZXkYASABKAMSHQoFdmFsdWUYAiABKAsyDi5jZWwuZXhwci5FeHByOgI4ARqxAgoJRXh0ZW5zaW9uEgoKAmlkGAEgASgJEkUKE2FmZmVjdGVkX2NvbXBvbmVudHMYAiADKA4yKC5jZWwuZXhwci5Tb3VyY2VJbmZvLkV4dGVuc2lvbi5Db21wb25lbnQSNwoHdmVyc2lvbhgDIAEoCzImLmNlbC5leHByLlNvdXJjZUluZm8uRXh0ZW5zaW9uLlZlcnNpb24aJwoHVmVyc2lvbhINCgVtYWpvchgBIAEoAxINCgVtaW5vchgCIAEoAyJvCglDb21wb25lbnQSGQoVQ09NUE9ORU5UX1VOU1BFQ0lGSUVEEAASFAoQQ09NUE9ORU5UX1BBUlNFUhABEhoKFkNPTVBPTkVOVF9UWVBFX0NIRUNLRVIQAhIVChFDT01QT05FTlRfUlVOVElNRRADQi4KDGRldi5jZWwuZXhwckILU3ludGF4UHJvdG9QAVoMY2VsLmRldi9leHBy+AEBYgZwcm90bzM",[file_google_protobuf_duration2,file_google_protobuf_struct2,file_google_protobuf_timestamp2]),ParsedExprSchema=messageDesc3(file_cel_expr_syntax,0),ExprSchema=messageDesc3(file_cel_expr_syntax,1);var SourceInfo_Extension_Component;(function(SourceInfo_Extension_Component2){SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.UNSPECIFIED=0]="UNSPECIFIED",SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.PARSER=1]="PARSER",SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.TYPE_CHECKER=2]="TYPE_CHECKER",SourceInfo_Extension_Component2[SourceInfo_Extension_Component2.RUNTIME=3]="RUNTIME"})(SourceInfo_Extension_Component||(SourceInfo_Extension_Component={}));var LogicManager=class _LogicManager{builder;function;terms;ops;variadicASTs;constructor(builder2,functionName,term,variadicASTs){this.builder=builder2,this.function=functionName,this.terms=[term],this.ops=[],this.variadicASTs=variadicASTs}static newVariadicLogicManager(builder2,functionName,term){return new _LogicManager(builder2,functionName,term,!0)}static newBalancingLogicManager(builder2,functionName,term){return new _LogicManager(builder2,functionName,term,!1)}addTerm(op2,term){this.terms.push(term),this.ops.push(op2)}toExpr(){return this.terms.length===1?this.terms[0]:this.variadicASTs?this.builder.nextExpr(this.ops[0],{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:this.function,args:this.terms}}):this.balancedTree(0,this.ops.length-1)}balancedTree(lo,hi){let mid=Math.floor((lo+hi+1)/2),left;mid===lo?left=this.terms[mid]:left=this.balancedTree(lo,mid-1);let right;return mid===hi?right=this.terms[mid+1]:right=this.balancedTree(mid+1,hi),this.builder.nextExpr(this.ops[mid],{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:this.function,args:[left,right]}})}};var encoder2=new TextEncoder,accuVarName="@result",Builder=class{#prevId=0n;sourceInfo={$typeName:"cel.expr.SourceInfo",syntaxVersion:"",location:"",lineOffsets:[],positions:{},macroCalls:{},extensions:[]};nextExpr(offset,exprKind){return this.sourceInfo.positions[(++this.#prevId).toString()]=offset,{$typeName:"cel.expr.Expr",id:this.#prevId,exprKind}}nextEntry(offset,keyKind,value){return this.sourceInfo.positions[(++this.#prevId).toString()]=offset,{$typeName:"cel.expr.Expr.CreateStruct.Entry",id:this.#prevId,keyKind,value,optionalEntry:!1}}newConstExpr(offset,constantKind){return this.nextExpr(offset,{case:"constExpr",value:{$typeName:"cel.expr.Constant",constantKind}})}newCallExpr(offset,functionName,args){if(functionName==="has"&&args.length===1&&args[0].exprKind?.case==="selectExpr")return this.expandHasMacro(offset,args[0]);if((functionName==="_||_"||functionName==="_&&_")&&args.length>1){let logicManager=LogicManager.newBalancingLogicManager(this,functionName,args[0]);for(let i6=1;i6<args.length;i6+=1)logicManager.addTerm(offset,args[i6]);return logicManager.toExpr()}return this.nextExpr(offset,{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:functionName,args}})}newMemberCallExpr(offset,target,functionName,args){return this.maybeExpand(offset,this.nextExpr(offset,{case:"callExpr",value:{$typeName:"cel.expr.Expr.Call",function:functionName,target,args}}))}newStringExpr(offset,sequence){return this.newConstExpr(offset,{case:"stringValue",value:sequence.reduce((string,chunk)=>{if(typeof chunk!="string"){if(chunk.some(cp=>cp>=55296&&cp<57344))throw new Error("surrogate code points are not allowed");return string+String.fromCodePoint(...chunk)}return string+chunk},"")})}newBytesExpr(offset,sequence){let chunks=[],totalSize=0;for(let rawChunk of sequence){let chunk=typeof rawChunk=="string"?encoder2.encode(rawChunk):rawChunk;chunks.push(chunk),totalSize+=chunk.length}let value=new Uint8Array(totalSize),chunkOffset=0;for(let chunk of chunks)value.set(chunk,chunkOffset),chunkOffset+=chunk.length;return this.newConstExpr(offset,{case:"bytesValue",value})}newBoolExpr(offset,keyword){return this.newConstExpr(offset,{case:"boolValue",value:keyword==="true"})}newInt64Expr(offset,digits){return this.newConstExpr(offset,{case:"int64Value",value:digits[0]==="-"?-BigInt(digits.slice(1)):BigInt(digits)})}newUnsignedInt64Expr(offset,digits){return this.newConstExpr(offset,{case:"uint64Value",value:BigInt(digits)})}newDoubleExpr(offset,digits){return this.newConstExpr(offset,{case:"doubleValue",value:parseFloat(digits)})}newNullExpr(offset){return this.newConstExpr(offset,{case:"nullValue",value:0})}newIdentExpr(offset,name){return this.nextExpr(offset,{case:"identExpr",value:{$typeName:"cel.expr.Expr.Ident",name}})}newInfixExpr(offset,op2,args){return this.newCallExpr(offset,op2==="in"?"@in":`_${op2}_`,args)}newSelectExpr(offset,operand,field3){return this.nextExpr(offset,{case:"selectExpr",value:{$typeName:"cel.expr.Expr.Select",operand,field:field3,testOnly:!1}})}newIndexExpr(offset,operand,index2){return this.newCallExpr(offset,"_[_]",[operand,index2])}expandHasMacro(offset,target){return target.exprKind.case!=="selectExpr"?this.newCallExpr(offset,"has",[target]):(target.exprKind.value.testOnly=!0,target)}newListExpr(offset,elements){return this.nextExpr(offset,{case:"listExpr",value:{$typeName:"cel.expr.Expr.CreateList",elements,optionalIndices:[]}})}newBoolMacro(offset,iterRange,iterVar,init,loopStep,loopCondition){return this.nextExpr(offset,{case:"comprehensionExpr",value:{$typeName:"cel.expr.Expr.Comprehension",accuVar:accuVarName,accuInit:this.newConstExpr(offset,{case:"boolValue",value:init}),iterVar,iterVar2:"",iterRange,loopStep,loopCondition,result:this.newIdentExpr(offset,accuVarName)}})}newListMacro(offset,iterRange,iterVar,loopStep){return this.nextExpr(offset,{case:"comprehensionExpr",value:{$typeName:"cel.expr.Expr.Comprehension",accuVar:accuVarName,accuInit:this.newListExpr(offset,[]),iterVar,iterVar2:"",iterRange,loopCondition:this.newConstExpr(offset,{case:"boolValue",value:!0}),loopStep,result:this.newIdentExpr(offset,accuVarName)}})}expandExistsMacro(offset,target,x2,test){return this.newBoolMacro(offset,target,x2,!1,this.newCallExpr(offset,"_||_",[this.newIdentExpr(offset,accuVarName),test]),this.newCallExpr(offset,"@not_strictly_false",[this.newCallExpr(offset,"!_",[this.newIdentExpr(offset,accuVarName)])]))}expandAllMacro(offset,target,x2,test){return this.newBoolMacro(offset,target,x2,!0,this.newCallExpr(offset,"_&&_",[this.newIdentExpr(offset,accuVarName),test]),this.newCallExpr(offset,"@not_strictly_false",[this.newIdentExpr(offset,accuVarName)]))}expandMapMacro(offset,target,x2,step){return this.newListMacro(offset,target,x2,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newListExpr(offset,[step])]))}expandMapFilterMacro(offset,target,x2,test,step){return this.newListMacro(offset,target,x2,this.newCallExpr(offset,"_?_:_",[test,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newListExpr(offset,[step])]),this.newIdentExpr(offset,accuVarName)]))}expandFilterMacro(offset,target,x2,step){return this.newListMacro(offset,target,x2,this.newCallExpr(offset,"_?_:_",[step,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newListExpr(offset,[this.newIdentExpr(offset,x2)])]),this.newIdentExpr(offset,accuVarName)]))}expandExistsOne(offset,iterRange,iterVar,step){return this.nextExpr(offset,{case:"comprehensionExpr",value:{$typeName:"cel.expr.Expr.Comprehension",accuVar:accuVarName,accuInit:this.newConstExpr(offset,{case:"int64Value",value:BigInt(0)}),iterVar,iterVar2:"",iterRange,loopCondition:this.newConstExpr(offset,{case:"boolValue",value:!0}),loopStep:this.newCallExpr(offset,"_?_:_",[step,this.newCallExpr(offset,"_+_",[this.newIdentExpr(offset,accuVarName),this.newConstExpr(offset,{case:"int64Value",value:BigInt(1)})]),this.newIdentExpr(offset,accuVarName)]),result:this.newCallExpr(offset,"_==_",[this.newIdentExpr(offset,accuVarName),this.newConstExpr(offset,{case:"int64Value",value:BigInt(1)})])}})}maybeExpand(offset,call){if(call.exprKind.case==="callExpr"){let callExpr=call.exprKind.value,varName=callExpr.args[0];if(varName!==void 0&&call.exprKind.value.target!==void 0&&varName.exprKind?.case==="identExpr"){if(callExpr.args.length===2)switch(callExpr.function){case"exists":return this.expandExistsMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"all":return this.expandAllMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"map":return this.expandMapMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"filter":return this.expandFilterMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1]);case"exists_one":case"existsOne":return this.expandExistsOne(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1])}if(callExpr.args.length===3&&callExpr.function=="map")return this.expandMapFilterMacro(offset,call.exprKind.value.target,varName.exprKind.value.name,call.exprKind.value.args[1],call.exprKind.value.args[2])}}return call}newMapEntry(offset,key,value){return this.nextEntry(offset,{case:"mapKey",value:key},value)}newStructExpr(offset,entries,messageName=""){return this.nextExpr(offset,{case:"structExpr",value:{$typeName:"cel.expr.Expr.CreateStruct",entries,messageName}})}newStructEntry(offset,field3,value){return this.nextEntry(offset,{case:"fieldKey",value:field3},value)}};var runtime;(function(runtime2){class GrammarLocation{source;start;constructor(source,start){this.source=source,this.start=start}toString(){return String(this.source)}offset(loc){return{line:loc.line+this.start.line-1,column:loc.line===1?loc.column+this.start.column-1:loc.column,offset:loc.offset+this.start.offset}}static offsetStart(range2){return range2.source instanceof GrammarLocation?range2.source.offset(range2.start):range2.start}static offsetEnd(range2){return range2.source instanceof GrammarLocation?range2.source.offset(range2.end):range2.end}}runtime2.GrammarLocation=GrammarLocation;function padEnd(str2,targetLength,padString){return padString=padString||" ",str2.length>targetLength?str2:(targetLength-=str2.length,padString+=padString.repeat(targetLength),str2+padString.slice(0,targetLength))}runtime2.padEnd=padEnd;class ParseFailure{}runtime2.ParseFailure=ParseFailure;function isFailure(r5){return!r5.success}runtime2.isFailure=isFailure;function getLine2(input,offset){let line=1;for(let i6=0;i6<offset;i6++)input[i6]==="\r"?(input[i6+1]===`
 `&&i6++,line++):input[i6]===`
 `&&line++;return line}function getColumn(input,offset){let column=1;for(let i6=offset;i6>0&&![`
 `,"\r"].includes(input[i6-1]);i6--)column++;return column}function getLocation(source,input,start,remainder){return{source,start:{offset:input.length-start.length,line:getLine2(input,input.length-start.length),column:getColumn(input,input.length-start.length)},end:{offset:input.length-remainder.length,line:getLine2(input,input.length-remainder.length),column:getColumn(input,input.length-remainder.length)}}}runtime2.getLocation=getLocation;function getRange(source,input,start,remainder){return{source,start:input.length-start.length,end:input.length-remainder.length}}runtime2.getRange=getRange;function getText(start,remainder){return start.slice(0,remainder.length>0?-remainder.length:void 0)}runtime2.getText=getText})(runtime||(runtime={}));var ParseError=class _ParseError extends Error{rawMessage;location;constructor(message6,location,name="parse error"){super(_ParseError.#formatMessage(message6,location)),this.name=name,this.rawMessage=message6,this.location=location}static#formatMessage(message6,location){return`${location.source!==void 0?String(location.source):"<input>"}:${location.start.line}:${location.start.column}: `+message6}},ParseSyntaxError=class _ParseSyntaxError extends ParseError{expected;found;constructor(expected,found,location,name="syntax error"){super(_ParseSyntaxError.#formatMessage(expected,found),location,name),this.expected=expected,this.found=found}static#formatMessage(expected,found){function encode2(s2){return"'"+s2.replace(/[\\\x07\b\f\n\r\t\v']/g,match=>{switch(match){case"\\":return"\\\\";case"\x07":return"\\x07";case"\b":return"\\b";case"\f":return"\\f";case`
@@ -485,7 +485,7 @@ caused by: ${_Layerr.fullStack(cause)}`:err2.stack??""}static info(err2){assertE
 `);return}let root5=import_node_path10.default.resolve(basePath),filePath=import_node_path10.default.resolve(root5,key);if(filePath!==root5&&!filePath.startsWith(root5+import_node_path10.default.sep)){res.writeHead(404),res.end(`404 page not found
 `);return}let info;try{info=await(0,import_promises5.stat)(filePath)}catch{res.writeHead(404),res.end(`404 page not found
 `);return}if(!info.isFile()){res.writeHead(404),res.end(`404 page not found
-`);return}let headers2={"Content-Length":String(info.size)},downloadName=url.searchParams.get(LOCAL_DOWNLOAD_QUERY_PARAM)??"";if(downloadName!==""&&(headers2["Content-Disposition"]=contentDispositionAttachment(downloadName)),res.writeHead(200,headers2),req.method==="HEAD"){res.end();return}let stream=(0,import_node_fs7.createReadStream)(filePath);stream.on("error",error2=>{logger2.error("artifact file stream failed",{key,error:error2.message}),res.destroy()}),stream.pipe(res)}catch(error2){logger2.error("artifact file server request failed",{error:error2 instanceof Error?error2.message:String(error2)}),res.headersSent||res.writeHead(500),res.end()}}async function warnOnLegacyArtifactLayout(basePath,logger2){for(let sub of["attachments","artifacts"]){let legacy=import_node_path10.default.join(basePath,"artifacts",sub);try{if((await(0,import_promises5.stat)(legacy)).isDirectory()){logger2.warn("Detected artifacts under a pre-#285 layout at <base>/artifacts/*. The artifact root is now <base> itself. Move <base>/artifacts/* up into <base> (or set ARTIFACT_LOCAL_BASE_PATH to the old <base>/artifacts) so existing artifacts remain reachable.",{legacyDir:import_node_path10.default.join(basePath,"artifacts"),artifactRoot:basePath});return}}catch{}}}var file_ai_stigmer_agentic_channelapp_v1_command=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9jb21tYW5kLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MTKOBQobQ2hhbm5lbEFwcENvbW1hbmRDb250cm9sbGVyEmMKBWFwcGx5EiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcBosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAStQEKBmNyZWF0ZRIsLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAaLC5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwIk/CuBhLCB8QHiIMbWV0YWRhdGEub3JnKjd1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIGNoYW5uZWwgYXBwIGluIHRoaXMgb3JnYW5pemF0aW9uEp8BCgZ1cGRhdGUSLC5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwGiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcCI5wrgYNQgCEDAiC21ldGFkYXRhLmlkKiJ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGNoYW5uZWwgYXBwEqkBCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiOcK4GDUIAxAwIgtyZXNvdXJjZV9pZCoidW5hdXRob3JpemVkIHRvIGRlbGV0ZSBjaGFubmVsIGFwcBoEoP8rMGIGcHJvdG8z",[file_ai_stigmer_agentic_channelapp_v1_api,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelAppCommandController=serviceDesc(file_ai_stigmer_agentic_channelapp_v1_command,0);var file_ai_stigmer_agentic_channelapp_v1_io=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9pby5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEiTAoLQ2hhbm5lbEFwcHMSPQoHZW50cmllcxgBIAMoCzIsLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiMQoZTGlzdENoYW5uZWxBcHBzQnlPcmdJbnB1dBIUCgNvcmcYASABKAlCB7pIBHICEAFiBnByb3RvMw",[file_ai_stigmer_agentic_channelapp_v1_api,file_buf_validate_validate]),ChannelAppsSchema=messageDesc2(file_ai_stigmer_agentic_channelapp_v1_io,0);var file_ai_stigmer_agentic_channelapp_v1_query=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9xdWVyeS5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEy9gMKGUNoYW5uZWxBcHBRdWVyeUNvbnRyb2xsZXISlQEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcCIxwrgYLQgBEDAiBXZhbHVlKiB1bmF1dGhvcml6ZWQgdG8gdmlldyBjaGFubmVsIGFwcBJ6Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiBNC4GAESvgEKCWxpc3RCeU9yZxI7LmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkxpc3RDaGFubmVsQXBwc0J5T3JnSW5wdXQaLS5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwcyJFwrgYQQgBEB4iA29yZyo2dW5hdXRob3JpemVkIHRvIGxpc3QgY2hhbm5lbCBhcHBzIGluIHRoaXMgb3JnYW5pemF0aW9uGgSg/yswYgZwcm90bzM",[file_ai_stigmer_agentic_channelapp_v1_api,file_ai_stigmer_agentic_channelapp_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelAppQueryController=serviceDesc(file_ai_stigmer_agentic_channelapp_v1_query,0);async function destroySecretBackingState(secretService,logger2,fields2,storedValues){for(let storedValue of storedValues)if(storedValue!=="")try{await secretService.delete(storedValue)}catch(error2){logger2.error("secret backing-state destruction failed after persist \u2014 external state may be orphaned",{...fields2,error:error2 instanceof Error?error2.message:String(error2)})}}function newDestroySecretBackingStateStep(secretService,logger2,extractSecretValues){return{name:"DestroySecretBackingState",async execute(ctx){let deleted=ctx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)return;let metadata=deleted.metadata;await destroySecretBackingState(secretService,logger2,{kind:getKindName(ctx.apiResourceKind),resourceId:metadata?.id??""},extractSecretValues(deleted))}}}var REDACTED_MARKER2="***REDACTED***";function plaintextRequiredMessage(fieldName){return`${fieldName} must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients`}function markerOnCreateMessage(fieldName){return`cannot use the redaction marker as ${fieldName} on create`}function noExistingSecretMessage(fieldName){return`cannot preserve ${fieldName}: no existing secret value found`}var PROVIDER_IMMUTABLE_MESSAGE="the provider of a channel app cannot be changed";function deleteBlockedByChannelMessage(org,slug,channelName){return`cannot delete ChannelApp '${org}/${slug}': referenced by agent channel '${channelName}'`}function redactChannelApp(app){let provider=app.spec?.providerConfig;switch(provider?.case){case"slack":redactSlack(provider.value);return;case"whatsapp":redactWhatsApp(provider.value);return;case void 0:return;default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}function redactSlack(slack){slack.clientSecret!==""&&(slack.clientSecret=REDACTED_MARKER2),slack.signingSecret!==""&&(slack.signingSecret=REDACTED_MARKER2)}function redactWhatsApp(whatsapp){whatsapp.appSecret!==""&&(whatsapp.appSecret=REDACTED_MARKER2),whatsapp.accessToken!==""&&(whatsapp.accessToken=REDACTED_MARKER2),whatsapp.verifyToken!==""&&(whatsapp.verifyToken=REDACTED_MARKER2)}function secretValuesOfChannelApp(app){let provider=app.spec?.providerConfig;switch(provider?.case){case"slack":return[provider.value.clientSecret,provider.value.signingSecret];case"whatsapp":return[provider.value.appSecret,provider.value.accessToken,provider.value.verifyToken];case void 0:return[];default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}function newEncryptChannelAppSecretsForCreateStep(secretService,logger2){return newEncryptChannelAppSecretsStep(secretService,logger2,!0)}function newEncryptChannelAppSecretsForUpdateStep(secretService,logger2){return newEncryptChannelAppSecretsStep(secretService,logger2,!1)}function newEncryptChannelAppSecretsStep(secretService,logger2,isCreate){async function resolveSecret(ctx,fieldName,requestValue,readExisting){if(requestValue==="")return requestValue;if(requestValue===REDACTED_MARKER2)return preserveExistingSecret2(ctx,fieldName,readExisting);if(isCiphertextShaped(requestValue))throw invalidArgumentError(plaintextRequiredMessage(fieldName));if(!secretService.isEnabled())return logger2.warn(`Encryption disabled: ${fieldName} will be stored in plaintext`),requestValue;try{return await secretService.encrypt(requestValue,EncryptionScope.forOrganization(ctx.newState.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt ${fieldName}`)}}function preserveExistingSecret2(ctx,fieldName,readExisting){if(isCreate)throw invalidArgumentError(markerOnCreateMessage(fieldName));let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not loaded"),`cannot preserve ${fieldName}: existing resource not loaded`);let existingSecret=readExisting(existing);if(existingSecret==="")throw invalidArgumentError(noExistingSecretMessage(fieldName));return existingSecret}return{name:"EncryptChannelAppSecrets",async execute(ctx){let provider=ctx.newState.spec?.providerConfig;switch(provider?.case){case"slack":{let slack=provider.value;slack.clientSecret=await resolveSecret(ctx,"client_secret",slack.clientSecret,existing=>existing.spec?.providerConfig.case==="slack"?existing.spec.providerConfig.value.clientSecret:""),slack.signingSecret=await resolveSecret(ctx,"signing_secret",slack.signingSecret,existing=>existing.spec?.providerConfig.case==="slack"?existing.spec.providerConfig.value.signingSecret:"");return}case"whatsapp":{let whatsapp=provider.value;whatsapp.appSecret=await resolveSecret(ctx,"app_secret",whatsapp.appSecret,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.appSecret:""),whatsapp.accessToken=await resolveSecret(ctx,"access_token",whatsapp.accessToken,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.accessToken:""),whatsapp.verifyToken=await resolveSecret(ctx,"verify_token",whatsapp.verifyToken,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.verifyToken:"");return}case void 0:return;default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}}}function newValidateProviderImmutableStep(){return{name:"ValidateProviderImmutable",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing channel app not found in context"),"existing channel app not found in context");let existingCase=existing.spec?.providerConfig.case,inputCase=ctx.input.spec?.providerConfig.case;if(existingCase!==inputCase)throw invalidArgumentError(PROVIDER_IMMUTABLE_MESSAGE)}}}function newCheckNoReferencingChannelsStep(store,logger2){return{name:"CheckNoReferencingChannels",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing ChannelApp not loaded in delete pipeline"),"existing ChannelApp not loaded in delete pipeline");let org=existing.metadata?.org??"",slug=existing.metadata?.slug??"",rows;try{rows=await store.listResources(ApiResourceKind.agent_channel)}catch(error2){throw internalError(error2,"failed to list agent channels for referential integrity check")}for(let bytes of rows){let channel;try{channel=fromBinary2(AgentChannelSchema,bytes)}catch{logger2.warn("Failed to unmarshal agent channel during referential integrity check, skipping");continue}let ref=channel.spec?.appRef;if(ref===void 0||ref.slug==="")continue;if((ref.org!==""?ref.org:channel.metadata?.org??"")===org&&ref.slug===slug)throw failedPreconditionError(deleteBlockedByChannelMessage(org,slug,channel.metadata?.name??""))}}}}function registerChannelAppServices(router,deps){router.service(ChannelAppCommandController,{apply:(app,ctx)=>apply6(deps,app,ctx),create:(app,ctx)=>createChannelApp(deps,app,ctx),update:(app,ctx)=>update9(deps,app,ctx),delete:(input,ctx)=>deleteChannelApp(deps,input,ctx)}),router.service(ChannelAppQueryController,{get:(id,ctx)=>get12(deps,id,ctx),getByReference:(ref,ctx)=>getByReference6(deps,ref,ctx),listByOrg:(req,ctx)=>listByOrg(deps,req,ctx)})}function kindOf11(ctx){return ctx.values.get(apiResourceKindKey)}async function createChannelApp(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));return await newPipeline("channelapp-create",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEncryptChannelAppSecretsForCreateStep(deps.secretService,deps.logger)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),redactChannelApp(reqCtx.newState),reqCtx.newState}async function update9(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));return await newPipeline("channelapp-update",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateProviderImmutableStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newEncryptChannelAppSecretsForUpdateStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).build().execute(reqCtx),redactChannelApp(reqCtx.newState),reqCtx.newState}async function apply6(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-apply",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createChannelApp(deps,app,ctx):update9(deps,withResolvedApplyId(ChannelAppSchema,app,reqCtx),ctx)}async function deleteChannelApp(deps,input,ctx){let reqCtx=new RequestContext(ChannelAppCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf11(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("channelapp-delete",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,ChannelAppSchema)).addStep(newCheckNoReferencingChannelsStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,secretValuesOfChannelApp)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted ChannelApp not found in context"),"deleted ChannelApp not found in context");let app=deleted;return redactChannelApp(app),app}async function get12(deps,id,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-get",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ChannelAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactChannelApp(app),app}async function getByReference6(deps,ref,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-get-by-reference",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ChannelAppSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(ChannelAppQueryController.method.get))).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactChannelApp(app),app}var LIST_RESULT_KEY4="listResult";async function listByOrg(deps,req,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.listByOrg.input,req,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-list-by-org",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgStep(deps.store,deps.logger)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY4);if(result===void 0)throw internalError(new Error("ChannelApp list not found in context"),"ChannelApp list not found in context");return result}function newListByOrgStep(store,logger2){return{name:"ListByOrg",async execute(ctx){let org=ctx.input.org,rows;try{rows=await store.listResources(ApiResourceKind.channel_app)}catch(error2){throw internalError(error2,"failed to list ChannelApps")}let apps=[];for(let bytes of rows){let app;try{app=fromBinary2(ChannelAppSchema,bytes)}catch{logger2.warn("Failed to unmarshal ChannelApp, skipping");continue}(app.metadata?.org??"")===org&&(redactChannelApp(app),apps.push(app))}apps.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY4,create2(ChannelAppsSchema,{entries:apps}))}}}var file_ai_stigmer_agentic_environment_v1_command=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvZW52aXJvbm1lbnQvdjEvY29tbWFuZC5wcm90bxIhYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxMoMKChxFbnZpcm9ubWVudENvbW1hbmRDb250cm9sbGVyEmcKBWFwcGx5Ei4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50Gi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50ErkBCgZjcmVhdGUSLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiT8K4GEsIDBAeIgxtZXRhZGF0YS5vcmcqN3VuYXV0aG9yaXplZCB0byBjcmVhdGUgZW52aXJvbm1lbnQgaW4gdGhpcyBvcmdhbml6YXRpb24SowEKBnVwZGF0ZRIuLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudBouLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudCI5wrgYNQgCEDUiC21ldGFkYXRhLmlkKiJ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGVudmlyb25tZW50Er8BChB1cGRhdGVWaXNpYmlsaXR5EjUuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlVwZGF0ZVZpc2liaWxpdHlJbnB1dBouLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudCJEwrgYQAgCEDUiC3Jlc291cmNlX2lkKi11bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGVudmlyb25tZW50IHZpc2liaWxpdHkSqwEKBmRlbGV0ZRI2LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZURlbGV0ZUlucHV0Gi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50IjnCuBg1CAIQNSILcmVzb3VyY2VfaWQqInVuYXV0aG9yaXplZCB0byBkZWxldGUgZW52aXJvbm1lbnQSzwEKD3VwZGF0ZVZhcmlhYmxlcxJELmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5VcGRhdGVFbnZpcm9ubWVudFZhcmlhYmxlc1JlcXVlc3QaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiRsK4GEIIAhA1Ig5lbnZpcm9ubWVudF9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBlbnZpcm9ubWVudCB2YXJpYWJsZXMSzwEKD3JlbW92ZVZhcmlhYmxlcxJELmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5SZW1vdmVFbnZpcm9ubWVudFZhcmlhYmxlc1JlcXVlc3QaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiRsK4GEIIAhA1Ig5lbnZpcm9ubWVudF9pZCosdW5hdXRob3JpemVkIHRvIHJlbW92ZSBlbnZpcm9ubWVudCB2YXJpYWJsZXMaBKD/KzViBnByb3RvMw",[file_ai_stigmer_agentic_environment_v1_api,file_ai_stigmer_agentic_environment_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EnvironmentCommandController=serviceDesc(file_ai_stigmer_agentic_environment_v1_command,0);var file_ai_stigmer_agentic_environment_v1_query=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvZW52aXJvbm1lbnQvdjEvcXVlcnkucHJvdG8SIWFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MTKMBQoaRW52aXJvbm1lbnRRdWVyeUNvbnRyb2xsZXISlgEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50IjDCuBgsCAEQNSIFdmFsdWUqH3VuYXV0aG9yaXplZCB0byBnZXQgZW52aXJvbm1lbnQSfAoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiBNC4GAES0gEKDmdldFNlY3JldFZhbHVlEj4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50U2VjcmV0VmFsdWVJbnB1dBozLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudFZhbHVlIkvCuBhHCBAQNSIOZW52aXJvbm1lbnRfaWQqMXVuYXV0aG9yaXplZCB0byByZWFkIHNlY3JldCB2YWx1ZXMgKGNyZWF0b3Itb25seSkSfAoEbGlzdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5MaXN0RW52aXJvbm1lbnRzUmVxdWVzdBoyLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudExpc3QiBNC4GAEaBKD/KzViBnByb3RvMw",[file_ai_stigmer_agentic_environment_v1_api,file_ai_stigmer_agentic_environment_v1_io,file_ai_stigmer_agentic_environment_v1_spec,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EnvironmentQueryController=serviceDesc(file_ai_stigmer_agentic_environment_v1_query,0);function redactEnvironmentSecrets(env2){let data=env2?.spec?.data;if(data!==void 0)for(let value of Object.values(data))value.isSecret&&value.value!==""&&(value.value=REDACTED_MARKER)}function shareRestrictionReason(metadata){let labels=metadata?.labels??{};return labels[PERSONAL_LABEL_KEY]===PERSONAL_LABEL_VALUE?PERSONAL_SHARE_RESTRICTION:labels[MANAGED_LABEL_KEY]===MANAGED_LABEL_VALUE?MANAGED_SHARE_RESTRICTION:""}var environmentSearchExtractor={kind:ApiResourceKind.environment,schema:EnvironmentSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let env2=resource;return buildSearchResult({kind:ApiResourceKind.environment,metadata:env2.metadata,summary:env2.spec?.description??"",score,createdAt:env2.status?.audit?.specAudit?.createdAt,updatedAt:env2.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let env2=resource,metadata=env2.metadata;if(metadata!==void 0)return{name:metadata.name,description:env2.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(env2.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var SECRET_VALUE_KEY="secretValue",UPDATED_ENVIRONMENT_KEY="updatedEnvironment";function newPreserveRedactedSecretsStep(){return{name:"PreserveRedactedSecrets",execute(ctx){let data=ctx.newState.spec?.data;if(data===void 0||Object.keys(data).length===0)return;let existingData=ctx.get(EXISTING_RESOURCE_KEY)?.spec?.data??{};for(let[key,value]of Object.entries(data))if(value.isSecret){if(value.value===REDACTED_MARKER){let existingEntry=existingData[key];if(existingEntry!==void 0&&existingEntry.isSecret){data[key]=existingEntry;continue}throw invalidArgumentError(markerRejectionMessage(key))}if(isCiphertextShaped(value.value))throw invalidArgumentError(forgedCiphertextMessage(key))}}}}function newEncryptSecretValuesStep(secretService,logger2){return{name:"EncryptSecretValues",async execute(ctx){let env2=ctx.newState,data=env2.spec?.data;if(!(data===void 0||Object.keys(data).length===0)){if(!secretService.isEnabled()){hasNonEmptySecret(data)&&logger2.warn("Encryption disabled: environment secret values will be stored in plaintext",{environmentId:env2.metadata?.id??""});return}for(let[key,value]of Object.entries(data))if(!(!value.isSecret||value.value===""))try{value.value=await secretService.encrypt(value.value,EncryptionScope.forOrganization(env2.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt secret value for variable '${key}'`)}}}}}function hasNonEmptySecret(data){return Object.values(data).some(v=>v.isSecret&&v.value!=="")}function newEnforcePersonalUniquenessStep(store){return{name:"EnforcePersonalEnvUniqueness",async execute(ctx){let metadata=ctx.newState.metadata;if(metadata===void 0||metadata.labels[PERSONAL_LABEL_KEY]!==PERSONAL_LABEL_VALUE)return;let existing;try{existing=await findResourceByLabelAndOrg(store,ctx.apiResourceKind,EnvironmentSchema,PERSONAL_LABEL_KEY,PERSONAL_LABEL_VALUE,metadata.org)}catch(error2){throw internalError(error2,"failed to check personal environment uniqueness")}if(existing!==void 0)throw new ConnectError(personalEnvironmentExistsMessage(existing.metadata?.id??""),Code.AlreadyExists)}}}function newLoadEnvironmentByIdStep(store){return{name:"LoadEnvironmentByID",async execute(ctx){let environmentId=ctx.input.environmentId;if(typeof environmentId!="string"||environmentId==="")throw invalidArgumentError("environment_id is required");let env2;try{env2=await store.getResource(ctx.apiResourceKind,environmentId,EnvironmentSchema)}catch{throw notFoundError("environment",environmentId)}ctx.set(TARGET_RESOURCE_KEY,env2)}}}function newExtractAndDecryptSingleKeyStep(secretService,logger2){return{name:"ExtractAndDecryptSingleKey",async execute(ctx){let key=ctx.input.key,env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");let envValue=env2.spec?.data[key];if(envValue===void 0)throw notFoundError("environment key",key);if(envValue.isSecret&&envValue.value!==""){let decrypted;try{decrypted=await secretService.decrypt(envValue.value)}catch(error2){throw logger2.error("Failed to decrypt secret value",{key,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to decrypt secret value")}ctx.set(SECRET_VALUE_KEY,create2(EnvironmentValueSchema,{value:decrypted,isSecret:!0,description:envValue.description}));return}ctx.set(SECRET_VALUE_KEY,envValue)}}}function newMergeVariablesAndPersistStep(store,secretService,logger2){return{name:"MergeVariablesAndPersist",async execute(ctx){let env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");env2.spec===void 0&&(env2.spec=create2(EnvironmentSpecSchema,{}));let incoming=ctx.input.variables;for(let[key,incomingValue]of Object.entries(incoming)){let value=incomingValue;if(value.isSecret&&value.value===REDACTED_MARKER){let existing=env2.spec.data[key];if(existing!==void 0&&existing.isSecret)continue;throw invalidArgumentError(markerRejectionMessage(key))}if(value.isSecret&&isCiphertextShaped(value.value))throw invalidArgumentError(forgedCiphertextMessage(key));if(value.isSecret&&value.value!=="")if(!secretService.isEnabled())logger2.warn("Encryption disabled: environment secret value will be stored in plaintext",{key});else{let encrypted;try{encrypted=await secretService.encrypt(value.value,EncryptionScope.forOrganization(env2.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt secret value for variable '${key}'`)}value=create2(EnvironmentValueSchema,{value:encrypted,isSecret:!0,description:value.description})}env2.spec.data[key]=value}try{setAuditFieldsForUpdate(EnvironmentSchema,env2,"spec_audit",ctx.callerIdentity)}catch(error2){throw internalError(error2,"failed to set audit fields")}try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to persist environment after merging variables")}ctx.set(UPDATED_ENVIRONMENT_KEY,env2)}}}function newRemoveVariableKeysAndPersistStep(store,secretService,logger2){return{name:"RemoveVariableKeysAndPersist",async execute(ctx){let env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");let keys=ctx.input.keys,removedSecretValues=[];if(env2.spec?.data!==void 0)for(let key of keys){let removed=env2.spec.data[key];removed!==void 0&&removed.isSecret&&removedSecretValues.push(removed.value),delete env2.spec.data[key]}try{setAuditFieldsForUpdate(EnvironmentSchema,env2,"spec_audit",ctx.callerIdentity)}catch(error2){throw internalError(error2,"failed to set audit fields")}try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to persist environment after removing variables")}await destroySecretBackingState(secretService,logger2,{kind:"environment",resourceId:env2.metadata?.id??"",operation:"removeVariables"},removedSecretValues),ctx.set(UPDATED_ENVIRONMENT_KEY,env2)}}}function newDestroyDroppedEnvironmentSecretsStep(secretService,logger2){return{name:"DestroyDroppedEnvironmentSecrets",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY),oldData=existing?.spec?.data;if(oldData===void 0)return;let newData=ctx.newState.spec?.data??{},droppedSecretValues=Object.entries(oldData).filter(([key,value])=>value.isSecret&&newData[key]===void 0).map(([,value])=>value.value);await destroySecretBackingState(secretService,logger2,{kind:"environment",resourceId:existing?.metadata?.id??"",operation:"update"},droppedSecretValues)}}}function secretValuesOfEnvironment(env2){return Object.values(env2.spec?.data??{}).filter(value=>value.isSecret).map(value=>value.value)}function registerEnvironmentServices(router,deps){router.service(EnvironmentCommandController,{apply:(env2,ctx)=>apply7(deps,env2,ctx),create:(env2,ctx)=>createEnvironment(deps,env2,ctx),update:(env2,ctx)=>update10(deps,env2,ctx),updateVisibility:(input,ctx)=>updateVisibility3(deps,input,ctx),delete:(input,ctx)=>deleteEnvironment(deps,input,ctx),updateVariables:(req,ctx)=>updateVariables(deps,req,ctx),removeVariables:(req,ctx)=>removeVariables(deps,req,ctx)}),router.service(EnvironmentQueryController,{get:(id,ctx)=>get13(deps,id,ctx),getByReference:(ref,ctx)=>getByReference7(deps,ref,ctx),getSecretValue:(input,ctx)=>getSecretValue(deps,input,ctx),list:(req,ctx)=>list8(deps,req,ctx)})}function kindOf12(ctx){return ctx.values.get(apiResourceKindKey)}async function createEnvironment(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-create",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEnforcePersonalUniquenessStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPreserveRedactedSecretsStep()).addStep(newEncryptSecretValuesStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,environmentSearchExtractor,deps.logger)).build().execute(reqCtx),redactEnvironmentSecrets(reqCtx.newState),reqCtx.newState}async function update10(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-update",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPreserveRedactedSecretsStep()).addStep(newEncryptSecretValuesStep(deps.secretService,deps.logger)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newDestroyDroppedEnvironmentSecretsStep(deps.secretService,deps.logger)).addStep(newIndexSearchStep(deps.store,environmentSearchExtractor,deps.logger)).build().execute(reqCtx),redactEnvironmentSecrets(reqCtx.newState),reqCtx.newState}async function apply7(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-apply",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createEnvironment(deps,env2,ctx):update10(deps,withResolvedApplyId(EnvironmentSchema,env2,reqCtx),ctx)}async function deleteEnvironment(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf12(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("environment-delete",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,EnvironmentSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,secretValuesOfEnvironment)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted environment not found in context"),"deleted environment not found in context");let env2=deleted;return redactEnvironmentSecrets(env2),env2}var UPDATE_VISIBILITY_ENVIRONMENT_KEY="updateVisibilityEnvironment";async function updateVisibility3(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-update-visibility",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentForVisibilityUpdateStep(deps.store)).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_ENVIRONMENT_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newValidateEnvironmentShareRestrictionStep()).addStep(newSetEnvironmentVisibilityStep()).addStep(newPersistEnvironmentForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_ENVIRONMENT_KEY)).addStep(newIndexEnvironmentAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx);let env2=reqCtx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);return redactEnvironmentSecrets(env2),env2}function newLoadEnvironmentForVisibilityUpdateStep(store){return{name:"LoadEnvironmentForVisibilityUpdate",async execute(ctx){let input=ctx.input,env2;try{env2=await store.getResource(ctx.apiResourceKind,input.resourceId,EnvironmentSchema)}catch{throw notFoundError("environment",input.resourceId)}ctx.set(UPDATE_VISIBILITY_ENVIRONMENT_KEY,env2)}}}function newValidateEnvironmentShareRestrictionStep(){return{name:"ValidateEnvironmentShareRestriction",execute(ctx){if(ctx.input.visibility!==ApiResourceVisibility.visibility_org)return;let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY),reason=shareRestrictionReason(env2.metadata);if(reason!=="")throw failedPreconditionError(reason)}}}function newSetEnvironmentVisibilityStep(){return{name:"SetVisibility",execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);env2.metadata!==void 0&&(env2.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(EnvironmentSchema,env2,"status_audit",ctx.callerIdentity)}}}function newPersistEnvironmentForVisibilityUpdateStep(store){return{name:"PersistEnvironmentForVisibilityUpdate",async execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to save environment")}}}}function newIndexEnvironmentAfterVisibilityUpdateStep(store,logger2){return{name:"IndexEnvironmentAfterVisibilityUpdate",async execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY),entry=environmentSearchExtractor.getSearchIndexEntry(env2);if(entry===void 0){logger2.warn("IndexEnvironmentAfterVisibilityUpdate: extractor returned nil, skipping",{id:env2.metadata?.id??""});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,env2.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexEnvironmentAfterVisibilityUpdate: failed (best-effort)",{id:env2.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function updateVariables(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.updateVariables.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-update-variables",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.updateVariables,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newMergeVariablesAndPersistStep(deps.store,deps.secretService,deps.logger)).build().execute(reqCtx);let updated=reqCtx.get(UPDATED_ENVIRONMENT_KEY);return redactEnvironmentSecrets(updated),updated}async function removeVariables(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.removeVariables.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-remove-variables",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.removeVariables,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newRemoveVariableKeysAndPersistStep(deps.store,deps.secretService,deps.logger)).build().execute(reqCtx);let updated=reqCtx.get(UPDATED_ENVIRONMENT_KEY);return redactEnvironmentSecrets(updated),updated}async function get13(deps,id,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-get",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,EnvironmentSchema)).build().execute(reqCtx);let env2=reqCtx.get(TARGET_RESOURCE_KEY);return redactEnvironmentSecrets(env2),env2}async function getByReference7(deps,ref,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-get-by-reference",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,EnvironmentSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(EnvironmentQueryController.method.get))).build().execute(reqCtx);let env2=reqCtx.get(TARGET_RESOURCE_KEY);return redactEnvironmentSecrets(env2),env2}async function getSecretValue(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.getSecretValue.input,input,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-get-secret-value",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.getSecretValue,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newExtractAndDecryptSingleKeyStep(deps.secretService,deps.logger)).build().execute(reqCtx),reqCtx.get(SECRET_VALUE_KEY)}var LIST_RESULT_KEY5="listResult";async function list8(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-list",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgAndLabelsStep5(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY5);if(result===void 0)throw internalError(new Error("environment list not found in context"),"environment list not found in context");return result}function newListByOrgAndLabelsStep5(store,listReadScope){return{name:"ListByOrgAndLabels",async execute(ctx){let{org,labels:filterLabels}=ctx.input,rows;try{rows=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list environments")}let decoded=[];for(let bytes of rows)try{decoded.push(fromBinary2(EnvironmentSchema,bytes))}catch{continue}let requested=decoded.filter(env2=>(env2.metadata?.org??"")===org&&matchesAllLabels(env2.metadata?.labels??{},filterLabels)),environments=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.environment,requested,"");for(let env2 of environments)redactEnvironmentSecrets(env2);environments.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY5,create2(EnvironmentListSchema,{totalCount:environments.length,items:environments}))}}}var file_ai_stigmer_agentic_executioncontext_v1_command=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9jb21tYW5kLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MTLpAwohRXhlY3V0aW9uQ29udGV4dENvbW1hbmRDb250cm9sbGVyEnsKBWFwcGx5EjguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQSggEKBmNyZWF0ZRI4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQaOC5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0IgTQuBgBErsBCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQiP8K4GDsIAhA2IgtyZXNvdXJjZV9pZCoodW5hdXRob3JpemVkIHRvIGRlbGV0ZSBleGVjdXRpb24gY29udGV4dBoEoP8rNmIGcHJvdG8z",[file_ai_stigmer_agentic_executioncontext_v1_api,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ExecutionContextCommandController=serviceDesc(file_ai_stigmer_agentic_executioncontext_v1_command,0);var file_ai_stigmer_agentic_executioncontext_v1_io=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9pby5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEiKwoSRXhlY3V0aW9uQ29udGV4dElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiQQogRXhlY3V0aW9uQ29udGV4dEV4ZWN1dGlvbklkSW5wdXQSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABYgZwcm90bzM",[file_buf_validate_validate]);var file_ai_stigmer_agentic_executioncontext_v1_query=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9xdWVyeS5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEyhQQKH0V4ZWN1dGlvbkNvbnRleHRRdWVyeUNvbnRyb2xsZXISswEKA2dldBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHRJZBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQiNsK4GDIIARA2IgV2YWx1ZSoldW5hdXRob3JpemVkIHRvIGdldCBleGVjdXRpb24gY29udGV4dBKGAQoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaOC5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0IgTQuBgBEpwBChBnZXRCeUV4ZWN1dGlvbklkEkguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dEV4ZWN1dGlvbklkSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0IgTQuBgBGgSg/ys2YgZwcm90bzM",[file_ai_stigmer_agentic_executioncontext_v1_api,file_ai_stigmer_agentic_executioncontext_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ExecutionContextQueryController=serviceDesc(file_ai_stigmer_agentic_executioncontext_v1_query,0);function redactExecutionContextSecrets(ec2){let data=ec2?.spec?.data;if(data!==void 0)for(let value of Object.values(data))value.isSecret&&value.value!==""&&(value.value=REDACTED_MARKER)}var import_node_crypto18=require("node:crypto"),CONNECT_EXECUTION_ID_PREFIX="connect-";function newConnectExecutionId(mcpServerId){return`${CONNECT_EXECUTION_ID_PREFIX}${mcpServerId}-${(0,import_node_crypto18.randomUUID)().slice(0,8)}`}function isConnectExecutionId(executionId){return executionId.startsWith(CONNECT_EXECUTION_ID_PREFIX)}function isTerminalWorkflowExecutionPhase(phase){switch(phase){case ExecutionPhase2.EXECUTION_COMPLETED:case ExecutionPhase2.EXECUTION_FAILED:case ExecutionPhase2.EXECUTION_CANCELLED:case ExecutionPhase2.EXECUTION_TERMINATED:return!0;default:return!1}}var RUNNER_VERIFIER_NAME="runner",RUNNER_CREDENTIAL_INVALID_MESSAGE="runner credential is not valid on this server",RUNNER_CREDENTIAL_NOT_LIVE_MESSAGE="runner credential names a run that is over or belongs to nobody this server recognizes",RUN_CREDENTIAL_NOT_RUNS_PERSON_MESSAGE="a run credential is minted only for the person whose run it is",WORKFLOW_LINEAGE_BINDING_MISMATCH_MESSAGE="workflow lineage label names a workflow execution this runner credential is not bound to",MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE="memory capture is scoped to the session's organization";function boundExecutionKindOf(executionId){switch(kindByIdPrefix(executionId)){case ApiResourceKind.agent_execution:return"agent-execution";case ApiResourceKind.workflow_execution:return"workflow-execution";default:return isConnectExecutionId(executionId)?"mcp-connect":void 0}}function bindsARun(kind){switch(kind){case"agent-execution":case"workflow-execution":return!0;case"mcp-connect":return!1;default:{let exhaustive=kind;throw new Error(`unknown bound execution kind ${String(exhaustive)}`)}}}async function loadBoundExecution(store,executionId,now=Date.now()){let kind=boundExecutionKindOf(executionId);if(kind!==void 0)switch(kind){case"agent-execution":{let row=await getRow(store,ApiResourceKind.agent_execution,executionId,AgentExecutionSchema);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(AgentExecutionSchema,row),sessionId:row.spec?.sessionId??"",live:isLive(row.status!==void 0&&isTerminalExecutionPhase(row.status.phase),row.status?.completedAt??"",now)}}case"workflow-execution":{let row=await getRow(store,ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(WorkflowExecutionSchema,row),sessionId:"",live:isLive(row.status!==void 0&&isTerminalWorkflowExecutionPhase(row.status.phase),row.status?.completedAt??"",now)}}case"mcp-connect":{let row=await getExecutionContextRow(store,executionId);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(ExecutionContextSchema,row),sessionId:"",live:!0}}default:{let exhaustive=kind;throw new Error(`unknown bound execution kind ${String(exhaustive)}`)}}}function isLive(terminal,completedAt,now){if(!terminal)return!0;let finishedAt=Date.parse(completedAt);return Number.isNaN(finishedAt)?!1:now-finishedAt<6e5}function creatorStampOf(schema2,row){return auditOf(schema2,row)?.specAudit?.createdBy?.id??""}async function getRow(store,kind,id,schema2){try{return await store.getResource(kind,id,schema2)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function getExecutionContextRow(store,executionId){try{return await store.findByField(ApiResourceKind.execution_context,"spec.executionId",executionId,ExecutionContextSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}function ciphertextShapedMessage(key){return`value for '${key}' looks like stored ciphertext (enc:v<N>: prefix); supply the plaintext value`}var ENCRYPT_BATCH_FAILURE_MESSAGE="failed to encrypt secret values";function encryptionKeyMissingMessage(executionId,key){return`execution context for ${executionId} holds encrypted secret '${key}' but no encryption key is configured`}async function resolveValuesForCaller(deps,ctx,ec2){if(await runnerMayDecrypt(deps,ctx,ec2)){await decryptSecretValues(deps,ec2);return}redactExecutionContextSecrets(ec2)}async function runnerMayDecrypt(deps,ctx,ec2){let authorizeRead=deps.runnerAuthService.authorizeExecutionContextRead?.bind(deps.runnerAuthService);if(authorizeRead!==void 0){let token2=bearerToken(ctx);if(token2==="")return!1;try{return await authorizeRead(token2,ec2.spec?.executionId??"")}catch(error2){return deps.logger.warn("ExecutionContext read authorization failed \u2014 redacting secrets",{error:error2 instanceof Error?error2.message:String(error2)}),!1}}let token=bearerToken(ctx),executionId=verifyRunnerToken(deps,token,ec2);return executionId===void 0?!1:!isClockedToken(token)&&!await runIsLive(deps,executionId)?(deps.logger.debug("Run credential presented for a run that is over - redacting execution context secrets",{executionId}),!1):(deps.logger.debug("Scope-bound runner token presented - decrypting execution context secrets",{executionId}),!0)}function verifyRunnerToken(deps,token,ec2){if(token==="")return;let tokenExecutionId;try{tokenExecutionId=deps.runnerAuthService.verify(TOKEN_TYPE_EXECUTION_SCOPED,token)}catch{deps.logger.debug("Presented runner token failed verification - redacting execution context secrets");return}if(tokenExecutionId!==(ec2.spec?.executionId??"")){deps.logger.warn("Runner token is not scope-bound to this execution context - redacting secrets",{tokenExecutionId,executionId:ec2.spec?.executionId??""});return}return tokenExecutionId}async function runIsLive(deps,executionId){try{let execution=await loadBoundExecution(deps.store,executionId);return execution!==void 0&&bindsARun(execution.kind)&&execution.live}catch(error2){throw internalError(error2,"failed to load the run credential's execution")}}function bearerToken(ctx){return parseBearerToken(ctx.requestHeader.get("authorization")??"")}async function decryptSecretValues(deps,ec2){let executionId=ec2.spec?.executionId??"",data=ec2.spec?.data??{};for(let[key,value]of Object.entries(data))if(!(!value.isSecret||!deps.secretService.isEncrypted(value.value)))try{value.value=await deps.secretService.decrypt(value.value)}catch(error2){if(error2 instanceof EncryptionUnavailableError)throw internalError(error2,encryptionKeyMissingMessage(executionId,key));deps.logger.warn("Undecryptable ciphertext in execution context \u2014 dropping this value from the runner read",{key,executionId,error:error2 instanceof Error?error2.message:String(error2)}),delete data[key]}}var executionContextSearchExtractor={kind:ApiResourceKind.execution_context,schema:ExecutionContextSchema,getSearchSummary(){return""},toSearchResult(resource,score){let ec2=resource;return buildSearchResult({kind:ApiResourceKind.execution_context,metadata:ec2.metadata,summary:"",score,createdAt:ec2.status?.audit?.specAudit?.createdAt,updatedAt:ec2.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let ec2=resource,metadata=ec2.metadata;if(metadata!==void 0)return{name:metadata.name,description:"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(ec2.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function newRejectCiphertextShapedStep(){return{name:"RejectCiphertextShapedValues",execute(ctx){let data=ctx.input.spec?.data??{};for(let[key,value]of Object.entries(data))if(isCiphertextShaped(value.value))throw invalidArgumentError(ciphertextShapedMessage(key))}}}function newEncryptSecretValuesStep2(secretService,logger2){return{name:"EncryptSecretValues",async execute(ctx){let ec2=ctx.newState,data=ec2.spec?.data;if(data===void 0||Object.keys(data).length===0)return;if(!secretService.isEnabled()){hasNonEmptySecret2(data)&&logger2.warn("Encryption disabled: execution context secret values will be stored in plaintext",{executionId:ec2.spec?.executionId??""});return}let toSeal=new Map;for(let[key,value]of Object.entries(data))!value.isSecret||value.value===""||toSeal.set(key,value.value);if(toSeal.size===0)return;let sealed;try{sealed=await secretService.encryptAllAtMostV2(toSeal,EncryptionScope.forOrganization(ec2.metadata?.org??""))}catch(error2){throw internalError(error2,ENCRYPT_BATCH_FAILURE_MESSAGE)}for(let[key,value]of Object.entries(data)){let sealedValue=sealed.get(key);sealedValue!==void 0&&(value.value=sealedValue)}}}}function hasNonEmptySecret2(data){return Object.values(data).some(v=>v.isSecret&&v.value!=="")}function newLoadByExecutionIdStep(store){return{name:"LoadByExecutionId",async execute(ctx){let input=ctx.input;if(input.executionId==="")throw invalidArgumentError("execution_id is required");let executionContext;try{executionContext=await store.findByField(ctx.apiResourceKind,"spec.executionId",input.executionId,ExecutionContextSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("execution_context",`execution_id=${input.executionId}`):internalError(error2,"failed to query execution context")}ctx.set(TARGET_RESOURCE_KEY,executionContext)}}}function newAuthorizeExecutionContextCreateStep(authorizer){return{name:"AuthorizeCreate",async execute(ctx){let caller=ctx.callerIdentity;if(isServerComposedRequest(caller))return;let decision;try{decision=await authorizer.authorize(caller,{permission:IamPermission.can_create_execution_in,resourceKind:ApiResourceKind.organization,resourceId:ctx.newState.metadata?.org??""})}catch(error2){throw internalError(error2 instanceof Error?error2:new Error(String(error2)),"execution-context create authorization could not be completed")}switch(decision.kind){case"allow":return;case"deny":case"not-found":throw new ConnectError("unauthorized to create execution context in this organization",Code.PermissionDenied);case"unavailable":throw internalError(decision.cause,"execution-context create authorization could not be completed");default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),"execution-context create authorization could not be completed")}}}}}function registerExecutionContextServices(router,deps){router.service(ExecutionContextCommandController,{apply:(ec2,ctx)=>apply8(deps,ec2,ctx),create:(ec2,ctx)=>createExecutionContext(deps,ec2,ctx),delete:(input,ctx)=>deleteExecutionContext(deps,input,ctx)}),router.service(ExecutionContextQueryController,{get:(id,ctx)=>get14(deps,id,ctx),getByReference:(ref,ctx)=>getByReference8(deps,ref,ctx),getByExecutionId:(input,ctx)=>getByExecutionId(deps,input,ctx)})}function kindOf13(ctx){return ctx.values.get(apiResourceKindKey)}async function createExecutionContext(deps,ec2,ctx){let reqCtx=new RequestContext(ExecutionContextSchema,ec2,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("execution-context-create",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeExecutionContextCreateStep(deps.authorizer)).addStep(newValidateVisibilityStep()).addStep(newRejectCiphertextShapedStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newEncryptSecretValuesStep2(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,executionContextSearchExtractor,deps.logger)).build().execute(reqCtx),redactExecutionContextSecrets(reqCtx.newState),reqCtx.newState}async function apply8(deps,ec2,ctx){let reqCtx=new RequestContext(ExecutionContextSchema,ec2,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-apply",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");if(shouldCreate)return createExecutionContext(deps,ec2,ctx);throw deps.logger.warn("ExecutionContext already exists - UPDATE not supported",{slug:ec2.metadata?.name??"",id:ec2.metadata?.id??""}),alreadyExistsError("ExecutionContext",ec2.metadata?.name??"")}async function deleteExecutionContext(deps,input,ctx){let reqCtx=new RequestContext(ExecutionContextCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf13(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("execution-context-delete",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,ExecutionContextSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted execution context not found in context"),"deleted execution context not found in context");let ec2=deleted;return redactExecutionContextSecrets(ec2),ec2}async function get14(deps,id,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ExecutionContextSchema)).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return redactExecutionContextSecrets(ec2),ec2}async function getByReference8(deps,ref,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get-by-reference",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ExecutionContextSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(ExecutionContextQueryController.method.get))).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return redactExecutionContextSecrets(ec2),ec2}async function getByExecutionId(deps,input,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.getByExecutionId.input,input,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get-by-execution-id",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.getByExecutionId,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByExecutionIdStep(deps.store)).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return await resolveValuesForCaller(deps,ctx,ec2),ec2}var import_node_crypto19=require("node:crypto");var file_ai_stigmer_platform_github_v1_service=fileDesc("CithaS9zdGlnbWVyL3BsYXRmb3JtL2dpdGh1Yi92MS9zZXJ2aWNlLnByb3RvEh1haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MSI8ChtHZXRPQXV0aEF1dGhvcml6ZVVybFJlcXVlc3QSHQoMcmVkaXJlY3RfdXJpGAEgASgJQge6SARyAhABIkQKHEdldE9BdXRoQXV0aG9yaXplVXJsUmVzcG9uc2USFQoNYXV0aG9yaXplX3VybBgBIAEoCRINCgVzdGF0ZRgCIAEoCSJoChhFeGNoYW5nZU9BdXRoQ29kZVJlcXVlc3QSFQoEY29kZRgBIAEoCUIHukgEcgIQARIWCgVzdGF0ZRgCIAEoCUIHukgEcgIQARIdCgxyZWRpcmVjdF91cmkYAyABKAlCB7pIBHICEAEiVAoZRXhjaGFuZ2VPQXV0aENvZGVSZXNwb25zZRIUCgxhY2Nlc3NfdG9rZW4YASABKAkSEgoKdG9rZW5fdHlwZRgCIAEoCRINCgVzY29wZRgDIAEoCTK2AgoNR2l0SHViU2VydmljZRKVAQoUZ2V0T0F1dGhBdXRob3JpemVVcmwSOi5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HZXRPQXV0aEF1dGhvcml6ZVVybFJlcXVlc3QaOy5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HZXRPQXV0aEF1dGhvcml6ZVVybFJlc3BvbnNlIgTQuBgBEowBChFleGNoYW5nZU9BdXRoQ29kZRI3LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkV4Y2hhbmdlT0F1dGhDb2RlUmVxdWVzdBo4LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkV4Y2hhbmdlT0F1dGhDb2RlUmVzcG9uc2UiBNC4GAFiBnByb3RvMw",[file_ai_stigmer_commons_rpc_method_options,file_buf_validate_validate]);var GetOAuthAuthorizeUrlResponseSchema=messageDesc2(file_ai_stigmer_platform_github_v1_service,1);var ExchangeOAuthCodeResponseSchema=messageDesc2(file_ai_stigmer_platform_github_v1_service,3),GitHubService=serviceDesc(file_ai_stigmer_platform_github_v1_service,0);var GITHUB_AUTHORIZE_URL="https://github.com/login/oauth/authorize",GITHUB_TOKEN_URL="https://github.com/login/oauth/access_token",OAUTH_SCOPES="repo,read:user",HTTP_TIMEOUT_MS=1e4;function registerGitHubServices(router,deps){router.service(GitHubService,{getOAuthAuthorizeUrl:req=>getOAuthAuthorizeUrl(deps,req),exchangeOAuthCode:req=>exchangeOAuthCode(deps,req)})}function getOAuthAuthorizeUrl(deps,req){if(deps.clientId==="")throw failedPreconditionError("GitHub OAuth is not configured (STIGMER_GITHUB_CLIENT_ID not set)");let state2;try{state2=(0,import_node_crypto19.randomBytes)(16).toString("hex")}catch(error2){throw deps.logger.error("failed to generate OAuth state",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to generate OAuth state")}let authorizeUrl=GITHUB_AUTHORIZE_URL+"?"+goUrlValuesEncode({client_id:deps.clientId,redirect_uri:req.redirectUri,scope:OAUTH_SCOPES,state:state2});return create2(GetOAuthAuthorizeUrlResponseSchema,{authorizeUrl,state:state2})}async function exchangeOAuthCode(deps,req){if(deps.clientId===""||deps.clientSecret==="")throw failedPreconditionError("GitHub OAuth is not configured");let body=goUrlValuesEncode({client_id:deps.clientId,client_secret:deps.clientSecret,code:req.code,redirect_uri:req.redirectUri}),fetchImpl=deps.fetchImpl??fetch,response;try{response=await fetchImpl(GITHUB_TOKEN_URL,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body,signal:AbortSignal.timeout(HTTP_TIMEOUT_MS)})}catch(error2){throw deps.logger.error("GitHub token exchange failed",{error:error2 instanceof Error?error2.message:String(error2)}),unavailableError("failed to reach GitHub for token exchange")}let raw;try{raw=await response.text()}catch(error2){throw deps.logger.error("failed to read GitHub token response",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to read GitHub response")}let tokenResponse;try{tokenResponse=JSON.parse(raw)}catch(error2){throw deps.logger.error("failed to parse GitHub token response",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to parse GitHub response")}if(tokenResponse.error!==void 0&&tokenResponse.error!=="")throw deps.logger.warn("GitHub OAuth error",{error:tokenResponse.error,description:tokenResponse.error_description??""}),invalidArgumentError(`GitHub OAuth error: ${tokenResponse.error_description??""}`);return create2(ExchangeOAuthCodeResponseSchema,{accessToken:tokenResponse.access_token??"",tokenType:tokenResponse.token_type??"",scope:tokenResponse.scope??""})}var file_ai_stigmer_agentic_memory_v1_io=fileDesc("CiVhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2lvLnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxIiEKCE1lbW9yeUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiYAoTTGlzdE1lbW9yaWVzUmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESMwoJcGFnZV9pbmZvGAIgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbyJWCgpNZW1vcnlMaXN0EhMKC3RvdGFsX2NvdW50GAEgASgFEjMKBWl0ZW1zGAIgAygLMiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnliBnByb3RvMw",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]),MemoryIdSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,0);var MemoryListSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,2);var file_ai_stigmer_agentic_memory_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEypQUKF01lbW9yeUNvbW1hbmRDb250cm9sbGVyEloKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5GiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnkiBNC4GAESigEKBnVwZGF0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5GiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnkiNMK4GDAIAhA5IgttZXRhZGF0YS5pZCoddW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtZW1vcnkShgEKBmRlbGV0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIuwrgYKggDEDkiBXZhbHVlKh11bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1lbW9yeRKIAQoHY29uZmlybRImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIvwrgYKwgCEDkiBXZhbHVlKh51bmF1dGhvcml6ZWQgdG8gY29uZmlybSBtZW1vcnkShgEKBnJlamVjdBImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIuwrgYKggCEDkiBXZhbHVlKh11bmF1dGhvcml6ZWQgdG8gcmVqZWN0IG1lbW9yeRoEoP8rOWIGcHJvdG8z",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryCommandController=serviceDesc(file_ai_stigmer_agentic_memory_v1_command,0);var file_ai_stigmer_agentic_memory_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxMosCChVNZW1vcnlRdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIrwrgYJwgBEDkiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IG1lbW9yeRJpCgRsaXN0EjEuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5MaXN0TWVtb3JpZXNSZXF1ZXN0GiguYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlMaXN0IgTQuBgBGgSg/ys5YgZwcm90bzM",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryQueryController=serviceDesc(file_ai_stigmer_agentic_memory_v1_query,0);var MEMORY_CAPTURE_CALLER_MESSAGE="memory can only be captured for a first-party human operator",MEMORY_CAPTURE_CREDENTIAL_KEY="memoryCaptureCredential";function newGuardMemoryCaptureStep(provider){return{name:"GuardMemoryCapture",async execute(ctx){let caller=ctx.callerIdentity;if(isServerComposedRequest(caller))return;let decide=provider?.authorizeMemoryCapture;if(decide!==void 0){let org=metadataOf(ctx.newState)?.org??"",decision=await decide.call(provider,caller,org);switch(decision.verdict){case"admit":ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY,{subjectIdentityAccountId:decision.subjectIdentityAccountId,provedSessionId:decision.provedSessionId});return;case"refuse":throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied);case"no-opinion":break;default:{let exhaustive=decision;throw new Error(`unknown memory capture decision ${JSON.stringify(exhaustive)}`)}}}if(caller.callerClass==="machine"||carriesPlatformClientClaim(caller.rawToken))throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied)}}}function memoryCaptureCredentialOf(ctx){let payload=ctx.get(MEMORY_CAPTURE_CREDENTIAL_KEY);if(typeof payload=="object"&&payload!==null&&"subjectIdentityAccountId"in payload&&"provedSessionId"in payload)return payload}function carriesPlatformClientClaim(rawToken){let segments=rawToken.split(".");if(segments.length!==3)return!1;try{let payload=JSON.parse(Buffer.from(segments[1],"base64url").toString("utf8"));return typeof payload.platform_client_id=="string"&&payload.platform_client_id!==""}catch{return!1}}var MEMORY_FULL_MESSAGE="memory is full \u2014 review and delete existing memories";function memoryDisabledMessage(org){return`memory is not enabled for organization ${org} \u2014 an organization admin can enable it in organization preferences`}var MEMORY_CONFIRM_REJECTED_MESSAGE="memory was rejected \u2014 delete it and let the agent propose it again",MEMORY_REJECT_CONFIRMED_MESSAGE="memory was confirmed \u2014 delete it to stop it from being recalled",MEMORY_SUBJECT_IMMUTABLE_MESSAGE="spec.subject_identity_account_id is immutable \u2014 it is derived from the capturing credential at create",MEMORY_PROVENANCE_IMMUTABLE_MESSAGE="spec.provenance is immutable \u2014 it records where the fact came from";var LIST_RESULT_KEY6="listResult";function newResolveMemoryDefaultsStep(){return{name:"ResolveMemoryDefaults",execute(ctx){let memory=ctx.newState,metadata=memory.metadata;if((metadata?.org??"")==="")throw invalidArgumentError("metadata.org is required for a memory");if(metadata===void 0)throw internalError(new Error("metadata is nil"),"metadata is nil");metadata.id===""&&(metadata.id=generateId("mem")),metadata.name===""&&metadata.slug===""&&(metadata.name=metadata.id);let spec=memory.spec;if(spec===void 0)throw internalError(new Error("memory spec is nil"),"memory spec is nil");let captureCredential=memoryCaptureCredentialOf(ctx);spec.subjectIdentityAccountId=captureCredential?.subjectIdentityAccountId??"",spec.provenance!==void 0&&(spec.provenance.toolCallId=""),captureCredential!==void 0&&(spec.provenance===void 0&&(spec.provenance=create2(MemoryProvenanceSchema,{})),spec.provenance.sessionId=captureCredential.provedSessionId)}}}var MEMORY_CREATE_DENIED_MESSAGE="unauthorized to capture memory in this organization";function resolveMemoryCreateTargets(ctx){return isServerComposedRequest(ctx.callerIdentity)?[]:[{permission:IamPermission.can_create_session,resourceKind:ApiResourceKind.organization,resourceId:ctx.newState.metadata?.org??"",deniedMessage:MEMORY_CREATE_DENIED_MESSAGE}]}function newCheckMemoryEnablementStep(store){return{name:"CheckMemoryEnablement",async execute(ctx){let orgID=ctx.newState.metadata?.org??"",org;try{org=await store.getResource(ApiResourceKind.organization,orgID,OrganizationSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Organization",orgID):internalError(error2,"failed to load organization for memory enablement check")}if(org.spec?.preferences?.memoryEnabled!==!0)throw failedPreconditionError(memoryDisabledMessage(orgID))}}}function newCheckMemoryCapStep(store){return{name:"CheckMemoryCap",async execute(ctx){let newState=ctx.newState,org=newState.metadata?.org??"",subject=newState.spec?.subjectIdentityAccountId??"",rows;try{rows=await store.listResources(ApiResourceKind.memory)}catch(error2){throw internalError(error2,"failed to count memories for cap check")}let count=0;for(let bytes of rows){let existing=unmarshalMemory(bytes);existing!==void 0&&(existing.metadata?.org??"")===org&&(existing.spec?.subjectIdentityAccountId??"")===subject&&count++}if(count>=100)throw failedPreconditionError(MEMORY_FULL_MESSAGE)}}}function newInitializeMemoryLifecycleStep(){return{name:"InitializeMemoryLifecycle",execute(ctx){let memory=ctx.newState;memory.status===void 0&&(memory.status=create2(MemoryStatusSchema,{})),memory.status.lifecycleState=MemoryLifecycleState.lifecycle_state_proposed,memory.status.stateChangedAt=timestampNow()}}}function newValidateMemoryUpdateStep(){return{name:"ValidateMemoryUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing memory not found in context"),"existing memory not found in context");let newState=ctx.newState;if((newState.spec?.subjectIdentityAccountId??"")!==(existing.spec?.subjectIdentityAccountId??""))throw failedPreconditionError(MEMORY_SUBJECT_IMMUTABLE_MESSAGE);let newProvenance=newState.spec?.provenance,existingProvenance=existing.spec?.provenance;if(!(newProvenance===void 0||existingProvenance===void 0?newProvenance===existingProvenance:equals(MemoryProvenanceSchema,newProvenance,existingProvenance)))throw failedPreconditionError(MEMORY_PROVENANCE_IMMUTABLE_MESSAGE)}}}function newPersistMemoryUpdateStep(store){return{name:"PersistMemoryUpdate",async execute(ctx){let newState=ctx.newState,memoryId=newState.metadata?.id??"",live;try{live=await store.updateResource(ApiResourceKind.memory,memoryId,MemorySchema,row=>{row.apiVersion=newState.apiVersion,row.kind=newState.kind,row.metadata=newState.metadata,row.spec=newState.spec,newState.status?.audit!==void 0&&(row.status===void 0&&(row.status=create2(MemoryStatusSchema,{})),row.status.audit=newState.status.audit)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Memory",memoryId):internalError(error2,"failed to persist memory update")}ctx.setNewState(live)}}}function newTransitionMemoryLifecycleStep(store,target,blockedMessage){return{name:"TransitionMemoryLifecycle",async execute(ctx){let memoryId=ctx.get(EXISTING_RESOURCE_KEY).metadata?.id??"",transitionNoOp=new Error("memory already in target state"),blocked,live;try{live=await store.updateResource(ApiResourceKind.memory,memoryId,MemorySchema,row=>{live=row;let current=row.status?.lifecycleState??MemoryLifecycleState.lifecycle_state_unspecified;if(current===target)throw transitionNoOp;if(current!==MemoryLifecycleState.lifecycle_state_proposed&&current!==MemoryLifecycleState.lifecycle_state_unspecified)throw blocked=failedPreconditionError(blockedMessage),blocked;row.status===void 0&&(row.status=create2(MemoryStatusSchema,{})),row.status.lifecycleState=target,row.status.stateChangedAt=timestampNow(),setAuditFieldsForUpdate(MemorySchema,row,"status_audit",ctx.callerIdentity)})}catch(error2){if(error2!==transitionNoOp)throw blocked!==void 0&&error2===blocked?blocked:error2 instanceof ResourceNotFoundError?notFoundError("Memory",memoryId):internalError(error2,"failed to transition memory lifecycle")}if(live===void 0)throw internalError(new Error("transition closure did not observe the row"),"failed to transition memory lifecycle");ctx.set(EXISTING_RESOURCE_KEY,live)}}}function newListMemoriesByOrgStep(store,listReadScope){return{name:"ListMemoriesByOrg",async execute(ctx){let org=ctx.input.org,rows;try{rows=await store.listResources(ApiResourceKind.memory)}catch(error2){throw internalError(error2,"failed to list memories")}let decoded=[];for(let bytes of rows){let memory=unmarshalMemory(bytes);memory!==void 0&&decoded.push(memory)}let memories=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.memory,decoded.filter(memory=>(memory.metadata?.org??"")===org),"");memories.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY6,create2(MemoryListSchema,{totalCount:memories.length,items:memories}))}}}function unmarshalMemory(data){try{return fromBinary2(MemorySchema,data)}catch{return}}function registerMemoryServices(router,deps){router.service(MemoryCommandController,{create:(memory,ctx)=>createMemory(deps,memory,ctx),update:(memory,ctx)=>update11(deps,memory,ctx),delete:(id,ctx)=>deleteMemory(deps,id,ctx),confirm:(id,ctx)=>confirm(deps,id,ctx),reject:(id,ctx)=>reject(deps,id,ctx)}),router.service(MemoryQueryController,{get:(id,ctx)=>get15(deps,id,ctx),list:(req,ctx)=>list9(deps,req,ctx)})}function kindOf14(ctx){return ctx.values.get(apiResourceKindKey)}async function createMemory(deps,memory,ctx){let reqCtx=new RequestContext(MemorySchema,memory,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("memory-create",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider)).addStep(newValidateVisibilityStep()).addStep(newResolveMemoryDefaultsStep()).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveMemoryCreateTargets)).addStep(newCheckMemoryEnablementStep(deps.store)).addStep(newCheckMemoryCapStep(deps.store)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newInitializeMemoryLifecycleStep()).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update11(deps,memory,ctx){let reqCtx=new RequestContext(MemorySchema,memory,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("memory-update",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateMemoryUpdateStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistMemoryUpdateStep(deps.store)).build().execute(reqCtx),reqCtx.newState}async function confirm(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-confirm",MemoryCommandController.method.confirm,MemoryLifecycleState.lifecycle_state_confirmed,MEMORY_CONFIRM_REJECTED_MESSAGE)}async function reject(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-reject",MemoryCommandController.method.reject,MemoryLifecycleState.lifecycle_state_rejected,MEMORY_REJECT_CONFIRMED_MESSAGE)}async function runTransition(deps,memoryId,ctx,name,method,target,blockedMessage){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline(name,deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newTransitionMemoryLifecycleStep(deps.store,target,blockedMessage)).build().execute(reqCtx);let transitioned=reqCtx.get(EXISTING_RESOURCE_KEY);if(transitioned===void 0)throw internalError(new Error("transitioned memory not found in context"),"transitioned memory not found in context");return transitioned}async function deleteMemory(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-delete",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted memory not found in context"),"deleted memory not found in context");return deleted}async function get15(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-get",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,MemorySchema)).build().execute(reqCtx);let target=reqCtx.get(TARGET_RESOURCE_KEY);if(target===void 0)throw internalError(new Error("target memory not found in context"),"target memory not found in context");return target}async function list9(deps,req,ctx){let reqCtx=new RequestContext(MemoryQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-list",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListMemoriesByOrgStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY6);if(result===void 0)throw internalError(new Error("memory list not found in context"),"memory list not found in context");return result}var file_ai_stigmer_iam_oauthapp_v1_command=fileDesc("CihhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9jb21tYW5kLnByb3RvEhphaS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MTLOBAoZT0F1dGhBcHBDb21tYW5kQ29udHJvbGxlchJTCgVhcHBseRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHASowEKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiTcK4GEkIFxAeIgxtZXRhZGF0YS5vcmcqNXVuYXV0aG9yaXplZCB0byBjcmVhdGUgb2F1dGggYXBwIGluIHRoaXMgb3JnYW5pemF0aW9uEo0BCgZ1cGRhdGUSJC5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5PQXV0aEFwcBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAIQFiILbWV0YWRhdGEuaWQqIHVuYXV0aG9yaXplZCB0byB1cGRhdGUgb2F1dGggYXBwEp8BCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAMQFiILcmVzb3VyY2VfaWQqIHVuYXV0aG9yaXplZCB0byBkZWxldGUgb2F1dGggYXBwGgSg/ysWYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api]),OAuthAppCommandController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_command,0);var file_ai_stigmer_iam_oauthapp_v1_io=fileDesc("CiNhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9pby5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEiJgoKT0F1dGhBcHBJZBIYCgV2YWx1ZRgBIAEoCUIJukgGcgQQARhAIkIKCU9BdXRoQXBwcxI1CgdlbnRyaWVzGAEgAygLMiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiLwoXTGlzdE9BdXRoQXBwc0J5T3JnSW5wdXQSFAoDb3JnGAEgASgJQge6SARyAhABYgZwcm90bzM",[file_ai_stigmer_iam_oauthapp_v1_api,file_buf_validate_validate]);var OAuthAppsSchema=messageDesc2(file_ai_stigmer_iam_oauthapp_v1_io,1);var file_ai_stigmer_iam_oauthapp_v1_query=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9xdWVyeS5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEy0AMKF09BdXRoQXBwUXVlcnlDb250cm9sbGVyEosBCgNnZXQSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIi/CuBgrCAEQFiIFdmFsdWUqHnVuYXV0aG9yaXplZCB0byB2aWV3IG9hdXRoIGFwcBJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIgTQuBgBEqwBCglsaXN0QnlPcmcSMy5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5MaXN0T0F1dGhBcHBzQnlPcmdJbnB1dBolLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwcyJDwrgYPwgBEB4iA29yZyo0dW5hdXRob3JpemVkIHRvIGxpc3Qgb2F1dGggYXBwcyBpbiB0aGlzIG9yZ2FuaXphdGlvbhoEoP8rFmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api,file_ai_stigmer_iam_oauthapp_v1_io]),OAuthAppQueryController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_query,0);var REDACTED_MARKER3="***REDACTED***",MARKER_ON_CREATE_MESSAGE="cannot use the redaction marker as client_secret on create",PRESERVE_NO_EXISTING_SECRET_MESSAGE="cannot preserve client_secret: no existing secret value found",CIPHERTEXT_SHAPED_SECRET_MESSAGE="client_secret must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients";function deleteBlockedByMcpServerMessage(org,slug,mcpServerName){return`cannot delete OAuthApp '${org}/${slug}': referenced by MCP server '${mcpServerName}'`}async function resolveOAuthAppRef(store,ref,logger2){let slug=ref?.slug??"";if(slug==="")return;let rows=await store.listResources(ApiResourceKind.oauth_app),slugMatches=[];for(let data of rows){let app;try{app=fromBinary2(OAuthAppSchema,data)}catch{continue}if((app.metadata?.slug??"")!==slug)continue;let refOrg=ref?.org??"";if(refOrg!==""&&app.metadata?.org===refOrg)return app;slugMatches.push(app)}if(slugMatches.length!==0){if(slugMatches.length===1)return slugMatches[0];logger2.warn("oauth_app_ref is ambiguous (slug exists in several orgs, none matching the ref); refusing to pick \u2014 pin the ref's org to resolve",{oauthAppSlug:slug,refOrg:ref?.org??"",candidateOrgs:slugMatches.map(app=>app.metadata?.org??"")})}}function redactOAuthApp(app){app.spec!==void 0&&app.spec.clientSecret!==""&&(app.spec.clientSecret=REDACTED_MARKER3)}function newEncryptClientSecretForCreateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!0)}function newEncryptClientSecretForUpdateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!1)}function newEncryptClientSecretStep(secretService,logger2,isCreate){return{name:"EncryptClientSecret",async execute(ctx){let app=ctx.newState;if(app.spec===void 0)return;let clientSecret=app.spec.clientSecret;if(clientSecret!==""){if(clientSecret===REDACTED_MARKER3){preserveExistingSecret(ctx,app,isCreate,logger2);return}if(isCiphertextShaped(clientSecret))throw invalidArgumentError(CIPHERTEXT_SHAPED_SECRET_MESSAGE);if(!secretService.isEnabled()){logger2.warn("encryption disabled: client_secret will be stored in plaintext");return}try{app.spec.clientSecret=await secretService.encrypt(clientSecret,EncryptionScope.forOrganization(app.metadata?.org??""))}catch(error2){throw internalError(error2,"failed to encrypt client_secret")}}}}}function preserveExistingSecret(ctx,app,isCreate,logger2){if(isCreate)throw invalidArgumentError(MARKER_ON_CREATE_MESSAGE);let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not loaded"),"cannot preserve client_secret: existing resource not loaded");let existingSecret=existing.spec?.clientSecret??"";if(existingSecret==="")throw invalidArgumentError(PRESERVE_NO_EXISTING_SECRET_MESSAGE);app.spec!==void 0&&(app.spec.clientSecret=existingSecret),logger2.debug("preserved existing encrypted client_secret",{oauthAppId:app.metadata?.id??""})}function newCheckNoReferencingMcpServersStep(store,logger2){return{name:"CheckNoReferencingMcpServers",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing OAuthApp missing from pipeline context"),"existing OAuthApp not loaded in delete pipeline");let resources;try{resources=await store.listResources(ApiResourceKind.mcp_server)}catch(error2){throw internalError(error2,"failed to list MCP servers for referential integrity check")}for(let data of resources){let mcp;try{mcp=fromBinary2(McpServerSchema,data)}catch(error2){logger2.warn("failed to unmarshal MCP server during referential integrity check, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}let ref=mcp.spec?.auth?.oauthAppRef;if(ref===void 0)continue;let resolved;try{resolved=await resolveOAuthAppRef(store,ref,logger2)}catch(error2){throw internalError(error2,"failed to resolve oauth_app_ref during referential integrity check")}if(resolved!==void 0&&(resolved.metadata?.id??"")===(existing.metadata?.id??""))throw failedPreconditionError(deleteBlockedByMcpServerMessage(existing.metadata?.org??"",existing.metadata?.slug??"",mcp.metadata?.name??""))}}}}function registerOAuthAppServices(router,deps){router.service(OAuthAppCommandController,{apply:(app,ctx)=>apply9(deps,app,ctx),create:(app,ctx)=>createOAuthApp(deps,app,ctx),update:(app,ctx)=>update12(deps,app,ctx),delete:(input,ctx)=>deleteOAuthApp(deps,input,ctx)}),router.service(OAuthAppQueryController,{get:(id,ctx)=>get16(deps,id,ctx),getByReference:(ref,ctx)=>getByReference9(deps,ref,ctx),listByOrg:(req,ctx)=>listByOrg2(deps,req,ctx)})}function kindOf15(ctx){return ctx.values.get(apiResourceKindKey)}async function createOAuthApp(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-create",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEncryptClientSecretForCreateStep(deps.secretService,deps.logger)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let result=reqCtx.newState;return redactOAuthApp(result),result}async function update12(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-update",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newEncryptClientSecretForUpdateStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).build().execute(reqCtx);let result=reqCtx.newState;return redactOAuthApp(result),result}async function apply9(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-apply",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOAuthApp(deps,app,ctx):update12(deps,withResolvedApplyId(OAuthAppSchema,app,reqCtx),ctx)}async function deleteOAuthApp(deps,input,ctx){let reqCtx=new RequestContext(OAuthAppCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf15(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("oauthapp-delete",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,OAuthAppSchema)).addStep(newCheckNoReferencingMcpServersStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,app2=>app2.spec===void 0?[]:[app2.spec.clientSecret])).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted OAuthApp not found in context"),"deleted OAuthApp not found in context");let app=deleted;return redactOAuthApp(app),app}async function get16(deps,id,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-get",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OAuthAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}async function getByReference9(deps,ref,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-get-by-reference",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,OAuthAppSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(OAuthAppQueryController.method.get))).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}var LIST_RESULT_KEY7="listResult";async function listByOrg2(deps,req,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.listByOrg.input,req,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-list-by-org",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgStep2(deps.store,deps.listReadScope,deps.logger)).build().execute(reqCtx);let list12=reqCtx.get(LIST_RESULT_KEY7);if(list12===void 0)throw internalError(new Error("list result missing from pipeline context"),"OAuthApp list not found in context");return list12}function newListByOrgStep2(store,listReadScope,logger2){return{name:"ListByOrg",async execute(ctx){let org=ctx.input.org,resources;try{resources=await store.listResources(ApiResourceKind.oauth_app)}catch(error2){throw internalError(error2,"failed to list OAuthApps")}let requested=[];for(let data of resources){let app;try{app=fromBinary2(OAuthAppSchema,data)}catch(error2){logger2.warn("failed to unmarshal OAuthApp, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}(app.metadata?.org??"")===org&&requested.push(app)}let apps=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.oauth_app,requested,"");for(let app of apps)redactOAuthApp(app);apps.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),logger2.info("listed OAuthApps by organization",{org,matchCount:apps.length}),ctx.set(LIST_RESULT_KEY7,create2(OAuthAppsSchema,{entries:apps}))}}}var file_ai_stigmer_iam_platformclient_v1_io=fileDesc("CilhaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9pby5wcm90bxIgYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEiLAoQUGxhdGZvcm1DbGllbnRJZBIYCgV2YWx1ZRgBIAEoCUIJukgGcgQQARhAIlQKD1BsYXRmb3JtQ2xpZW50cxJBCgdlbnRyaWVzGAEgAygLMjAuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnQiNQodTGlzdFBsYXRmb3JtQ2xpZW50c0J5T3JnSW5wdXQSFAoDb3JnGAEgASgJQge6SARyAhABIoABChxQbGF0Zm9ybUNsaWVudENyZWF0ZVJlc3BvbnNlEkkKD3BsYXRmb3JtX2NsaWVudBgBIAEoCzIwLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50EhUKDWNsaWVudF9zZWNyZXQYAiABKAliBnByb3RvMw",[file_ai_stigmer_iam_platformclient_v1_api,file_buf_validate_validate]);var PlatformClientsSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_io,1);var PlatformClientCreateResponseSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_io,3);var file_ai_stigmer_iam_platformclient_v1_command=fileDesc("Ci5haS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9jb21tYW5kLnByb3RvEiBhaS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MTKgBgofUGxhdGZvcm1DbGllbnRDb21tYW5kQ29udHJvbGxlchLPAQoGY3JlYXRlEjAuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnQaPi5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5QbGF0Zm9ybUNsaWVudENyZWF0ZVJlc3BvbnNlIlPCuBhPCBgQHiIMbWV0YWRhdGEub3JnKjt1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIHBsYXRmb3JtIGNsaWVudCBpbiB0aGlzIG9yZ2FuaXphdGlvbhKrAQoGdXBkYXRlEjAuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnQaMC5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5QbGF0Zm9ybUNsaWVudCI9wrgYOQgCEBciC21ldGFkYXRhLmlkKiZ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIHBsYXRmb3JtIGNsaWVudBKxAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaMC5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5QbGF0Zm9ybUNsaWVudCI9wrgYOQgDEBciC3Jlc291cmNlX2lkKiZ1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIHBsYXRmb3JtIGNsaWVudBLCAQoMcm90YXRlU2VjcmV0EjIuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnRJZBo+LmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50Q3JlYXRlUmVzcG9uc2UiPsK4GDoIAhAXIgV2YWx1ZSotdW5hdXRob3JpemVkIHRvIHJvdGF0ZSBwbGF0Zm9ybSBjbGllbnQgc2VjcmV0GgSg/ysXYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_platformclient_v1_api,file_ai_stigmer_iam_platformclient_v1_io]),PlatformClientCommandController=serviceDesc(file_ai_stigmer_iam_platformclient_v1_command,0);var file_ai_stigmer_iam_platformclient_v1_query=fileDesc("CixhaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9xdWVyeS5wcm90bxIgYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEykgQKHVBsYXRmb3JtQ2xpZW50UXVlcnlDb250cm9sbGVyEp0BCgNnZXQSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBowLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50IjXCuBgxCAEQFyIFdmFsdWUqJHVuYXV0aG9yaXplZCB0byB2aWV3IHBsYXRmb3JtIGNsaWVudBJ+Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRowLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50IgTQuBgBEsoBCglsaXN0QnlPcmcSPy5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5MaXN0UGxhdGZvcm1DbGllbnRzQnlPcmdJbnB1dBoxLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50cyJJwrgYRQgBEB4iA29yZyo6dW5hdXRob3JpemVkIHRvIGxpc3QgcGxhdGZvcm0gY2xpZW50cyBpbiB0aGlzIG9yZ2FuaXphdGlvbhoEoP8rF2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_platformclient_v1_api,file_ai_stigmer_iam_platformclient_v1_io]),PlatformClientQueryController=serviceDesc(file_ai_stigmer_iam_platformclient_v1_query,0);var PLATFORM_CLIENT_KIND_NAME="PlatformClient",SYSTEM_SHARE_CLIENT_SLUG="system-share-client",RESERVED_PLATFORM_CLIENT_SLUGS=new Set([SYSTEM_SHARE_CLIENT_SLUG]),USER_TOKEN_CLAIMS={subject:"sub",externalUserId:"ext_user_id",email:"email",name:"name",org:"org",platformClientId:"platform_client_id"},BEARER_TOKEN_TYPE="Bearer";function reservedSlugMessage(slug){return`The slug '${slug}' is reserved for the platform's system-managed resources and cannot be used. If you did not provide a slug explicitly, it was derived from the resource name \u2014 choose a different name or provide an explicit slug.`}function systemManagedMessage(verb){return`This platform client is system-managed and cannot be ${verb}`}function referenceNotFoundMessage(org,slug){return`PlatformClient '${org}/${slug}' not found`}var INVALID_CLIENT_CREDENTIALS_MESSAGE="Invalid client_id or client_secret",EXPIRED_CLIENT_SECRET_MESSAGE="PlatformClient secret has expired. Rotating the secret does not extend it; the client's owner must set a later expires_at or set never_expires.";function organizationMismatchMessage(owningOrg){return`org_id must be empty or the PlatformClient's owning organization ('${owningOrg}'); cross-organization minting is not supported`}function noAccountMessage(externalUserId,org){return`User '${externalUserId}' has no Stigmer account in organization '${org}'. Enable auto_provision_accounts on the PlatformClient or create the account first.`}var OWNER_AUTO_GRANT_MESSAGE="auto_grant_role cannot be 'owner'; organization ownership must be assigned explicitly.",PROVISIONING_FAILED_MESSAGE="Account provisioning failed. No partial account was left behind; the request is safe to retry.";function blankSubjectPartMessage(part){return`${part} must not be null or blank`}function subjectSeparatorMessage(part,value){return`${part} must not contain the separator character '|': ${value}`}function foreignAccountMessage(externalUserId,org){return`User '${externalUserId}' in organization '${org}' resolves to an account no platform client provisioned \u2014 refusing to mint a token for it`}var MINTING_REQUIRES_AUTHENTICATION_MESSAGE="mintUserToken requires a server that authenticates its callers: this server trusts every request, so nothing would verify the token \u2014 configure an identity provider (STIGMER_OIDC_ISSUER) to enable PlatformClient token minting",MINTING_DISABLED_MESSAGE="mintUserToken is disabled: this server's platform-token key ring holds no signing key",GUEST_MINT_UNIMPLEMENTED_MESSAGE="PlatformClientTokenController.mintGuestToken is not implemented: guest tokens for shared agents are served by the Cloud edition",TOKEN_NAMES_NO_CLIENT_MESSAGE="platform token names no platform client",DELETED_CLIENT_MESSAGE="The platform client that minted this token has been deleted, so the token is no longer accepted. Mint a new user token from an active platform client.";function originRefusalMessage(origin){return`Request origin '${origin}' is not in this platform client's allowed_origins. Add it to the PlatformClient's allowed_origins to permit browser requests from this origin.`}var import_node_crypto20=require("node:crypto"),CLIENT_ID_PREFIX="stgm_cid_",CLIENT_SECRET_PREFIX="stgm_cs_",CLIENT_ID_BYTES=32,CLIENT_SECRET_BYTES=48,SECRET_FINGERPRINT_LENGTH=6;function generateClientId(){return CLIENT_ID_PREFIX+(0,import_node_crypto20.randomBytes)(CLIENT_ID_BYTES).toString("base64url")}function generateClientSecret(){return CLIENT_SECRET_PREFIX+(0,import_node_crypto20.randomBytes)(CLIENT_SECRET_BYTES).toString("base64url")}function hashClientSecret(secret){return(0,import_node_crypto20.createHash)("sha256").update(secret,"utf8").digest("base64url")}function secretFingerprint(secret){return secret.length<=SECRET_FINGERPRINT_LENGTH?secret:secret.slice(-SECRET_FINGERPRINT_LENGTH)}function secretMatchesHash(secret,storedHash){if(storedHash==="")return!1;let presented=Buffer.from(hashClientSecret(secret),"utf8"),stored=Buffer.from(storedHash,"utf8");return presented.length===stored.length&&(0,import_node_crypto20.timingSafeEqual)(presented,stored)}var DuplicatePlatformClientError=class extends Error{constructor(message6,options){super(message6,options),this.name="DuplicatePlatformClientError"}};var CLIENT_SECRET_PLAINTEXT_KEY="platformClientSecretPlaintext";function redactPlatformClient(client){return client.spec!==void 0&&(client.spec.clientSecretHash=""),client}function parkedClientSecret(ctx){let secret=ctx.get(CLIENT_SECRET_PLAINTEXT_KEY);if(typeof secret!="string"||secret==="")throw internalError(new Error("no client secret parked \u2014 a credential step must run first"),"platform client credentials");return secret}function newRefuseReservedSlugStep(){return{name:"RefuseReservedSlug",execute(ctx){let slug=metadataOf(ctx.newState)?.slug??"";if(RESERVED_PLATFORM_CLIENT_SLUGS.has(slug))throw invalidArgumentError(reservedSlugMessage(slug))}}}function newCheckDuplicateStep3(clients){return{name:"CheckDuplicate",async execute(ctx){let metadata=requireMetadata2(ctx,"duplicate check"),existing=await clients.findByOrgAndSlug(metadata.org,metadata.slug);if(existing!==void 0)throw alreadyExistsError(PLATFORM_CLIENT_KIND_NAME,`slug '${metadata.slug}' in org '${metadata.org}' (id: ${existing.metadata?.id??""})`)}}}function newGenerateClientCredentialsStep(){return{name:"GenerateClientCredentials",execute(ctx){let spec=specOf3(ctx.newState),secret=generateClientSecret();spec.clientId=generateClientId(),spec.clientSecretHash=hashClientSecret(secret),spec.secretFingerprint=secretFingerprint(secret),ctx.set(CLIENT_SECRET_PLAINTEXT_KEY,secret)}}}function newPersistNewClientStep(clients){return{name:"Persist",async execute(ctx){try{await clients.save(ctx.newState)}catch(error2){if(error2 instanceof DuplicatePlatformClientError){let metadata=requireMetadata2(ctx,"persist");throw alreadyExistsError(PLATFORM_CLIENT_KIND_NAME,`slug '${metadata.slug}' in org '${metadata.org}'`)}throw internalError(error2,"failed to save platform client")}}}}function newLoadExistingClientStep(clients){return{name:"LoadExisting",async execute(ctx){let metadata=requireMetadata2(ctx,"load existing"),existing;if(metadata.id!==""){if(existing=await clients.findById(metadata.id),existing===void 0)throw notFoundError(PLATFORM_CLIENT_KIND_NAME,metadata.id)}else if(metadata.slug!==""){if(existing=await clients.findByOrgAndSlug(metadata.org,metadata.slug),existing===void 0)throw notFoundError(PLATFORM_CLIENT_KIND_NAME,metadata.slug);metadata.id=existing.metadata?.id??""}else throw invalidArgumentError("resource id or slug is required for update");ctx.set(EXISTING_RESOURCE_KEY,existing)}}}function newPreserveClientCredentialsStep(){return{name:"PreserveClientCredentials",execute(ctx){let existing=storedClientOf(ctx,EXISTING_RESOURCE_KEY),spec=specOf3(ctx.newState);spec.clientId=existing.spec?.clientId??"",spec.clientSecretHash=existing.spec?.clientSecretHash??"",spec.secretFingerprint=existing.spec?.secretFingerprint??""}}}function newPersistUpdatedClientStep(clients){return{name:"Persist",async execute(ctx){try{await clients.update(ctx.newState)}catch(error2){throw internalError(error2,"failed to save platform client")}}}}function newRefuseSystemManagedStep(verb,key){return{name:"RefuseSystemManaged",execute(ctx){if(storedClientOf(ctx,key).metadata?.labels[SYSTEM_MANAGED_LABEL]===RESERVED_LABEL_TRUE)throw failedPreconditionError(systemManagedMessage(verb))}}}function newLoadTargetClientStep(clients){return{name:"LoadTarget",async execute(ctx){let id=idValueOf(ctx.input);if(id==="")throw invalidArgumentError("resource id is required");ctx.set(TARGET_RESOURCE_KEY,await readClient(clients,id))}}}function newLoadClientByReferenceStep(clients){return{name:"LoadByReference",async execute(ctx){let ref=ctx.input;if(ref.slug==="")throw invalidArgumentError("slug is required in reference");if(ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==ApiResourceKind.platform_client)throw invalidArgumentError(`kind mismatch: expected platform_client, got ${ApiResourceKind[ref.kind]??String(ref.kind)}`);requireOrgForReference(ApiResourceKind.platform_client,ref.org);let client=await clients.findByOrgAndSlug(ref.org,ref.slug);if(client===void 0)throw new ConnectError(referenceNotFoundMessage(ref.org,ref.slug),Code.NotFound);ctx.set(TARGET_RESOURCE_KEY,client)}}}function newRotateClientCredentialsStep(){return{name:"RotateClientCredentials",execute(ctx){let client=storedClientOf(ctx,TARGET_RESOURCE_KEY),spec=specOf3(client),secret=generateClientSecret();spec.clientSecretHash=hashClientSecret(secret),spec.secretFingerprint=secretFingerprint(secret),updateAuditFields(PlatformClientSchema,client,client,ctx.callerIdentity),ctx.set(CLIENT_SECRET_PLAINTEXT_KEY,secret)}}}function newPersistTargetClientStep(clients){return{name:"Persist",async execute(ctx){try{await clients.update(storedClientOf(ctx,TARGET_RESOURCE_KEY))}catch(error2){throw internalError(error2,"failed to save platform client")}}}}function newLoadExistingClientForDeleteStep(clients){return{name:"LoadExistingForDelete",async execute(ctx){ctx.set(EXISTING_RESOURCE_KEY,await readClient(clients,requireResourceId3(ctx)))}}}function newDeleteClientStep(clients){return{name:"DeleteResource",async execute(ctx){try{await clients.deleteById(requireResourceId3(ctx))}catch(error2){throw internalError(error2,"failed to delete platform client")}}}}async function readClient(clients,id){let client=await clients.findById(id);if(client===void 0)throw notFoundError(PLATFORM_CLIENT_KIND_NAME,id);return client}function storedClientOf(ctx,key){let client=ctx.get(key);if(client===void 0)throw internalError(new Error(`no platform client under '${key}' \u2014 its load step must run first`),"platform client chain ordering");return client}function requireMetadata2(ctx,operation2){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("platform client metadata is nil"),operation2);return metadata}function specOf3(client){return client.spec===void 0&&(client.spec=create2(PlatformClientSpecSchema)),client.spec}function requireResourceId3(ctx){let id=ctx.get(RESOURCE_ID_KEY);if(typeof id!="string"||id==="")throw internalError(new Error("resource id not found in context (the delete handler sets it)"),"platform client delete ordering");return id}function registerPlatformClientServices(router,deps){router.service(PlatformClientCommandController,{create:(client,ctx)=>createClient2(deps,client,ctx),update:(client,ctx)=>updateClient(deps,client,ctx),delete:(input,ctx)=>deleteClient(deps,input,ctx),rotateSecret:(id,ctx)=>rotateSecret(deps,id,ctx)}),router.service(PlatformClientQueryController,{get:(id,ctx)=>get17(deps,id,ctx),getByReference:(ref,ctx)=>getByReference10(deps,ref,ctx),listByOrg:(input,ctx)=>listByOrg3(deps,input,ctx)})}function kindOf16(ctx){return ctx.values.get(apiResourceKindKey)}async function createClient2(deps,client,ctx){let reqCtx=new RequestContext(PlatformClientSchema,client,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-create",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newRefuseReservedSlugStep()).addStep(newCheckDuplicateStep3(deps.clients)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newGenerateClientCredentialsStep()).addStep(newPersistNewClientStep(deps.clients)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),create2(PlatformClientCreateResponseSchema,{platformClient:redactPlatformClient(reqCtx.newState),clientSecret:parkedClientSecret(reqCtx)})}async function updateClient(deps,client,ctx){let reqCtx=new RequestContext(PlatformClientSchema,client,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-update",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingClientStep(deps.clients)).addStep(newRefuseSystemManagedStep("updated",EXISTING_RESOURCE_KEY)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPreserveClientCredentialsStep()).addStep(newPersistUpdatedClientStep(deps.clients)).build().execute(reqCtx),redactPlatformClient(reqCtx.newState)}async function deleteClient(deps,input,ctx){let reqCtx=new RequestContext(PlatformClientCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf16(ctx));return reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("platformclient-delete",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingClientForDeleteStep(deps.clients)).addStep(newRefuseSystemManagedStep("deleted",EXISTING_RESOURCE_KEY)).addStep(newDeleteClientStep(deps.clients)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),redactPlatformClient(storedClientOf(reqCtx,EXISTING_RESOURCE_KEY))}async function rotateSecret(deps,id,ctx){let reqCtx=new RequestContext(PlatformClientCommandController.method.rotateSecret.input,id,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-rotate-secret",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.rotateSecret,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetClientStep(deps.clients)).addStep(newRefuseSystemManagedStep("rotated",TARGET_RESOURCE_KEY)).addStep(newRotateClientCredentialsStep()).addStep(newPersistTargetClientStep(deps.clients)).build().execute(reqCtx),create2(PlatformClientCreateResponseSchema,{platformClient:redactPlatformClient(storedClientOf(reqCtx,TARGET_RESOURCE_KEY)),clientSecret:parkedClientSecret(reqCtx)})}async function get17(deps,id,ctx){let reqCtx=new RequestContext(PlatformClientQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-get",deps.logger).addStep(newAuthorizeStep(PlatformClientQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetClientStep(deps.clients)).build().execute(reqCtx),redactPlatformClient(storedClientOf(reqCtx,TARGET_RESOURCE_KEY))}async function getByReference10(deps,ref,ctx){let reqCtx=new RequestContext(PlatformClientQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-get-by-reference",deps.logger).addStep(newAuthorizeStep(PlatformClientQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadClientByReferenceStep(deps.clients)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(PlatformClientQueryController.method.get))).build().execute(reqCtx),redactPlatformClient(storedClientOf(reqCtx,TARGET_RESOURCE_KEY))}async function listByOrg3(deps,input,ctx){let caller=callerIdentityOf(ctx),reqCtx=new RequestContext(PlatformClientQueryController.method.listByOrg.input,input,caller,kindOf16(ctx));await newPipeline("platformclient-list-by-org",deps.logger).addStep(newAuthorizeStep(PlatformClientQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx);let candidates;try{candidates=await deps.clients.findByOrg(input.org)}catch(error2){throw internalError(error2,"failed to list platform clients")}let entries=[...await restrictListByReadScope(deps.listReadScope,caller,ApiResourceKind.platform_client,candidates,input.org)].sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)).map(redactPlatformClient);return create2(PlatformClientsSchema,{entries})}var import_node_crypto21=require("node:crypto"),PLATFORM_TOKEN_ISSUER="stigmer",TOKEN_TYPE_CLAIM="token_type",ENVELOPE_CLAIMS=new Set(["iss","iat","exp","jti","aud"]),PLATFORM_TOKEN_REFUSAL_MESSAGES={signature:"platform token signature verification failed",expired:"platform token is expired",audience:"platform token was minted for another environment",subject:"platform token carries no subject"};function signPlatformToken(ring,claims,options={}){for(let name of Object.keys(claims))if(ENVELOPE_CLAIMS.has(name))throw new Error(`platform-token claim '${name}' belongs to the envelope and cannot be set by a lane`);let ttlSeconds=options.ttlSeconds??ring.ttlSeconds;if(!Number.isInteger(ttlSeconds)||ttlSeconds<=0)throw new Error(`platform-token lifetime must be a positive integer number of seconds, got ${ttlSeconds}`);let issuedAt=Math.floor((options.now??new Date).getTime()/1e3),expiresAtSeconds=issuedAt+ttlSeconds,header={alg:"RS256",typ:"JWT",kid:ring.signer.kid},payload={iss:PLATFORM_TOKEN_ISSUER,iat:issuedAt,exp:expiresAtSeconds,jti:(0,import_node_crypto21.randomUUID)(),...ring.audience!==""?{aud:ring.audience}:{},...claims},signingInput=`${base64UrlJson(header)}.${base64UrlJson(payload)}`,signature=(0,import_node_crypto21.sign)("sha256",Buffer.from(signingInput),ring.signer.key);return{token:`${signingInput}.${signature.toString("base64url")}`,expiresAt:new Date(expiresAtSeconds*1e3)}}function verifyPlatformToken(ring,token,now=new Date){let decoded=decode2(token);if(decoded===void 0||decoded.payload.iss!==PLATFORM_TOKEN_ISSUER)return{outcome:"foreign"};let signingInput=Buffer.from(`${decoded.encodedHeader}.${decoded.encodedPayload}`);if(!ring.verificationKeys.some(key=>(0,import_node_crypto21.verify)("sha256",signingInput,key,decoded.signature)))return{outcome:"refused",refusal:"signature"};let exp=decoded.payload.exp;if(typeof exp!="number"||exp*1e3<=now.getTime())return{outcome:"refused",refusal:"expired"};let aud=decoded.payload.aud;if(ring.audience!==""&&aud!==void 0&&!audienceMatches(aud,ring.audience))return{outcome:"refused",refusal:"audience"};let sub=decoded.payload.sub;return typeof sub!="string"||sub===""?{outcome:"refused",refusal:"subject"}:{outcome:"verified",token:{subject:sub,tokenType:stringClaim(decoded.payload,TOKEN_TYPE_CLAIM),payload:decoded.payload}}}function platformTokenRefusalError(refusal2){return new ConnectError(PLATFORM_TOKEN_REFUSAL_MESSAGES[refusal2],Code.Unauthenticated)}function decodeVerifiedPlatformTokenPayload(token){let decoded=decode2(token);return decoded!==void 0&&decoded.payload.iss===PLATFORM_TOKEN_ISSUER?decoded.payload:void 0}function stringClaim(payload,name){let value=payload[name];return typeof value=="string"&&value!==""?value:void 0}function decode2(token){let parts=token.split(".");if(parts.length!==3)return;let[encodedHeader="",encodedPayload="",encodedSignature=""]=parts,header=parseJsonObject(encodedHeader),payload=parseJsonObject(encodedPayload);if(!(header===void 0||payload===void 0))return{encodedHeader,encodedPayload,payload,signature:Buffer.from(encodedSignature,"base64url")}}function parseJsonObject(segment){try{let value=JSON.parse(Buffer.from(segment,"base64url").toString("utf8"));return typeof value=="object"&&value!==null&&!Array.isArray(value)?value:void 0}catch{return}}function audienceMatches(aud,expected){return typeof aud=="string"?aud===expected:Array.isArray(aud)&&aud.includes(expected)}function base64UrlJson(value){return Buffer.from(JSON.stringify(value)).toString("base64url")}var OPAQUE_ORIGIN="null";function newPlatformClientOriginGuard(deps){return{name:"platform-client-origin",async guard(caller,method,headers2){let origin=headers2.get("origin")??"";if(origin.trim()==="")return;let platformClientId=mintingClientOf(caller);if(platformClientId===void 0)return;let procedure=`/${method.parent.typeName}/${method.name}`,client=await deps.clients.findById(platformClientId);if(client===void 0)throw new ConnectError(DELETED_CLIENT_MESSAGE,Code.Unauthenticated);if(!originAllowed(origin,client.spec?.allowedOrigins??[]))throw deps.logger.warn("origin refusal: origin not in allowed_origins",{procedure,platformClientId,origin}),new ConnectError(originRefusalMessage(origin),Code.PermissionDenied)}}}function mintingClientOf(caller){let payload=decodeVerifiedPlatformTokenPayload(caller.rawToken);if(!(payload===void 0||stringClaim(payload,TOKEN_TYPE_CLAIM)!==void 0))return stringClaim(payload,USER_TOKEN_CLAIMS.platformClientId)}function originAllowed(origin,allowed){if(allowed.length===0)return!0;if(origin===OPAQUE_ORIGIN)return!1;let presented=origin.toLowerCase();return allowed.some(entry=>entry.toLowerCase()===presented)}var KIND5=ApiResourceKind.platform_client;function newResourcePlatformClientStore(store){async function readById(id){try{return await store.getResource(KIND5,id,PlatformClientSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function readByClientId(clientId){if(clientId!=="")try{return await store.findByField(KIND5,"spec.clientId",clientId,PlatformClientSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function listOrg(org){let clients=[];for(let data of await store.listResources(KIND5)){let client;try{client=fromBinary2(PlatformClientSchema,data)}catch{continue}(client.metadata?.org??"")===org&&clients.push(client)}return clients}async function readByOrgAndSlug(org,slug){if(!(org===""||slug===""))return(await listOrg(org)).find(client=>(client.metadata?.slug??"")===slug)}return{async save(client){let id=client.metadata?.id??"",org=client.metadata?.org??"",slug=client.metadata?.slug??"";if(await readById(id)!==void 0)throw new DuplicatePlatformClientError(`platform client '${id}' already exists`);if(await readByOrgAndSlug(org,slug)!==void 0)throw new DuplicatePlatformClientError(`platform client '${org}/${slug}' already exists`);if(await readByClientId(client.spec?.clientId??"")!==void 0)throw new DuplicatePlatformClientError("a platform client already holds this client_id");await store.saveResource(KIND5,id,PlatformClientSchema,client)},async update(client){let id=client.metadata?.id??"";await readById(id)!==void 0&&await store.saveResource(KIND5,id,PlatformClientSchema,client)},async modifyById(id,modify){try{return await store.updateResource(KIND5,id,PlatformClientSchema,modify)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}},async deleteById(id){await store.deleteResource(KIND5,id)},findById:readById,findByClientId:readByClientId,findByOrgAndSlug:readByOrgAndSlug,findByOrg:listOrg}}var file_ai_stigmer_iam_platformclient_v1_token=fileDesc("CixhaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS90b2tlbi5wcm90bxIgYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEiugEKFE1pbnRVc2VyVG9rZW5SZXF1ZXN0EhoKCWNsaWVudF9pZBgBIAEoCUIHukgEcgIQARIeCg1jbGllbnRfc2VjcmV0GAIgASgJQge6SARyAhABEhsKB3VzZXJfaWQYAyABKAlCCrpIB3IFEAEYgAISHAoKdXNlcl9lbWFpbBgEIAEoCUIIukgFcgMYwAISGwoJdXNlcl9uYW1lGAUgASgJQgi6SAVyAxiAAhIOCgZvcmdfaWQYBiABKAkiVQoVTWludFVzZXJUb2tlblJlc3BvbnNlEhQKDGFjY2Vzc190b2tlbhgBIAEoCRISCgp0b2tlbl90eXBlGAIgASgJEhIKCmV4cGlyZXNfaW4YAyABKAUiyQMKFU1pbnRHdWVzdFRva2VuUmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESFQoEc2x1ZxgCIAEoCUIHukgEcgIQARIXCg9ndWVzdF9jb29raWVfaWQYAyABKAkSywIKDGVtYmVkX29yaWdpbhgEIAEoCUK0ArpIsAK6AawCChNlbWJlZF9vcmlnaW4uZm9ybWF0EndlbWJlZF9vcmlnaW4gbXVzdCBiZSBlbXB0eSwgIm51bGwiLCBvciBhbiBleGFjdCB3ZWIgb3JpZ2luIGxpa2UgaHR0cHM6Ly9leGFtcGxlLmNvbSAobm8gcGF0aCwgcXVlcnksIG9yIHRyYWlsaW5nIHNsYXNoKRqbAXRoaXMgPT0gJycgfHwgdGhpcyA9PSAnbnVsbCcgfHwgdGhpcy5tYXRjaGVzKCdeaHR0cHM/Oi8vW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8oXFwuW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8pKig6WzAtOV17MSw1fSk/JCcpEhwKCmxpbmtfdG9rZW4YBSABKAlCCLpIBXIDGIABIm8KFk1pbnRHdWVzdFRva2VuUmVzcG9uc2USFAoMYWNjZXNzX3Rva2VuGAEgASgJEhIKCnRva2VuX3R5cGUYAiABKAkSEgoKZXhwaXJlc19pbhgDIAEoBRIXCg9ndWVzdF9jb29raWVfaWQYBCABKAkytAIKHVBsYXRmb3JtQ2xpZW50VG9rZW5Db250cm9sbGVyEoYBCg1taW50VXNlclRva2VuEjYuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuTWludFVzZXJUb2tlblJlcXVlc3QaNy5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5NaW50VXNlclRva2VuUmVzcG9uc2UiBMi4GAESiQEKDm1pbnRHdWVzdFRva2VuEjcuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuTWludEd1ZXN0VG9rZW5SZXF1ZXN0GjguYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuTWludEd1ZXN0VG9rZW5SZXNwb25zZSIEyLgYAWIGcHJvdG8z",[file_ai_stigmer_commons_rpc_method_options,file_buf_validate_validate]);var MintUserTokenResponseSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_token,1);var PlatformClientTokenController=serviceDesc(file_ai_stigmer_iam_platformclient_v1_token,0);var import_node_crypto22=require("node:crypto");var PLATFORM_TOKEN_KEY_ENV_VAR="STIGMER_PLATFORM_TOKEN_KEY",PLATFORM_TOKEN_KEY_FILE_NAME="platform-token.key",DEFAULT_PLATFORM_TOKEN_TTL_SECONDS=900,MIN_RSA_MODULUS_BITS=2048;function canSign(ring){return ring.signer!==void 0}function resolvePlatformTokenKeys(input){if(input.requireAuthentication){if(input.supplied!==void 0)return input.supplied;if(input.edition!==ServerEdition.oss)throw new Error(`the ${ServerEdition[input.edition]} edition requires authentication but registers no platform-token key ring \u2014 register drivers.platformTokenKeys; only open source generates its own key`);return openSourcePlatformTokenKeyRing(input.options)}}function openSourcePlatformTokenKeyRing(options={}){let privateKey=getOrCreateKey(RSA_PRIVATE_KEY,PLATFORM_TOKEN_KEY_ENV_VAR,PLATFORM_TOKEN_KEY_FILE_NAME,options);return{signer:{key:privateKey,kid:kidOf(privateKey)},verificationKeys:[(0,import_node_crypto22.createPublicKey)(privateKey)],audience:"",ttlSeconds:DEFAULT_PLATFORM_TOKEN_TTL_SECONDS}}var RSA_PRIVATE_KEY={fromEnv(envVar,decoded){let key=parseKey2(()=>(0,import_node_crypto22.createPrivateKey)(decoded.toString("utf8")),envVar);return requireRsa(key,envVar)},fromFile(content){try{let key=(0,import_node_crypto22.createPrivateKey)(content.toString("utf8"));return isUsableRsa(key)?key:void 0}catch{return}},generate(){return(0,import_node_crypto22.generateKeyPairSync)("rsa",{modulusLength:MIN_RSA_MODULUS_BITS}).privateKey},toFile(key){return Buffer.from(key.export({format:"pem",type:"pkcs8"}))}};function kidOf(key){let publicKey=key.type==="private"?(0,import_node_crypto22.createPublicKey)(key):key;return(0,import_node_crypto22.createHash)("sha256").update(spkiOf(publicKey)).digest("base64url").slice(0,16)}function spkiOf(publicKey){return publicKey.export({format:"der",type:"spki"})}function parseKey2(parse5,what){try{return parse5()}catch(error2){throw new Error(`${what} is not a readable PEM key: ${error2 instanceof Error?error2.message:String(error2)}`)}}function requireRsa(key,what){if(!isUsableRsa(key))throw new Error(`${what} must be an RSA key of at least ${MIN_RSA_MODULUS_BITS} bits`);return key}function isUsableRsa(key){return key.asymmetricKeyType==="rsa"&&(key.asymmetricKeyDetails?.modulusLength??0)>=MIN_RSA_MODULUS_BITS}var SUBJECT_SEPARATOR="|",DEFAULT_AUTO_GRANT_ROLE=IamRole.viewer;async function mintUserToken(deps,request){let keys=deps.keys;if(keys===void 0)throw new ConnectError(MINTING_REQUIRES_AUTHENTICATION_MESSAGE,Code.FailedPrecondition);if(!canSign(keys))throw new ConnectError(MINTING_DISABLED_MESSAGE,Code.FailedPrecondition);let client=await authenticateClient(deps,request),owningOrg=client.metadata?.org??"";if(request.orgId!==""&&request.orgId!==owningOrg)throw new ConnectError(organizationMismatchMessage(owningOrg),Code.InvalidArgument);let user={externalUserId:request.userId,email:request.userEmail,name:request.userName},accountId=await resolveOrProvisionAccount(deps,client,owningOrg,user),now=deps.now(),signed=signPlatformToken(keys,{[USER_TOKEN_CLAIMS.subject]:accountId,[USER_TOKEN_CLAIMS.externalUserId]:user.externalUserId,[USER_TOKEN_CLAIMS.email]:user.email,[USER_TOKEN_CLAIMS.name]:user.name,[USER_TOKEN_CLAIMS.org]:owningOrg,[USER_TOKEN_CLAIMS.platformClientId]:client.metadata?.id??""},{now});return await recordClientUse(deps,client,now),create2(MintUserTokenResponseSchema,{accessToken:signed.token,tokenType:BEARER_TOKEN_TYPE,expiresIn:keys.ttlSeconds})}async function authenticateClient(deps,request){let client;try{client=await deps.clients.findByClientId(request.clientId)}catch(error2){throw internalError(error2,"failed to authenticate platform client")}if(client===void 0||!secretMatchesHash(request.clientSecret,client.spec?.clientSecretHash??""))throw new ConnectError(INVALID_CLIENT_CREDENTIALS_MESSAGE,Code.Unauthenticated);let spec=client.spec;if(spec?.neverExpires!==!0&&spec?.expiresAt!==void 0&&deps.now().getTime()>timestampDate(spec.expiresAt).getTime())throw new ConnectError(EXPIRED_CLIENT_SECRET_MESSAGE,Code.FailedPrecondition);return client}function recordClientUse(deps,client,now){let id=client.metadata?.id??"";return recordCredentialUse({credential:"platform client",id,lastUsedAt:client.status?.lastUsedAt,now,logger:deps.logger,write:stamp2=>deps.clients.modifyById(id,live=>{live.status??=create2(PlatformClientStatusSchema),stamp2(live.status)})})}async function resolveOrProvisionAccount(deps,client,org,user){let idpId=platformClientSubject(org,user.externalUserId),existing=await findAccount(deps,idpId);if(existing!==void 0)return platformClientAccountId(existing,user,org);let spec=client.spec;if(spec?.autoProvisionAccounts!==!0)throw new ConnectError(noAccountMessage(user.externalUserId,org),Code.FailedPrecondition);let input=accountInput(idpId,org,user),actor=serverActingFor(client.metadata?.id??"");spec.autoGrantOnOrg&&await grantAutoRole(deps,client,org,accountIdFor(idpId),actor);try{return(await deps.createAccount(input,actor)).metadata?.id??""}catch(error2){let winner=await resolveCreateRace(error2,()=>deps.accounts.findByIdpId(idpId));return platformClientAccountId(winner,user,org)}}async function findAccount(deps,idpId){try{return await deps.accounts.findByIdpId(idpId)}catch(error2){throw internalError(error2,"failed to resolve platform client user")}}function platformClientAccountId(account2,user,org){if(account2.spec?.provisioningMode!==IdentityAccountProvisioningMode.platform_client)throw new ConnectError(foreignAccountMessage(user.externalUserId,org),Code.FailedPrecondition);return account2.metadata?.id??""}function accountInput(idpId,org,user){let input={name:user.email!==""?user.email:user.externalUserId,spec:create2(IdentityAccountSpecSchema,{idpId,email:user.email,...splitName(user.name,user.email)}),provisioning:{mode:"platform_client",org}},result=validator().validate(IdentityAccountSchema,create2(IdentityAccountSchema,{apiVersion:"iam.stigmer.ai/v1",kind:"IdentityAccount",metadata:{name:input.name,org},spec:input.spec}));if(result.kind==="invalid")throw new ConnectError(result.error.message,Code.InvalidArgument);if(result.kind==="error")throw new ConnectError(`validation could not run: ${result.error.message}`,Code.Internal);return input}async function grantAutoRole(deps,client,org,accountId,actor){let configured=client.spec?.autoGrantRole??IamRole.iam_role_unspecified;if(configured===IamRole.owner)throw new ConnectError(OWNER_AUTO_GRANT_MESSAGE,Code.InvalidArgument);let role=configured===IamRole.iam_role_unspecified?DEFAULT_AUTO_GRANT_ROLE:configured;try{await deps.grantPath.grant(organizationRole(accountId,role,org),actor)}catch(error2){throw deps.logger.error("platform client auto-grant failed; nothing was provisioned",{accountId,platformClientId:client.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)}),new ConnectError(PROVISIONING_FAILED_MESSAGE,Code.Internal)}}function platformClientSubject(org,externalUserId){return requireSubjectPart("org",org),requireSubjectPart("externalUserId",externalUserId),`${PLATFORM_CLIENT_SUBJECT_PREFIX}${org}${SUBJECT_SEPARATOR}${externalUserId}`}function requireSubjectPart(part,value){if(value.trim()==="")throw new ConnectError(blankSubjectPartMessage(part),Code.InvalidArgument);if(value.includes(SUBJECT_SEPARATOR))throw new ConnectError(subjectSeparatorMessage(part,value),Code.InvalidArgument)}function splitName(name,email){if(name!==""){let space=name.indexOf(" ");return space>0?{firstName:name.slice(0,space),lastName:name.slice(space+1)}:{firstName:name,lastName:""}}let at2=email.indexOf("@");return{firstName:at2>=0?email.slice(0,at2):email,lastName:""}}function registerPlatformClientTokenService(router,deps){router.service(PlatformClientTokenController,{mintUserToken:request=>mintUserToken(deps.mint,request),mintGuestToken:(request,ctx)=>{if(deps.guestTokenMinting===void 0)throw new ConnectError(GUEST_MINT_UNIMPLEMENTED_MESSAGE,Code.Unimplemented);return deps.guestTokenMinting.mintGuestToken(request,ctx.requestHeader)}})}function newPlatformClientTokenVerifier(deps){return{name:"platform-client",async verify(token){let result=verifyPlatformToken(deps.keys,token,deps.now?.());switch(result.outcome){case"foreign":return null;case"refused":throw platformTokenRefusalError(result.refusal);case"verified":break;default:{let exhaustive=result;throw new Error(`unknown verification ${JSON.stringify(exhaustive)}`)}}let verified=result.token;if(verified.tokenType!==void 0)return null;let platformClientId=stringClaim(verified.payload,USER_TOKEN_CLAIMS.platformClientId);if(platformClientId===void 0)throw new ConnectError(TOKEN_NAMES_NO_CLIENT_MESSAGE,Code.Unauthenticated);if(await deps.clients.findById(platformClientId)===void 0)throw new ConnectError(DELETED_CLIENT_MESSAGE,Code.Unauthenticated);let email=stringClaim(verified.payload,USER_TOKEN_CLAIMS.email),displayName=stringClaim(verified.payload,USER_TOKEN_CLAIMS.name);return{identityId:verified.subject,callerClass:"user",issuer:PLATFORM_TOKEN_ISSUER,rawToken:token,...email!==void 0?{email}:{},...displayName!==void 0?{displayName}:{},platformClientId}}}}var file_ai_stigmer_tenancy_organization_v1_io=fileDesc("CithaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2lvLnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxIlIKDU9yZ2FuaXphdGlvbnMSQQoHZW50cmllcxgBIAMoCzIwLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uImoKEE9yZ2FuaXphdGlvbkxpc3QSEwoLdG90YWxfcGFnZXMYASABKAUSQQoHZW50cmllcxgCIAMoCzIwLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIioKDk9yZ2FuaXphdGlvbklkEhgKBXZhbHVlGAEgASgJQgm6SAZyBBABGEAimwEKGk9yZ2FuaXphdGlvbkV4dGVybmFsTG9va3VwElsKFWlkZW50aXR5X3Byb3ZpZGVyX3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUIGukgDyAEBEiAKD2V4dGVybmFsX29yZ19pZBgCIAEoCUIHukgEcgIQAWIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_tenancy_organization_v1_api,file_buf_validate_validate]),OrganizationsSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,0),OrganizationListSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,1);var file_ai_stigmer_tenancy_organization_v1_command=fileDesc("CjBhaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2NvbW1hbmQucHJvdG8SImFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEy2AQKHU9yZ2FuaXphdGlvbkNvbW1hbmRDb250cm9sbGVyEmsKBWFwcGx5EjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24aMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhJyCgZjcmVhdGUSMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhowLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIgTQuBgBEqgBCgZ1cGRhdGUSMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhowLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIjrCuBg2CAIQHiILbWV0YWRhdGEuaWQqI3VuYXV0aG9yaXplZCB0byB1cGRhdGUgb3JnYW5pemF0aW9uEqQBCgZkZWxldGUSMi5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbklkGjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iNMK4GDAIAxAeIgV2YWx1ZSojdW5hdXRob3JpemVkIHRvIGRlbGV0ZSBvcmdhbml6YXRpb24aBKD/Kx5iBnByb3RvMw",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io]),OrganizationCommandController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_command,0);var file_ai_stigmer_tenancy_organization_v1_query=fileDesc("Ci5haS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL3F1ZXJ5LnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxMrkEChtPcmdhbml6YXRpb25RdWVyeUNvbnRyb2xsZXISnwEKA2dldBIyLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uSWQaMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbiIywrgYLggBEB4iBXZhbHVlKiF1bmF1dGhvcml6ZWQgdG8gdmlldyBvcmdhbml6YXRpb24SewoEZmluZBI3LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5GaW5kQXBpUmVzb3VyY2VzUmVxdWVzdBo0LmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uTGlzdCIE0LgYARJmChNmaW5kTXlPcmdhbml6YXRpb25zEhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5GjEuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb25zIgTQuBgBEowBChJnZXRCeUV4dGVybmFsT3JnSWQSPi5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbkV4dGVybmFsTG9va3VwGjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iBNC4GAEaBKD/Kx5iBnByb3RvMw",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io,file_google_protobuf_empty]),OrganizationQueryController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_query,0);var organizationSearchExtractor={kind:ApiResourceKind.organization,schema:OrganizationSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let org=resource;return buildSearchResult({kind:ApiResourceKind.organization,metadata:org.metadata,summary:org.spec?.description??"",score,createdAt:org.status?.audit?.specAudit?.createdAt,updatedAt:org.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let org=resource,metadata=org.metadata;if(metadata!==void 0)return{name:metadata.name,description:org.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(org.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function newCheckOrgDuplicateStep(store){return{name:"CheckDuplicate",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("organization metadata is nil"),"duplicate check");if(metadata.slug==="")throw internalError(new Error("organization slug is empty"),"duplicate check");try{await store.getResource(ctx.apiResourceKind,metadata.slug,OrganizationSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw internalError(error2,"failed to check for duplicate organization")}throw alreadyExistsError("Organization",`slug '${metadata.slug}'`)}}}function newCopySlugToIdStep(){return{name:"CopySlugToId",execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("organization metadata is nil"),"copy slug to id");if(metadata.slug==="")throw internalError(new Error("organization slug is empty"),"copy slug to id");metadata.id=metadata.slug}}}function registerOrganizationServices(router,deps){router.service(OrganizationCommandController,{apply:(org,ctx)=>apply10(deps,org,ctx),create:(org,ctx)=>createOrganization(deps,org,ctx),update:(org,ctx)=>update13(deps,org,ctx),delete:(orgId,ctx)=>deleteOrganization(deps,orgId,ctx)});let externalLookup=deps.organizationDirectory?.getOrganizationIdByExternalOrgId?.bind(deps.organizationDirectory);router.service(OrganizationQueryController,{get:(orgId,ctx)=>get18(deps,orgId,ctx),find:(req,ctx)=>find(deps,req,ctx),findMyOrganizations:(_,ctx)=>findMyOrganizations(deps,ctx),...externalLookup===void 0?{}:{getByExternalOrgId:(lookup3,ctx)=>getByExternalOrgId(deps,externalLookup,lookup3,ctx)}})}function kindOf17(ctx){return ctx.values.get(apiResourceKindKey)}async function createOrganization(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx)),builder2=newPipeline("organization-create",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckOrgDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newCopySlugToIdStep());for(let step of stepsForSlot(deps.gateSteps,"org-create:pre-side-effect-gate"))builder2.addStep(step);builder2.addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger));for(let step of stepsForSlot(deps.gateSteps,"org-create:post-persist"))builder2.addStep(step);return await builder2.addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update13(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-update",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply10(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx));await newPipeline("organization-apply",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOrganization(deps,org,ctx):update13(deps,withResolvedApplyId(OrganizationSchema,org,reqCtx),ctx)}async function deleteOrganization(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationCommandController.method.delete.input,orgId,callerIdentityOf(ctx),kindOf17(ctx));await newPipeline("organization-delete",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,OrganizationSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted organization not found in context"),"delete operation lost its loaded resource");return deleted}async function get18(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.get.input,orgId,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-get",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OrganizationSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var FIND_RESULT_KEY="findResult";async function find(deps,req,ctx){if(deps.organizationDirectory?.refusesEnumeration===!0)throw new ConnectError("ai.stigmer.tenancy.organization.v1.OrganizationQueryController.find is not implemented",Code.Unimplemented);let reqCtx=new RequestContext(OrganizationQueryController.method.find.input,req,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-find",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.find,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListAllOrganizationsStep(deps.store)).build().execute(reqCtx),reqCtx.get(FIND_RESULT_KEY)}function newListAllOrganizationsStep(store){return{name:"ListAllOrganizations",async execute(ctx){let data;try{data=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list organizations")}let orgs=[];for(let bytes of data)try{orgs.push(fromBinary2(OrganizationSchema,bytes))}catch{continue}let req=ctx.input,pageSize=req.pageSize,pageNumber=req.pageNumber;req.page!==void 0&&(req.page.size>0&&(pageSize=req.page.size),req.page.num>0&&(pageNumber=req.page.num)),pageSize<=0&&(pageSize=20),pageSize>100&&(pageSize=100),pageNumber<=0&&(pageNumber=1);let totalPages=Math.ceil(orgs.length/pageSize),start=(pageNumber-1)*pageSize,entries=start>=orgs.length?[]:orgs.slice(start,start+pageSize);ctx.set(FIND_RESULT_KEY,create2(OrganizationListSchema,{totalPages,entries}))}}}async function findMyOrganizations(deps,ctx){let directory=deps.organizationDirectory;if(directory!==void 0){let authorized=await directory.listMyOrganizationIds(callerIdentityOf(ctx));if(authorized!=="all"){let entries2=[];for(let id of authorized)try{entries2.push(await deps.store.getResource(ApiResourceKind.organization,id,OrganizationSchema))}catch(error2){if(error2 instanceof ResourceNotFoundError)continue;throw internalError(error2,"failed to list organizations")}return create2(OrganizationsSchema,{entries:entries2})}}let data;try{data=await deps.store.listResources(ApiResourceKind.organization)}catch(error2){throw internalError(error2,"failed to list organizations")}let entries=[];for(let bytes of data)try{entries.push(fromBinary2(OrganizationSchema,bytes))}catch{continue}return create2(OrganizationsSchema,{entries})}async function getByExternalOrgId(deps,lookup3,input,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.getByExternalOrgId.input,input,callerIdentityOf(ctx),kindOf17(ctx));if(await newPipeline("organization-get-by-external-org-id",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.getByExternalOrgId,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx),input.externalOrgId==="")throw invalidArgumentError("external_org_id is required");let orgId=await lookup3(input.externalOrgId);if(orgId===void 0)throw notFoundError("Organization",input.externalOrgId);try{return await deps.store.getResource(ApiResourceKind.organization,orgId,OrganizationSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Organization",input.externalOrgId):internalError(error2,"failed to load organization")}}var file_ai_stigmer_agentic_mcpserver_v1_io=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2lvLnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxIiQKC01jcFNlcnZlcklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiggIKDENvbm5lY3RJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESUgoLcnVudGltZV9lbnYYAiADKAsyPS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dC5SdW50aW1lRW52RW50cnkSFAoDb3JnGAMgASgJQge6SARyAhABGmkKD1J1bnRpbWVFbnZFbnRyeRILCgNrZXkYASABKAkSRQoFdmFsdWUYAiABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25WYWx1ZToCOAEiUAoZSW5pdGlhdGVPQXV0aENvbm5lY3RJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESFAoDb3JnGAIgASgJQge6SARyAhABIm0KGkluaXRpYXRlT0F1dGhDb25uZWN0T3V0cHV0EhkKEWF1dGhvcml6YXRpb25fdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEg4KBnNjb3BlcxgDIAMoCRIVCg1wcm92aWRlcl9uYW1lGAQgASgJIncKGUNvbXBsZXRlT0F1dGhDb25uZWN0SW5wdXQSHQoNbWNwX3NlcnZlcl9pZBgBIAEoCUIGukgDyAEBEiMKEmF1dGhvcml6YXRpb25fY29kZRgCIAEoCUIHukgEcgIQARIWCgVzdGF0ZRgDIAEoCUIHukgEcgIQASJkChpDb21wbGV0ZU9BdXRoQ29ubmVjdE91dHB1dBIRCgljb25uZWN0ZWQYASABKAgSFgoOdGFyZ2V0X2Vudl92YXIYAiABKAkSGwoTdG9rZW5fbGlmZXRpbWVfaGludBgDIAEoCSJNChhHZXRPQXV0aEdyYW50U3RhdHVzSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBARIUCgNvcmcYAiABKAlCB7pIBHICEAEizwEKGUdldE9BdXRoR3JhbnRTdGF0dXNPdXRwdXQSEQoJY29ubmVjdGVkGAEgASgIEh8KF2FjY2Vzc190b2tlbl9leHBpcmVzX2F0GAIgASgDEhYKDnRhcmdldF9lbnZfdmFyGAMgASgJEhMKC2F1dGhfbWV0aG9kGAQgASgJElEKEWNvbm5lY3Rpb25faGVhbHRoGAUgASgOMjYuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5PQXV0aENvbm5lY3Rpb25IZWFsdGgiSQoURGlzY29ubmVjdE9BdXRoSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBARIUCgNvcmcYAiABKAlCB7pIBHICEAEiLQoVRGlzY29ubmVjdE9BdXRoT3V0cHV0EhQKDGRpc2Nvbm5lY3RlZBgBIAEoCCKEAQoTU2V0T3JnT0F1dGhBcHBJbnB1dBIbCgtyZXNvdXJjZV9pZBgBIAEoCUIGukgDyAEBEhQKA29yZxgCIAEoCUIHukgEcgIQARIaCgljbGllbnRfaWQYAyABKAlCB7pIBHICEAESHgoNY2xpZW50X3NlY3JldBgEIAEoCUIHukgEcgIQASIsChRTZXRPcmdPQXV0aEFwcE91dHB1dBIUCgxvYXV0aF9hcHBfaWQYASABKAkiSAoTR2V0T3JnT0F1dGhBcHBJbnB1dBIbCgtyZXNvdXJjZV9pZBgBIAEoCUIGukgDyAEBEhQKA29yZxgCIAEoCUIHukgEcgIQASJVChRHZXRPcmdPQXV0aEFwcE91dHB1dBIUCgxoYXNfb3ZlcnJpZGUYASABKAgSFAoMb2F1dGhfYXBwX2lkGAIgASgJEhEKCWNsaWVudF9pZBgDIAEoCSJLChZEZWxldGVPcmdPQXV0aEFwcElucHV0EhsKC3Jlc291cmNlX2lkGAEgASgJQga6SAPIAQESFAoDb3JnGAIgASgJQge6SARyAhABIioKF0RlbGV0ZU9yZ09BdXRoQXBwT3V0cHV0Eg8KB2RlbGV0ZWQYASABKAgq7QEKFU9BdXRoQ29ubmVjdGlvbkhlYWx0aBInCiNPQVVUSF9DT05ORUNUSU9OX0hFQUxUSF9VTlNQRUNJRklFRBAAEiMKH09BVVRIX0NPTk5FQ1RJT05fSEVBTFRIX0hFQUxUSFkQARIpCiVPQVVUSF9DT05ORUNUSU9OX0hFQUxUSF9UT0tFTl9FWFBJUkVEEAISNQoxT0FVVEhfQ09OTkVDVElPTl9IRUFMVEhfVE9LRU5fRVhQSVJFRF9SRUZSRVNIQUJMRRADEiQKIE9BVVRIX0NPTk5FQ1RJT05fSEVBTFRIX05PX0dSQU5UEARiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_spec,file_buf_validate_validate]);var InitiateOAuthConnectOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,3);var CompleteOAuthConnectOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,5);var GetOAuthGrantStatusOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,7);var DisconnectOAuthOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,9);var OAuthConnectionHealth;(function(OAuthConnectionHealth2){OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_UNSPECIFIED=0]="OAUTH_CONNECTION_HEALTH_UNSPECIFIED",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_HEALTHY=1]="OAUTH_CONNECTION_HEALTH_HEALTHY",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED=2]="OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE=3]="OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_NO_GRANT=4]="OAUTH_CONNECTION_HEALTH_NO_GRANT"})(OAuthConnectionHealth||(OAuthConnectionHealth={}));var file_ai_stigmer_agentic_mcpserver_v1_command=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2NvbW1hbmQucHJvdG8SH2FpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEynREKGk1jcFNlcnZlckNvbW1hbmRDb250cm9sbGVyEl8KBWFwcGx5EiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchKwAQoGY3JlYXRlEiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciJOwrgYSggrEB4iDG1ldGFkYXRhLm9yZyo2dW5hdXRob3JpemVkIHRvIGNyZWF0ZSBtY3Agc2VydmVyIGluIHRoaXMgb3JnYW5pemF0aW9uEpoBCgZ1cGRhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIjjCuBg0CAIQLCILbWV0YWRhdGEuaWQqIXVuYXV0aG9yaXplZCB0byB1cGRhdGUgbWNwIHNlcnZlchKmAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI4wrgYNAgDECwiC3Jlc291cmNlX2lkKiF1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1jcCBzZXJ2ZXISugEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiQ8K4GD8IAhAsIgtyZXNvdXJjZV9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtY3Agc2VydmVyIHZpc2liaWxpdHkSpAEKB2Nvbm5lY3QSLS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dBoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIj7CuBg6CBYQLCINbWNwX3NlcnZlcl9pZColdW5hdXRob3JpemVkIHRvIGNvbm5lY3QgdG8gbWNwIHNlcnZlchKpAQoMc3RhcnRDb25uZWN0Ei0uYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Db25uZWN0SW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI+wrgYOggWECwiDW1jcF9zZXJ2ZXJfaWQqJXVuYXV0aG9yaXplZCB0byBjb25uZWN0IHRvIG1jcCBzZXJ2ZXIS3wEKFGluaXRpYXRlT0F1dGhDb25uZWN0EjouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Jbml0aWF0ZU9BdXRoQ29ubmVjdElucHV0GjsuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Jbml0aWF0ZU9BdXRoQ29ubmVjdE91dHB1dCJOwrgYSggWECwiDW1jcF9zZXJ2ZXJfaWQqNXVuYXV0aG9yaXplZCB0byBpbml0aWF0ZSBvYXV0aCBjb25uZWN0IGZvciBtY3Agc2VydmVyEt8BChRjb21wbGV0ZU9BdXRoQ29ubmVjdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuQ29tcGxldGVPQXV0aENvbm5lY3RJbnB1dBo7LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuQ29tcGxldGVPQXV0aENvbm5lY3RPdXRwdXQiTsK4GEoIFhAsIg1tY3Bfc2VydmVyX2lkKjV1bmF1dGhvcml6ZWQgdG8gY29tcGxldGUgb2F1dGggY29ubmVjdCBmb3IgbWNwIHNlcnZlchLIAQoPZGlzY29ubmVjdE9BdXRoEjUuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5EaXNjb25uZWN0T0F1dGhJbnB1dBo2LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuRGlzY29ubmVjdE9BdXRoT3V0cHV0IkbCuBhCCBYQLCILcmVzb3VyY2VfaWQqL3VuYXV0aG9yaXplZCB0byBkaXNjb25uZWN0IG9hdXRoIGZvciBtY3Agc2VydmVyErgBCg5zZXRPcmdPQXV0aEFwcBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU2V0T3JnT0F1dGhBcHBJbnB1dBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU2V0T3JnT0F1dGhBcHBPdXRwdXQiOcK4GDUIFxAeIgNvcmcqKnVuYXV0aG9yaXplZCB0byBzZXQgb3JnIG9hdXRoIGFwcCBvdmVycmlkZRLEAQoRZGVsZXRlT3JnT0F1dGhBcHASNy5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRlbGV0ZU9yZ09BdXRoQXBwSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRlbGV0ZU9yZ09BdXRoQXBwT3V0cHV0IjzCuBg4CBcQHiIDb3JnKi11bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG9yZyBvYXV0aCBhcHAgb3ZlcnJpZGUaBKD/KyxiBnByb3RvMw",[file_ai_stigmer_agentic_mcpserver_v1_api,file_ai_stigmer_agentic_mcpserver_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),McpServerCommandController=serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_command,0);var file_ai_stigmer_agentic_mcpserver_v1_query=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL3F1ZXJ5LnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxMssFChhNY3BTZXJ2ZXJRdWVyeUNvbnRyb2xsZXISkgEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiMMK4GCwIARAsIgV2YWx1ZSofdW5hdXRob3JpemVkIHRvIHZpZXcgbWNwIHNlcnZlchJ4Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBEtUBChNnZXRPQXV0aEdyYW50U3RhdHVzEjkuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5HZXRPQXV0aEdyYW50U3RhdHVzSW5wdXQaOi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkdldE9BdXRoR3JhbnRTdGF0dXNPdXRwdXQiR8K4GEMIARAsIgtyZXNvdXJjZV9pZCowdW5hdXRob3JpemVkIHRvIHZpZXcgb2F1dGggc3RhdHVzIGZvciBtY3Agc2VydmVyEsEBCg5nZXRPcmdPQXV0aEFwcBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuR2V0T3JnT0F1dGhBcHBJbnB1dBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuR2V0T3JnT0F1dGhBcHBPdXRwdXQiQsK4GD4IARAsIgtyZXNvdXJjZV9pZCordW5hdXRob3JpemVkIHRvIHZpZXcgb3JnIG9hdXRoIGFwcCBvdmVycmlkZRoEoP8rLGIGcHJvdG8z",[file_ai_stigmer_agentic_mcpserver_v1_api,file_ai_stigmer_agentic_mcpserver_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),McpServerQueryController=serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_query,0);async function completeOAuthConnect(deps,input,identity2){let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");let stateParam=input.state;if(stateParam==="")throw invalidArgumentError("state is required");let code=input.authorizationCode;if(code==="")throw invalidArgumentError("authorization_code is required");let pendingState;try{pendingState=await deps.pendingOAuthStates.getAndDelete(stateParam)}catch(error2){throw internalError(error2,"failed to load pending OAuth state")}if(pendingState===void 0)throw failedPreconditionError("no pending OAuth state found for the given state parameter (expired or already used)");if(pendingState.mcpServerId!==mcpServerId)throw failedPreconditionError("state parameter does not match the requested mcp_server_id");await authorizeDirect(McpServerCommandController.method.completeOAuthConnect,deps.authorizer,identity2,input,{resourceId:pendingState.mcpServerId});try{pendingState=await unsealPendingOAuthState(deps.secretService,pendingState)}catch(error2){throw deps.logger.error("Failed to decrypt pending OAuth state secrets",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to decrypt OAuth handshake secrets \u2014 please retry the connect flow")}let tokenResponse;try{tokenResponse=await exchangeCode(pendingState.tokenEndpoint,code,pendingState.redirectUri,pendingState.codeVerifier,pendingState.clientId,pendingState.clientSecret,pendingState.tokenAuthMethod,deps.outboundFetch)}catch(error2){throw unavailableError(`token exchange failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}let org=pendingState.org;org===""&&(org=mcpServer.metadata?.org??"");let managedEnvId=await resolveOrCreateManagedEnvironment(deps,pendingState.identityAccountId,mcpServerId,org,mcpServer.metadata?.name??"",identity2),tokenVars={[pendingState.targetEnvVar]:create2(EnvironmentValueSchema,{value:tokenResponse.accessToken,isSecret:!0})},refreshTokenEnvVar=`${pendingState.targetEnvVar}_REFRESH_TOKEN`;tokenResponse.refreshToken!==""&&(tokenVars[refreshTokenEnvVar]=create2(EnvironmentValueSchema,{value:tokenResponse.refreshToken,isSecret:!0}));try{await deps.managedEnv.updateSecrets(managedEnvId,tokenVars)}catch(error2){throw internalError(error2,"failed to store OAuth tokens in managed environment")}let expiresAt=0;tokenResponse.expiresIn>0&&(expiresAt=Math.floor(Date.now()/1e3)+tokenResponse.expiresIn);try{await deps.oauthGrants.upsert({identityAccountId:pendingState.identityAccountId,resourceId:mcpServerId,resourceKind:"mcp_server",orgId:org,accessTokenExpiresAt:expiresAt,clientId:pendingState.clientId,authMethod:pendingState.authMethod,tokenEndpoint:pendingState.tokenEndpoint,accessTokenEnvVar:pendingState.targetEnvVar,refreshTokenEnvVar,environmentId:managedEnvId,createdAt:0,updatedAt:0})}catch(error2){throw internalError(error2,"failed to create OAuth grant record")}let auth=mcpServer.spec?.auth;return deps.logger.info("OAuth Connect completed: tokens stored in managed environment",{mcp_server_id:mcpServerId,auth_method:pendingState.authMethod,target_env_var:pendingState.targetEnvVar,managed_env_id:managedEnvId,expires_at:expiresAt,has_refresh_token:tokenResponse.refreshToken!==""}),create2(CompleteOAuthConnectOutputSchema,{connected:!0,targetEnvVar:pendingState.targetEnvVar,tokenLifetimeHint:auth?.tokenLifetimeHint??""})}async function unsealPendingOAuthState(secretService,state2){let verifier;try{verifier=await secretService.decrypt(state2.codeVerifier)}catch(error2){throw new Error(`failed to decrypt code_verifier: ${error2 instanceof Error?error2.message:String(error2)}`)}let secret;try{secret=await secretService.decrypt(state2.clientSecret)}catch(error2){throw new Error(`failed to decrypt client_secret: ${error2 instanceof Error?error2.message:String(error2)}`)}return{...state2,codeVerifier:verifier,clientSecret:secret}}async function resolveOrCreateManagedEnvironment(deps,identityAccountId,mcpServerId,org,mcpServerName,caller){let existingGrant;try{existingGrant=await deps.oauthGrants.find(identityAccountId,mcpServerId,org)}catch(error2){deps.logger.warn("Failed to look up existing OAuth grant (non-fatal, will create new managed env)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}if(existingGrant!==void 0&&existingGrant.environmentId!=="")return deps.logger.info("Reusing existing managed environment for OAuth re-connect",{mcp_server_id:mcpServerId,environment_id:existingGrant.environmentId}),existingGrant.environmentId;let envName=`OAuth: ${mcpServerName}`;try{return await deps.managedEnv.createManagedEnvironment(envName,org,caller)}catch(error2){throw internalError(error2,"failed to create managed environment for OAuth tokens")}}function convertToDiscoveredCapabilities(output){let capabilities=create2(DiscoveredCapabilitiesSchema,{lastDiscoveredAt:timestampNow()});for(let t of output.tools??[]){let tool=create2(DiscoveredToolSchema,{name:t.name??"",description:t.description??""});t.input_schema!==void 0&&(tool.inputSchema=t.input_schema),capabilities.tools.push(tool)}for(let rt of output.resource_templates??[])capabilities.resourceTemplates.push(create2(DiscoveredResourceTemplateSchema,{uriTemplate:rt.uri_template??"",name:rt.name??"",description:rt.description??"",mimeType:rt.mime_type??""}));return capabilities}function convertToToolApprovals(output){let approvals=[];for(let a5 of output.tool_approvals??[])a5.requires_approval!==!0||(a5.tool_name??"")===""||approvals.push(create2(ToolApprovalPolicySchema,{toolName:a5.tool_name,message:a5.message??"",fromDestructiveHint:a5.from_destructive_hint??!1}));return approvals}function setToolApprovalsFromConnect(status,output){let approvals=convertToToolApprovals(output);return approvals.length>0&&(status.toolApprovals=approvals),approvals.length}function settleConnectStatus(mcpStatus,workflowId,failure){let cs=mcpStatus.connectStatus;if(cs===void 0&&(cs=create2(ConnectStatusSchema),mcpStatus.connectStatus=cs),cs.workflowId=workflowId,cs.finishedAt=timestampNow(),cs.warning="",failure===void 0){cs.phase=ConnectPhase.succeeded,cs.failureCode="",cs.failureMessage="";return}cs.phase=ConnectPhase.failed,cs.failureCode=grpcCodeName(failure.code),cs.failureMessage=failure.rawMessage}async function persistConnectResult(store,mcpServerId,workflowId,output){let toolApprovalCount=0;return{persisted:await store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),mcpServer.status.discoveredCapabilities=convertToDiscoveredCapabilities(output),toolApprovalCount=setToolApprovalsFromConnect(mcpServer.status,output),settleConnectStatus(mcpServer.status,workflowId,void 0)}),toolApprovalCount}}async function persistConnectStarting(store,mcpServerId,workflowId,warning2){return store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),mcpServer.status.connectStatus=create2(ConnectStatusSchema,{phase:ConnectPhase.connecting,workflowId,startedAt:timestampNow(),warning:warning2})})}async function persistConnectFailure(store,logger2,mcpServerId,failure){try{await store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),settleConnectStatus(mcpServer.status,mcpServer.status.connectStatus?.workflowId??"",failure)})}catch(error2){if(error2 instanceof ResourceNotFoundError){logger2.info("Skipping connect failure persistence: MCP server deleted before connect settled",{mcp_server_id:mcpServerId});return}logger2.warn("Failed to record connect failure on connect_status (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}}var CONNECT_TIMEOUT={ms:42e4,goLabel:"7m0s"},ASYNC_CONNECT_TIMEOUT={ms:3600*1e3,goLabel:"1h0m0s"},BEST_EFFORT_CONNECT_GET_BUFFER_MS=15e3;async function connect(deps,input,identity2){let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");if(input.org==="")throw invalidArgumentError("org is required for connect");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.connect,deps.authorizer,identity2,input);let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError("connect is not available: Temporal not configured");let prepared=await prepareConnect(deps,mcpServer,input,identity2);try{let run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,prepared.workflowInput,CONNECT_TIMEOUT.ms)}catch(error2){throw deps.logger.error("Failed to start MCP connect workflow",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to start connect workflow")}if(!run.attached)try{await persistConnectStarting(deps.store,mcpServerId,run.workflowId,"")}catch(error2){deps.logger.warn("Failed to record CONNECTING on connect_status (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let outcome=await run.result(CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,CONNECT_TIMEOUT);throw await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure),failure}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){throw internalError(error2,"failed to save mcp server after connect")}return deps.logger.info("MCP server connect completed and stored",{mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount}),persisted}finally{prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId)}}async function prepareConnect(deps,mcpServer,input,identity2){let mcpServerId=mcpServer.metadata?.id??"",callerOrg=input.org;Object.keys(input.runtimeEnv).length===0&&await refreshOAuthTokenIfNeeded(deps,mcpServer,callerOrg);let executionId=newConnectExecutionId(mcpServerId),ecResourceId=await createConnectExecutionContext(deps,mcpServer,executionId,callerOrg,input.runtimeEnv,identity2),workflowInput={mcp_server_id:mcpServerId,...ecResourceId!==""?{execution_context_id:executionId}:{}};if(ecResourceId!==""&&deps.runnerAuth.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))try{let minted=deps.runnerAuth.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return{workflowInput:{...workflowInput,execution_context_token:minted.token},ecResourceId,executionId}}catch(error2){deps.logger.warn("Failed to mint connect EC token \u2014 discovery will read redacted credentials",{execution_id:executionId,error:error2 instanceof Error?error2.message:String(error2)})}return{workflowInput,ecResourceId,executionId}}async function createConnectExecutionContext(deps,mcpServer,executionId,callerOrg,runtimeEnv,caller){let ecData;if(Object.keys(runtimeEnv).length>0)ecData=runtimeEnv,deps.logger.info("Using runtime_env for connect ExecutionContext (one-time use)",{execution_id:executionId,runtime_env_count:Object.keys(runtimeEnv).length});else{let envDecls=mcpServer.spec?.env??{};if(Object.keys(envDecls).length===0)return deps.logger.debug("MCP server has no env declarations \u2014 skipping ExecutionContext creation",{execution_id:executionId}),"";let mcpServerId=mcpServer.metadata?.id??"",{oauthVars,remainingDecls}=await resolveOAuthVarsFromManagedEnv(deps,mcpServerId,callerOrg,envDecls),personalVars={};Object.keys(remainingDecls).length>0&&(personalVars=await resolveFromPersonalEnvironment(deps,callerOrg,remainingDecls)),ecData={...personalVars,...oauthVars},deps.logger.info("Resolved env vars for connect ExecutionContext",{execution_id:executionId,oauth_count:Object.keys(oauthVars).length,personal_count:Object.keys(personalVars).length})}if(Object.keys(ecData).length===0)return"";let created;try{created=await deps.executionContext.create(create2(ExecutionContextSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"ExecutionContext",metadata:{name:`exec-ctx-${executionId}`,org:callerOrg},spec:{executionId,data:ecData}}),caller)}catch(error2){throw internalError(error2,"failed to create connect ExecutionContext")}let resourceId=created.metadata?.id??"";return deps.logger.info("Created ephemeral ExecutionContext for MCP connect",{execution_context_id:resourceId,execution_id:executionId,data_entries:Object.keys(ecData).length}),resourceId}async function resolveOAuthVarsFromManagedEnv(deps,mcpServerId,org,envDecls){let grant;try{grant=await deps.oauthGrants.find("",mcpServerId,org)}catch{return{oauthVars:{},remainingDecls:envDecls}}if(grant===void 0||grant.environmentId==="")return{oauthVars:{},remainingDecls:envDecls};let oauthKey=grant.accessTokenEnvVar;if(!(oauthKey in envDecls))return{oauthVars:{},remainingDecls:envDecls};let tokenValue="";try{tokenValue=await deps.managedEnv.readSecretValue(grant.environmentId,oauthKey)}catch(error2){return deps.logger.warn("Failed to read OAuth token from managed environment \u2014 falling back to personal env",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId,error:error2 instanceof Error?error2.message:String(error2)}),{oauthVars:{},remainingDecls:envDecls}}if(tokenValue==="")return deps.logger.warn("Failed to read OAuth token from managed environment \u2014 falling back to personal env",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId}),{oauthVars:{},remainingDecls:envDecls};let remainingDecls={};for(let[k5,v]of Object.entries(envDecls))k5!==oauthKey&&(remainingDecls[k5]=v);return deps.logger.debug("Resolved OAuth token from managed environment",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId}),{oauthVars:{[oauthKey]:create2(ExecutionValueSchema,{value:tokenValue,isSecret:!0})},remainingDecls}}async function resolveFromPersonalEnvironment(deps,org,envDecls){let resolution=await resolveDeclaredFromPersonalEnvironment(deps.environmentReader,deps.logger,org,envDecls);if(resolution.kind==="no-personal-environment"){let requiredKeys=Object.entries(envDecls).filter(([,decl])=>!decl.optional).map(([key])=>key);if(requiredKeys.length===0)return{};throw failedPreconditionError(`personal environment not found for org '${org}'; save required credentials first: [${requiredKeys.join(" ")}]`)}if(resolution.missing.length>0)throw failedPreconditionError(`missing required credentials in personal environment: [${resolution.missing.join(" ")}]`);return{...resolution.values}}async function deleteConnectExecutionContext(deps,resourceId,executionId){try{await deps.executionContext.delete({resourceId})}catch(error2){deps.logger.warn("Failed to delete connect ExecutionContext (non-fatal)",{resource_id:resourceId,execution_id:executionId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.debug("Deleted ephemeral connect ExecutionContext",{resource_id:resourceId,execution_id:executionId})}function mapConnectFailure(logger2,mcpServer,workflowId,failure,budget){let mcpServerId=mcpServer.metadata?.id??"";switch(logger2.error("MCP connect workflow failed",{workflow_id:workflowId,mcp_server_id:mcpServerId,failure_kind:failure.kind}),failure.kind){case"application":return failedPreconditionError(buildConnectFailureMessage(mcpServer,failure.message));case"timeout":return new ConnectError(`connect did not complete within the ${budget.goLabel} budget for MCP server '${mcpServerId}' \u2014 if this repeats, check that your runner is running and healthy`,Code.DeadlineExceeded);case"service-not-found":return unavailableError(`connect service temporarily unavailable for MCP server '${mcpServerId}'`);case"other":return new ConnectError(buildConnectFailureMessage(mcpServer,failure.message),Code.Internal);default:{let exhaustive=failure;throw new Error(`unhandled connect failure ${String(exhaustive)}`)}}}function buildConnectFailureMessage(mcpServer,cause){let name=mcpServer.metadata?.name??"";if(cause.includes("requires OAuth"))return cause;if(mcpServer.spec?.serverType.case==="stdio"){let slug=mcpServer.metadata?.slug??"";return`connect failed for MCP server '${name}': ${cause}. This is a stdio server launched by your local runner \u2014 verify the command is installed and its arguments and environment variables are correct. Preview discovery locally with: stigmer connect mcp-server ${slug} --dry-run`}return`connect failed for MCP server '${name}': ${cause}. Check that the server URL is reachable and your credentials are valid.`}async function refreshOAuthTokenIfNeeded(deps,mcpServer,callerOrg){if(mcpServer.spec?.auth===void 0)return;let mcpServerId=mcpServer.metadata?.id??"",grant;try{grant=await deps.oauthGrants.find("",mcpServerId,callerOrg)}catch(error2){deps.logger.warn("Failed to load OAuth grant for pre-flight check (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}if(grant===void 0)return;if(grant.environmentId===""){deps.logger.warn("OAuth grant has no managed environment ID \u2014 user must re-authenticate via OAuth Connect",{mcp_server_id:mcpServerId});return}let refreshTokenValue;try{refreshTokenValue=await deps.managedEnv.readSecretValue(grant.environmentId,grant.refreshTokenEnvVar)}catch(error2){deps.logger.debug("No refresh token found in managed environment (may not be OAuth-connected)",{mcp_server_id:mcpServerId,refresh_token_var:grant.refreshTokenEnvVar,managed_env_id:grant.environmentId,error:error2 instanceof Error?error2.message:String(error2)});return}let clientSecret="",tokenAuthMethod="";if(grant.authMethod==="vendor_oauth")try{({clientSecret,tokenAuthMethod}=await loadOAuthAppClientCredentials(deps,mcpServer))}catch(error2){deps.logger.warn("Failed to load OAuthApp client secret for refresh",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let result;try{result=await refreshTokenIfExpired(grant,refreshTokenValue,clientSecret,tokenAuthMethod,deps.logger,deps.outboundFetch)}catch(error2){throw failedPreconditionError(error2 instanceof Error?error2.message:String(error2))}if(!result.refreshed)return;let tokenVars={[grant.accessTokenEnvVar]:create2(EnvironmentValueSchema,{value:result.newAccessToken,isSecret:!0})};result.newRefreshToken!==refreshTokenValue&&(tokenVars[grant.refreshTokenEnvVar]=create2(EnvironmentValueSchema,{value:result.newRefreshToken,isSecret:!0}));try{await deps.managedEnv.updateSecrets(grant.environmentId,tokenVars)}catch(error2){throw internalError(error2,"failed to update refreshed tokens in managed environment")}try{await deps.oauthGrants.upsert({...grant,accessTokenExpiresAt:result.newExpiresAt})}catch(error2){deps.logger.warn("Failed to update OAuth grant after refresh (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}}async function loadOAuthAppClientCredentials(deps,mcpServer){let ref=mcpServer.spec?.auth?.oauthAppRef;if(ref===void 0||ref.slug==="")return{clientSecret:"",tokenAuthMethod:""};let app;try{app=await resolveOAuthAppRef(deps.store,ref,deps.logger)}catch(error2){throw new Error(`failed to list oauth apps: ${error2 instanceof Error?error2.message:String(error2)}`)}if(app===void 0)throw new Error(`OAuthApp '${ref.slug}' not found`);let tokenAuthMethod=tokenAuthMethodFromSpec(app.spec?.tokenEndpointAuthMethod??TokenEndpointAuthMethod.UNSPECIFIED),secret=app.spec?.clientSecret??"";return deps.secretService.isEncrypted(secret)&&(secret=await deps.secretService.decrypt(secret)),{clientSecret:secret,tokenAuthMethod}}function tokenAuthMethodFromSpec(method){return method===TokenEndpointAuthMethod.CLIENT_SECRET_POST?TOKEN_AUTH_METHOD_POST:TOKEN_AUTH_METHOD_BASIC}async function startBestEffortConnect(deps,mcpServer){let engineState=deps.engineState();if(!engineState.connected)return;let envKeys=Object.keys(mcpServer.spec?.env??{}).length;if(envKeys>0){deps.logger.debug("Skipping best-effort auto-connect: MCP server has env declarations (requires manual connect)",{mcp_server_id:mcpServer.metadata?.id??"",env_keys:envKeys});return}let mcpServerId=mcpServer.metadata?.id??"",run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,{mcp_server_id:mcpServerId},CONNECT_TIMEOUT.ms)}catch(error2){deps.logger.warn("Failed to start best-effort connect workflow (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}if(!run.attached)try{await persistConnectStarting(deps.store,mcpServerId,run.workflowId,"")}catch(error2){deps.logger.warn("Failed to record CONNECTING for best-effort connect (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let outcome=await run.result(CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,CONNECT_TIMEOUT);await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure);return}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){if(error2 instanceof ResourceNotFoundError){deps.logger.info("Skipping best-effort connect persistence: MCP server deleted before connect completed",{mcp_server_id:mcpServerId});return}deps.logger.warn("Failed to persist best-effort connect result (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.info("Best-effort auto-connect completed and stored",{workflow_id:run.workflowId,mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount})}async function disconnectOAuth(deps,input,identity2){let resourceId=input.resourceId;if(resourceId==="")throw invalidArgumentError("resource_id is required");let org=input.org;if(org==="")throw invalidArgumentError("org is required");await authorizeDirect(McpServerCommandController.method.disconnectOAuth,deps.authorizer,identity2,input);let grant;try{grant=await deps.oauthGrants.find("",resourceId,org)}catch(error2){throw internalError(error2,"failed to look up OAuth grant")}if(grant===void 0)return deps.logger.debug("No OAuth grant to disconnect",{resource_id:resourceId,org}),create2(DisconnectOAuthOutputSchema,{disconnected:!1});let envId=grant.environmentId;if(envId!=="")try{await deps.managedEnv.deleteManagedEnvironment(envId)}catch(error2){deps.logger.warn("Failed to delete managed environment \u2014 may already be deleted",{resource_id:resourceId,environment_id:envId,error:error2 instanceof Error?error2.message:String(error2)})}try{await deps.oauthGrants.delete("",resourceId,org)}catch(error2){throw internalError(error2,"failed to delete OAuth grant")}return deps.logger.info("OAuth connection disconnected",{resource_id:resourceId,org,env_deleted:envId!==""}),create2(DisconnectOAuthOutputSchema,{disconnected:!0})}function isOAuthChallenge(wwwAuthenticate){let value=wwwAuthenticate.toLowerCase();return value.includes("bearer")?value.includes("oauth")||value.includes("resource_metadata"):!1}function parseResourceMetadataUrl(wwwAuthenticate){return/resource_metadata="([^"]+)"/i.exec(wwwAuthenticate)?.[1]}function protectedResourceMetadataUrls(resource){let bare=`${resource.origin}/.well-known/oauth-protected-resource`,path14=resource.pathname.replace(/\/+$/,"");return path14===""?[bare]:[`${bare}${path14}`,bare]}function authorizationServerMetadataUrls(issuer){let path14=issuer.pathname.replace(/\/+$/,""),urls=[...path14===""?[]:[`${issuer.origin}/.well-known/oauth-authorization-server${path14}`],`${issuer.origin}/.well-known/oauth-authorization-server`,...path14===""?[]:[`${issuer.origin}${path14}/.well-known/openid-configuration`],`${issuer.origin}/.well-known/openid-configuration`];return[...new Set(urls)]}async function resolveAuthorizationServers(resourceUrl,pointer,deps){let attempts=[],candidates=pointer!==void 0?[pointer]:protectedResourceMetadataUrls(new URL(resourceUrl));for(let candidate of candidates){let read3=await readJson(candidate,deps,attempts);if(read3===void 0)continue;let issuers=readStringArray(read3,"authorization_servers");if(issuers.length>0)return{issuers,attempts}}return{issuers:[],attempts}}async function readAuthorizationServerMetadata(issuer,deps){let attempts=[],parsed;try{parsed=new URL(issuer)}catch{return{kind:"not-found",attempts}}for(let metadataUrl of authorizationServerMetadataUrls(parsed)){let document2=await readJson(metadataUrl,deps,attempts);if(document2===void 0)continue;let authorizationEndpoint=readString(document2,"authorization_endpoint"),tokenEndpoint=readString(document2,"token_endpoint");if(authorizationEndpoint===""||tokenEndpoint===""){let last=attempts.pop();last!==void 0&&attempts.push({...last,missing:authorizationEndpoint===""?"authorization_endpoint":"token_endpoint"});continue}return{kind:"found",attempts,metadata:{metadataUrl,issuer:readString(document2,"issuer"),authorizationEndpoint,tokenEndpoint,registrationEndpoint:readString(document2,"registration_endpoint"),scopesSupported:readStringArray(document2,"scopes_supported"),codeChallengeMethodsSupported:readStringArray(document2,"code_challenge_methods_supported")}}}return{kind:"not-found",attempts}}async function readJson(url,deps,attempts){let response;try{response=await deps.fetchImpl(url,{method:"GET",headers:{Accept:"application/json"},signal:AbortSignal.timeout(deps.timeoutMs)})}catch(error2){attempts.push({url,error:error2 instanceof Error?error2.message:String(error2)});return}if(attempts.push({url,status:response.status}),response.status!==200){await response.body?.cancel().catch(()=>{});return}try{let parsed=await response.json();return isRecord(parsed)?parsed:void 0}catch{return}}function readString(record2,key){let value=record2[key];return typeof value=="string"?value:""}function readStringArray(record2,key){let list12=record2[key];return Array.isArray(list12)?list12.filter(item=>typeof item=="string"):[]}function isRecord(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)}var MCP_PROTOCOL_VERSION="2025-06-18";function baseHeaders(headers2){return{"Content-Type":"application/json",Accept:"application/json, text/event-stream","MCP-Protocol-Version":MCP_PROTOCOL_VERSION,...headers2??{}}}function initializeRequest(clientName,headers2){return{method:"POST",headers:baseHeaders(headers2),body:JSON.stringify({jsonrpc:"2.0",id:1,method:"initialize",params:{protocolVersion:MCP_PROTOCOL_VERSION,capabilities:{},clientInfo:{name:clientName,version:"0"}}})}}async function probeEndpointAuth(url,headers2,deps){let request=initializeRequest(deps.clientName,headers2),response;try{response=await deps.fetchImpl(url,{method:request.method,headers:{...request.headers},body:request.body,signal:AbortSignal.timeout(deps.timeoutMs)})}catch(error2){return{kind:"unreachable",error:describeError(error2)}}if(await response.body?.cancel().catch(()=>{}),response.status===401){let challenge=response.headers.get("www-authenticate")??"";return isOAuthChallenge(challenge)?{kind:"oauth",challenge,resourceMetadataUrl:parseResourceMetadataUrl(challenge)}:{kind:"challenge-not-oauth",challenge}}return response.status>=200&&response.status<300?{kind:"accepted",status:response.status}:{kind:"http-other",status:response.status}}function describeError(error2){return error2 instanceof Error?`${error2.name}: ${error2.message}`:String(error2)}var ENDPOINT_PROBE_TIMEOUT_MS=3e3,PROBE_CLIENT_NAME="stigmer-server",ACCESS_TOKEN_VAR_SUFFIX="_ACCESS_TOKEN",AUTHORIZATION_HEADER="authorization";function newCompleteEndpointAuthStep(deps){return{name:"CompleteEndpointAuth",async execute(ctx){let server=ctx.newState,spec=server.spec;if(spec===void 0)return;applyTokenPathDefault(spec,server.metadata?.slug??"");let existing=ctx.get(EXISTING_RESOURCE_KEY),derived=existing!==void 0?derivedCompletionOf(existing):void 0,url=authorShapeUrl(spec);if(url===void 0){derived!==void 0&&echoesDerived(spec,derived)?stamp(ctx,server):dropLabel(server);return}if(derived!==void 0&&derived.url===url){applyCompletion(spec,derived.variable,derived.description),stamp(ctx,server);return}if(await probe(url,spec,deps)!=="oauth"){dropLabel(server);return}let variable=accessTokenVariable(server.metadata?.slug??"");applyCompletion(spec,variable,tokenDescription(server.metadata?.slug??"")),stamp(ctx,server)}}}function authorShapeUrl(spec){if(spec.serverType.case==="http"&&spec.auth===void 0&&!(Object.keys(spec.env).length>0)){for(let[name,value]of Object.entries(spec.serverType.value.headers))if(name.toLowerCase()===AUTHORIZATION_HEADER||value.includes("${"))return;return spec.serverType.value.url}}function derivedCompletionOf(existing){if(existing.metadata?.labels[MCP_AUTH_LABEL]!==MCP_AUTH_ENDPOINT)return;let spec=existing.spec;if(spec===void 0||spec.serverType.case!=="http")return;let variable=spec.auth?.targetEnvVar??"";if(variable!=="")return{url:spec.serverType.value.url,variable,description:spec.env[variable]?.description??""}}function echoesDerived(spec,derived){if(spec.serverType.case!=="http"||spec.serverType.value.url!==derived.url)return!1;let auth=spec.auth;if(auth===void 0||auth.targetEnvVar!==derived.variable||!auth.oauthOnly||(auth.oauthAppRef?.slug??"")!==""||auth.discoveryUrl!==""||auth.scopeHints.length>0||auth.tokenLifetimeHint!=="")return!1;let envKeys=Object.keys(spec.env);if(envKeys.length!==1||envKeys[0]!==derived.variable)return!1;let declaration=spec.env[derived.variable];if(declaration===void 0||!declaration.isSecret||declaration.optional)return!1;let headers2=Object.entries(spec.serverType.value.headers),authorization=headers2.filter(([name])=>name.toLowerCase()===AUTHORIZATION_HEADER);return authorization.length!==1||authorization[0]?.[1]!==bearerHeader(derived.variable)?!1:headers2.every(([name,value])=>name.toLowerCase()===AUTHORIZATION_HEADER||!value.includes("${"))}function applyCompletion(spec,variable,description){spec.auth=create2(McpServerAuthSchema,{targetEnvVar:variable,oauthOnly:!0}),spec.env[variable]=create2(EnvVarDeclarationSchema,{isSecret:!0,optional:!1,description}),applyTokenPathDefault(spec,"")}function applyTokenPathDefault(spec,slug){let variable=spec.auth?.targetEnvVar??"";if(variable===""||(spec.env[variable]===void 0&&(spec.env[variable]=create2(EnvVarDeclarationSchema,{isSecret:!0,optional:!1,description:tokenDescription(slug)})),spec.serverType.case!=="http"))return;let headers2=spec.serverType.value.headers,reference=`\${${variable}}`;Object.values(headers2).some(value=>value.includes(reference))||(headers2.Authorization=bearerHeader(variable))}function bearerHeader(variable){return`Bearer \${${variable}}`}function accessTokenVariable(slug){let stem=slug.toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/^_+|_+$/g,"");return`${stem===""?"MCP":stem}${ACCESS_TOKEN_VAR_SUFFIX}`}function tokenDescription(slug){return`OAuth access token for the '${slug}' MCP server; Sign in fills it`}function stamp(ctx,server){server.metadata!==void 0&&(server.metadata.labels[MCP_AUTH_LABEL]=MCP_AUTH_ENDPOINT,recordServerStampedReservedLabels(ctx,MCP_AUTH_LABEL))}function dropLabel(server){server.metadata!==void 0&&delete server.metadata.labels[MCP_AUTH_LABEL]}async function probe(url,spec,deps){let headers2=spec.serverType.case==="http"?spec.serverType.value.headers:{};try{let outcome=await probeEndpointAuth(url,headers2,{fetchImpl:deps.outboundFetch,timeoutMs:ENDPOINT_PROBE_TIMEOUT_MS,clientName:PROBE_CLIENT_NAME});return outcome.kind==="unreachable"&&deps.logger.debug("MCP endpoint probe got no answer; saving the spec as sent",{url,error:outcome.error}),outcome.kind==="oauth"?"oauth":"other"}catch(error2){return deps.logger.warn("MCP endpoint probe threw; saving the spec as sent",{url,error:error2 instanceof Error?error2.message:String(error2)}),"other"}}async function getOAuthGrantStatus(deps,input,identity2){if(input.resourceId==="")throw invalidArgumentError("resource_id is required");if(input.org==="")throw invalidArgumentError("org is required");await authorizeDirect(McpServerQueryController.method.getOAuthGrantStatus,deps.authorizer,identity2,input);let grant;try{grant=await deps.oauthGrants.find("",input.resourceId,input.org)}catch(error2){throw internalError(error2,"failed to look up OAuth grant")}return grant===void 0?create2(GetOAuthGrantStatusOutputSchema,{connected:!1,connectionHealth:OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_NO_GRANT}):create2(GetOAuthGrantStatusOutputSchema,{connected:!0,accessTokenExpiresAt:BigInt(grant.accessTokenExpiresAt),targetEnvVar:grant.accessTokenEnvVar,authMethod:grant.authMethod,connectionHealth:evaluateHealth(grant)})}function evaluateHealth(grant){return grant.accessTokenExpiresAt===0?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY:Math.floor(Date.now()/1e3)<grant.accessTokenExpiresAt-REFRESH_EXPIRY_BUFFER_SECONDS?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY:grant.refreshTokenEnvVar!==""?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE:OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED}var import_node_crypto24=require("node:crypto");var import_node_crypto23=require("node:crypto");function generatePkce(){let verifier=(0,import_node_crypto23.randomBytes)(32).toString("base64url"),challenge=(0,import_node_crypto23.createHash)("sha256").update(verifier).digest().toString("base64url");return{codeVerifier:verifier,codeChallenge:challenge}}var DISCOVERY_REQUEST_TIMEOUT_MS=1e4;async function discoverForResource(mcpUrl,fetchImpl){let resource=parseDiscoveryUrl(mcpUrl),deps={fetchImpl,timeoutMs:DISCOVERY_REQUEST_TIMEOUT_MS},resolved=await resolveAuthorizationServers(resource.href,void 0,deps),issuers=resolved.issuers.length>0?resolved.issuers:[resource.origin];return readIssuers(issuers,deps)}async function discoverAtIssuer(issuerUrl,fetchImpl){let issuer=parseDiscoveryUrl(issuerUrl);return readIssuers([issuer.href],{fetchImpl,timeoutMs:DISCOVERY_REQUEST_TIMEOUT_MS})}async function readIssuers(issuers,deps){let attempts=[];for(let issuer of issuers){let read3=await readAuthorizationServerMetadata(issuer,deps);if(attempts.push(...read3.attempts),read3.kind==="found"){let metadata=toAuthServerMetadata(read3.metadata);return validateMetadata(metadata,read3.metadata.metadataUrl),metadata}}throw discoveryFailure(issuers,attempts)}function toAuthServerMetadata(m3){return{issuer:m3.issuer,authorizationEndpoint:m3.authorizationEndpoint,tokenEndpoint:m3.tokenEndpoint,registrationEndpoint:m3.registrationEndpoint,scopesSupported:[...m3.scopesSupported],codeChallengeMethodsSupported:[...m3.codeChallengeMethodsSupported]}}function discoveryFailure(issuers,attempts){let firstIssuer=issuers[0]??"",named=firstDocumentFor(firstIssuer),attempt=attempts.find(a5=>a5.url===named)??attempts[0];if(attempt?.error!==void 0)return new Error(`discovery request to ${attempt.url} failed: ${attempt.error}`);if(attempt?.missing!==void 0)return new Error(`authorization server at ${attempt.url} is missing ${attempt.missing}`);let status=attempt?.status??0;return new Error(`authorization server discovery failed: ${named} returned HTTP ${status} (expected 200). This MCP server may not support the MCP Authorization specification`)}function firstDocumentFor(issuer){try{return authorizationServerMetadataUrls(new URL(issuer))[0]??issuer}catch{return issuer}}function parseDiscoveryUrl(serverUrl){let parsed;try{parsed=new URL(serverUrl)}catch(error2){throw new Error(`invalid server URL for discovery: ${error2 instanceof Error?error2.message:String(error2)}`)}let scheme=parsed.protocol.replace(/:$/,"");if(scheme!=="http"&&scheme!=="https")throw new Error(`invalid server URL for discovery: unsupported scheme "${scheme}": only http and https are supported`);if(parsed.host==="")throw new Error("invalid server URL for discovery: server URL has no host");return parsed}function validateMetadata(m3,sourceUrl){if(m3.authorizationEndpoint==="")throw new Error(`authorization server at ${sourceUrl} is missing authorization_endpoint`);if(m3.tokenEndpoint==="")throw new Error(`authorization server at ${sourceUrl} is missing token_endpoint`);if(m3.codeChallengeMethodsSupported.length>0&&!m3.codeChallengeMethodsSupported.includes("S256"))throw new Error(`authorization server at ${sourceUrl} does not support S256 PKCE (supports: [${m3.codeChallengeMethodsSupported.join(" ")}]). S256 is required by the MCP Authorization specification`)}var DCR_REQUEST_TIMEOUT_MS=15e3;async function registerClient(registrationEndpoint,redirectUri,clientName,fetchImpl){let requestBody=JSON.stringify({redirect_uris:[redirectUri],client_name:clientName,grant_types:["authorization_code"],response_types:["code"],token_endpoint_auth_method:"none"}),response;try{response=await fetchImpl(registrationEndpoint,{method:"POST",headers:{"Content-Type":"application/json",Accept:"application/json"},body:requestBody,signal:AbortSignal.timeout(DCR_REQUEST_TIMEOUT_MS)})}catch(error2){throw new Error(`DCR request to ${registrationEndpoint} failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let body=await response.text();if(response.status!==201&&response.status!==200)throw new Error(`DCR at ${registrationEndpoint} returned HTTP ${response.status}: ${truncateBody(body)}`);let raw;try{raw=JSON.parse(body)}catch(error2){throw new Error(`failed to parse DCR response: ${error2 instanceof Error?error2.message:String(error2)}`)}if((raw.client_id??"")==="")throw new Error(`DCR response from ${registrationEndpoint} is missing client_id`);return{clientId:raw.client_id,clientSecret:raw.client_secret??"",clientName:raw.client_name??"",tokenEndpointAuthMethod:raw.token_endpoint_auth_method??""}}var PREFLIGHT_REQUEST_TIMEOUT_MS=4e3,PREFLIGHT_BODY_READ_CAP=4096;async function preflightAuthorize(authorizationUrl,fetchImpl){let response=await fetchImpl(authorizationUrl,{method:"GET",redirect:"manual",signal:AbortSignal.timeout(PREFLIGHT_REQUEST_TIMEOUT_MS)});if(response.status!==400){await response.text().catch(()=>"");return}let body=(await response.text()).slice(0,PREFLIGHT_BODY_READ_CAP);return{statusCode:response.status,vendorDetail:extractVendorDetail(body),bodySnippet:truncateBody(body)}}function extractVendorDetail(body){let parsed;try{parsed=JSON.parse(body)}catch{return""}return(parsed.error_description??"")!==""?parsed.error_description:parsed.error??""}async function initiateOAuthConnect(deps,input,identity2){if(deps.oauthRedirectUri==="")throw failedPreconditionError("OAuth Connect is not configured: STIGMER_OAUTH_REDIRECT_URI is not set");let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.initiateOAuthConnect,deps.authorizer,identity2,input);let auth=mcpServer.spec?.auth;if(auth===void 0)throw failedPreconditionError(`MCP server '${mcpServerId}' does not have an auth block configured`);let pkcePair=generatePkce(),stateParam=generateState(),oauthAppRef=auth.oauthAppRef,isDcr=oauthAppRef===void 0||oauthAppRef.slug==="",result=isDcr?await initiateDcr(deps,mcpServer,pkcePair,stateParam):await initiateVendorOAuth(deps,mcpServer,pkcePair,stateParam),authMethod=isDcr?"mcp_oauth":"vendor_oauth",pendingState={state:stateParam,codeVerifier:pkcePair.codeVerifier,clientId:result.clientId,clientSecret:result.clientSecret,tokenEndpoint:result.tokenEndpoint,mcpServerId,identityAccountId:"",targetEnvVar:auth.targetEnvVar,authMethod,tokenAuthMethod:result.tokenAuthMethod,redirectUri:deps.oauthRedirectUri,org:input.org,createdAt:0},sealed;try{sealed=await sealPendingOAuthState(deps.secretService,deps.logger,pendingState)}catch(error2){throw internalError(error2,"failed to encrypt OAuth handshake secrets")}try{await deps.pendingOAuthStates.save(sealed)}catch(error2){throw internalError(error2,"failed to save pending OAuth state")}return deps.logger.info("Initiated OAuth Connect flow",{mcp_server_id:mcpServerId,auth_method:authMethod,provider:result.providerName}),create2(InitiateOAuthConnectOutputSchema,{authorizationUrl:result.authorizationUrl,state:stateParam,scopes:result.scopes,providerName:result.providerName})}async function initiateDcr(deps,mcpServer,pkcePair,stateParam){let discoveryUrl2=mcpServer.spec?.auth?.discoveryUrl??"",serverType=mcpServer.spec?.serverType,resourceUrl=serverType?.case==="http"?serverType.value.url:"",serverUrl=discoveryUrl2!==""?discoveryUrl2:resourceUrl;if(serverUrl==="")throw failedPreconditionError(`DCR requires a discoverable URL. MCP server '${mcpServer.metadata?.id??""}' has no http.url and no auth.discovery_url. Set auth.discovery_url for stdio servers, oauth_app_ref for vendor OAuth, or switch to HTTP transport`);let metadata;try{metadata=discoveryUrl2!==""?await discoverAtIssuer(discoveryUrl2,deps.outboundFetch):await discoverForResource(resourceUrl,deps.outboundFetch)}catch(error2){throw failedPreconditionError(`OAuth authorization server discovery failed for ${serverUrl}: ${error2 instanceof Error?error2.message:String(error2)}`)}if(metadata.registrationEndpoint==="")throw failedPreconditionError(`MCP server at ${serverUrl} does not advertise a registration_endpoint for DCR: ${loginServerHost(metadata,serverUrl)} does not allow automatic client registration, so this server needs an OAuth app registered with the vendor and referenced from its definition (auth.oauth_app_ref)`);let clientName=`Stigmer (${mcpServer.metadata?.name??""})`,dcrResponse;try{dcrResponse=await registerClient(metadata.registrationEndpoint,deps.oauthRedirectUri,clientName,deps.outboundFetch)}catch(error2){throw failedPreconditionError(`DCR registration failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let scopes=mcpServer.spec?.auth?.scopeHints??[];scopes.length===0&&metadata.scopesSupported.length>0&&(scopes=metadata.scopesSupported);let authUrl=buildAuthorizationUrl(metadata.authorizationEndpoint,dcrResponse.clientId,deps.oauthRedirectUri,pkcePair.codeChallenge,stateParam,scopes,"scope"),rejection;try{rejection=await preflightAuthorize(authUrl,deps.outboundFetch)}catch(probeError){deps.logger.debug("authorize pre-flight probe inconclusive; proceeding",{mcp_server_id:mcpServer.metadata?.id??"",error:probeError instanceof Error?probeError.message:String(probeError)})}if(rejection!==void 0)throw deps.logger.warn("authorization endpoint rejected the sign-in request pre-flight",{status_code:rejection.statusCode,mcp_server_id:mcpServer.metadata?.id??"",body_snippet:rejection.bodySnippet}),failedPreconditionError(dcrRejectionMessage(mcpServer.metadata?.name??"",deps.oauthRedirectUri,rejection));return{authorizationUrl:authUrl,providerName:mcpServer.metadata?.name??"",scopes,clientId:dcrResponse.clientId,clientSecret:"",tokenEndpoint:metadata.tokenEndpoint,tokenAuthMethod:""}}function loginServerHost(metadata,serverUrl){for(let candidate of[metadata.issuer,metadata.authorizationEndpoint,serverUrl])try{let host=new URL(candidate).host;if(host!=="")return host}catch{}return serverUrl}async function initiateVendorOAuth(deps,mcpServer,pkcePair,stateParam){let ref=mcpServer.spec?.auth?.oauthAppRef,oauthApp;try{oauthApp=await resolveOAuthAppRef(deps.store,ref,deps.logger)}catch(error2){throw internalError(error2,"failed to list oauth apps")}if(oauthApp===void 0)throw notFoundError("oauth_app",ref?.slug??"");let approvalStatus=oauthApp.spec?.vendorApprovalStatus;if(approvalStatus===VendorApprovalStatus.PENDING||approvalStatus===VendorApprovalStatus.REJECTED){let statusLabel=approvalStatus===VendorApprovalStatus.REJECTED?"rejected":"pending approval",alternative=mcpServer.spec?.auth?.oauthOnly?"This server only accepts OAuth sign-in; an org admin can configure your own OAuth app instead.":"Please enter a token manually instead.";throw failedPreconditionError(`OAuth sign-in is unavailable: the platform's OAuth app for '${oauthApp.spec?.provider??""}' is ${statusLabel} by the vendor. ${alternative}`)}let clientSecret=oauthApp.spec?.clientSecret??"";if(deps.secretService.isEncrypted(clientSecret))try{clientSecret=await deps.secretService.decrypt(clientSecret)}catch(error2){throw internalError(error2,"failed to decrypt OAuthApp client secret")}let scopes=oauthApp.spec?.scopes??[];return{authorizationUrl:buildAuthorizationUrl(oauthApp.spec?.authorizationUrl??"",oauthApp.spec?.clientId??"",deps.oauthRedirectUri,pkcePair.codeChallenge,stateParam,scopes,oauthApp.spec?.scopeParameterName??""),providerName:oauthApp.spec?.provider??"",scopes,clientId:oauthApp.spec?.clientId??"",clientSecret,tokenEndpoint:oauthApp.spec?.tokenUrl??"",tokenAuthMethod:tokenAuthMethodFromSpec(oauthApp.spec?.tokenEndpointAuthMethod??TokenEndpointAuthMethod.UNSPECIFIED)}}function buildAuthorizationUrl(authEndpoint,clientId,redirectUri,codeChallenge,state2,scopes,scopeParamName){let scopeParam=scopeParamName===""?"scope":scopeParamName,params=new URLSearchParams({response_type:"code",client_id:clientId,redirect_uri:redirectUri,code_challenge:codeChallenge,code_challenge_method:"S256",state:state2});scopes.length>0&&params.set(scopeParam,scopes.join(" ")),params.sort();let separator=authEndpoint.includes("?")?"&":"?";return authEndpoint+separator+params.toString()}function dcrRejectionMessage(providerName,redirectUri,rejection){let callbackHost=redirectUri;try{let parsed=new URL(redirectUri);parsed.host!==""&&(callbackHost=parsed.host)}catch{}let message6=`${providerName} rejected the sign-in request before showing a login page (HTTP ${rejection.statusCode}). The most common cause is a redirect-host allowlist: this deployment's OAuth callback host (${callbackHost}) is not on the provider's approved list. Self-hosted deployments with a localhost callback are typically unaffected.`;return rejection.vendorDetail!==""&&(message6+=" Provider detail: "+rejection.vendorDetail),message6}function generateState(){return(0,import_node_crypto24.randomBytes)(32).toString("base64url")}async function sealPendingOAuthState(secretService,logger2,state2){if(!secretService.isEnabled())return logger2.warn("Encryption disabled: pending OAuth state secrets will be stored in plaintext"),state2;let scope=EncryptionScope.forOrganization(state2.org),sealedVerifier;try{sealedVerifier=await secretService.encrypt(state2.codeVerifier,scope)}catch(error2){throw new Error(`failed to encrypt code_verifier: ${error2 instanceof Error?error2.message:String(error2)}`)}let sealedSecret=state2.clientSecret;if(state2.clientSecret!=="")try{sealedSecret=await secretService.encrypt(state2.clientSecret,scope)}catch(error2){throw new Error(`failed to encrypt client_secret: ${error2 instanceof Error?error2.message:String(error2)}`)}return{...state2,codeVerifier:sealedVerifier,clientSecret:sealedSecret}}var mcpServerSearchExtractor={kind:ApiResourceKind.mcp_server,schema:McpServerSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let mcpServer=resource;return buildSearchResult({kind:ApiResourceKind.mcp_server,metadata:mcpServer.metadata,summary:mcpServer.spec?.description??"",score,createdAt:mcpServer.status?.audit?.specAudit?.createdAt,updatedAt:mcpServer.status?.audit?.specAudit?.updatedAt,iconUrl:mcpServer.spec?.iconUrl??""})},getSearchIndexEntry(resource){let mcpServer=resource,metadata=mcpServer.metadata;if(metadata!==void 0)return{name:metadata.name,description:mcpServer.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(mcpServer.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var RUNNER_QUEUE_WARNING="no runner appears to be polling the task queue \u2014 the connect will wait for one to come up (start your local runner if it is not running)";async function startConnect(deps,input,identity2){let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");if(input.org==="")throw invalidArgumentError("org is required for connect");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.startConnect,deps.authorizer,identity2,input);let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError("connect is not available: Temporal not configured");let connectStatus=mcpServer.status?.connectStatus;if(connectStatus?.phase===ConnectPhase.connecting&&await engineState.engine.isConnectRunRunning(connectStatus.workflowId))return deps.logger.info("StartConnect attached to in-flight connect operation",{mcp_server_id:mcpServerId,workflow_id:connectStatus.workflowId}),mcpServer;let prepared=await prepareConnect(deps,mcpServer,input,identity2),warning2=await runnerQueueWarning(engineState.engine),run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,prepared.workflowInput,ASYNC_CONNECT_TIMEOUT.ms)}catch(error2){throw prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId),deps.logger.error("Failed to start MCP connect workflow",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to start connect workflow")}if(run.attached){prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId);try{return await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}}let persisted;try{persisted=await persistConnectStarting(deps.store,mcpServerId,run.workflowId,warning2)}catch(error2){throw detachSettle(deps,mcpServer,run,prepared),internalError(error2,"failed to record connect operation")}return detachSettle(deps,mcpServer,run,prepared),persisted}function detachSettle(deps,mcpServer,run,prepared){settleConnectAsync(deps,mcpServer,run,prepared.ecResourceId,prepared.executionId).catch(error2=>{deps.logger.warn("Async connect settle task failed unexpectedly",{mcp_server_id:mcpServer.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})})}async function settleConnectAsync(deps,mcpServer,run,ecResourceId,executionId){let mcpServerId=mcpServer.metadata?.id??"";try{let outcome=await run.result(ASYNC_CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,ASYNC_CONNECT_TIMEOUT);await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure);return}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){if(error2 instanceof ResourceNotFoundError){deps.logger.info("Skipping async connect persistence: MCP server deleted before connect completed",{mcp_server_id:mcpServerId});return}deps.logger.warn("Failed to persist async connect result",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.info("Async MCP server connect completed and stored",{workflow_id:run.workflowId,mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount})}finally{ecResourceId!==""&&await deleteConnectExecutionContext(deps,ecResourceId,executionId)}}async function runnerQueueWarning(engine){let hasPollers=await engine.hasRunnerQueuePollers();return hasPollers===void 0||hasPollers?"":RUNNER_QUEUE_WARNING}function newValidateDefaultEnabledToolsStep(){return{name:"ValidateDefaultEnabledTools",execute(ctx){let mcpServer=ctx.newState,requested=mcpServer.spec?.defaultEnabledTools??[];if(requested.length===0)return;let caps=mcpServer.status?.discoveredCapabilities;if(caps===void 0)return;let classification=classify(caps,requested);if(isValidClassification(classification))return;let problems=[];throw classification.unknown.length>0&&problems.push(`default_enabled_tools names tool(s) this server does not expose: ${quoteJoin(classification.unknown)}`),classification.resourceTemplates.length>0&&problems.push(`default_enabled_tools names resource template(s): ${quoteJoin(classification.resourceTemplates)} \u2014 resource templates are read-only data endpoints, not callable tools, and must not appear in default_enabled_tools`),invalidArgumentError(`MCP server '${mcpServer.metadata?.slug??""}': ${problems.join("; ")}. Discovered tools: ${quoteJoin(toolNames(caps))}. If the server's toolset changed, run 'stigmer connect' on it to refresh discovered capabilities.`)}}}function newEnrichOAuthStatusStep(store,logger2){return{name:"EnrichOAuthStatus",async execute(ctx){let mcpServer=ctx.get(TARGET_RESOURCE_KEY);if(mcpServer===void 0)return;let ref=mcpServer.spec?.auth?.oauthAppRef;if((ref?.slug??"")==="")return;let oauthApp;try{oauthApp=await resolveOAuthAppRef(store,ref,logger2)}catch(error2){logger2.warn("OAuthApp lookup failed; returning MCP server without oauth_status enrichment",{mcpServerId:mcpServer.metadata?.id??"",oauthAppSlug:ref?.slug??"",error:error2 instanceof Error?error2.message:String(error2)});return}if(oauthApp===void 0){logger2.debug("OAuthApp not found for ref; skipping oauth_status enrichment",{mcpServerId:mcpServer.metadata?.id??"",oauthAppSlug:ref?.slug??""});return}let approvalStatus=oauthApp.spec?.vendorApprovalStatus??VendorApprovalStatus.UNSPECIFIED,docsUrl=oauthApp.spec?.vendorApprovalDocsUrl??"";approvalStatus===VendorApprovalStatus.UNSPECIFIED&&docsUrl===""||(mcpServer.status??=create2(McpServerStatusSchema,{}),mcpServer.status.oauthStatus=create2(OAuthStatusSchema,{vendorApprovalStatus:approvalStatus,vendorApprovalDocsUrl:docsUrl}))}}}function registerMcpServerServices(router,deps){router.service(McpServerCommandController,{apply:(server,ctx)=>apply11(deps,server,ctx),create:(server,ctx)=>createMcpServer(deps,server,ctx),update:(server,ctx)=>update14(deps,server,ctx),updateVisibility:(input,ctx)=>updateVisibility4(deps,input,ctx),delete:(input,ctx)=>deleteMcpServer(deps,input,ctx),connect:(input,ctx)=>connect(deps.connect,input,callerIdentityOf(ctx)),startConnect:(input,ctx)=>startConnect(deps.connect,input,callerIdentityOf(ctx)),initiateOAuthConnect:(input,ctx)=>initiateOAuthConnect(deps.connect,input,callerIdentityOf(ctx)),completeOAuthConnect:(input,ctx)=>completeOAuthConnect(deps.connect,input,callerIdentityOf(ctx)),disconnectOAuth:(input,ctx)=>disconnectOAuth(deps.connect,input,callerIdentityOf(ctx)),setOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("SetOrgOAuthApp")},deleteOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("DeleteOrgOAuthApp")}}),router.service(McpServerQueryController,{get:(id,ctx)=>get19(deps,id,ctx),getByReference:(ref,ctx)=>getByReference11(deps,ref,ctx),getOAuthGrantStatus:(input,ctx)=>getOAuthGrantStatus(deps.connect,input,callerIdentityOf(ctx)),getOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("GetOrgOAuthApp")}})}function orgOAuthAppUnimplemented(method){return new ConnectError(`method ${method} not implemented`,Code.Unimplemented)}function kindOf18(ctx){return ctx.values.get(apiResourceKindKey)}function endpointAuthDeps(deps){return{outboundFetch:deps.connect.outboundFetch,logger:deps.logger}}async function createMcpServer(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-create",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newCompleteEndpointAuthStep(endpointAuthDeps(deps))).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,mcpServerSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update14(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-update",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newCompleteEndpointAuthStep(endpointAuthDeps(deps))).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newValidateDefaultEnabledToolsStep()).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,mcpServerSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply11(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf18(ctx));await newPipeline("mcpserver-apply",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");let result=shouldCreate?await createMcpServer(deps,server,ctx):await update14(deps,withResolvedApplyId(McpServerSchema,server,reqCtx),ctx);return startBestEffortConnect(deps.connect,result).catch(error2=>{deps.logger.warn("Best-effort connect task failed unexpectedly",{mcp_server_id:result.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}),result}async function deleteMcpServer(deps,input,ctx){let reqCtx=new RequestContext(McpServerCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf18(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("mcpserver-delete",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,McpServerSchema)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted mcp server not found in context"),"deleted mcp server not found in context");return deleted}var UPDATE_VISIBILITY_MCP_SERVER_KEY="updateVisibilityMcpServer";async function updateVisibility4(deps,input,ctx){let reqCtx=new RequestContext(McpServerCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-update-visibility",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadMcpServerForVisibilityUpdateStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store,{existingKey:UPDATE_VISIBILITY_MCP_SERVER_KEY})).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_MCP_SERVER_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newSetMcpServerVisibilityStep()).addStep(newPersistMcpServerForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_MCP_SERVER_KEY)).addStep(newIndexMcpServerAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY)}function newLoadMcpServerForVisibilityUpdateStep(store){return{name:"LoadMcpServerForVisibilityUpdate",async execute(ctx){let input=ctx.input,mcpServer;try{mcpServer=await store.getResource(ctx.apiResourceKind,input.resourceId,McpServerSchema)}catch{throw notFoundError("mcp_server",input.resourceId)}ctx.set(UPDATE_VISIBILITY_MCP_SERVER_KEY,mcpServer)}}}function newSetMcpServerVisibilityStep(){return{name:"SetMcpServerVisibility",execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY);mcpServer.metadata!==void 0&&(mcpServer.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(McpServerSchema,mcpServer,"status_audit",ctx.callerIdentity)}}}function newPersistMcpServerForVisibilityUpdateStep(store){return{name:"PersistMcpServerForVisibilityUpdate",async execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY);try{await store.saveResource(ctx.apiResourceKind,mcpServer.metadata?.id??"",McpServerSchema,mcpServer)}catch(error2){throw internalError(error2,"failed to save mcp server")}}}}function newIndexMcpServerAfterVisibilityUpdateStep(store,logger2){return{name:"IndexMcpServerAfterVisibilityUpdate",async execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY),entry=mcpServerSearchExtractor.getSearchIndexEntry(mcpServer);if(entry===void 0){logger2.warn("IndexMcpServerAfterVisibilityUpdate: extractor returned nil, skipping",{id:mcpServer.metadata?.id??""});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,mcpServer.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexMcpServerAfterVisibilityUpdate: failed (best-effort)",{id:mcpServer.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function get19(deps,id,ctx){let reqCtx=new RequestContext(McpServerQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-get",deps.logger).addStep(newAuthorizeStep(McpServerQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,McpServerSchema)).addStep(newEnrichOAuthStatusStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference11(deps,ref,ctx){let reqCtx=new RequestContext(McpServerQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-get-by-reference",deps.logger).addStep(newAuthorizeStep(McpServerQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,McpServerSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(McpServerQueryController.method.get))).addStep(newEnrichOAuthStatusStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}function registerPlatformServices(router,deps){router.service(PlatformQueryController,{getServerInfo:()=>getServerInfo(deps),getLicenseStatus:()=>getLicenseStatus(deps),getRunnerBootstrapConfig:(_input,ctx)=>getRunnerBootstrapConfig(deps,ctx),getRunnerScopedToken:(input,ctx)=>getRunnerScopedToken(deps,input,ctx)})}function getServerInfo(deps){return create2(GetServerInfoOutputSchema,{edition:deps.edition,version:deps.version,authenticationRequired:deps.authenticationRequired})}async function getLicenseStatus(deps){let now=deps.now(),report=await deps.licenseStatus.status(now),output=create2(GetLicenseStatusOutputSchema,{state:report.state,checkedAt:timestampFromDate(now)});switch(report.state){case LicenseState.absent:return output;case LicenseState.invalid:return output.keyId=report.keyId,output;case LicenseState.valid:case LicenseState.expiring:case LicenseState.grace:case LicenseState.expired:return output.keyId=report.keyId,output.claims=report.claims,output;default:{let exhaustive=report;throw new Error(`unhandled license report: ${JSON.stringify(exhaustive)}`)}}}async function getRunnerBootstrapConfig(deps,ctx){let output=create2(GetRunnerBootstrapConfigOutputSchema,{temporalAddress:deps.temporalHostPort,temporalNamespace:deps.temporalNamespace}),bootstrapCredentials=deps.runnerAuthService.bootstrapCredentials?.bind(deps.runnerAuthService);if(bootstrapCredentials===void 0)return output;try{let credentials=await bootstrapCredentials(callerIdentityOf(ctx));credentials.accessToken!==void 0&&(output.runnerAccessToken=credentials.accessToken.token,output.tokenType="Bearer",output.runnerAccessTokenExpiresInSeconds=credentials.accessToken.expiresInSeconds),credentials.payloadKeys!==void 0&&(output.payloadEncryptionKey=credentials.payloadKeys.keyBase64,output.payloadEncryptionKeyId=credentials.payloadKeys.keyId,output.payloadEncryptionSecondaryKey=credentials.payloadKeys.secondaryKeyBase64??"",output.payloadEncryptionSecondaryKeyId=credentials.payloadKeys.secondaryKeyId??"")}catch(error2){deps.logger.warn("Bootstrap credentials unavailable \u2014 answering coordinates without them",{error:error2 instanceof Error?error2.message:String(error2)})}return output}async function getRunnerScopedToken(deps,input,ctx){let exchange=deps.runnerAuthService.exchangeScopedToken?.bind(deps.runnerAuthService);if(exchange!==void 0){let minted=await exchange(exchangeRequestOf(input),callerIdentityOf(ctx));return minted.minted?create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.expiresInSeconds}):create2(GetRunnerScopedTokenOutputSchema)}let executionId;switch(input.scope.case){case"agentExecutionId":executionId=input.scope.value;break;case"workflowExecutionId":executionId=input.scope.value;break;case"poolClaim":case"renewal":case void 0:return create2(GetRunnerScopedTokenOutputSchema);default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}if(executionId===""||!deps.runnerAuthService.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))return create2(GetRunnerScopedTokenOutputSchema);try{let minted=deps.runnerAuthService.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.ttlSeconds})}catch(error2){return deps.logger.warn("failed to mint runner scoped token \u2014 answering not-minted",{executionId,error:error2 instanceof Error?error2.message:String(error2)}),create2(GetRunnerScopedTokenOutputSchema)}}function exchangeRequestOf(input){switch(input.scope.case){case"agentExecutionId":return{arm:"agent-execution",executionId:input.scope.value};case"workflowExecutionId":return{arm:"workflow-execution",executionId:input.scope.value};case"poolClaim":return{arm:"pool-claim",sessionId:input.scope.value.sessionId};case"renewal":return{arm:"renewal"};case void 0:return{arm:"unset"};default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}}var SERVER_VERSION="3.34.0";var file_ai_stigmer_agentic_session_v1_io=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9pby5wcm90bxIdYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEiIgoJU2Vzc2lvbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiIAoHQWdlbnRJZBIVCgV2YWx1ZRgBIAEoCUIGukgDyAEBInQKC1Nlc3Npb25MaXN0EhMKC3RvdGFsX3BhZ2VzGAEgASgFEjcKB2VudHJpZXMYAiADKAsyJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uEhcKD25leHRfcGFnZV90b2tlbhgDIAEoCSJgChNMaXN0U2Vzc2lvbnNSZXF1ZXN0EhoKCXBhZ2Vfc2l6ZRgBIAEoBUIHukgEGgIoABISCgpwYWdlX3Rva2VuGAIgASgJEgwKBHRhZ3MYAyADKAkSCwoDb3JnGAQgASgJIncKIkxpc3RTZXNzaW9uc0J5QWdlbnRJbnN0YW5jZVJlcXVlc3QSIQoRYWdlbnRfaW5zdGFuY2VfaWQYASABKAlCBrpIA8gBARIaCglwYWdlX3NpemUYAiABKAVCB7pIBBoCKAASEgoKcGFnZV90b2tlbhgDIAEoCSJqChxMaXN0U2Vzc2lvbnNCeUNoYW5uZWxSZXF1ZXN0EhoKCmNoYW5uZWxfaWQYASABKAlCBrpIA8gBARIaCglwYWdlX3NpemUYAiABKAVCB7pIBBoCKAASEgoKcGFnZV90b2tlbhgDIAEoCSJCChtVcGRhdGVTZXNzaW9uU3ViamVjdFJlcXVlc3QSEgoCaWQYASABKAlCBrpIA8gBARIPCgdzdWJqZWN0GAIgASgJYgZwcm90bzM",[file_ai_stigmer_agentic_session_v1_api,file_buf_validate_validate]),SessionIdSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_io,0);var SessionListSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_io,2);var file_ai_stigmer_agentic_session_v1_command=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9jb21tYW5kLnByb3RvEh1haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MTLtBQoYU2Vzc2lvbkNvbW1hbmRDb250cm9sbGVyElcKBWFwcGx5EiYuYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbhomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24SpQEKBmNyZWF0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24aJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uIkvCuBhHCAgQHiIMbWV0YWRhdGEub3JnKjN1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIHNlc3Npb24gaW4gdGhpcyBvcmdhbml6YXRpb24SjwEKBnVwZGF0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24aJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uIjXCuBgxCAIQKiILbWV0YWRhdGEuaWQqHnVuYXV0aG9yaXplZCB0byB1cGRhdGUgc2Vzc2lvbhKpAQoNdXBkYXRlU3ViamVjdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlVwZGF0ZVNlc3Npb25TdWJqZWN0UmVxdWVzdBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iNMK4GDAIAhAqIgJpZComdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBzZXNzaW9uIHN1YmplY3QSiwEKBmRlbGV0ZRIoLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iL8K4GCsIAxAqIgV2YWx1ZSoedW5hdXRob3JpemVkIHRvIGRlbGV0ZSBzZXNzaW9uGgSg/ysqYgZwcm90bzM",[file_ai_stigmer_agentic_session_v1_api,file_ai_stigmer_agentic_session_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SessionCommandController=serviceDesc(file_ai_stigmer_agentic_session_v1_command,0);var file_ai_stigmer_agentic_session_v1_query=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9xdWVyeS5wcm90bxIdYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEyoQQKFlNlc3Npb25RdWVyeUNvbnRyb2xsZXIShQEKA2dldBIoLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iLMK4GCgIARAqIgV2YWx1ZSobdW5hdXRob3JpemVkIHRvIGdldCBzZXNzaW9uEmwKBGxpc3QSMi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5MaXN0U2Vzc2lvbnNSZXF1ZXN0GiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbkxpc3QiBNC4GAESigEKE2xpc3RCeUFnZW50SW5zdGFuY2USQS5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5MaXN0U2Vzc2lvbnNCeUFnZW50SW5zdGFuY2VSZXF1ZXN0GiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbkxpc3QiBNC4GAESfgoNbGlzdEJ5Q2hhbm5lbBI7LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLkxpc3RTZXNzaW9uc0J5Q2hhbm5lbFJlcXVlc3QaKi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uTGlzdCIE0LgYARoEoP8rKmIGcHJvdG8z",[file_ai_stigmer_agentic_session_v1_api,file_ai_stigmer_agentic_session_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SessionQueryController=serviceDesc(file_ai_stigmer_agentic_session_v1_query,0);function runAgentInstanceDeniedMessage2(agentInstanceId){return`unauthorized to run agent instance '${agentInstanceId}'`}function sessionRunTarget(session){let agentInstanceId=session.spec?.agentInstanceId??"";if(agentInstanceId!=="")return{...RUN_GATE_CHECKS.agentInstance,resourceId:agentInstanceId,deniedMessage:runAgentInstanceDeniedMessage2(agentInstanceId)}}var sessionSearchExtractor={kind:ApiResourceKind.session,schema:SessionSchema,getSearchSummary(resource){return resource.spec?.subject??""},toSearchResult(resource,score){let session=resource;return buildSearchResult({kind:ApiResourceKind.session,metadata:session.metadata,summary:session.spec?.subject??"",score,createdAt:session.status?.audit?.specAudit?.createdAt,updatedAt:session.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let session=resource,metadata=session.metadata;if(metadata!==void 0)return{name:metadata.name,description:session.spec?.subject??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(session.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var SESSION_CHANNEL_ID_LABEL="stigmer.ai/channel-id",sessionListIndex=declareListIndex({kind:ApiResourceKind.session,schema:SessionSchema,revision:1,keys:{agent_instance:field2("spec.agent_instance_id"),channel:label(SESSION_CHANNEL_ID_LABEL)}});var LIST_RESULT_KEY8="listResult";function newValidateHarnessImmutabilityStep(){return{name:"ValidateHarnessImmutability",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0||existingSpec.harnessStateId==="")return;let inputSpec=ctx.input.spec;if(inputSpec===void 0)return;let existingHarness=existingSpec.harness,inputHarness=inputSpec.harness;if(existingHarness===Harness.UNSPECIFIED&&(existingHarness=Harness.NATIVE),inputHarness===Harness.UNSPECIFIED&&(inputHarness=Harness.NATIVE),inputHarness!==existingHarness)throw failedPreconditionError("session harness cannot be changed after the first execution \u2014 each harness owns its conversation state independently")}}}var EXECUTION_TARGET_GO_NAMES={[ExecutionTarget.UNSPECIFIED]:"EXECUTION_TARGET_UNSPECIFIED",[ExecutionTarget.LOCAL]:"EXECUTION_TARGET_LOCAL",[ExecutionTarget.CLOUD]:"EXECUTION_TARGET_CLOUD"};function newValidateExecutionTargetImmutabilityStep(temporalConfig){return{name:"ValidateExecutionTargetImmutability",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0||existingSpec.harnessStateId==="")return;let inputSpec=ctx.input.spec;if(inputSpec===void 0)return;let existingTarget=temporalConfig.resolveExecutionTarget(existingSpec.executionTarget),inputTarget=temporalConfig.resolveExecutionTarget(inputSpec.executionTarget);if(inputTarget!==existingTarget)throw failedPreconditionError(`session execution_target cannot be changed after the first execution (${EXECUTION_TARGET_GO_NAMES[existingTarget]} \u2192 ${EXECUTION_TARGET_GO_NAMES[inputTarget]}; unset resolves to the deployment default, ${temporalConfig.defaultExecutionTarget}) \u2014 workspace state may not be portable between local and cloud environments`)}}}function newRecordHarnessStateHistoryStep(){return{name:"RecordHarnessStateHistory",execute(ctx){let mergedSpec=ctx.newState.spec;if(mergedSpec===void 0)return;let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0||existing.spec===void 0)return;let existingSpec=existing.spec,history=[...existingSpec.harnessStateIdHistory],previousId=existingSpec.harnessStateId;previousId!==""&&previousId!==mergedSpec.harnessStateId&&!history.includes(previousId)&&history.push(previousId),mergedSpec.harnessStateIdHistory=history}}}function isActiveExecutionPhase(phase){switch(phase){case ExecutionPhase.EXECUTION_PENDING:case ExecutionPhase.EXECUTION_IN_PROGRESS:case ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL:case ExecutionPhase.EXECUTION_PAUSED:return!0;default:return!1}}async function listExecutionsBySession(store,logger2,sessionId){let rows;try{rows=await store.queryResources(agentExecutionListIndex,{anyKey:[{name:"session",value:sessionId}]})}catch(error2){throw internalError(error2,"failed to list agent executions")}let executions=[];for(let row of rows)try{executions.push(fromBinary2(AgentExecutionSchema,row.data))}catch(error2){logger2.warn("Failed to unmarshal execution, skipping",{error:error2 instanceof Error?error2.message:String(error2)})}return executions}function newRejectDeleteWithActiveExecutionsStep(store,logger2){return{name:"RejectDeleteWithActiveExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId),activeCount=0;for(let execution of executions)isActiveExecutionPhase(execution.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED)&&activeCount++;if(activeCount>0)throw failedPreconditionError(`session has ${activeCount} active execution(s); cancel them or wait for completion before deleting`)}}}function newCascadeDeleteAgentExecutionsStep(store,logger2){return{name:"CascadeDeleteAgentExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId);if(executions.length!==0){for(let execution of executions){let executionId=execution.metadata?.id??"";try{await store.deleteResource(ApiResourceKind.agent_execution,executionId)}catch(error2){throw internalError(error2,`failed to cascade-delete execution ${executionId} of session ${sessionId}`)}try{await store.deleteSearchIndex(ApiResourceKind.agent_execution,executionId)}catch(error2){logger2.warn("CascadeDeleteAgentExecutions: failed to remove search index entry (best-effort)",{executionId,error:error2 instanceof Error?error2.message:String(error2)})}}logger2.info("Cascade-deleted executions of session",{sessionId,count:executions.length})}}}}function requireSessionId(ctx){let sessionId=ctx.get(RESOURCE_ID_KEY);if(typeof sessionId!="string"||sessionId==="")throw internalError(new Error("session id not found in context (ExtractResourceId must run first)"),"session id not found in context (ExtractResourceId must run first)");return sessionId}function newListAllSessionsStep(store,logger2,listReadScope){return{name:"ListAllSessions",async execute(ctx){let input=ctx.input,page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{org:input.org},fingerprint:{lane:"session.list",org:input.org,tags:input.tags}});ctx.set(LIST_RESULT_KEY8,page)}}}function newFilterByAgentInstanceStep(store,logger2,listReadScope){return{name:"FilterByAgentInstance",async execute(ctx){let agentInstanceId=ctx.input.agentInstanceId;if(agentInstanceId==="")throw invalidArgumentError("agent_instance_id is required");let page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{anyKey:[{name:"agent_instance",value:agentInstanceId}]},fingerprint:{lane:"session.listByAgentInstance",agentInstanceId}});ctx.set(LIST_RESULT_KEY8,page)}}}function newAuthorizeChannelAccessStep(authorizer){return newAuthorizeResolvedTargetStep(authorizer,({input})=>input.channelId===""?[]:[{permission:IamPermission.can_view,resourceKind:ApiResourceKind.agent_channel,resourceId:input.channelId,deniedMessage:"unauthorized to list channel conversations"}],"AuthorizeChannelAccess")}function newFilterByChannelStep(store,logger2,listReadScope){return{name:"FilterByChannel",async execute(ctx){let channelId=ctx.input.channelId;if(channelId==="")throw invalidArgumentError("channel_id is required");let page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{anyKey:[{name:"channel",value:channelId}]},fingerprint:{lane:"session.listByChannel",channelId}});ctx.set(LIST_RESULT_KEY8,page)}}}async function readSessionPage(store,logger2,listReadScope,caller,request,lane){let page=await readListPage({store,declaration:sessionListIndex,query:lane.query,request,fingerprint:listPageFingerprint(lane.fingerprint),decode:data=>{try{return fromBinary2(SessionSchema,data)}catch(error2){logger2.warn("Failed to unmarshal session, skipping",{error:error2 instanceof Error?error2.message:String(error2)});return}},scope:sessions=>restrictListByReadScope(listReadScope,caller,ApiResourceKind.session,sessions,""),failure:"failed to list sessions"});return create2(SessionListSchema,{entries:page.entries,nextPageToken:page.nextPageToken,totalPages:page.nextPageToken===""?1:0})}function registerSessionServices(router,deps){router.service(SessionCommandController,{apply:(session,ctx)=>apply12(deps,session,ctx),create:(session,ctx)=>createSession(deps,session,ctx),update:(session,ctx)=>update15(deps,session,ctx),updateSubject:(req,ctx)=>updateSubject(deps,req,callerIdentityOf(ctx)),delete:(id,ctx)=>deleteSession(deps,id,ctx)}),router.service(SessionQueryController,{get:(id,ctx)=>get20(deps,id,ctx),list:(req,ctx)=>list10(deps,req,ctx),listByAgentInstance:(req,ctx)=>listByAgentInstance(deps,req,ctx),listByChannel:(req,ctx)=>listByChannel(deps,req,ctx)})}function kindOf19(ctx){return ctx.values.get(apiResourceKindKey)}async function createSession(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx)),builder2=newPipeline("session-create",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.create,deps.authorizer)).addStep(newAuthorizeRunTargetStep(deps.authorizer,sessionRunTarget)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store));for(let step of stepsForSlot(deps.gateSteps,"session-create:pre-side-effect-gate"))builder2.addStep(step);return await builder2.addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update15(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-update",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateHarnessImmutabilityStep()).addStep(newValidateExecutionTargetImmutabilityStep(deps.temporalConfig)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newRecordHarnessStateHistoryStep()).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply12(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("session-apply",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createSession(deps,session,ctx):update15(deps,withResolvedApplyId(SessionSchema,session,reqCtx),ctx)}async function deleteSession(deps,sessionId,ctx){let reqCtx=new RequestContext(SessionCommandController.method.delete.input,sessionId,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("session-delete",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,SessionSchema)).addStep(newRejectDeleteWithActiveExecutionsStep(deps.store,deps.logger)).addStep(newCascadeDeleteAgentExecutionsStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted session not found in context"),"deleted session not found in context");return await deprovisionSessionSandboxBestEffort(deps.sandboxLane,deps.logger,deleted.metadata?.id??""),deleted}async function updateSubject(deps,req,identity2){if(req.id==="")throw invalidArgumentError("id is required");let kind=ApiResourceKind.session,session;try{session=await deps.store.getResource(kind,req.id,SessionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("session",req.id):internalError(error2,"failed to load session")}await authorizeDirect(SessionCommandController.method.updateSubject,deps.authorizer,identity2,req),session.spec===void 0&&(session.spec=create2(SessionSpecSchema,{})),session.spec.subject=req.subject,setAuditFieldsForUpdate(SessionSchema,session,"spec_audit",identity2);try{await deps.store.saveResource(kind,req.id,SessionSchema,session)}catch(error2){throw internalError(error2,"failed to persist session")}return await indexSessionSearch(deps,kind,session),session}async function indexSessionSearch(deps,kind,session){let entry=sessionSearchExtractor.getSearchIndexEntry(session);if(entry!==void 0)try{await deps.store.upsertSearchIndex(kind,session.metadata?.id??"",entry)}catch(error2){deps.logger.warn("UpdateSubject: failed to update search index (best-effort)",{id:session.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}async function get20(deps,id,ctx){let reqCtx=new RequestContext(SessionQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-get",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,SessionSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function list10(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListAllSessionsStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}async function listByAgentInstance(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByAgentInstance.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list-by-agent-instance",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByAgentInstance,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newFilterByAgentInstanceStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}async function listByChannel(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByChannel.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list-by-channel",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByChannel,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeChannelAccessStep(deps.authorizer)).addStep(newFilterByChannelStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}function requireListResult2(result){if(result===void 0)throw internalError(new Error("session list not found in context"),"session list not found in context");return result}var file_ai_stigmer_agentic_plugin_v1_io=fileDesc("CiVhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2lvLnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxIiEKCFBsdWdpbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEi9wIKEVB1c2hQbHVnaW5SZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhAKCGFydGlmYWN0GAIgASgMEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYAyABKAkSUwoKdmlzaWJpbGl0eRgEIAEoDjI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVZpc2liaWxpdHlCCLpIBYIBAhABEg8KB21lc3NhZ2UYBSABKAk6twG6SLMBGrABCiNwdXNoX3BsdWdpbl9yZXF1ZXN0LmFydGlmYWN0X3NvdXJjZRJJZXhhY3RseSBvbmUgb2YgYXJ0aWZhY3QgKGlubGluZSBieXRlcykgb3IgYXJ0aWZhY3RfdXBsb2FkX3JlZiBtdXN0IGJlIHNldBo+KHRoaXMuYXJ0aWZhY3Quc2l6ZSgpID4gMCkgIT0gKHRoaXMuYXJ0aWZhY3RfdXBsb2FkX3JlZiAhPSAnJykiWAokQ3JlYXRlUGx1Z2luQXJ0aWZhY3RVcGxvYWRVcmxSZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhsKCnNpemVfYnl0ZXMYAiABKANCB7pIBCICIAAiWAoXUGx1Z2luQXJ0aWZhY3RVcGxvYWRVcmwSCwoDdXJsGAEgASgJEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYAiABKAkSEwoLdHRsX3NlY29uZHMYAyABKAUihQEKDFBsdWdpbk1lbWJlchJNCgRraW5kGAEgASgOMj8uYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUtpbmQSCgoCaWQYAiABKAkSDAoEc2x1ZxgDIAEoCRIMCgRuYW1lGAQgASgJIlgKGUxpc3RQbHVnaW5NZW1iZXJzUmVzcG9uc2USOwoHbWVtYmVycxgBIAMoCzIqLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luTWVtYmVyImsKF0xpc3RQbHVnaW5WZXJzaW9uc0lucHV0EhMKA29yZxgBIAEoCUIGukgDyAEBEhQKBHNsdWcYAiABKAlCBrpIA8gBARISCgpwYWdlX3Rva2VuGAMgASgJEhEKCXBhZ2Vfc2l6ZRgEIAEoBSLtAQoSUGx1Z2luVmVyc2lvbkVudHJ5Eg4KBmRpZ2VzdBgBIAEoCRItCglwdXNoZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkgKCXB1c2hlZF9ieRgDIAEoCzI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0QWN0b3ISCwoDdGFnGAQgASgJEhIKCmlzX2N1cnJlbnQYBSABKAgSDwoHbWVzc2FnZRgGIAEoCRIcChRhcnRpZmFjdF9zdG9yYWdlX2tleRgHIAEoCSKOAQoaTGlzdFBsdWdpblZlcnNpb25zUmVzcG9uc2USQgoIdmVyc2lvbnMYASADKAsyMC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpblZlcnNpb25FbnRyeRIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEwoLdG90YWxfY291bnQYAyABKAViBnByb3RvMw",[file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind,file_ai_stigmer_commons_apiresource_enum,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_timestamp]);var PushPluginRequestSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,1);var PluginArtifactUploadUrlSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,3),PluginMemberSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,4),ListPluginMembersResponseSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,5);var PluginVersionEntrySchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,7),ListPluginVersionsResponseSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,8);var file_ai_stigmer_agentic_plugin_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEy2gUKF1BsdWdpbkNvbW1hbmRDb250cm9sbGVyEqEBCgRwdXNoEi8uYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QdXNoUGx1Z2luUmVxdWVzdBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24S2AEKF2NyZWF0ZUFydGlmYWN0VXBsb2FkVXJsEkIuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5DcmVhdGVQbHVnaW5BcnRpZmFjdFVwbG9hZFVybFJlcXVlc3QaNS5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbkFydGlmYWN0VXBsb2FkVXJsIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24SsAEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiQuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW4iP8K4GDsIAhA6IgtyZXNvdXJjZV9pZCoodW5hdXRob3JpemVkIHRvIHVwZGF0ZSBwbHVnaW4gdmlzaWJpbGl0eRKGAQoGZGVsZXRlEiYuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5JZBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIi7CuBgqCAMQOiIFdmFsdWUqHXVuYXV0aG9yaXplZCB0byBkZWxldGUgcGx1Z2luGgSg/ys6YgZwcm90bzM",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginCommandController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_command,0);var file_ai_stigmer_agentic_plugin_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxMsMEChVQbHVnaW5RdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luSWQaJC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbiIrwrgYJwgBEDoiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IHBsdWdpbhJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIgTQuBgBEqQBCgtsaXN0TWVtYmVycxImLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luSWQaNy5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5NZW1iZXJzUmVzcG9uc2UiNMK4GDAIARA6IgV2YWx1ZSojdW5hdXRob3JpemVkIHRvIGxpc3QgcGx1Z2luIG1lbWJlcnMShQEKDGxpc3RWZXJzaW9ucxI1LmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuTGlzdFBsdWdpblZlcnNpb25zSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5WZXJzaW9uc1Jlc3BvbnNlIgTQuBgBGgSg/ys6YgZwcm90bzM",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginQueryController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_query,0);var PLATFORM_ARCHIVE_LIMITS={maxFiles:1e4,maxUncompressedSize:524288e3,maxCompressionRatio:100};var import_node_fs8=__toESM(require("node:fs"),1),import_node_path11=__toESM(require("node:path"),1),import_promises6=require("node:stream/promises"),SlotUnknownError=class extends Error{constructor(){super("upload reference unknown or expired"),this.name="SlotUnknownError"}},SlotConsumedError=class extends Error{constructor(){super("upload reference already carries an upload"),this.name="SlotConsumedError"}},SizeMismatchError=class extends Error{constructor(received,declared){super(`upload size mismatch: received ${received} bytes, declared ${declared}`),this.name="SizeMismatchError"}},STAGED_FILE_NAME=/^[0-9a-f]+\.zip$/,UploadSlots=class{root;stagingPrefix;ttlMs;maxSize;slots=new Map;stagingDir;now;constructor(root5,stagingPrefix,ttlMs,maxSize,now=Date.now){this.root=root5,this.stagingPrefix=stagingPrefix,this.ttlMs=ttlMs,this.maxSize=maxSize,this.stagingDir=import_node_path11.default.join(root5,stagingPrefix),import_node_fs8.default.rmSync(this.stagingDir,{recursive:!0,force:!0}),import_node_fs8.default.mkdirSync(this.stagingDir,{recursive:!0,mode:448}),this.now=now}reserve(key,declaredSize){if(declaredSize<=0||declaredSize>this.maxSize)throw new Error(`declared size ${declaredSize} outside (0, ${this.maxSize}]`);if(this.stagePath(key),this.slots.has(key))throw new Error(`staging key ${key} is already reserved`);return this.sweep(),this.slots.set(key,{declaredSize,expiresAtMs:this.now()+this.ttlMs,uploaded:!1}),{ttlMs:this.ttlMs}}async receive(key,body){let slot=this.slots.get(key);if(slot===void 0||this.now()>slot.expiresAtMs)throw new SlotUnknownError;if(slot.uploaded)throw new SlotConsumedError;let declared=slot.declaredSize,filePath=this.stagePath(key),written=0;try{await import_node_fs8.default.promises.mkdir(import_node_path11.default.dirname(filePath),{recursive:!0,mode:448}),await(0,import_promises6.pipeline)(body,limitBytes(declared+1,n3=>{written+=n3}),import_node_fs8.default.createWriteStream(filePath,{flags:"w",mode:384}))}catch(error2){throw await import_node_fs8.default.promises.rm(filePath,{force:!0}),new Error(`failed to receive upload: ${error2 instanceof Error?error2.message:String(error2)}`)}if(written!==declared)throw await import_node_fs8.default.promises.rm(filePath,{force:!0}),new SizeMismatchError(written,declared);let current=this.slots.get(key);if(current===void 0||this.now()>current.expiresAtMs)throw await import_node_fs8.default.promises.rm(filePath,{force:!0}),new SlotUnknownError;current.uploaded=!0}sweep(){let nowMs=this.now();for(let[key,slot]of this.slots)nowMs>slot.expiresAtMs&&(this.slots.delete(key),import_node_fs8.default.rmSync(this.stagePath(key),{force:!0}))}stagePath(key){if(!key.startsWith(this.stagingPrefix))throw new Error(`staging key ${key} is outside ${this.stagingPrefix}`);let fileName=key.slice(this.stagingPrefix.length);if(!STAGED_FILE_NAME.test(fileName))throw new Error(`staging key ${key} does not name a staged archive`);return import_node_path11.default.join(this.root,key)}};function limitBytes(limit,onBytes){return async function*(source){let remaining=limit;for await(let chunk of source){if(remaining<=0)return;let slice=chunk.length<=remaining?chunk:chunk.subarray(0,remaining);remaining-=slice.length,onBytes(slice.length),yield slice}}}var ARTIFACT_BYTES_KEY="pushArtifactBytes";function newResolveArtifactSourceStep(staging,binding){return{name:"ResolveArtifactSource",async execute(ctx){let{artifact,artifactUploadRef}=binding.source(ctx.input);if(artifactUploadRef===""){ctx.set(ARTIFACT_BYTES_KEY,artifact);return}if(staging===void 0)throw failedPreconditionError(binding.laneNotConfigured);let data;try{data=await staging.consume(artifactUploadRef)}catch(error2){throw error2 instanceof SlotUnknownError?invalidArgumentError(`artifact_upload_ref not usable: ${error2.message} \u2014 request a new upload URL via createArtifactUploadUrl`):error2}ctx.set(ARTIFACT_BYTES_KEY,data)}}}function newArchiveCurrentVersionStep(store,logger2,binding){return{name:binding.stepName,async execute(ctx){let resource=ctx.get(binding.resourceKey),versionHash=binding.headHashOf(resource);if(versionHash==="")return;let tag2=binding.liveTagOf(resource),resourceId=metadataOf(resource)?.id??"",idField=`${binding.noun}Id`,alreadyArchived=!1;try{await store.getAuditByHash(ctx.apiResourceKind,resourceId,versionHash,binding.schema),alreadyArchived=!0}catch(error2){error2 instanceof AuditNotFoundError||logger2.warn(`Could not check for an existing archived ${binding.noun} version \u2014 archiving anyway`,{[idField]:resourceId,versionHash,error:error2 instanceof Error?error2.message:String(error2)})}if(!alreadyArchived)try{await store.saveAudit(ctx.apiResourceKind,resourceId,binding.schema,resource,versionHash,"")}catch(error2){logger2.error(`Failed to archive ${binding.noun} version \u2014 reverting the version hash to maintain the audit-resolvability invariant`,{[idField]:resourceId,versionHash,error:error2 instanceof Error?error2.message:String(error2)}),binding.clearHeadHash(resource);return}if(tag2!=="")try{await store.setAuditTag(ctx.apiResourceKind,resourceId,versionHash,tag2)}catch(error2){logger2.error(`Archived ${binding.noun} version but failed to assign its tag \u2014 clearing the live tag to stay consistent with the audit column`,{[idField]:resourceId,versionHash,tag:tag2,error:error2 instanceof Error?error2.message:String(error2)}),binding.clearLiveTag(resource)}alreadyArchived?logger2.info(`${capitalize(binding.noun)} version content already archived \u2014 repointed head without a new history row`,{[idField]:resourceId,versionHash,tag:tag2}):logger2.info(`Archived ${binding.noun} version to audit history`,{[idField]:resourceId,versionHash,tag:tag2})}}}function newDeleteVersionArchivesStep(store,logger2,binding){return{name:binding.stepName,async execute(ctx){let resourceId=ctx.get(RESOURCE_ID_KEY);if(typeof resourceId!="string")throw new Error("resource id not found in context (ExtractResourceIdStep must run first)");let idField=`${binding.noun}Id`;try{let deletedCount=await store.deleteAuditByResourceId(ctx.apiResourceKind,resourceId);deletedCount>0&&logger2.info(`Deleted archive records for ${binding.noun}`,{[idField]:resourceId,count:deletedCount})}catch(error2){logger2.warn(`failed to delete ${binding.noun} archives (best-effort)`,{[idField]:resourceId,error:error2 instanceof Error?error2.message:String(error2)})}}}}function capitalize(word){return word.charAt(0).toUpperCase()+word.slice(1)}var HASH_PATTERN=/^[a-f0-9]{64}$/;function isVersionHash(version){return HASH_PATTERN.test(version)}function newLoadByReferenceWithVersionStep(store,binding,stepName){return{name:stepName,async execute(ctx){let ref=ctx.input;if(ref.slug==="")throw invalidArgumentError("slug is required in reference");if(requireOrgForReference(ctx.apiResourceKind,ref.org),ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==binding.kind)throw invalidArgumentError(`kind mismatch: expected ${ApiResourceKind[binding.kind]}, got ${ApiResourceKind[ref.kind]}`);let head;try{head=await findResourceBySlug(store,ctx.apiResourceKind,binding.schema,ref.slug,ref.org)}catch(error2){throw internalError(error2,`failed to list ${binding.noun}s`)}if(head===void 0)throw notFoundError(binding.noun,ref.slug);let version=ref.version.trim();if(version===""||version==="latest"){ctx.set(TARGET_RESOURCE_KEY,head);return}if(headMatchesVersion(binding,head,version)){ctx.set(TARGET_RESOURCE_KEY,head);return}let archived=await findAuditByVersion(store,ctx.apiResourceKind,binding.schema,idOf(head),version);if(archived===void 0)throw notFoundError(`${binding.noun} version`,`${ref.slug}:${version}`);ctx.set(TARGET_RESOURCE_KEY,archived)}}}function headMatchesVersion(binding,head,version){if(isVersionHash(version))return binding.headHashOf(head)===version;let liveTag=binding.liveTagOf(head);return liveTag!==""&&liveTag===version}async function findAuditByVersion(store,kind,schema2,resourceId,version){if(isVersionHash(version))try{return await store.getAuditByHash(kind,resourceId,version,schema2)}catch(error2){if(error2 instanceof AuditNotFoundError)return;throw internalError(error2,"failed to query audit by hash")}try{return await store.getAuditByTag(kind,resourceId,version,schema2)}catch(error2){if(error2 instanceof AuditNotFoundError)return;throw internalError(error2,"failed to query audit by tag")}}var DEFAULT_PAGE_SIZE=50,MAX_PAGE_SIZE=100,LIST_VERSIONS_RESOURCE_ID_KEY="listVersionsResourceId",LIST_VERSIONS_HEAD_HASH_KEY="listVersionsHeadHash",LIST_VERSIONS_RESPONSE_KEY="listVersionsResponse";function versionHistoryTarget(kind,deniedMessage,idKey=LIST_VERSIONS_RESOURCE_ID_KEY){return ctx=>{let resourceId=ctx.get(idKey);if(typeof resourceId!="string"||resourceId==="")throw new Error(`ListVersions: no resolved resource id under ${idKey}; the slug resolver must run first`);return[{permission:IamPermission.can_view,resourceKind:kind,resourceId,deniedMessage}]}}function newResolveBySlugForVersionsStep(store,binding,stepName){return{name:stepName,async execute(ctx){let req=binding.input(ctx.input),head;try{head=await findResourceBySlug(store,ctx.apiResourceKind,binding.schema,req.slug,req.org)}catch(error2){throw internalError(error2,`failed to search for ${binding.noun}`)}if(head===void 0)throw notFoundError(binding.noun,`${req.slug} (org: ${req.org})`);ctx.set(LIST_VERSIONS_RESOURCE_ID_KEY,idOf(head)),ctx.set(LIST_VERSIONS_HEAD_HASH_KEY,binding.headHashOf(head))}}}function newLoadAndMapVersionsStep(store,binding,stepName){return{name:stepName,async execute(ctx){let req=binding.input(ctx.input),resourceId=ctx.get(LIST_VERSIONS_RESOURCE_ID_KEY),records;try{records=await store.listAuditRecords(ctx.apiResourceKind,resourceId)}catch(error2){throw internalError(error2,"failed to load version history")}let headHash=ctx.get(LIST_VERSIONS_HEAD_HASH_KEY),currentMarked=!1,entries=[];for(let record2 of records){let snapshot;try{snapshot=fromBinary2(binding.schema,record2.data)}catch{continue}let isCurrent=!currentMarked&&headHash!==""&&binding.headHashOf(snapshot)===headHash;currentMarked=currentMarked||isCurrent,entries.push(binding.mapEntry(snapshot,isCurrent,record2.tag))}let pageSize=req.pageSize;pageSize<=0&&(pageSize=DEFAULT_PAGE_SIZE),pageSize>MAX_PAGE_SIZE&&(pageSize=MAX_PAGE_SIZE);let startIndex=0;req.pageToken!==""&&(startIndex=decodePageToken(req.pageToken));let pageEntries=[],nextPageToken="";if(startIndex<entries.length){let end=Math.min(startIndex+pageSize,entries.length);pageEntries=entries.slice(startIndex,end),end<entries.length&&(nextPageToken=Buffer.from(String(end)).toString("base64"))}ctx.set(LIST_VERSIONS_RESPONSE_KEY,binding.response(pageEntries,nextPageToken,entries.length))}}}function decodePageToken(token){let decoded=Buffer.from(token,"base64");if(decoded.toString("base64")!==token)throw invalidArgumentError("invalid page_token");let text2=decoded.toString("utf8"),index2=Number.parseInt(text2,10);if(!Number.isSafeInteger(index2)||String(index2)!==text2||index2<0)throw invalidArgumentError("invalid page_token");return index2}function idOf(resource){return metadataOf(resource)?.id??""}var PLUGIN_ARTIFACT_KEY_PREFIX="plugins/",VERSION_TAG_PATTERN=/^[a-zA-Z0-9._-]+$/,BUILT_IN_SUB_AGENT_NAMES=new Set(["explore","shell","general-purpose"]);var TRANSFER_LANE_NOT_CONFIGURED="plugin artifact transfer lane is not configured on this server",SERVER_WARNING_KINDS={componentIgnored:"component-ignored",memberAdopted:"member-adopted",modelHintUnresolved:"model-hint-unresolved",subAgentNameBuiltin:"sub-agent-name-builtin",versionNotTaggable:"version-not-taggable"};var MEMBER_KINDS=[{kind:ApiResourceKind.skill,schema:SkillSchema},{kind:ApiResourceKind.mcp_server,schema:McpServerSchema},{kind:ApiResourceKind.agent,schema:AgentSchema},{kind:ApiResourceKind.workflow,schema:WorkflowSchema}];function memberOf(kind,metadata){return{kind,id:metadata.id,slug:metadata.slug,name:metadata.name,version:metadata.labels[PLUGIN_VERSION_LABEL]??"",system:isSystemContent(metadata)}}async function findMembers(store,pluginId,org){let members=[];for(let{kind,schema:schema2}of MEMBER_KINDS){let raws=await store.findAllByLabel(kind,PLUGIN_LABEL,pluginId,schema2);for(let raw of raws){let metadata=metadataOf(fromBinary2(schema2,raw));metadata!==void 0&&metadata.org===org&&members.push(memberOf(kind,metadata))}}return members}async function slugHolder(store,planned,org){let entry=MEMBER_KINDS.find(candidate=>candidate.kind===planned.kind);if(entry===void 0)throw new Error(`kind ${ApiResourceKind[planned.kind]} is not a plugin member kind`);let existing=await findResourceBySlug(store,planned.kind,entry.schema,planned.slug,org),metadata=existing===void 0?void 0:metadataOf(existing);return metadata===void 0?{held:!1}:{held:!0,byPlugin:pluginIdOf(metadata),holder:memberOf(planned.kind,metadata)}}function judgeSlug(holder,planned,pluginId){return holder.held?holder.byPlugin===pluginId?{kind:"ours",holder:holder.holder}:holder.byPlugin!==void 0?{kind:"held-by-plugin",holder:holder.holder,pluginId:holder.byPlugin}:holder.holder.system&&planned.system?{kind:"adopt",holder:holder.holder}:{kind:"held-unmanaged",holder:holder.holder}:{kind:"free"}}function membersConverge(existing,planned,digest3){if(existing.length!==planned.length)return!1;let byKey=new Map(existing.map(member2=>[`${member2.kind}:${member2.slug}`,member2]));return planned.every(member2=>{let found=byKey.get(`${member2.kind}:${member2.slug}`);return found!==void 0&&found.version===digest3})}function droppedMembers(existing,planned){let keep=new Set(planned.map(member2=>`${member2.kind}:${member2.slug}`));return existing.filter(member2=>!keep.has(`${member2.kind}:${member2.slug}`))}var PLUGIN_DOCUMENT_LIMITS={manifest:262144,mcpConfig:262144,skillMd:1048576,subAgent:1048576,overlay:1048576,logo:1048576,marketplace:1048576},encoder5=new TextEncoder,decoder3=new TextDecoder("utf-8",{fatal:!1});function comparePaths(a5,b7){return a5<b7?-1:a5>b7?1:0}function decodeUtf8(bytes){let text2=decoder3.decode(bytes);return text2.charCodeAt(0)===65279?text2.slice(1):text2}function isContainedPath(path14){return path14===""||path14.startsWith("/")||path14.includes("\\")?!1:path14.split("/").every(segment=>segment!==""&&segment!=="."&&segment!=="..")}var GLOB_CHARACTERS=/[*?[\]{}]/;function resolveDeclaredPath(value){if(GLOB_CHARACTERS.test(value))return{ok:!1,kind:"path-glob-unsupported"};if(value==="."||value==="./")return{ok:!0,path:""};if(!value.startsWith("./"))return{ok:!1,kind:"path-not-relative"};let trimmed=value.slice(2).replace(/\/+$/,"");return trimmed===""?{ok:!0,path:""}:isContainedPath(trimmed)?{ok:!0,path:trimmed}:{ok:!1,kind:"path-escapes-root"}}function joinPath(dir,name){return dir===""?name:`${dir}/${name}`}function basename(path14){let slash=path14.lastIndexOf("/");return slash===-1?path14:path14.slice(slash+1)}function dirname(path14){let slash=path14.lastIndexOf("/");return slash===-1?"":path14.slice(0,slash)}var PluginFileIndex=class{files;byPath;constructor(files){this.files=files,this.byPath=new Map(files.entries.map(entry=>[entry.path,entry]))}has(path14){return this.byPath.has(path14)}entry(path14){return this.byPath.get(path14)}filesUnder(dir){if(dir==="")return this.files.entries.map(entry=>entry.path);let prefix=`${dir}/`;return this.files.entries.filter(entry=>entry.path.startsWith(prefix)).map(entry=>entry.path)}isDirectory(dir){if(dir==="")return this.files.entries.length>0;let prefix=`${dir}/`;return this.files.entries.some(entry=>entry.path.startsWith(prefix))}childDirectories(dir){let prefix=dir===""?"":`${dir}/`,names=new Set;for(let entry of this.files.entries){if(!entry.path.startsWith(prefix))continue;let rest=entry.path.slice(prefix.length),slash=rest.indexOf("/");slash!==-1&&names.add(rest.slice(0,slash))}return[...names].sort(comparePaths)}childFiles(dir){let prefix=dir===""?"":`${dir}/`,names=[];for(let entry of this.files.entries){if(!entry.path.startsWith(prefix))continue;let rest=entry.path.slice(prefix.length);rest.includes("/")||names.push(rest)}return names.sort(comparePaths)}};function readText(index2,path14,cls,findings){let bytes=readBytes(index2,path14,cls,findings);return bytes===void 0?void 0:decodeUtf8(bytes)}function readBytes(index2,path14,cls,findings){let limit=PLUGIN_DOCUMENT_LIMITS[cls],entry=index2.entry(path14);if(entry===void 0)throw new Error(`plugin file '${path14}' is not listed`);if(entry.size>limit){findings.error("document-too-large",{path:path14,subject:String(entry.size),detail:String(limit)});return}let bytes=index2.files.read(path14);if(bytes.length>limit){findings.error("document-too-large",{path:path14,subject:String(bytes.length),detail:String(limit)});return}return bytes}function parseJsonObject2(text2,path14,kind,findings){let value;try{value=JSON.parse(text2)}catch(error2){findings.error(kind,{path:path14,detail:error2 instanceof Error?error2.message:String(error2)});return}if(!isJsonObject2(value)){findings.error(kind,{path:path14,detail:"the document is not a JSON object"});return}return value}function isJsonObject2(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)}function isStringArray(value){return Array.isArray(value)&&value.every(item=>typeof item=="string")}function isStringRecord(value){return isJsonObject2(value)&&Object.values(value).every(item=>typeof item=="string")}function describeValue(value){return typeof value=="string"?value:JSON.stringify(value)}function fields(object){return Object.entries(object)}function optionalString(object,field3,path14,findings){let value=object[field3];if(value!==void 0){if(typeof value!="string"){findings.error("manifest-field-type",{path:path14,subject:field3,detail:"a string"});return}return value}}function optionalStringArray(object,field3,path14,findings){let value=object[field3];if(value!==void 0){if(!isStringArray(value)){findings.error("manifest-field-type",{path:path14,subject:field3,detail:"an array of strings"});return}return value}}function stringOrStringArray(object,field3,path14,findings){let value=object[field3];if(value!==void 0){if(typeof value=="string")return[value];if(isStringArray(value))return value;findings.error("manifest-field-type",{path:path14,subject:field3,detail:"a string or an array of strings"})}}function warnUnknownFields(object,known,path14,findings){for(let[name]of fields(object))known.has(name)||findings.warn("manifest-field-unknown",{path:path14,subject:name})}function readIdentity(object,path14,findings){let identity2={},name=optionalString(object,"name",path14,findings);name!==void 0&&(identity2.name=name);let version=optionalString(object,"version",path14,findings);version!==void 0&&(identity2.version=version);let description=optionalString(object,"description",path14,findings);description!==void 0&&(identity2.description=description);let homepage=optionalString(object,"homepage",path14,findings);homepage!==void 0&&(identity2.homepage=homepage);let repository=optionalString(object,"repository",path14,findings);repository!==void 0&&(identity2.repository=repository);let license=optionalString(object,"license",path14,findings);license!==void 0&&(identity2.license=license);let keywords=optionalStringArray(object,"keywords",path14,findings);keywords!==void 0&&(identity2.keywords=keywords);let author=readAuthor(object,path14,findings);return author!==void 0&&(identity2.author=author),identity2}function readAuthor(object,path14,findings){let value=object.author;if(value===void 0)return;if(!isJsonObject2(value)){findings.error("manifest-field-type",{path:path14,subject:"author",detail:"an object"});return}let author={},name=optionalString(value,"name",path14,findings);name!==void 0&&(author.name=name);let email=optionalString(value,"email",path14,findings);email!==void 0&&(author.email=email);let url=optionalString(value,"url",path14,findings);return url!==void 0&&(author.url=url),author}function readDeclaredPaths(object,field3,path14,findings){let values=stringOrStringArray(object,field3,path14,findings);if(values===void 0)return;let declared=[];for(let value of values){let resolved=resolveDeclaredPath(value);if(!resolved.ok){findings.error(resolved.kind,{path:path14,subject:value});continue}declared.push({path:resolved.path,manifest:path14})}return declared}function readMcpSources(object,field3,path14,dialect,findings){let value=object[field3];if(value===void 0)return[];let items=Array.isArray(value)?value:[value],sources=[];for(let item of items)if(typeof item=="string"){let resolved=resolveDeclaredPath(item);if(!resolved.ok){findings.error(resolved.kind,{path:path14,subject:item});continue}sources.push({kind:"file",path:resolved.path,dialect,manifest:path14})}else isJsonObject2(item)?sources.push({kind:"inline",manifest:path14,servers:item,dialect}):findings.error("manifest-field-type",{path:path14,subject:field3,detail:"a path, an object, or an array of either"});return sources}var IGNORED_FIELD_KINDS={hooks:"hooks",rules:"rules",commands:"commands",workflows:"workflows",outputStyles:"output-styles",lspServers:"lsp-servers",channels:"channels",dependencies:"dependencies",defaultEnabled:"default-enabled",minClientVersions:"min-client-versions",logo:"logo",apps:"apps"};function ignoredFieldComponents(object,path14){let ignored=[];for(let[name,value]of fields(object)){let kind=IGNORED_FIELD_KINDS[name];if(kind!==void 0&&ignored.push({kind,path:`${path14}#${name}`}),name==="experimental"&&isJsonObject2(value))for(let[sub]of fields(value)){let subKind=EXPERIMENTAL_KINDS[sub];subKind!==void 0&&ignored.push({kind:subKind,path:`${path14}#experimental.${sub}`})}}return ignored}var EXPERIMENTAL_KINDS={themes:"themes",monitors:"monitors",evals:"evals"},STIGMER_EXTENSION_NAMESPACE="ai.stigmer",STIGMER_EXTENSION_FIELDS=new Set(["displayName","logo","category"]);function extensionComponents(object,path14,findings){let value=object.extensions;if(value===void 0)return[];if(!isJsonObject2(value))return findings.warn("manifest-extensions-invalid",{path:path14}),[];let ignored=[];for(let[namespace,content]of fields(value)){if(isJsonObject2(content)&&fields(content).length===0)continue;let at2=`${path14}#extensions.${namespace}`;if(namespace===STIGMER_EXTENSION_NAMESPACE&&isJsonObject2(content)){content.logo!==void 0&&ignored.push({kind:"logo",path:`${at2}.logo`}),fields(content).some(([name])=>!STIGMER_EXTENSION_FIELDS.has(name))&&ignored.push({kind:"extension",path:at2});continue}ignored.push({kind:"extension",path:at2})}return ignored}var CLAUDE_KNOWN_FIELDS=new Set(["name","version","description","author","homepage","repository","license","keywords","skills","commands","agents","workflows","hooks","mcpServers","outputStyles","lspServers","experimental","userConfig","channels","dependencies","defaultEnabled"]),CLAUDE_DEFAULT_MCP_CONFIG=".mcp.json";function readClaudeManifest(object,path14,findings){return readClaudeShapedManifest(object,path14,"claude",CLAUDE_KNOWN_FIELDS,findings)}function readClaudeShapedManifest(object,path14,dialect,known,findings){warnUnknownFields(object,known,path14,findings);let identity2=readIdentity(object,path14,findings),skillPaths=readDeclaredPaths(object,"skills",path14,findings)??[],agentPaths=readDeclaredPaths(object,"agents",path14,findings),declaredMcp=readMcpSources(object,"mcpServers",path14,dialect,findings),manifest={dialect,path:path14,identity:identity2,skillPaths,mcpConfigs:declaredMcp,ignored:ignoredFieldComponents(object,path14)};return agentPaths!==void 0&&(manifest.agentPaths=agentPaths),object.userConfig!==void 0&&(manifest.variables={dialect:"claude",value:object.userConfig,manifest:path14}),manifest}var KNOWN_FIELDS=new Set([...CLAUDE_KNOWN_FIELDS,"apps","interface"]);function readCodexManifest(object,path14,findings){return readClaudeShapedManifest(object,path14,"codex",KNOWN_FIELDS,findings)}var KNOWN_FIELDS2=new Set(["name","displayName","description","version","minClientVersions","author","publisher","homepage","repository","license","logo","keywords","category","tags","commands","agents","skills","rules","hooks","variables","mcpServers"]);function readCursorManifest(object,path14,findings){warnUnknownFields(object,KNOWN_FIELDS2,path14,findings);let identity2=readIdentity(object,path14,findings),skillPaths=readDeclaredPaths(object,"skills",path14,findings)??[],agentPaths=readDeclaredPaths(object,"agents",path14,findings),manifest={dialect:"cursor",path:path14,identity:identity2,skillPaths,mcpConfigs:readMcpSources(object,"mcpServers",path14,"cursor",findings),ignored:ignoredFieldComponents(object,path14)};return agentPaths!==void 0&&(manifest.agentPaths=agentPaths),object.variables!==void 0&&(manifest.variables={dialect:"cursor",value:object.variables,manifest:path14}),manifest}var AGENT_PLUGINS_MANIFEST_SCHEMA="https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",AGENT_PLUGINS_MCP_SCHEMA="https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",MANIFEST_LOCATIONS={"agent-plugins":"plugin.json",claude:".claude-plugin/plugin.json",cursor:".cursor-plugin/plugin.json",codex:".codex-plugin/plugin.json"},q3=value=>`'${value??""}'`,at=path14=>path14===void 0?"":` in ${q3(path14)}`,ERROR_MESSAGES={"no-manifest":()=>`no plugin manifest found: expected one of ${Object.values(MANIFEST_LOCATIONS).map(p3=>q3(p3)).join(", ")}`,"manifest-unreadable":c5=>`manifest ${q3(c5.path)} is not valid JSON: ${c5.detail??"parse error"}`,"manifest-schema-missing":c5=>`manifest ${q3(c5.path)} is missing the required '$schema' field; an Agent Plugins manifest declares ${q3(AGENT_PLUGINS_MANIFEST_SCHEMA)}`,"manifest-schema-unsupported":c5=>`manifest ${q3(c5.path)} declares an unsupported '$schema' ${q3(c5.detail)}; this reader supports ${q3(AGENT_PLUGINS_MANIFEST_SCHEMA)}`,"manifest-name-missing":c5=>`manifest ${q3(c5.path)} is missing the required 'name' field`,"manifest-name-invalid":c5=>`plugin name ${q3(c5.subject)}${at(c5.path)} is invalid: 1 to 64 characters of lowercase letters, digits, hyphens and periods, starting and ending alphanumeric, with no '--' or '..'`,"manifest-name-conflict":c5=>`manifests disagree on the plugin name: ${q3(c5.subject)} in ${q3(c5.path)} versus ${c5.detail??"another manifest"}`,"manifest-field-type":c5=>`field ${q3(c5.subject)}${at(c5.path)} has the wrong type: expected ${c5.detail??"a different type"}`,"path-not-relative":c5=>`path ${q3(c5.subject)}${at(c5.path)} must be plugin-relative and begin with './'`,"path-escapes-root":c5=>`path ${q3(c5.subject)}${at(c5.path)} escapes the plugin root`,"path-glob-unsupported":c5=>`path ${q3(c5.subject)}${at(c5.path)} is a glob pattern; declare directories and files by path`,"path-uncontained":c5=>`the reader listed a path outside the plugin root: ${q3(c5.path)}`,"document-too-large":c5=>`${q3(c5.path)} is ${c5.subject??"too many"} bytes, over the ${c5.detail??""}-byte limit for this kind of document`,"skill-frontmatter-missing":c5=>`${q3(c5.path)} must start with YAML frontmatter ('---')`,"skill-frontmatter-unclosed":c5=>`${q3(c5.path)} frontmatter is not closed (missing the closing '---')`,"skill-frontmatter-unreadable":c5=>`${q3(c5.path)} frontmatter is not valid YAML: ${c5.detail??"parse error"}`,"skill-name-invalid":c5=>`skill name ${q3(c5.subject)}${at(c5.path)} is invalid: lowercase letters, digits and hyphens, optionally dot-scoped, with every segment alphanumeric`,"skill-name-duplicate":c5=>`skill name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"mcp-config-unreadable":c5=>`MCP configuration ${q3(c5.path)} is not valid JSON: ${c5.detail??"parse error"}`,"mcp-config-shape":c5=>`MCP configuration ${q3(c5.path)} must be an object with an 'mcpServers' object`,"mcp-config-schema-missing":c5=>`MCP configuration ${q3(c5.path)} is missing the required '$schema' field; an Agent Plugins configuration declares ${q3(AGENT_PLUGINS_MCP_SCHEMA)}`,"mcp-config-schema-unsupported":c5=>`MCP configuration ${q3(c5.path)} declares an unsupported '$schema' ${q3(c5.detail)}; this reader supports ${q3(AGENT_PLUGINS_MCP_SCHEMA)}`,"mcp-config-field-unknown":c5=>`MCP configuration ${q3(c5.path)} has an unexpected top-level field ${q3(c5.subject)}; only '$schema' and 'mcpServers' are allowed`,"mcp-server-shape":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} must be an object`,"mcp-server-type-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'type' field the Agent Plugins format requires ('stdio', 'streamable-http' or 'sse')`,"mcp-server-transport-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has no 'type' and neither a 'command' nor a 'url' to infer it from`,"mcp-server-type-ambiguous":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares both 'command' and 'url'; a server is either stdio or HTTP`,"mcp-server-type-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an unknown 'type' ${q3(c5.detail)}; expected 'stdio', 'http', 'streamable-http' or 'sse'`,"mcp-server-field-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} that its transport does not define`,"mcp-server-field-type":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} field ${q3(c5.detail)} has the wrong type`,"mcp-server-url-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'url' its HTTP transport requires`,"mcp-server-url-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an invalid 'url' ${q3(c5.detail)}: expected an absolute HTTPS URL (HTTP only for localhost) with no user information or fragment`,"mcp-server-url-variable":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a variable in its 'url'; Stigmer sends the URL as written, so write the URL out and put variables in 'headers'`,"mcp-server-command-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'command' its stdio transport requires`,"mcp-server-command-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a 'command' that is not a single executable name; put arguments in 'args'`,"mcp-server-command-relative":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} runs a command bundled in the plugin ${q3(c5.detail)}; Stigmer runs only commands on the runner's PATH (for example 'npx' or 'uvx')`,"mcp-server-plugin-root-reference":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} references the plugin's own files through ${q3(c5.detail)}; Stigmer does not mount plugin files into the runner`,"mcp-server-cwd-unsupported":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} sets a working directory; Stigmer does not mount plugin files, so a bundled directory cannot be reached`,"mcp-server-env-literal":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} sets environment variable ${q3(c5.detail)} to a literal value; Stigmer passes declared variables by name, so write ${q3(`${c5.detail??"KEY"}: "\${${c5.detail??"KEY"}}"`)} and declare the variable`,"mcp-server-env-rename":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} maps environment variable ${q3(c5.detail)} to a differently named variable; Stigmer passes declared variables by name, so use the same name on both sides`,"mcp-server-name-duplicate":c5=>`MCP server name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"mcp-server-header-duplicate":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares header ${q3(c5.detail)} more than once (header names are case-insensitive)`,"mcp-server-header-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an invalid header name ${q3(c5.detail)}`,"sub-agent-frontmatter-unreadable":c5=>`${q3(c5.path)} frontmatter is not valid YAML: ${c5.detail??"parse error"}`,"sub-agent-instructions-short":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} has instructions under ${c5.detail??""} characters; the body of the file is the sub-agent's prompt`,"sub-agent-name-duplicate":c5=>`sub-agent name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"variable-name-invalid":c5=>`variable name ${q3(c5.subject)}${at(c5.path)} is invalid: an environment variable name is letters, digits and underscores, not starting with a digit`,"overlay-server-unknown":c5=>`${q3(c5.path)} overlays MCP server ${q3(c5.subject)}, which the plugin does not declare`,"overlay-document-unknown":c5=>`${q3(c5.path)} is not a document Stigmer reads; the 'ai.stigmer/' folder holds 'agent.yaml', 'workflows/<name>.yaml' and 'mcp-servers/<server>.yaml'`},WARNING_MESSAGES={"manifest-field-unknown":c5=>`manifest ${q3(c5.path)} has an unknown field ${q3(c5.subject)}, ignored`,"manifest-extensions-invalid":c5=>`manifest ${q3(c5.path)} has an 'extensions' field that is not an object, ignored`,"path-missing":c5=>`path ${q3(c5.subject)} declared${at(c5.path)} does not exist in the plugin`,"skill-name-defaulted":c5=>`${q3(c5.path)} has no 'name' in its frontmatter; the skill is named after its directory, ${q3(c5.subject)}`,"skill-name-differs-from-directory":c5=>`skill ${q3(c5.subject)}${at(c5.path)} is named differently from its directory ${q3(c5.detail)}`,"skill-description-missing":c5=>`skill ${q3(c5.subject)}${at(c5.path)} has no 'description'`,"mcp-config-field-ignored":c5=>`MCP configuration ${q3(c5.path)} has a top-level field ${q3(c5.subject)} Stigmer does not read, ignored`,"mcp-server-sse-mapped":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares the legacy 'sse' transport; Stigmer connects over Streamable HTTP and falls back to SSE only when the server rejects it`,"mcp-server-field-ignored":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} Stigmer does not read, ignored`,"mcp-server-auth-ignored":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an 'auth' block Stigmer does not read; OAuth for a server is declared in 'ai.stigmer/mcp-servers/${c5.subject??"<server>"}.yaml'`,"variable-inferred":c5=>`variable ${q3(c5.subject)} is referenced by MCP server ${q3(c5.detail)} but not declared; it is declared as a required secret`,"variable-unreferenced":c5=>`variable ${q3(c5.subject)}${at(c5.path)} is declared but no MCP server references it`,"variable-default-dropped":c5=>`variable ${q3(c5.subject)}${at(c5.path)} has a default value, which Stigmer does not carry; the user supplies the value`,"variable-type-narrowed":c5=>`variable ${q3(c5.subject)}${at(c5.path)} is typed ${q3(c5.detail)}; Stigmer variables are strings`,"variable-option-dropped":c5=>`variable ${q3(c5.subject)}${at(c5.path)} has a ${q3(c5.detail)} constraint, which Stigmer does not carry`,"sub-agent-name-defaulted":c5=>`${q3(c5.path)} has no 'name' in its frontmatter; the sub-agent is named after the file, ${q3(c5.subject)}`,"sub-agent-skill-unknown":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} asks for skill ${q3(c5.detail)}, which the plugin does not ship`,"sub-agent-model-unknown":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} names model ${q3(c5.detail)}, which Stigmer cannot map; the sub-agent runs on the session's model`,"sub-agent-field-ignored":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} Stigmer does not read, ignored`};var FindingCollector=class{errorSentences;warningSentences;errors=[];warnings=[];constructor(errorSentences,warningSentences){this.errorSentences=errorSentences,this.warningSentences=warningSentences}error(kind,ctx={}){this.errors.push(compose(kind,ctx,this.errorSentences[kind](ctx)))}warn(kind,ctx={}){this.warnings.push(compose(kind,ctx,this.warningSentences[kind](ctx)))}},Findings=class extends FindingCollector{constructor(){super(ERROR_MESSAGES,WARNING_MESSAGES)}};function compose(kind,ctx,message6){return{kind,...ctx.path!==void 0&&{path:ctx.path},...ctx.subject!==void 0&&{subject:ctx.subject},...ctx.detail!==void 0&&{detail:ctx.detail},message:message6}}var KNOWN_FIELDS3=new Set(["$schema","name","version","description","author","homepage","repository","license","keywords","extensions"]);function readOpenManifest(object,path14,findings){let schema2=object.$schema;return schema2===void 0?findings.error("manifest-schema-missing",{path:path14}):schema2!==AGENT_PLUGINS_MANIFEST_SCHEMA&&findings.error("manifest-schema-unsupported",{path:path14,detail:describeValue(schema2)}),warnUnknownFields(object,KNOWN_FIELDS3,path14,findings),{dialect:"agent-plugins",path:path14,identity:readIdentity(object,path14,findings),skillPaths:[],mcpConfigs:[],ignored:extensionComponents(object,path14,findings)}}var OPEN_MCP_CONFIG="mcp.json",VENDOR_PRECEDENCE=["claude","cursor","codex"],MANIFEST_PRECEDENCE=["agent-plugins",...VENDOR_PRECEDENCE],NAME_MAX_LENGTH=64,NAME_PATTERN=/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/;function detectManifests(index2,findings){let manifests=[],present=dialect=>{let path14=MANIFEST_LOCATIONS[dialect];if(!index2.has(path14))return;let object=readManifestObject(index2,path14,findings),manifest=object===void 0?emptyManifest(dialect,path14):readDialect(dialect,object,path14,findings);return manifests.push(manifest),manifest},root5=present("agent-plugins"),vendors=VENDOR_PRECEDENCE.map(present).filter(m3=>m3!==void 0);if(manifests.length===0){findings.error("no-manifest");return}let identity2=root5??vendors[0];if(identity2===void 0)throw new Error("manifest set without an identity manifest");let ordered=[identity2,...manifests.filter(m3=>m3!==identity2)],name=resolveName(identity2,ordered,findings);return{dialect:identity2.dialect,manifests:ordered,name,readsAgents:vendors.length>0,mcpSources:resolveMcpSources(index2,root5,vendors)}}function readManifestObject(index2,path14,findings){let text2=readText(index2,path14,"manifest",findings);return text2===void 0?void 0:parseJsonObject2(text2,path14,"manifest-unreadable",findings)}function readDialect(dialect,object,path14,findings){switch(dialect){case"agent-plugins":return readOpenManifest(object,path14,findings);case"claude":return readClaudeManifest(object,path14,findings);case"cursor":return readCursorManifest(object,path14,findings);case"codex":return readCodexManifest(object,path14,findings);default:{let exhaustive=dialect;throw new Error(`unknown dialect ${String(exhaustive)}`)}}}function emptyManifest(dialect,path14){return{dialect,path:path14,identity:{},skillPaths:[],mcpConfigs:[],ignored:[]}}function resolveName(identity2,all,findings){let name=identity2.identity.name;if(name===void 0){if(findings.errors.some(f5=>f5.kind==="manifest-unreadable"&&f5.path===identity2.path))return;findings.error("manifest-name-missing",{path:identity2.path});return}let valid=!0;isValidPluginName(name)||(findings.error("manifest-name-invalid",{path:identity2.path,subject:name}),valid=!1);for(let other of all){if(other===identity2)continue;let otherName=other.identity.name;otherName!==void 0&&otherName!==name&&(findings.error("manifest-name-conflict",{path:identity2.path,subject:name,detail:`'${otherName}' in '${other.path}'`}),valid=!1)}return valid?name:void 0}function isValidPluginName(name){return name.length<=NAME_MAX_LENGTH&&NAME_PATTERN.test(name)&&!name.includes("--")&&!name.includes("..")}function resolveMcpSources(index2,root5,vendors){let sources=[];root5!==void 0&&index2.has(OPEN_MCP_CONFIG)&&sources.push({kind:"file",path:OPEN_MCP_CONFIG,dialect:"agent-plugins",manifest:root5.path});for(let vendor of vendors)vendor.mcpConfigs.length>0?sources.push(...vendor.mcpConfigs):vendor.dialect!=="cursor"&&index2.has(CLAUDE_DEFAULT_MCP_CONFIG)&&sources.push({kind:"file",path:CLAUDE_DEFAULT_MCP_CONFIG,dialect:vendor.dialect,manifest:vendor.path});let seen=new Set;return sources.filter(source=>source.kind==="inline"?!0:seen.has(source.path)?!1:(seen.add(source.path),!0))}var import_yaml=__toESM(require_dist2(),1);var SKILL_NAME_PATTERN=/^[a-z0-9]+([.-][a-z0-9]+)*$/;function extractFrontmatter(content){let lines=content.split(/\r?\n/);if(lines.length===0||lines[0]?.trim()!=="---")return{ok:!1,reason:"missing"};for(let i6=1;i6<lines.length;i6++)if(lines[i6]?.trim()==="---")return{ok:!0,yaml:lines.slice(1,i6).join(`
+`);return}let headers2={"Content-Length":String(info.size)},downloadName=url.searchParams.get(LOCAL_DOWNLOAD_QUERY_PARAM)??"";if(downloadName!==""&&(headers2["Content-Disposition"]=contentDispositionAttachment(downloadName)),res.writeHead(200,headers2),req.method==="HEAD"){res.end();return}let stream=(0,import_node_fs7.createReadStream)(filePath);stream.on("error",error2=>{logger2.error("artifact file stream failed",{key,error:error2.message}),res.destroy()}),stream.pipe(res)}catch(error2){logger2.error("artifact file server request failed",{error:error2 instanceof Error?error2.message:String(error2)}),res.headersSent||res.writeHead(500),res.end()}}async function warnOnLegacyArtifactLayout(basePath,logger2){for(let sub of["attachments","artifacts"]){let legacy=import_node_path10.default.join(basePath,"artifacts",sub);try{if((await(0,import_promises5.stat)(legacy)).isDirectory()){logger2.warn("Detected artifacts under a pre-#285 layout at <base>/artifacts/*. The artifact root is now <base> itself. Move <base>/artifacts/* up into <base> (or set ARTIFACT_LOCAL_BASE_PATH to the old <base>/artifacts) so existing artifacts remain reachable.",{legacyDir:import_node_path10.default.join(basePath,"artifacts"),artifactRoot:basePath});return}}catch{}}}var file_ai_stigmer_agentic_channelapp_v1_command=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9jb21tYW5kLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MTKOBQobQ2hhbm5lbEFwcENvbW1hbmRDb250cm9sbGVyEmMKBWFwcGx5EiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcBosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAStQEKBmNyZWF0ZRIsLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAaLC5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwIk/CuBhLCB8QHiIMbWV0YWRhdGEub3JnKjd1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIGNoYW5uZWwgYXBwIGluIHRoaXMgb3JnYW5pemF0aW9uEp8BCgZ1cGRhdGUSLC5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwGiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcCI5wrgYNQgCEDAiC21ldGFkYXRhLmlkKiJ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGNoYW5uZWwgYXBwEqkBCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiOcK4GDUIAxAwIgtyZXNvdXJjZV9pZCoidW5hdXRob3JpemVkIHRvIGRlbGV0ZSBjaGFubmVsIGFwcBoEoP8rMGIGcHJvdG8z",[file_ai_stigmer_agentic_channelapp_v1_api,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelAppCommandController=serviceDesc(file_ai_stigmer_agentic_channelapp_v1_command,0);var file_ai_stigmer_agentic_channelapp_v1_io=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9pby5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEiTAoLQ2hhbm5lbEFwcHMSPQoHZW50cmllcxgBIAMoCzIsLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiMQoZTGlzdENoYW5uZWxBcHBzQnlPcmdJbnB1dBIUCgNvcmcYASABKAlCB7pIBHICEAFiBnByb3RvMw",[file_ai_stigmer_agentic_channelapp_v1_api,file_buf_validate_validate]),ChannelAppsSchema=messageDesc2(file_ai_stigmer_agentic_channelapp_v1_io,0);var file_ai_stigmer_agentic_channelapp_v1_query=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9xdWVyeS5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEy9gMKGUNoYW5uZWxBcHBRdWVyeUNvbnRyb2xsZXISlQEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcCIxwrgYLQgBEDAiBXZhbHVlKiB1bmF1dGhvcml6ZWQgdG8gdmlldyBjaGFubmVsIGFwcBJ6Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiBNC4GAESvgEKCWxpc3RCeU9yZxI7LmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkxpc3RDaGFubmVsQXBwc0J5T3JnSW5wdXQaLS5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwcyJFwrgYQQgBEB4iA29yZyo2dW5hdXRob3JpemVkIHRvIGxpc3QgY2hhbm5lbCBhcHBzIGluIHRoaXMgb3JnYW5pemF0aW9uGgSg/yswYgZwcm90bzM",[file_ai_stigmer_agentic_channelapp_v1_api,file_ai_stigmer_agentic_channelapp_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelAppQueryController=serviceDesc(file_ai_stigmer_agentic_channelapp_v1_query,0);async function destroySecretBackingState(secretService,logger2,fields2,storedValues){for(let storedValue of storedValues)if(storedValue!=="")try{await secretService.delete(storedValue)}catch(error2){logger2.error("secret backing-state destruction failed after persist \u2014 external state may be orphaned",{...fields2,error:error2 instanceof Error?error2.message:String(error2)})}}function newDestroySecretBackingStateStep(secretService,logger2,extractSecretValues){return{name:"DestroySecretBackingState",async execute(ctx){let deleted=ctx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)return;let metadata=deleted.metadata;await destroySecretBackingState(secretService,logger2,{kind:getKindName(ctx.apiResourceKind),resourceId:metadata?.id??""},extractSecretValues(deleted))}}}var REDACTED_MARKER2="***REDACTED***";function plaintextRequiredMessage(fieldName){return`${fieldName} must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients`}function markerOnCreateMessage(fieldName){return`cannot use the redaction marker as ${fieldName} on create`}function noExistingSecretMessage(fieldName){return`cannot preserve ${fieldName}: no existing secret value found`}var PROVIDER_IMMUTABLE_MESSAGE="the provider of a channel app cannot be changed";function deleteBlockedByChannelMessage(org,slug,channelName){return`cannot delete ChannelApp '${org}/${slug}': referenced by agent channel '${channelName}'`}function redactChannelApp(app){let provider=app.spec?.providerConfig;switch(provider?.case){case"slack":redactSlack(provider.value);return;case"whatsapp":redactWhatsApp(provider.value);return;case void 0:return;default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}function redactSlack(slack){slack.clientSecret!==""&&(slack.clientSecret=REDACTED_MARKER2),slack.signingSecret!==""&&(slack.signingSecret=REDACTED_MARKER2)}function redactWhatsApp(whatsapp){whatsapp.appSecret!==""&&(whatsapp.appSecret=REDACTED_MARKER2),whatsapp.accessToken!==""&&(whatsapp.accessToken=REDACTED_MARKER2),whatsapp.verifyToken!==""&&(whatsapp.verifyToken=REDACTED_MARKER2)}function secretValuesOfChannelApp(app){let provider=app.spec?.providerConfig;switch(provider?.case){case"slack":return[provider.value.clientSecret,provider.value.signingSecret];case"whatsapp":return[provider.value.appSecret,provider.value.accessToken,provider.value.verifyToken];case void 0:return[];default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}function newEncryptChannelAppSecretsForCreateStep(secretService,logger2){return newEncryptChannelAppSecretsStep(secretService,logger2,!0)}function newEncryptChannelAppSecretsForUpdateStep(secretService,logger2){return newEncryptChannelAppSecretsStep(secretService,logger2,!1)}function newEncryptChannelAppSecretsStep(secretService,logger2,isCreate){async function resolveSecret(ctx,fieldName,requestValue,readExisting){if(requestValue==="")return requestValue;if(requestValue===REDACTED_MARKER2)return preserveExistingSecret2(ctx,fieldName,readExisting);if(isCiphertextShaped(requestValue))throw invalidArgumentError(plaintextRequiredMessage(fieldName));if(!secretService.isEnabled())return logger2.warn(`Encryption disabled: ${fieldName} will be stored in plaintext`),requestValue;try{return await secretService.encrypt(requestValue,EncryptionScope.forOrganization(ctx.newState.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt ${fieldName}`)}}function preserveExistingSecret2(ctx,fieldName,readExisting){if(isCreate)throw invalidArgumentError(markerOnCreateMessage(fieldName));let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not loaded"),`cannot preserve ${fieldName}: existing resource not loaded`);let existingSecret=readExisting(existing);if(existingSecret==="")throw invalidArgumentError(noExistingSecretMessage(fieldName));return existingSecret}return{name:"EncryptChannelAppSecrets",async execute(ctx){let provider=ctx.newState.spec?.providerConfig;switch(provider?.case){case"slack":{let slack=provider.value;slack.clientSecret=await resolveSecret(ctx,"client_secret",slack.clientSecret,existing=>existing.spec?.providerConfig.case==="slack"?existing.spec.providerConfig.value.clientSecret:""),slack.signingSecret=await resolveSecret(ctx,"signing_secret",slack.signingSecret,existing=>existing.spec?.providerConfig.case==="slack"?existing.spec.providerConfig.value.signingSecret:"");return}case"whatsapp":{let whatsapp=provider.value;whatsapp.appSecret=await resolveSecret(ctx,"app_secret",whatsapp.appSecret,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.appSecret:""),whatsapp.accessToken=await resolveSecret(ctx,"access_token",whatsapp.accessToken,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.accessToken:""),whatsapp.verifyToken=await resolveSecret(ctx,"verify_token",whatsapp.verifyToken,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.verifyToken:"");return}case void 0:return;default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}}}function newValidateProviderImmutableStep(){return{name:"ValidateProviderImmutable",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing channel app not found in context"),"existing channel app not found in context");let existingCase=existing.spec?.providerConfig.case,inputCase=ctx.input.spec?.providerConfig.case;if(existingCase!==inputCase)throw invalidArgumentError(PROVIDER_IMMUTABLE_MESSAGE)}}}function newCheckNoReferencingChannelsStep(store,logger2){return{name:"CheckNoReferencingChannels",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing ChannelApp not loaded in delete pipeline"),"existing ChannelApp not loaded in delete pipeline");let org=existing.metadata?.org??"",slug=existing.metadata?.slug??"",rows;try{rows=await store.listResources(ApiResourceKind.agent_channel)}catch(error2){throw internalError(error2,"failed to list agent channels for referential integrity check")}for(let bytes of rows){let channel;try{channel=fromBinary2(AgentChannelSchema,bytes)}catch{logger2.warn("Failed to unmarshal agent channel during referential integrity check, skipping");continue}let ref=channel.spec?.appRef;if(ref===void 0||ref.slug==="")continue;if((ref.org!==""?ref.org:channel.metadata?.org??"")===org&&ref.slug===slug)throw failedPreconditionError(deleteBlockedByChannelMessage(org,slug,channel.metadata?.name??""))}}}}function registerChannelAppServices(router,deps){router.service(ChannelAppCommandController,{apply:(app,ctx)=>apply6(deps,app,ctx),create:(app,ctx)=>createChannelApp(deps,app,ctx),update:(app,ctx)=>update9(deps,app,ctx),delete:(input,ctx)=>deleteChannelApp(deps,input,ctx)}),router.service(ChannelAppQueryController,{get:(id,ctx)=>get12(deps,id,ctx),getByReference:(ref,ctx)=>getByReference6(deps,ref,ctx),listByOrg:(req,ctx)=>listByOrg(deps,req,ctx)})}function kindOf11(ctx){return ctx.values.get(apiResourceKindKey)}async function createChannelApp(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));return await newPipeline("channelapp-create",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEncryptChannelAppSecretsForCreateStep(deps.secretService,deps.logger)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),redactChannelApp(reqCtx.newState),reqCtx.newState}async function update9(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));return await newPipeline("channelapp-update",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateProviderImmutableStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newEncryptChannelAppSecretsForUpdateStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).build().execute(reqCtx),redactChannelApp(reqCtx.newState),reqCtx.newState}async function apply6(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-apply",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createChannelApp(deps,app,ctx):update9(deps,withResolvedApplyId(ChannelAppSchema,app,reqCtx),ctx)}async function deleteChannelApp(deps,input,ctx){let reqCtx=new RequestContext(ChannelAppCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf11(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("channelapp-delete",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,ChannelAppSchema)).addStep(newCheckNoReferencingChannelsStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,secretValuesOfChannelApp)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted ChannelApp not found in context"),"deleted ChannelApp not found in context");let app=deleted;return redactChannelApp(app),app}async function get12(deps,id,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-get",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ChannelAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactChannelApp(app),app}async function getByReference6(deps,ref,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-get-by-reference",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ChannelAppSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(ChannelAppQueryController.method.get))).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactChannelApp(app),app}var LIST_RESULT_KEY4="listResult";async function listByOrg(deps,req,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.listByOrg.input,req,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-list-by-org",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgStep(deps.store,deps.logger)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY4);if(result===void 0)throw internalError(new Error("ChannelApp list not found in context"),"ChannelApp list not found in context");return result}function newListByOrgStep(store,logger2){return{name:"ListByOrg",async execute(ctx){let org=ctx.input.org,rows;try{rows=await store.listResources(ApiResourceKind.channel_app)}catch(error2){throw internalError(error2,"failed to list ChannelApps")}let apps=[];for(let bytes of rows){let app;try{app=fromBinary2(ChannelAppSchema,bytes)}catch{logger2.warn("Failed to unmarshal ChannelApp, skipping");continue}(app.metadata?.org??"")===org&&(redactChannelApp(app),apps.push(app))}apps.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY4,create2(ChannelAppsSchema,{entries:apps}))}}}var file_ai_stigmer_agentic_environment_v1_command=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvZW52aXJvbm1lbnQvdjEvY29tbWFuZC5wcm90bxIhYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxMoMKChxFbnZpcm9ubWVudENvbW1hbmRDb250cm9sbGVyEmcKBWFwcGx5Ei4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50Gi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50ErkBCgZjcmVhdGUSLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiT8K4GEsIDBAeIgxtZXRhZGF0YS5vcmcqN3VuYXV0aG9yaXplZCB0byBjcmVhdGUgZW52aXJvbm1lbnQgaW4gdGhpcyBvcmdhbml6YXRpb24SowEKBnVwZGF0ZRIuLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudBouLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudCI5wrgYNQgCEDUiC21ldGFkYXRhLmlkKiJ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGVudmlyb25tZW50Er8BChB1cGRhdGVWaXNpYmlsaXR5EjUuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlVwZGF0ZVZpc2liaWxpdHlJbnB1dBouLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudCJEwrgYQAgCEDUiC3Jlc291cmNlX2lkKi11bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGVudmlyb25tZW50IHZpc2liaWxpdHkSqwEKBmRlbGV0ZRI2LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZURlbGV0ZUlucHV0Gi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50IjnCuBg1CAIQNSILcmVzb3VyY2VfaWQqInVuYXV0aG9yaXplZCB0byBkZWxldGUgZW52aXJvbm1lbnQSzwEKD3VwZGF0ZVZhcmlhYmxlcxJELmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5VcGRhdGVFbnZpcm9ubWVudFZhcmlhYmxlc1JlcXVlc3QaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiRsK4GEIIAhA1Ig5lbnZpcm9ubWVudF9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBlbnZpcm9ubWVudCB2YXJpYWJsZXMSzwEKD3JlbW92ZVZhcmlhYmxlcxJELmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5SZW1vdmVFbnZpcm9ubWVudFZhcmlhYmxlc1JlcXVlc3QaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiRsK4GEIIAhA1Ig5lbnZpcm9ubWVudF9pZCosdW5hdXRob3JpemVkIHRvIHJlbW92ZSBlbnZpcm9ubWVudCB2YXJpYWJsZXMaBKD/KzViBnByb3RvMw",[file_ai_stigmer_agentic_environment_v1_api,file_ai_stigmer_agentic_environment_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EnvironmentCommandController=serviceDesc(file_ai_stigmer_agentic_environment_v1_command,0);var file_ai_stigmer_agentic_environment_v1_query=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvZW52aXJvbm1lbnQvdjEvcXVlcnkucHJvdG8SIWFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MTKMBQoaRW52aXJvbm1lbnRRdWVyeUNvbnRyb2xsZXISlgEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50IjDCuBgsCAEQNSIFdmFsdWUqH3VuYXV0aG9yaXplZCB0byBnZXQgZW52aXJvbm1lbnQSfAoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiBNC4GAES0gEKDmdldFNlY3JldFZhbHVlEj4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50U2VjcmV0VmFsdWVJbnB1dBozLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudFZhbHVlIkvCuBhHCBAQNSIOZW52aXJvbm1lbnRfaWQqMXVuYXV0aG9yaXplZCB0byByZWFkIHNlY3JldCB2YWx1ZXMgKGNyZWF0b3Itb25seSkSfAoEbGlzdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5MaXN0RW52aXJvbm1lbnRzUmVxdWVzdBoyLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudExpc3QiBNC4GAEaBKD/KzViBnByb3RvMw",[file_ai_stigmer_agentic_environment_v1_api,file_ai_stigmer_agentic_environment_v1_io,file_ai_stigmer_agentic_environment_v1_spec,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EnvironmentQueryController=serviceDesc(file_ai_stigmer_agentic_environment_v1_query,0);function redactEnvironmentSecrets(env2){let data=env2?.spec?.data;if(data!==void 0)for(let value of Object.values(data))value.isSecret&&value.value!==""&&(value.value=REDACTED_MARKER)}function shareRestrictionReason(metadata){let labels=metadata?.labels??{};return labels[PERSONAL_LABEL_KEY]===PERSONAL_LABEL_VALUE?PERSONAL_SHARE_RESTRICTION:labels[MANAGED_LABEL_KEY]===MANAGED_LABEL_VALUE?MANAGED_SHARE_RESTRICTION:""}var environmentSearchExtractor={kind:ApiResourceKind.environment,schema:EnvironmentSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let env2=resource;return buildSearchResult({kind:ApiResourceKind.environment,metadata:env2.metadata,summary:env2.spec?.description??"",score,createdAt:env2.status?.audit?.specAudit?.createdAt,updatedAt:env2.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let env2=resource,metadata=env2.metadata;if(metadata!==void 0)return{name:metadata.name,description:env2.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(env2.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var SECRET_VALUE_KEY="secretValue",UPDATED_ENVIRONMENT_KEY="updatedEnvironment";function newPreserveRedactedSecretsStep(){return{name:"PreserveRedactedSecrets",execute(ctx){let data=ctx.newState.spec?.data;if(data===void 0||Object.keys(data).length===0)return;let existingData=ctx.get(EXISTING_RESOURCE_KEY)?.spec?.data??{};for(let[key,value]of Object.entries(data))if(value.isSecret){if(value.value===REDACTED_MARKER){let existingEntry=existingData[key];if(existingEntry!==void 0&&existingEntry.isSecret){data[key]=existingEntry;continue}throw invalidArgumentError(markerRejectionMessage(key))}if(isCiphertextShaped(value.value))throw invalidArgumentError(forgedCiphertextMessage(key))}}}}function newEncryptSecretValuesStep(secretService,logger2){return{name:"EncryptSecretValues",async execute(ctx){let env2=ctx.newState,data=env2.spec?.data;if(!(data===void 0||Object.keys(data).length===0)){if(!secretService.isEnabled()){hasNonEmptySecret(data)&&logger2.warn("Encryption disabled: environment secret values will be stored in plaintext",{environmentId:env2.metadata?.id??""});return}for(let[key,value]of Object.entries(data))if(!(!value.isSecret||value.value===""))try{value.value=await secretService.encrypt(value.value,EncryptionScope.forOrganization(env2.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt secret value for variable '${key}'`)}}}}}function hasNonEmptySecret(data){return Object.values(data).some(v=>v.isSecret&&v.value!=="")}function newEnforcePersonalUniquenessStep(store){return{name:"EnforcePersonalEnvUniqueness",async execute(ctx){let metadata=ctx.newState.metadata;if(metadata===void 0||metadata.labels[PERSONAL_LABEL_KEY]!==PERSONAL_LABEL_VALUE)return;let existing;try{existing=await findResourceByLabelAndOrg(store,ctx.apiResourceKind,EnvironmentSchema,PERSONAL_LABEL_KEY,PERSONAL_LABEL_VALUE,metadata.org)}catch(error2){throw internalError(error2,"failed to check personal environment uniqueness")}if(existing!==void 0)throw new ConnectError(personalEnvironmentExistsMessage(existing.metadata?.id??""),Code.AlreadyExists)}}}function newLoadEnvironmentByIdStep(store){return{name:"LoadEnvironmentByID",async execute(ctx){let environmentId=ctx.input.environmentId;if(typeof environmentId!="string"||environmentId==="")throw invalidArgumentError("environment_id is required");let env2;try{env2=await store.getResource(ctx.apiResourceKind,environmentId,EnvironmentSchema)}catch{throw notFoundError("environment",environmentId)}ctx.set(TARGET_RESOURCE_KEY,env2)}}}function newExtractAndDecryptSingleKeyStep(secretService,logger2){return{name:"ExtractAndDecryptSingleKey",async execute(ctx){let key=ctx.input.key,env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");let envValue=env2.spec?.data[key];if(envValue===void 0)throw notFoundError("environment key",key);if(envValue.isSecret&&envValue.value!==""){let decrypted;try{decrypted=await secretService.decrypt(envValue.value)}catch(error2){throw logger2.error("Failed to decrypt secret value",{key,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to decrypt secret value")}ctx.set(SECRET_VALUE_KEY,create2(EnvironmentValueSchema,{value:decrypted,isSecret:!0,description:envValue.description}));return}ctx.set(SECRET_VALUE_KEY,envValue)}}}function newMergeVariablesAndPersistStep(store,secretService,logger2){return{name:"MergeVariablesAndPersist",async execute(ctx){let env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");env2.spec===void 0&&(env2.spec=create2(EnvironmentSpecSchema,{}));let incoming=ctx.input.variables;for(let[key,incomingValue]of Object.entries(incoming)){let value=incomingValue;if(value.isSecret&&value.value===REDACTED_MARKER){let existing=env2.spec.data[key];if(existing!==void 0&&existing.isSecret)continue;throw invalidArgumentError(markerRejectionMessage(key))}if(value.isSecret&&isCiphertextShaped(value.value))throw invalidArgumentError(forgedCiphertextMessage(key));if(value.isSecret&&value.value!=="")if(!secretService.isEnabled())logger2.warn("Encryption disabled: environment secret value will be stored in plaintext",{key});else{let encrypted;try{encrypted=await secretService.encrypt(value.value,EncryptionScope.forOrganization(env2.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt secret value for variable '${key}'`)}value=create2(EnvironmentValueSchema,{value:encrypted,isSecret:!0,description:value.description})}env2.spec.data[key]=value}try{setAuditFieldsForUpdate(EnvironmentSchema,env2,"spec_audit",ctx.callerIdentity)}catch(error2){throw internalError(error2,"failed to set audit fields")}try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to persist environment after merging variables")}ctx.set(UPDATED_ENVIRONMENT_KEY,env2)}}}function newRemoveVariableKeysAndPersistStep(store,secretService,logger2){return{name:"RemoveVariableKeysAndPersist",async execute(ctx){let env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");let keys=ctx.input.keys,removedSecretValues=[];if(env2.spec?.data!==void 0)for(let key of keys){let removed=env2.spec.data[key];removed!==void 0&&removed.isSecret&&removedSecretValues.push(removed.value),delete env2.spec.data[key]}try{setAuditFieldsForUpdate(EnvironmentSchema,env2,"spec_audit",ctx.callerIdentity)}catch(error2){throw internalError(error2,"failed to set audit fields")}try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to persist environment after removing variables")}await destroySecretBackingState(secretService,logger2,{kind:"environment",resourceId:env2.metadata?.id??"",operation:"removeVariables"},removedSecretValues),ctx.set(UPDATED_ENVIRONMENT_KEY,env2)}}}function newDestroyDroppedEnvironmentSecretsStep(secretService,logger2){return{name:"DestroyDroppedEnvironmentSecrets",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY),oldData=existing?.spec?.data;if(oldData===void 0)return;let newData=ctx.newState.spec?.data??{},droppedSecretValues=Object.entries(oldData).filter(([key,value])=>value.isSecret&&newData[key]===void 0).map(([,value])=>value.value);await destroySecretBackingState(secretService,logger2,{kind:"environment",resourceId:existing?.metadata?.id??"",operation:"update"},droppedSecretValues)}}}function secretValuesOfEnvironment(env2){return Object.values(env2.spec?.data??{}).filter(value=>value.isSecret).map(value=>value.value)}function registerEnvironmentServices(router,deps){router.service(EnvironmentCommandController,{apply:(env2,ctx)=>apply7(deps,env2,ctx),create:(env2,ctx)=>createEnvironment(deps,env2,ctx),update:(env2,ctx)=>update10(deps,env2,ctx),updateVisibility:(input,ctx)=>updateVisibility3(deps,input,ctx),delete:(input,ctx)=>deleteEnvironment(deps,input,ctx),updateVariables:(req,ctx)=>updateVariables(deps,req,ctx),removeVariables:(req,ctx)=>removeVariables(deps,req,ctx)}),router.service(EnvironmentQueryController,{get:(id,ctx)=>get13(deps,id,ctx),getByReference:(ref,ctx)=>getByReference7(deps,ref,ctx),getSecretValue:(input,ctx)=>getSecretValue(deps,input,ctx),list:(req,ctx)=>list8(deps,req,ctx)})}function kindOf12(ctx){return ctx.values.get(apiResourceKindKey)}async function createEnvironment(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-create",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEnforcePersonalUniquenessStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPreserveRedactedSecretsStep()).addStep(newEncryptSecretValuesStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,environmentSearchExtractor,deps.logger)).build().execute(reqCtx),redactEnvironmentSecrets(reqCtx.newState),reqCtx.newState}async function update10(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-update",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPreserveRedactedSecretsStep()).addStep(newEncryptSecretValuesStep(deps.secretService,deps.logger)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newDestroyDroppedEnvironmentSecretsStep(deps.secretService,deps.logger)).addStep(newIndexSearchStep(deps.store,environmentSearchExtractor,deps.logger)).build().execute(reqCtx),redactEnvironmentSecrets(reqCtx.newState),reqCtx.newState}async function apply7(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-apply",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createEnvironment(deps,env2,ctx):update10(deps,withResolvedApplyId(EnvironmentSchema,env2,reqCtx),ctx)}async function deleteEnvironment(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf12(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("environment-delete",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,EnvironmentSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,secretValuesOfEnvironment)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted environment not found in context"),"deleted environment not found in context");let env2=deleted;return redactEnvironmentSecrets(env2),env2}var UPDATE_VISIBILITY_ENVIRONMENT_KEY="updateVisibilityEnvironment";async function updateVisibility3(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-update-visibility",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentForVisibilityUpdateStep(deps.store)).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_ENVIRONMENT_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newValidateEnvironmentShareRestrictionStep()).addStep(newSetEnvironmentVisibilityStep()).addStep(newPersistEnvironmentForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_ENVIRONMENT_KEY)).addStep(newIndexEnvironmentAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx);let env2=reqCtx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);return redactEnvironmentSecrets(env2),env2}function newLoadEnvironmentForVisibilityUpdateStep(store){return{name:"LoadEnvironmentForVisibilityUpdate",async execute(ctx){let input=ctx.input,env2;try{env2=await store.getResource(ctx.apiResourceKind,input.resourceId,EnvironmentSchema)}catch{throw notFoundError("environment",input.resourceId)}ctx.set(UPDATE_VISIBILITY_ENVIRONMENT_KEY,env2)}}}function newValidateEnvironmentShareRestrictionStep(){return{name:"ValidateEnvironmentShareRestriction",execute(ctx){if(ctx.input.visibility!==ApiResourceVisibility.visibility_org)return;let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY),reason=shareRestrictionReason(env2.metadata);if(reason!=="")throw failedPreconditionError(reason)}}}function newSetEnvironmentVisibilityStep(){return{name:"SetVisibility",execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);env2.metadata!==void 0&&(env2.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(EnvironmentSchema,env2,"status_audit",ctx.callerIdentity)}}}function newPersistEnvironmentForVisibilityUpdateStep(store){return{name:"PersistEnvironmentForVisibilityUpdate",async execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to save environment")}}}}function newIndexEnvironmentAfterVisibilityUpdateStep(store,logger2){return{name:"IndexEnvironmentAfterVisibilityUpdate",async execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY),entry=environmentSearchExtractor.getSearchIndexEntry(env2);if(entry===void 0){logger2.warn("IndexEnvironmentAfterVisibilityUpdate: extractor returned nil, skipping",{id:env2.metadata?.id??""});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,env2.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexEnvironmentAfterVisibilityUpdate: failed (best-effort)",{id:env2.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function updateVariables(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.updateVariables.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-update-variables",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.updateVariables,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newMergeVariablesAndPersistStep(deps.store,deps.secretService,deps.logger)).build().execute(reqCtx);let updated=reqCtx.get(UPDATED_ENVIRONMENT_KEY);return redactEnvironmentSecrets(updated),updated}async function removeVariables(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.removeVariables.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-remove-variables",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.removeVariables,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newRemoveVariableKeysAndPersistStep(deps.store,deps.secretService,deps.logger)).build().execute(reqCtx);let updated=reqCtx.get(UPDATED_ENVIRONMENT_KEY);return redactEnvironmentSecrets(updated),updated}async function get13(deps,id,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-get",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,EnvironmentSchema)).build().execute(reqCtx);let env2=reqCtx.get(TARGET_RESOURCE_KEY);return redactEnvironmentSecrets(env2),env2}async function getByReference7(deps,ref,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-get-by-reference",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,EnvironmentSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(EnvironmentQueryController.method.get))).build().execute(reqCtx);let env2=reqCtx.get(TARGET_RESOURCE_KEY);return redactEnvironmentSecrets(env2),env2}async function getSecretValue(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.getSecretValue.input,input,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-get-secret-value",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.getSecretValue,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newExtractAndDecryptSingleKeyStep(deps.secretService,deps.logger)).build().execute(reqCtx),reqCtx.get(SECRET_VALUE_KEY)}var LIST_RESULT_KEY5="listResult";async function list8(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-list",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgAndLabelsStep5(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY5);if(result===void 0)throw internalError(new Error("environment list not found in context"),"environment list not found in context");return result}function newListByOrgAndLabelsStep5(store,listReadScope){return{name:"ListByOrgAndLabels",async execute(ctx){let{org,labels:filterLabels}=ctx.input,rows;try{rows=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list environments")}let decoded=[];for(let bytes of rows)try{decoded.push(fromBinary2(EnvironmentSchema,bytes))}catch{continue}let requested=decoded.filter(env2=>(env2.metadata?.org??"")===org&&matchesAllLabels(env2.metadata?.labels??{},filterLabels)),environments=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.environment,requested,"");for(let env2 of environments)redactEnvironmentSecrets(env2);environments.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY5,create2(EnvironmentListSchema,{totalCount:environments.length,items:environments}))}}}var file_ai_stigmer_agentic_executioncontext_v1_command=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9jb21tYW5kLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MTLpAwohRXhlY3V0aW9uQ29udGV4dENvbW1hbmRDb250cm9sbGVyEnsKBWFwcGx5EjguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQSggEKBmNyZWF0ZRI4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQaOC5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0IgTQuBgBErsBCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQiP8K4GDsIAhA2IgtyZXNvdXJjZV9pZCoodW5hdXRob3JpemVkIHRvIGRlbGV0ZSBleGVjdXRpb24gY29udGV4dBoEoP8rNmIGcHJvdG8z",[file_ai_stigmer_agentic_executioncontext_v1_api,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ExecutionContextCommandController=serviceDesc(file_ai_stigmer_agentic_executioncontext_v1_command,0);var file_ai_stigmer_agentic_executioncontext_v1_io=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9pby5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEiKwoSRXhlY3V0aW9uQ29udGV4dElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiQQogRXhlY3V0aW9uQ29udGV4dEV4ZWN1dGlvbklkSW5wdXQSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABYgZwcm90bzM",[file_buf_validate_validate]);var file_ai_stigmer_agentic_executioncontext_v1_query=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9xdWVyeS5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEyhQQKH0V4ZWN1dGlvbkNvbnRleHRRdWVyeUNvbnRyb2xsZXISswEKA2dldBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHRJZBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQiNsK4GDIIARA2IgV2YWx1ZSoldW5hdXRob3JpemVkIHRvIGdldCBleGVjdXRpb24gY29udGV4dBKGAQoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaOC5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0IgTQuBgBEpwBChBnZXRCeUV4ZWN1dGlvbklkEkguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dEV4ZWN1dGlvbklkSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0IgTQuBgBGgSg/ys2YgZwcm90bzM",[file_ai_stigmer_agentic_executioncontext_v1_api,file_ai_stigmer_agentic_executioncontext_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ExecutionContextQueryController=serviceDesc(file_ai_stigmer_agentic_executioncontext_v1_query,0);function redactExecutionContextSecrets(ec2){let data=ec2?.spec?.data;if(data!==void 0)for(let value of Object.values(data))value.isSecret&&value.value!==""&&(value.value=REDACTED_MARKER)}var import_node_crypto18=require("node:crypto"),CONNECT_EXECUTION_ID_PREFIX="connect-";function newConnectExecutionId(mcpServerId){return`${CONNECT_EXECUTION_ID_PREFIX}${mcpServerId}-${(0,import_node_crypto18.randomUUID)().slice(0,8)}`}function isConnectExecutionId(executionId){return executionId.startsWith(CONNECT_EXECUTION_ID_PREFIX)}function isTerminalWorkflowExecutionPhase(phase){switch(phase){case ExecutionPhase2.EXECUTION_COMPLETED:case ExecutionPhase2.EXECUTION_FAILED:case ExecutionPhase2.EXECUTION_CANCELLED:case ExecutionPhase2.EXECUTION_TERMINATED:return!0;default:return!1}}var RUNNER_VERIFIER_NAME="runner",RUNNER_CREDENTIAL_INVALID_MESSAGE="runner credential is not valid on this server",RUNNER_CREDENTIAL_NOT_LIVE_MESSAGE="runner credential names a run that is over or belongs to nobody this server recognizes",RUN_CREDENTIAL_NOT_RUNS_PERSON_MESSAGE="a run credential is minted only for the person whose run it is",WORKFLOW_LINEAGE_BINDING_MISMATCH_MESSAGE="workflow lineage label names a workflow execution this runner credential is not bound to",MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE="memory capture is scoped to the session's organization";function boundExecutionKindOf(executionId){switch(kindByIdPrefix(executionId)){case ApiResourceKind.agent_execution:return"agent-execution";case ApiResourceKind.workflow_execution:return"workflow-execution";default:return isConnectExecutionId(executionId)?"mcp-connect":void 0}}function bindsARun(kind){switch(kind){case"agent-execution":case"workflow-execution":return!0;case"mcp-connect":return!1;default:{let exhaustive=kind;throw new Error(`unknown bound execution kind ${String(exhaustive)}`)}}}async function loadBoundExecution(store,executionId,now=Date.now()){let kind=boundExecutionKindOf(executionId);if(kind!==void 0)switch(kind){case"agent-execution":{let row=await getRow(store,ApiResourceKind.agent_execution,executionId,AgentExecutionSchema);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(AgentExecutionSchema,row),sessionId:row.spec?.sessionId??"",live:isLive(row.status!==void 0&&isTerminalExecutionPhase(row.status.phase),row.status?.completedAt??"",now)}}case"workflow-execution":{let row=await getRow(store,ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(WorkflowExecutionSchema,row),sessionId:"",live:isLive(row.status!==void 0&&isTerminalWorkflowExecutionPhase(row.status.phase),row.status?.completedAt??"",now)}}case"mcp-connect":{let row=await getExecutionContextRow(store,executionId);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(ExecutionContextSchema,row),sessionId:"",live:!0}}default:{let exhaustive=kind;throw new Error(`unknown bound execution kind ${String(exhaustive)}`)}}}function isLive(terminal,completedAt,now){if(!terminal)return!0;let finishedAt=Date.parse(completedAt);return Number.isNaN(finishedAt)?!1:now-finishedAt<6e5}function creatorStampOf(schema2,row){return auditOf(schema2,row)?.specAudit?.createdBy?.id??""}async function getRow(store,kind,id,schema2){try{return await store.getResource(kind,id,schema2)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function getExecutionContextRow(store,executionId){try{return await store.findByField(ApiResourceKind.execution_context,"spec.executionId",executionId,ExecutionContextSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}function ciphertextShapedMessage(key){return`value for '${key}' looks like stored ciphertext (enc:v<N>: prefix); supply the plaintext value`}var ENCRYPT_BATCH_FAILURE_MESSAGE="failed to encrypt secret values";function encryptionKeyMissingMessage(executionId,key){return`execution context for ${executionId} holds encrypted secret '${key}' but no encryption key is configured`}async function resolveValuesForCaller(deps,ctx,ec2){if(await runnerMayDecrypt(deps,ctx,ec2)){await decryptSecretValues(deps,ec2);return}redactExecutionContextSecrets(ec2)}async function runnerMayDecrypt(deps,ctx,ec2){let authorizeRead=deps.runnerAuthService.authorizeExecutionContextRead?.bind(deps.runnerAuthService);if(authorizeRead!==void 0){let token2=bearerToken(ctx);if(token2==="")return!1;try{return await authorizeRead(token2,ec2.spec?.executionId??"")}catch(error2){return deps.logger.warn("ExecutionContext read authorization failed \u2014 redacting secrets",{error:error2 instanceof Error?error2.message:String(error2)}),!1}}let token=bearerToken(ctx),executionId=verifyRunnerToken(deps,token,ec2);return executionId===void 0?!1:!isClockedToken(token)&&!await runIsLive(deps,executionId)?(deps.logger.debug("Run credential presented for a run that is over - redacting execution context secrets",{executionId}),!1):(deps.logger.debug("Scope-bound runner token presented - decrypting execution context secrets",{executionId}),!0)}function verifyRunnerToken(deps,token,ec2){if(token==="")return;let tokenExecutionId;try{tokenExecutionId=deps.runnerAuthService.verify(TOKEN_TYPE_EXECUTION_SCOPED,token)}catch{deps.logger.debug("Presented runner token failed verification - redacting execution context secrets");return}if(tokenExecutionId!==(ec2.spec?.executionId??"")){deps.logger.warn("Runner token is not scope-bound to this execution context - redacting secrets",{tokenExecutionId,executionId:ec2.spec?.executionId??""});return}return tokenExecutionId}async function runIsLive(deps,executionId){try{let execution=await loadBoundExecution(deps.store,executionId);return execution!==void 0&&bindsARun(execution.kind)&&execution.live}catch(error2){throw internalError(error2,"failed to load the run credential's execution")}}function bearerToken(ctx){return parseBearerToken(ctx.requestHeader.get("authorization")??"")}async function decryptSecretValues(deps,ec2){let executionId=ec2.spec?.executionId??"",data=ec2.spec?.data??{};for(let[key,value]of Object.entries(data))if(!(!value.isSecret||!deps.secretService.isEncrypted(value.value)))try{value.value=await deps.secretService.decrypt(value.value)}catch(error2){if(error2 instanceof EncryptionUnavailableError)throw internalError(error2,encryptionKeyMissingMessage(executionId,key));deps.logger.warn("Undecryptable ciphertext in execution context \u2014 dropping this value from the runner read",{key,executionId,error:error2 instanceof Error?error2.message:String(error2)}),delete data[key]}}var executionContextSearchExtractor={kind:ApiResourceKind.execution_context,schema:ExecutionContextSchema,getSearchSummary(){return""},toSearchResult(resource,score){let ec2=resource;return buildSearchResult({kind:ApiResourceKind.execution_context,metadata:ec2.metadata,summary:"",score,createdAt:ec2.status?.audit?.specAudit?.createdAt,updatedAt:ec2.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let ec2=resource,metadata=ec2.metadata;if(metadata!==void 0)return{name:metadata.name,description:"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(ec2.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function newRejectCiphertextShapedStep(){return{name:"RejectCiphertextShapedValues",execute(ctx){let data=ctx.input.spec?.data??{};for(let[key,value]of Object.entries(data))if(isCiphertextShaped(value.value))throw invalidArgumentError(ciphertextShapedMessage(key))}}}function newEncryptSecretValuesStep2(secretService,logger2){return{name:"EncryptSecretValues",async execute(ctx){let ec2=ctx.newState,data=ec2.spec?.data;if(data===void 0||Object.keys(data).length===0)return;if(!secretService.isEnabled()){hasNonEmptySecret2(data)&&logger2.warn("Encryption disabled: execution context secret values will be stored in plaintext",{executionId:ec2.spec?.executionId??""});return}let toSeal=new Map;for(let[key,value]of Object.entries(data))!value.isSecret||value.value===""||toSeal.set(key,value.value);if(toSeal.size===0)return;let sealed;try{sealed=await secretService.encryptAllAtMostV2(toSeal,EncryptionScope.forOrganization(ec2.metadata?.org??""))}catch(error2){throw internalError(error2,ENCRYPT_BATCH_FAILURE_MESSAGE)}for(let[key,value]of Object.entries(data)){let sealedValue=sealed.get(key);sealedValue!==void 0&&(value.value=sealedValue)}}}}function hasNonEmptySecret2(data){return Object.values(data).some(v=>v.isSecret&&v.value!=="")}function newLoadByExecutionIdStep(store){return{name:"LoadByExecutionId",async execute(ctx){let input=ctx.input;if(input.executionId==="")throw invalidArgumentError("execution_id is required");let executionContext;try{executionContext=await store.findByField(ctx.apiResourceKind,"spec.executionId",input.executionId,ExecutionContextSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("execution_context",`execution_id=${input.executionId}`):internalError(error2,"failed to query execution context")}ctx.set(TARGET_RESOURCE_KEY,executionContext)}}}function newAuthorizeExecutionContextCreateStep(authorizer){return{name:"AuthorizeCreate",async execute(ctx){let caller=ctx.callerIdentity;if(isServerComposedRequest(caller))return;let decision;try{decision=await authorizer.authorize(caller,{permission:IamPermission.can_create_execution_in,resourceKind:ApiResourceKind.organization,resourceId:ctx.newState.metadata?.org??""})}catch(error2){throw internalError(error2 instanceof Error?error2:new Error(String(error2)),"execution-context create authorization could not be completed")}switch(decision.kind){case"allow":return;case"deny":case"not-found":throw new ConnectError("unauthorized to create execution context in this organization",Code.PermissionDenied);case"unavailable":throw internalError(decision.cause,"execution-context create authorization could not be completed");default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),"execution-context create authorization could not be completed")}}}}}function registerExecutionContextServices(router,deps){router.service(ExecutionContextCommandController,{apply:(ec2,ctx)=>apply8(deps,ec2,ctx),create:(ec2,ctx)=>createExecutionContext(deps,ec2,ctx),delete:(input,ctx)=>deleteExecutionContext(deps,input,ctx)}),router.service(ExecutionContextQueryController,{get:(id,ctx)=>get14(deps,id,ctx),getByReference:(ref,ctx)=>getByReference8(deps,ref,ctx),getByExecutionId:(input,ctx)=>getByExecutionId(deps,input,ctx)})}function kindOf13(ctx){return ctx.values.get(apiResourceKindKey)}async function createExecutionContext(deps,ec2,ctx){let reqCtx=new RequestContext(ExecutionContextSchema,ec2,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("execution-context-create",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeExecutionContextCreateStep(deps.authorizer)).addStep(newValidateVisibilityStep()).addStep(newRejectCiphertextShapedStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newEncryptSecretValuesStep2(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,executionContextSearchExtractor,deps.logger)).build().execute(reqCtx),redactExecutionContextSecrets(reqCtx.newState),reqCtx.newState}async function apply8(deps,ec2,ctx){let reqCtx=new RequestContext(ExecutionContextSchema,ec2,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-apply",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");if(shouldCreate)return createExecutionContext(deps,ec2,ctx);throw deps.logger.warn("ExecutionContext already exists - UPDATE not supported",{slug:ec2.metadata?.name??"",id:ec2.metadata?.id??""}),alreadyExistsError("ExecutionContext",ec2.metadata?.name??"")}async function deleteExecutionContext(deps,input,ctx){let reqCtx=new RequestContext(ExecutionContextCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf13(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("execution-context-delete",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,ExecutionContextSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted execution context not found in context"),"deleted execution context not found in context");let ec2=deleted;return redactExecutionContextSecrets(ec2),ec2}async function get14(deps,id,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ExecutionContextSchema)).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return redactExecutionContextSecrets(ec2),ec2}async function getByReference8(deps,ref,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get-by-reference",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ExecutionContextSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(ExecutionContextQueryController.method.get))).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return redactExecutionContextSecrets(ec2),ec2}async function getByExecutionId(deps,input,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.getByExecutionId.input,input,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get-by-execution-id",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.getByExecutionId,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByExecutionIdStep(deps.store)).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return await resolveValuesForCaller(deps,ctx,ec2),ec2}var import_node_crypto19=require("node:crypto");var file_ai_stigmer_platform_github_v1_service=fileDesc("CithaS9zdGlnbWVyL3BsYXRmb3JtL2dpdGh1Yi92MS9zZXJ2aWNlLnByb3RvEh1haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MSI8ChtHZXRPQXV0aEF1dGhvcml6ZVVybFJlcXVlc3QSHQoMcmVkaXJlY3RfdXJpGAEgASgJQge6SARyAhABIkQKHEdldE9BdXRoQXV0aG9yaXplVXJsUmVzcG9uc2USFQoNYXV0aG9yaXplX3VybBgBIAEoCRINCgVzdGF0ZRgCIAEoCSJoChhFeGNoYW5nZU9BdXRoQ29kZVJlcXVlc3QSFQoEY29kZRgBIAEoCUIHukgEcgIQARIWCgVzdGF0ZRgCIAEoCUIHukgEcgIQARIdCgxyZWRpcmVjdF91cmkYAyABKAlCB7pIBHICEAEiVAoZRXhjaGFuZ2VPQXV0aENvZGVSZXNwb25zZRIUCgxhY2Nlc3NfdG9rZW4YASABKAkSEgoKdG9rZW5fdHlwZRgCIAEoCRINCgVzY29wZRgDIAEoCTK2AgoNR2l0SHViU2VydmljZRKVAQoUZ2V0T0F1dGhBdXRob3JpemVVcmwSOi5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HZXRPQXV0aEF1dGhvcml6ZVVybFJlcXVlc3QaOy5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HZXRPQXV0aEF1dGhvcml6ZVVybFJlc3BvbnNlIgTQuBgBEowBChFleGNoYW5nZU9BdXRoQ29kZRI3LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkV4Y2hhbmdlT0F1dGhDb2RlUmVxdWVzdBo4LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkV4Y2hhbmdlT0F1dGhDb2RlUmVzcG9uc2UiBNC4GAFiBnByb3RvMw",[file_ai_stigmer_commons_rpc_method_options,file_buf_validate_validate]);var GetOAuthAuthorizeUrlResponseSchema=messageDesc2(file_ai_stigmer_platform_github_v1_service,1);var ExchangeOAuthCodeResponseSchema=messageDesc2(file_ai_stigmer_platform_github_v1_service,3),GitHubService=serviceDesc(file_ai_stigmer_platform_github_v1_service,0);var GITHUB_AUTHORIZE_URL="https://github.com/login/oauth/authorize",GITHUB_TOKEN_URL="https://github.com/login/oauth/access_token",OAUTH_SCOPES="repo,read:user",HTTP_TIMEOUT_MS=1e4;function registerGitHubServices(router,deps){router.service(GitHubService,{getOAuthAuthorizeUrl:req=>getOAuthAuthorizeUrl(deps,req),exchangeOAuthCode:req=>exchangeOAuthCode(deps,req)})}function getOAuthAuthorizeUrl(deps,req){if(deps.clientId==="")throw failedPreconditionError("GitHub OAuth is not configured (STIGMER_GITHUB_CLIENT_ID not set)");let state2;try{state2=(0,import_node_crypto19.randomBytes)(16).toString("hex")}catch(error2){throw deps.logger.error("failed to generate OAuth state",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to generate OAuth state")}let authorizeUrl=GITHUB_AUTHORIZE_URL+"?"+goUrlValuesEncode({client_id:deps.clientId,redirect_uri:req.redirectUri,scope:OAUTH_SCOPES,state:state2});return create2(GetOAuthAuthorizeUrlResponseSchema,{authorizeUrl,state:state2})}async function exchangeOAuthCode(deps,req){if(deps.clientId===""||deps.clientSecret==="")throw failedPreconditionError("GitHub OAuth is not configured");let body=goUrlValuesEncode({client_id:deps.clientId,client_secret:deps.clientSecret,code:req.code,redirect_uri:req.redirectUri}),fetchImpl=deps.fetchImpl??fetch,response;try{response=await fetchImpl(GITHUB_TOKEN_URL,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body,signal:AbortSignal.timeout(HTTP_TIMEOUT_MS)})}catch(error2){throw deps.logger.error("GitHub token exchange failed",{error:error2 instanceof Error?error2.message:String(error2)}),unavailableError("failed to reach GitHub for token exchange")}let raw;try{raw=await response.text()}catch(error2){throw deps.logger.error("failed to read GitHub token response",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to read GitHub response")}let tokenResponse;try{tokenResponse=JSON.parse(raw)}catch(error2){throw deps.logger.error("failed to parse GitHub token response",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to parse GitHub response")}if(tokenResponse.error!==void 0&&tokenResponse.error!=="")throw deps.logger.warn("GitHub OAuth error",{error:tokenResponse.error,description:tokenResponse.error_description??""}),invalidArgumentError(`GitHub OAuth error: ${tokenResponse.error_description??""}`);return create2(ExchangeOAuthCodeResponseSchema,{accessToken:tokenResponse.access_token??"",tokenType:tokenResponse.token_type??"",scope:tokenResponse.scope??""})}var file_ai_stigmer_agentic_memory_v1_io=fileDesc("CiVhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2lvLnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxIiEKCE1lbW9yeUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiYAoTTGlzdE1lbW9yaWVzUmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESMwoJcGFnZV9pbmZvGAIgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbyJWCgpNZW1vcnlMaXN0EhMKC3RvdGFsX2NvdW50GAEgASgFEjMKBWl0ZW1zGAIgAygLMiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnliBnByb3RvMw",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]),MemoryIdSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,0);var MemoryListSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,2);var file_ai_stigmer_agentic_memory_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEypQUKF01lbW9yeUNvbW1hbmRDb250cm9sbGVyEloKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5GiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnkiBNC4GAESigEKBnVwZGF0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5GiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnkiNMK4GDAIAhA5IgttZXRhZGF0YS5pZCoddW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtZW1vcnkShgEKBmRlbGV0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIuwrgYKggDEDkiBXZhbHVlKh11bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1lbW9yeRKIAQoHY29uZmlybRImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIvwrgYKwgCEDkiBXZhbHVlKh51bmF1dGhvcml6ZWQgdG8gY29uZmlybSBtZW1vcnkShgEKBnJlamVjdBImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIuwrgYKggCEDkiBXZhbHVlKh11bmF1dGhvcml6ZWQgdG8gcmVqZWN0IG1lbW9yeRoEoP8rOWIGcHJvdG8z",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryCommandController=serviceDesc(file_ai_stigmer_agentic_memory_v1_command,0);var file_ai_stigmer_agentic_memory_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxMosCChVNZW1vcnlRdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIrwrgYJwgBEDkiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IG1lbW9yeRJpCgRsaXN0EjEuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5MaXN0TWVtb3JpZXNSZXF1ZXN0GiguYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlMaXN0IgTQuBgBGgSg/ys5YgZwcm90bzM",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryQueryController=serviceDesc(file_ai_stigmer_agentic_memory_v1_query,0);var MEMORY_CAPTURE_CALLER_MESSAGE="memory can only be captured for a first-party human operator",MEMORY_CAPTURE_CREDENTIAL_KEY="memoryCaptureCredential";function newGuardMemoryCaptureStep(provider){return{name:"GuardMemoryCapture",async execute(ctx){let caller=ctx.callerIdentity;if(isServerComposedRequest(caller))return;let decide=provider?.authorizeMemoryCapture;if(decide!==void 0){let org=metadataOf(ctx.newState)?.org??"",decision=await decide.call(provider,caller,org);switch(decision.verdict){case"admit":ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY,{subjectIdentityAccountId:decision.subjectIdentityAccountId,provedSessionId:decision.provedSessionId});return;case"refuse":throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied);case"no-opinion":break;default:{let exhaustive=decision;throw new Error(`unknown memory capture decision ${JSON.stringify(exhaustive)}`)}}}if(caller.callerClass==="machine"||carriesPlatformClientClaim(caller.rawToken))throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied)}}}function memoryCaptureCredentialOf(ctx){let payload=ctx.get(MEMORY_CAPTURE_CREDENTIAL_KEY);if(typeof payload=="object"&&payload!==null&&"subjectIdentityAccountId"in payload&&"provedSessionId"in payload)return payload}function carriesPlatformClientClaim(rawToken){let segments=rawToken.split(".");if(segments.length!==3)return!1;try{let payload=JSON.parse(Buffer.from(segments[1],"base64url").toString("utf8"));return typeof payload.platform_client_id=="string"&&payload.platform_client_id!==""}catch{return!1}}var MEMORY_FULL_MESSAGE="memory is full \u2014 review and delete existing memories";function memoryDisabledMessage(org){return`memory is not enabled for organization ${org} \u2014 an organization admin can enable it in organization preferences`}var MEMORY_CONFIRM_REJECTED_MESSAGE="memory was rejected \u2014 delete it and let the agent propose it again",MEMORY_REJECT_CONFIRMED_MESSAGE="memory was confirmed \u2014 delete it to stop it from being recalled",MEMORY_SUBJECT_IMMUTABLE_MESSAGE="spec.subject_identity_account_id is immutable \u2014 it is derived from the capturing credential at create",MEMORY_PROVENANCE_IMMUTABLE_MESSAGE="spec.provenance is immutable \u2014 it records where the fact came from";var LIST_RESULT_KEY6="listResult";function newResolveMemoryDefaultsStep(){return{name:"ResolveMemoryDefaults",execute(ctx){let memory=ctx.newState,metadata=memory.metadata;if((metadata?.org??"")==="")throw invalidArgumentError("metadata.org is required for a memory");if(metadata===void 0)throw internalError(new Error("metadata is nil"),"metadata is nil");metadata.id===""&&(metadata.id=generateId("mem")),metadata.name===""&&metadata.slug===""&&(metadata.name=metadata.id);let spec=memory.spec;if(spec===void 0)throw internalError(new Error("memory spec is nil"),"memory spec is nil");let captureCredential=memoryCaptureCredentialOf(ctx);spec.subjectIdentityAccountId=captureCredential?.subjectIdentityAccountId??"",spec.provenance!==void 0&&(spec.provenance.toolCallId=""),captureCredential!==void 0&&(spec.provenance===void 0&&(spec.provenance=create2(MemoryProvenanceSchema,{})),spec.provenance.sessionId=captureCredential.provedSessionId)}}}var MEMORY_CREATE_DENIED_MESSAGE="unauthorized to capture memory in this organization";function resolveMemoryCreateTargets(ctx){return isServerComposedRequest(ctx.callerIdentity)?[]:[{permission:IamPermission.can_create_session,resourceKind:ApiResourceKind.organization,resourceId:ctx.newState.metadata?.org??"",deniedMessage:MEMORY_CREATE_DENIED_MESSAGE}]}function newCheckMemoryEnablementStep(store){return{name:"CheckMemoryEnablement",async execute(ctx){let orgID=ctx.newState.metadata?.org??"",org;try{org=await store.getResource(ApiResourceKind.organization,orgID,OrganizationSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Organization",orgID):internalError(error2,"failed to load organization for memory enablement check")}if(org.spec?.preferences?.memoryEnabled!==!0)throw failedPreconditionError(memoryDisabledMessage(orgID))}}}function newCheckMemoryCapStep(store){return{name:"CheckMemoryCap",async execute(ctx){let newState=ctx.newState,org=newState.metadata?.org??"",subject=newState.spec?.subjectIdentityAccountId??"",rows;try{rows=await store.listResources(ApiResourceKind.memory)}catch(error2){throw internalError(error2,"failed to count memories for cap check")}let count=0;for(let bytes of rows){let existing=unmarshalMemory(bytes);existing!==void 0&&(existing.metadata?.org??"")===org&&(existing.spec?.subjectIdentityAccountId??"")===subject&&count++}if(count>=100)throw failedPreconditionError(MEMORY_FULL_MESSAGE)}}}function newInitializeMemoryLifecycleStep(){return{name:"InitializeMemoryLifecycle",execute(ctx){let memory=ctx.newState;memory.status===void 0&&(memory.status=create2(MemoryStatusSchema,{})),memory.status.lifecycleState=MemoryLifecycleState.lifecycle_state_proposed,memory.status.stateChangedAt=timestampNow()}}}function newValidateMemoryUpdateStep(){return{name:"ValidateMemoryUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing memory not found in context"),"existing memory not found in context");let newState=ctx.newState;if((newState.spec?.subjectIdentityAccountId??"")!==(existing.spec?.subjectIdentityAccountId??""))throw failedPreconditionError(MEMORY_SUBJECT_IMMUTABLE_MESSAGE);let newProvenance=newState.spec?.provenance,existingProvenance=existing.spec?.provenance;if(!(newProvenance===void 0||existingProvenance===void 0?newProvenance===existingProvenance:equals(MemoryProvenanceSchema,newProvenance,existingProvenance)))throw failedPreconditionError(MEMORY_PROVENANCE_IMMUTABLE_MESSAGE)}}}function newPersistMemoryUpdateStep(store){return{name:"PersistMemoryUpdate",async execute(ctx){let newState=ctx.newState,memoryId=newState.metadata?.id??"",live;try{live=await store.updateResource(ApiResourceKind.memory,memoryId,MemorySchema,row=>{row.apiVersion=newState.apiVersion,row.kind=newState.kind,row.metadata=newState.metadata,row.spec=newState.spec,newState.status?.audit!==void 0&&(row.status===void 0&&(row.status=create2(MemoryStatusSchema,{})),row.status.audit=newState.status.audit)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Memory",memoryId):internalError(error2,"failed to persist memory update")}ctx.setNewState(live)}}}function newTransitionMemoryLifecycleStep(store,target,blockedMessage){return{name:"TransitionMemoryLifecycle",async execute(ctx){let memoryId=ctx.get(EXISTING_RESOURCE_KEY).metadata?.id??"",transitionNoOp=new Error("memory already in target state"),blocked,live;try{live=await store.updateResource(ApiResourceKind.memory,memoryId,MemorySchema,row=>{live=row;let current=row.status?.lifecycleState??MemoryLifecycleState.lifecycle_state_unspecified;if(current===target)throw transitionNoOp;if(current!==MemoryLifecycleState.lifecycle_state_proposed&&current!==MemoryLifecycleState.lifecycle_state_unspecified)throw blocked=failedPreconditionError(blockedMessage),blocked;row.status===void 0&&(row.status=create2(MemoryStatusSchema,{})),row.status.lifecycleState=target,row.status.stateChangedAt=timestampNow(),setAuditFieldsForUpdate(MemorySchema,row,"status_audit",ctx.callerIdentity)})}catch(error2){if(error2!==transitionNoOp)throw blocked!==void 0&&error2===blocked?blocked:error2 instanceof ResourceNotFoundError?notFoundError("Memory",memoryId):internalError(error2,"failed to transition memory lifecycle")}if(live===void 0)throw internalError(new Error("transition closure did not observe the row"),"failed to transition memory lifecycle");ctx.set(EXISTING_RESOURCE_KEY,live)}}}function newListMemoriesByOrgStep(store,listReadScope){return{name:"ListMemoriesByOrg",async execute(ctx){let org=ctx.input.org,rows;try{rows=await store.listResources(ApiResourceKind.memory)}catch(error2){throw internalError(error2,"failed to list memories")}let decoded=[];for(let bytes of rows){let memory=unmarshalMemory(bytes);memory!==void 0&&decoded.push(memory)}let memories=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.memory,decoded.filter(memory=>(memory.metadata?.org??"")===org),"");memories.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY6,create2(MemoryListSchema,{totalCount:memories.length,items:memories}))}}}function unmarshalMemory(data){try{return fromBinary2(MemorySchema,data)}catch{return}}function registerMemoryServices(router,deps){router.service(MemoryCommandController,{create:(memory,ctx)=>createMemory(deps,memory,ctx),update:(memory,ctx)=>update11(deps,memory,ctx),delete:(id,ctx)=>deleteMemory(deps,id,ctx),confirm:(id,ctx)=>confirm(deps,id,ctx),reject:(id,ctx)=>reject(deps,id,ctx)}),router.service(MemoryQueryController,{get:(id,ctx)=>get15(deps,id,ctx),list:(req,ctx)=>list9(deps,req,ctx)})}function kindOf14(ctx){return ctx.values.get(apiResourceKindKey)}async function createMemory(deps,memory,ctx){let reqCtx=new RequestContext(MemorySchema,memory,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("memory-create",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider)).addStep(newValidateVisibilityStep()).addStep(newResolveMemoryDefaultsStep()).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveMemoryCreateTargets)).addStep(newCheckMemoryEnablementStep(deps.store)).addStep(newCheckMemoryCapStep(deps.store)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newInitializeMemoryLifecycleStep()).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update11(deps,memory,ctx){let reqCtx=new RequestContext(MemorySchema,memory,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("memory-update",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateMemoryUpdateStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistMemoryUpdateStep(deps.store)).build().execute(reqCtx),reqCtx.newState}async function confirm(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-confirm",MemoryCommandController.method.confirm,MemoryLifecycleState.lifecycle_state_confirmed,MEMORY_CONFIRM_REJECTED_MESSAGE)}async function reject(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-reject",MemoryCommandController.method.reject,MemoryLifecycleState.lifecycle_state_rejected,MEMORY_REJECT_CONFIRMED_MESSAGE)}async function runTransition(deps,memoryId,ctx,name,method,target,blockedMessage){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline(name,deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newTransitionMemoryLifecycleStep(deps.store,target,blockedMessage)).build().execute(reqCtx);let transitioned=reqCtx.get(EXISTING_RESOURCE_KEY);if(transitioned===void 0)throw internalError(new Error("transitioned memory not found in context"),"transitioned memory not found in context");return transitioned}async function deleteMemory(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-delete",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted memory not found in context"),"deleted memory not found in context");return deleted}async function get15(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-get",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,MemorySchema)).build().execute(reqCtx);let target=reqCtx.get(TARGET_RESOURCE_KEY);if(target===void 0)throw internalError(new Error("target memory not found in context"),"target memory not found in context");return target}async function list9(deps,req,ctx){let reqCtx=new RequestContext(MemoryQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-list",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListMemoriesByOrgStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY6);if(result===void 0)throw internalError(new Error("memory list not found in context"),"memory list not found in context");return result}var file_ai_stigmer_iam_oauthapp_v1_command=fileDesc("CihhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9jb21tYW5kLnByb3RvEhphaS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MTLOBAoZT0F1dGhBcHBDb21tYW5kQ29udHJvbGxlchJTCgVhcHBseRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHASowEKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiTcK4GEkIFxAeIgxtZXRhZGF0YS5vcmcqNXVuYXV0aG9yaXplZCB0byBjcmVhdGUgb2F1dGggYXBwIGluIHRoaXMgb3JnYW5pemF0aW9uEo0BCgZ1cGRhdGUSJC5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5PQXV0aEFwcBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAIQFiILbWV0YWRhdGEuaWQqIHVuYXV0aG9yaXplZCB0byB1cGRhdGUgb2F1dGggYXBwEp8BCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAMQFiILcmVzb3VyY2VfaWQqIHVuYXV0aG9yaXplZCB0byBkZWxldGUgb2F1dGggYXBwGgSg/ysWYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api]),OAuthAppCommandController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_command,0);var file_ai_stigmer_iam_oauthapp_v1_io=fileDesc("CiNhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9pby5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEiJgoKT0F1dGhBcHBJZBIYCgV2YWx1ZRgBIAEoCUIJukgGcgQQARhAIkIKCU9BdXRoQXBwcxI1CgdlbnRyaWVzGAEgAygLMiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiLwoXTGlzdE9BdXRoQXBwc0J5T3JnSW5wdXQSFAoDb3JnGAEgASgJQge6SARyAhABYgZwcm90bzM",[file_ai_stigmer_iam_oauthapp_v1_api,file_buf_validate_validate]);var OAuthAppsSchema=messageDesc2(file_ai_stigmer_iam_oauthapp_v1_io,1);var file_ai_stigmer_iam_oauthapp_v1_query=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9xdWVyeS5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEy0AMKF09BdXRoQXBwUXVlcnlDb250cm9sbGVyEosBCgNnZXQSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIi/CuBgrCAEQFiIFdmFsdWUqHnVuYXV0aG9yaXplZCB0byB2aWV3IG9hdXRoIGFwcBJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIgTQuBgBEqwBCglsaXN0QnlPcmcSMy5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5MaXN0T0F1dGhBcHBzQnlPcmdJbnB1dBolLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwcyJDwrgYPwgBEB4iA29yZyo0dW5hdXRob3JpemVkIHRvIGxpc3Qgb2F1dGggYXBwcyBpbiB0aGlzIG9yZ2FuaXphdGlvbhoEoP8rFmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api,file_ai_stigmer_iam_oauthapp_v1_io]),OAuthAppQueryController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_query,0);var REDACTED_MARKER3="***REDACTED***",MARKER_ON_CREATE_MESSAGE="cannot use the redaction marker as client_secret on create",PRESERVE_NO_EXISTING_SECRET_MESSAGE="cannot preserve client_secret: no existing secret value found",CIPHERTEXT_SHAPED_SECRET_MESSAGE="client_secret must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients";function deleteBlockedByMcpServerMessage(org,slug,mcpServerName){return`cannot delete OAuthApp '${org}/${slug}': referenced by MCP server '${mcpServerName}'`}async function resolveOAuthAppRef(store,ref,logger2){let slug=ref?.slug??"";if(slug==="")return;let rows=await store.listResources(ApiResourceKind.oauth_app),slugMatches=[];for(let data of rows){let app;try{app=fromBinary2(OAuthAppSchema,data)}catch{continue}if((app.metadata?.slug??"")!==slug)continue;let refOrg=ref?.org??"";if(refOrg!==""&&app.metadata?.org===refOrg)return app;slugMatches.push(app)}if(slugMatches.length!==0){if(slugMatches.length===1)return slugMatches[0];logger2.warn("oauth_app_ref is ambiguous (slug exists in several orgs, none matching the ref); refusing to pick \u2014 pin the ref's org to resolve",{oauthAppSlug:slug,refOrg:ref?.org??"",candidateOrgs:slugMatches.map(app=>app.metadata?.org??"")})}}function redactOAuthApp(app){app.spec!==void 0&&app.spec.clientSecret!==""&&(app.spec.clientSecret=REDACTED_MARKER3)}function newEncryptClientSecretForCreateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!0)}function newEncryptClientSecretForUpdateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!1)}function newEncryptClientSecretStep(secretService,logger2,isCreate){return{name:"EncryptClientSecret",async execute(ctx){let app=ctx.newState;if(app.spec===void 0)return;let clientSecret=app.spec.clientSecret;if(clientSecret!==""){if(clientSecret===REDACTED_MARKER3){preserveExistingSecret(ctx,app,isCreate,logger2);return}if(isCiphertextShaped(clientSecret))throw invalidArgumentError(CIPHERTEXT_SHAPED_SECRET_MESSAGE);if(!secretService.isEnabled()){logger2.warn("encryption disabled: client_secret will be stored in plaintext");return}try{app.spec.clientSecret=await secretService.encrypt(clientSecret,EncryptionScope.forOrganization(app.metadata?.org??""))}catch(error2){throw internalError(error2,"failed to encrypt client_secret")}}}}}function preserveExistingSecret(ctx,app,isCreate,logger2){if(isCreate)throw invalidArgumentError(MARKER_ON_CREATE_MESSAGE);let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not loaded"),"cannot preserve client_secret: existing resource not loaded");let existingSecret=existing.spec?.clientSecret??"";if(existingSecret==="")throw invalidArgumentError(PRESERVE_NO_EXISTING_SECRET_MESSAGE);app.spec!==void 0&&(app.spec.clientSecret=existingSecret),logger2.debug("preserved existing encrypted client_secret",{oauthAppId:app.metadata?.id??""})}function newCheckNoReferencingMcpServersStep(store,logger2){return{name:"CheckNoReferencingMcpServers",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing OAuthApp missing from pipeline context"),"existing OAuthApp not loaded in delete pipeline");let resources;try{resources=await store.listResources(ApiResourceKind.mcp_server)}catch(error2){throw internalError(error2,"failed to list MCP servers for referential integrity check")}for(let data of resources){let mcp;try{mcp=fromBinary2(McpServerSchema,data)}catch(error2){logger2.warn("failed to unmarshal MCP server during referential integrity check, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}let ref=mcp.spec?.auth?.oauthAppRef;if(ref===void 0)continue;let resolved;try{resolved=await resolveOAuthAppRef(store,ref,logger2)}catch(error2){throw internalError(error2,"failed to resolve oauth_app_ref during referential integrity check")}if(resolved!==void 0&&(resolved.metadata?.id??"")===(existing.metadata?.id??""))throw failedPreconditionError(deleteBlockedByMcpServerMessage(existing.metadata?.org??"",existing.metadata?.slug??"",mcp.metadata?.name??""))}}}}function registerOAuthAppServices(router,deps){router.service(OAuthAppCommandController,{apply:(app,ctx)=>apply9(deps,app,ctx),create:(app,ctx)=>createOAuthApp(deps,app,ctx),update:(app,ctx)=>update12(deps,app,ctx),delete:(input,ctx)=>deleteOAuthApp(deps,input,ctx)}),router.service(OAuthAppQueryController,{get:(id,ctx)=>get16(deps,id,ctx),getByReference:(ref,ctx)=>getByReference9(deps,ref,ctx),listByOrg:(req,ctx)=>listByOrg2(deps,req,ctx)})}function kindOf15(ctx){return ctx.values.get(apiResourceKindKey)}async function createOAuthApp(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-create",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEncryptClientSecretForCreateStep(deps.secretService,deps.logger)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let result=reqCtx.newState;return redactOAuthApp(result),result}async function update12(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-update",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newEncryptClientSecretForUpdateStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).build().execute(reqCtx);let result=reqCtx.newState;return redactOAuthApp(result),result}async function apply9(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-apply",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOAuthApp(deps,app,ctx):update12(deps,withResolvedApplyId(OAuthAppSchema,app,reqCtx),ctx)}async function deleteOAuthApp(deps,input,ctx){let reqCtx=new RequestContext(OAuthAppCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf15(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("oauthapp-delete",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,OAuthAppSchema)).addStep(newCheckNoReferencingMcpServersStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,app2=>app2.spec===void 0?[]:[app2.spec.clientSecret])).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted OAuthApp not found in context"),"deleted OAuthApp not found in context");let app=deleted;return redactOAuthApp(app),app}async function get16(deps,id,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-get",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OAuthAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}async function getByReference9(deps,ref,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-get-by-reference",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,OAuthAppSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(OAuthAppQueryController.method.get))).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}var LIST_RESULT_KEY7="listResult";async function listByOrg2(deps,req,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.listByOrg.input,req,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-list-by-org",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgStep2(deps.store,deps.listReadScope,deps.logger)).build().execute(reqCtx);let list12=reqCtx.get(LIST_RESULT_KEY7);if(list12===void 0)throw internalError(new Error("list result missing from pipeline context"),"OAuthApp list not found in context");return list12}function newListByOrgStep2(store,listReadScope,logger2){return{name:"ListByOrg",async execute(ctx){let org=ctx.input.org,resources;try{resources=await store.listResources(ApiResourceKind.oauth_app)}catch(error2){throw internalError(error2,"failed to list OAuthApps")}let requested=[];for(let data of resources){let app;try{app=fromBinary2(OAuthAppSchema,data)}catch(error2){logger2.warn("failed to unmarshal OAuthApp, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}(app.metadata?.org??"")===org&&requested.push(app)}let apps=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.oauth_app,requested,"");for(let app of apps)redactOAuthApp(app);apps.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),logger2.info("listed OAuthApps by organization",{org,matchCount:apps.length}),ctx.set(LIST_RESULT_KEY7,create2(OAuthAppsSchema,{entries:apps}))}}}var file_ai_stigmer_iam_platformclient_v1_io=fileDesc("CilhaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9pby5wcm90bxIgYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEiLAoQUGxhdGZvcm1DbGllbnRJZBIYCgV2YWx1ZRgBIAEoCUIJukgGcgQQARhAIlQKD1BsYXRmb3JtQ2xpZW50cxJBCgdlbnRyaWVzGAEgAygLMjAuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnQiNQodTGlzdFBsYXRmb3JtQ2xpZW50c0J5T3JnSW5wdXQSFAoDb3JnGAEgASgJQge6SARyAhABIoABChxQbGF0Zm9ybUNsaWVudENyZWF0ZVJlc3BvbnNlEkkKD3BsYXRmb3JtX2NsaWVudBgBIAEoCzIwLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50EhUKDWNsaWVudF9zZWNyZXQYAiABKAliBnByb3RvMw",[file_ai_stigmer_iam_platformclient_v1_api,file_buf_validate_validate]);var PlatformClientsSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_io,1);var PlatformClientCreateResponseSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_io,3);var file_ai_stigmer_iam_platformclient_v1_command=fileDesc("Ci5haS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9jb21tYW5kLnByb3RvEiBhaS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MTKgBgofUGxhdGZvcm1DbGllbnRDb21tYW5kQ29udHJvbGxlchLPAQoGY3JlYXRlEjAuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnQaPi5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5QbGF0Zm9ybUNsaWVudENyZWF0ZVJlc3BvbnNlIlPCuBhPCBgQHiIMbWV0YWRhdGEub3JnKjt1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIHBsYXRmb3JtIGNsaWVudCBpbiB0aGlzIG9yZ2FuaXphdGlvbhKrAQoGdXBkYXRlEjAuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnQaMC5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5QbGF0Zm9ybUNsaWVudCI9wrgYOQgCEBciC21ldGFkYXRhLmlkKiZ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIHBsYXRmb3JtIGNsaWVudBKxAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaMC5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5QbGF0Zm9ybUNsaWVudCI9wrgYOQgDEBciC3Jlc291cmNlX2lkKiZ1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIHBsYXRmb3JtIGNsaWVudBLCAQoMcm90YXRlU2VjcmV0EjIuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnRJZBo+LmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50Q3JlYXRlUmVzcG9uc2UiPsK4GDoIAhAXIgV2YWx1ZSotdW5hdXRob3JpemVkIHRvIHJvdGF0ZSBwbGF0Zm9ybSBjbGllbnQgc2VjcmV0GgSg/ysXYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_platformclient_v1_api,file_ai_stigmer_iam_platformclient_v1_io]),PlatformClientCommandController=serviceDesc(file_ai_stigmer_iam_platformclient_v1_command,0);var file_ai_stigmer_iam_platformclient_v1_query=fileDesc("CixhaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9xdWVyeS5wcm90bxIgYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEykgQKHVBsYXRmb3JtQ2xpZW50UXVlcnlDb250cm9sbGVyEp0BCgNnZXQSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBowLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50IjXCuBgxCAEQFyIFdmFsdWUqJHVuYXV0aG9yaXplZCB0byB2aWV3IHBsYXRmb3JtIGNsaWVudBJ+Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRowLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50IgTQuBgBEsoBCglsaXN0QnlPcmcSPy5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5MaXN0UGxhdGZvcm1DbGllbnRzQnlPcmdJbnB1dBoxLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50cyJJwrgYRQgBEB4iA29yZyo6dW5hdXRob3JpemVkIHRvIGxpc3QgcGxhdGZvcm0gY2xpZW50cyBpbiB0aGlzIG9yZ2FuaXphdGlvbhoEoP8rF2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_platformclient_v1_api,file_ai_stigmer_iam_platformclient_v1_io]),PlatformClientQueryController=serviceDesc(file_ai_stigmer_iam_platformclient_v1_query,0);var PLATFORM_CLIENT_KIND_NAME="PlatformClient",SYSTEM_SHARE_CLIENT_SLUG="system-share-client",RESERVED_PLATFORM_CLIENT_SLUGS=new Set([SYSTEM_SHARE_CLIENT_SLUG]),USER_TOKEN_CLAIMS={subject:"sub",externalUserId:"ext_user_id",email:"email",name:"name",org:"org",platformClientId:"platform_client_id"},BEARER_TOKEN_TYPE="Bearer";function reservedSlugMessage(slug){return`The slug '${slug}' is reserved for the platform's system-managed resources and cannot be used. If you did not provide a slug explicitly, it was derived from the resource name \u2014 choose a different name or provide an explicit slug.`}function systemManagedMessage(verb){return`This platform client is system-managed and cannot be ${verb}`}function referenceNotFoundMessage(org,slug){return`PlatformClient '${org}/${slug}' not found`}var INVALID_CLIENT_CREDENTIALS_MESSAGE="Invalid client_id or client_secret",EXPIRED_CLIENT_SECRET_MESSAGE="PlatformClient secret has expired. Rotating the secret does not extend it; the client's owner must set a later expires_at or set never_expires.";function organizationMismatchMessage(owningOrg){return`org_id must be empty or the PlatformClient's owning organization ('${owningOrg}'); cross-organization minting is not supported`}function noAccountMessage(externalUserId,org){return`User '${externalUserId}' has no Stigmer account in organization '${org}'. Enable auto_provision_accounts on the PlatformClient or create the account first.`}var OWNER_AUTO_GRANT_MESSAGE="auto_grant_role cannot be 'owner'; organization ownership must be assigned explicitly.",PROVISIONING_FAILED_MESSAGE="Account provisioning failed. No partial account was left behind; the request is safe to retry.";function blankSubjectPartMessage(part){return`${part} must not be null or blank`}function subjectSeparatorMessage(part,value){return`${part} must not contain the separator character '|': ${value}`}function foreignAccountMessage(externalUserId,org){return`User '${externalUserId}' in organization '${org}' resolves to an account no platform client provisioned \u2014 refusing to mint a token for it`}var MINTING_REQUIRES_AUTHENTICATION_MESSAGE="mintUserToken requires a server that authenticates its callers: this server trusts every request, so nothing would verify the token \u2014 configure an identity provider (STIGMER_OIDC_ISSUER) to enable PlatformClient token minting",MINTING_DISABLED_MESSAGE="mintUserToken is disabled: this server's platform-token key ring holds no signing key",GUEST_MINT_UNIMPLEMENTED_MESSAGE="PlatformClientTokenController.mintGuestToken is not implemented: guest tokens for shared agents are served by the Cloud edition",TOKEN_NAMES_NO_CLIENT_MESSAGE="platform token names no platform client",DELETED_CLIENT_MESSAGE="The platform client that minted this token has been deleted, so the token is no longer accepted. Mint a new user token from an active platform client.";function originRefusalMessage(origin){return`Request origin '${origin}' is not in this platform client's allowed_origins. Add it to the PlatformClient's allowed_origins to permit browser requests from this origin.`}var import_node_crypto20=require("node:crypto"),CLIENT_ID_PREFIX="stgm_cid_",CLIENT_SECRET_PREFIX="stgm_cs_",CLIENT_ID_BYTES=32,CLIENT_SECRET_BYTES=48,SECRET_FINGERPRINT_LENGTH=6;function generateClientId(){return CLIENT_ID_PREFIX+(0,import_node_crypto20.randomBytes)(CLIENT_ID_BYTES).toString("base64url")}function generateClientSecret(){return CLIENT_SECRET_PREFIX+(0,import_node_crypto20.randomBytes)(CLIENT_SECRET_BYTES).toString("base64url")}function hashClientSecret(secret){return(0,import_node_crypto20.createHash)("sha256").update(secret,"utf8").digest("base64url")}function secretFingerprint(secret){return secret.length<=SECRET_FINGERPRINT_LENGTH?secret:secret.slice(-SECRET_FINGERPRINT_LENGTH)}function secretMatchesHash(secret,storedHash){if(storedHash==="")return!1;let presented=Buffer.from(hashClientSecret(secret),"utf8"),stored=Buffer.from(storedHash,"utf8");return presented.length===stored.length&&(0,import_node_crypto20.timingSafeEqual)(presented,stored)}var DuplicatePlatformClientError=class extends Error{constructor(message6,options){super(message6,options),this.name="DuplicatePlatformClientError"}};var CLIENT_SECRET_PLAINTEXT_KEY="platformClientSecretPlaintext";function redactPlatformClient(client){return client.spec!==void 0&&(client.spec.clientSecretHash=""),client}function parkedClientSecret(ctx){let secret=ctx.get(CLIENT_SECRET_PLAINTEXT_KEY);if(typeof secret!="string"||secret==="")throw internalError(new Error("no client secret parked \u2014 a credential step must run first"),"platform client credentials");return secret}function newRefuseReservedSlugStep(){return{name:"RefuseReservedSlug",execute(ctx){let slug=metadataOf(ctx.newState)?.slug??"";if(RESERVED_PLATFORM_CLIENT_SLUGS.has(slug))throw invalidArgumentError(reservedSlugMessage(slug))}}}function newCheckDuplicateStep3(clients){return{name:"CheckDuplicate",async execute(ctx){let metadata=requireMetadata2(ctx,"duplicate check"),existing=await clients.findByOrgAndSlug(metadata.org,metadata.slug);if(existing!==void 0)throw alreadyExistsError(PLATFORM_CLIENT_KIND_NAME,`slug '${metadata.slug}' in org '${metadata.org}' (id: ${existing.metadata?.id??""})`)}}}function newGenerateClientCredentialsStep(){return{name:"GenerateClientCredentials",execute(ctx){let spec=specOf3(ctx.newState),secret=generateClientSecret();spec.clientId=generateClientId(),spec.clientSecretHash=hashClientSecret(secret),spec.secretFingerprint=secretFingerprint(secret),ctx.set(CLIENT_SECRET_PLAINTEXT_KEY,secret)}}}function newPersistNewClientStep(clients){return{name:"Persist",async execute(ctx){try{await clients.save(ctx.newState)}catch(error2){if(error2 instanceof DuplicatePlatformClientError){let metadata=requireMetadata2(ctx,"persist");throw alreadyExistsError(PLATFORM_CLIENT_KIND_NAME,`slug '${metadata.slug}' in org '${metadata.org}'`)}throw internalError(error2,"failed to save platform client")}}}}function newLoadExistingClientStep(clients){return{name:"LoadExisting",async execute(ctx){let metadata=requireMetadata2(ctx,"load existing"),existing;if(metadata.id!==""){if(existing=await clients.findById(metadata.id),existing===void 0)throw notFoundError(PLATFORM_CLIENT_KIND_NAME,metadata.id)}else if(metadata.slug!==""){if(existing=await clients.findByOrgAndSlug(metadata.org,metadata.slug),existing===void 0)throw notFoundError(PLATFORM_CLIENT_KIND_NAME,metadata.slug);metadata.id=existing.metadata?.id??""}else throw invalidArgumentError("resource id or slug is required for update");ctx.set(EXISTING_RESOURCE_KEY,existing)}}}function newPreserveClientCredentialsStep(){return{name:"PreserveClientCredentials",execute(ctx){let existing=storedClientOf(ctx,EXISTING_RESOURCE_KEY),spec=specOf3(ctx.newState);spec.clientId=existing.spec?.clientId??"",spec.clientSecretHash=existing.spec?.clientSecretHash??"",spec.secretFingerprint=existing.spec?.secretFingerprint??""}}}function newPersistUpdatedClientStep(clients){return{name:"Persist",async execute(ctx){try{await clients.update(ctx.newState)}catch(error2){throw internalError(error2,"failed to save platform client")}}}}function newRefuseSystemManagedStep(verb,key){return{name:"RefuseSystemManaged",execute(ctx){if(storedClientOf(ctx,key).metadata?.labels[SYSTEM_MANAGED_LABEL]===RESERVED_LABEL_TRUE)throw failedPreconditionError(systemManagedMessage(verb))}}}function newLoadTargetClientStep(clients){return{name:"LoadTarget",async execute(ctx){let id=idValueOf(ctx.input);if(id==="")throw invalidArgumentError("resource id is required");ctx.set(TARGET_RESOURCE_KEY,await readClient(clients,id))}}}function newLoadClientByReferenceStep(clients){return{name:"LoadByReference",async execute(ctx){let ref=ctx.input;if(ref.slug==="")throw invalidArgumentError("slug is required in reference");if(ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==ApiResourceKind.platform_client)throw invalidArgumentError(`kind mismatch: expected platform_client, got ${ApiResourceKind[ref.kind]??String(ref.kind)}`);requireOrgForReference(ApiResourceKind.platform_client,ref.org);let client=await clients.findByOrgAndSlug(ref.org,ref.slug);if(client===void 0)throw new ConnectError(referenceNotFoundMessage(ref.org,ref.slug),Code.NotFound);ctx.set(TARGET_RESOURCE_KEY,client)}}}function newRotateClientCredentialsStep(){return{name:"RotateClientCredentials",execute(ctx){let client=storedClientOf(ctx,TARGET_RESOURCE_KEY),spec=specOf3(client),secret=generateClientSecret();spec.clientSecretHash=hashClientSecret(secret),spec.secretFingerprint=secretFingerprint(secret),updateAuditFields(PlatformClientSchema,client,client,ctx.callerIdentity),ctx.set(CLIENT_SECRET_PLAINTEXT_KEY,secret)}}}function newPersistTargetClientStep(clients){return{name:"Persist",async execute(ctx){try{await clients.update(storedClientOf(ctx,TARGET_RESOURCE_KEY))}catch(error2){throw internalError(error2,"failed to save platform client")}}}}function newLoadExistingClientForDeleteStep(clients){return{name:"LoadExistingForDelete",async execute(ctx){ctx.set(EXISTING_RESOURCE_KEY,await readClient(clients,requireResourceId3(ctx)))}}}function newDeleteClientStep(clients){return{name:"DeleteResource",async execute(ctx){try{await clients.deleteById(requireResourceId3(ctx))}catch(error2){throw internalError(error2,"failed to delete platform client")}}}}async function readClient(clients,id){let client=await clients.findById(id);if(client===void 0)throw notFoundError(PLATFORM_CLIENT_KIND_NAME,id);return client}function storedClientOf(ctx,key){let client=ctx.get(key);if(client===void 0)throw internalError(new Error(`no platform client under '${key}' \u2014 its load step must run first`),"platform client chain ordering");return client}function requireMetadata2(ctx,operation2){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("platform client metadata is nil"),operation2);return metadata}function specOf3(client){return client.spec===void 0&&(client.spec=create2(PlatformClientSpecSchema)),client.spec}function requireResourceId3(ctx){let id=ctx.get(RESOURCE_ID_KEY);if(typeof id!="string"||id==="")throw internalError(new Error("resource id not found in context (the delete handler sets it)"),"platform client delete ordering");return id}function registerPlatformClientServices(router,deps){router.service(PlatformClientCommandController,{create:(client,ctx)=>createClient2(deps,client,ctx),update:(client,ctx)=>updateClient(deps,client,ctx),delete:(input,ctx)=>deleteClient(deps,input,ctx),rotateSecret:(id,ctx)=>rotateSecret(deps,id,ctx)}),router.service(PlatformClientQueryController,{get:(id,ctx)=>get17(deps,id,ctx),getByReference:(ref,ctx)=>getByReference10(deps,ref,ctx),listByOrg:(input,ctx)=>listByOrg3(deps,input,ctx)})}function kindOf16(ctx){return ctx.values.get(apiResourceKindKey)}async function createClient2(deps,client,ctx){let reqCtx=new RequestContext(PlatformClientSchema,client,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-create",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newRefuseReservedSlugStep()).addStep(newCheckDuplicateStep3(deps.clients)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newGenerateClientCredentialsStep()).addStep(newPersistNewClientStep(deps.clients)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),create2(PlatformClientCreateResponseSchema,{platformClient:redactPlatformClient(reqCtx.newState),clientSecret:parkedClientSecret(reqCtx)})}async function updateClient(deps,client,ctx){let reqCtx=new RequestContext(PlatformClientSchema,client,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-update",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingClientStep(deps.clients)).addStep(newRefuseSystemManagedStep("updated",EXISTING_RESOURCE_KEY)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPreserveClientCredentialsStep()).addStep(newPersistUpdatedClientStep(deps.clients)).build().execute(reqCtx),redactPlatformClient(reqCtx.newState)}async function deleteClient(deps,input,ctx){let reqCtx=new RequestContext(PlatformClientCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf16(ctx));return reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("platformclient-delete",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingClientForDeleteStep(deps.clients)).addStep(newRefuseSystemManagedStep("deleted",EXISTING_RESOURCE_KEY)).addStep(newDeleteClientStep(deps.clients)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),redactPlatformClient(storedClientOf(reqCtx,EXISTING_RESOURCE_KEY))}async function rotateSecret(deps,id,ctx){let reqCtx=new RequestContext(PlatformClientCommandController.method.rotateSecret.input,id,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-rotate-secret",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.rotateSecret,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetClientStep(deps.clients)).addStep(newRefuseSystemManagedStep("rotated",TARGET_RESOURCE_KEY)).addStep(newRotateClientCredentialsStep()).addStep(newPersistTargetClientStep(deps.clients)).build().execute(reqCtx),create2(PlatformClientCreateResponseSchema,{platformClient:redactPlatformClient(storedClientOf(reqCtx,TARGET_RESOURCE_KEY)),clientSecret:parkedClientSecret(reqCtx)})}async function get17(deps,id,ctx){let reqCtx=new RequestContext(PlatformClientQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-get",deps.logger).addStep(newAuthorizeStep(PlatformClientQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetClientStep(deps.clients)).build().execute(reqCtx),redactPlatformClient(storedClientOf(reqCtx,TARGET_RESOURCE_KEY))}async function getByReference10(deps,ref,ctx){let reqCtx=new RequestContext(PlatformClientQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-get-by-reference",deps.logger).addStep(newAuthorizeStep(PlatformClientQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadClientByReferenceStep(deps.clients)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(PlatformClientQueryController.method.get))).build().execute(reqCtx),redactPlatformClient(storedClientOf(reqCtx,TARGET_RESOURCE_KEY))}async function listByOrg3(deps,input,ctx){let caller=callerIdentityOf(ctx),reqCtx=new RequestContext(PlatformClientQueryController.method.listByOrg.input,input,caller,kindOf16(ctx));await newPipeline("platformclient-list-by-org",deps.logger).addStep(newAuthorizeStep(PlatformClientQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx);let candidates;try{candidates=await deps.clients.findByOrg(input.org)}catch(error2){throw internalError(error2,"failed to list platform clients")}let entries=[...await restrictListByReadScope(deps.listReadScope,caller,ApiResourceKind.platform_client,candidates,input.org)].sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)).map(redactPlatformClient);return create2(PlatformClientsSchema,{entries})}var import_node_crypto21=require("node:crypto"),PLATFORM_TOKEN_ISSUER="stigmer",TOKEN_TYPE_CLAIM="token_type",ENVELOPE_CLAIMS=new Set(["iss","iat","exp","jti","aud"]),PLATFORM_TOKEN_REFUSAL_MESSAGES={signature:"platform token signature verification failed",expired:"platform token is expired",audience:"platform token was minted for another environment",subject:"platform token carries no subject"};function signPlatformToken(ring,claims,options={}){for(let name of Object.keys(claims))if(ENVELOPE_CLAIMS.has(name))throw new Error(`platform-token claim '${name}' belongs to the envelope and cannot be set by a lane`);let ttlSeconds=options.ttlSeconds??ring.ttlSeconds;if(!Number.isInteger(ttlSeconds)||ttlSeconds<=0)throw new Error(`platform-token lifetime must be a positive integer number of seconds, got ${ttlSeconds}`);let issuedAt=Math.floor((options.now??new Date).getTime()/1e3),expiresAtSeconds=issuedAt+ttlSeconds,header={alg:"RS256",typ:"JWT",kid:ring.signer.kid},payload={iss:PLATFORM_TOKEN_ISSUER,iat:issuedAt,exp:expiresAtSeconds,jti:(0,import_node_crypto21.randomUUID)(),...ring.audience!==""?{aud:ring.audience}:{},...claims},signingInput=`${base64UrlJson(header)}.${base64UrlJson(payload)}`,signature=(0,import_node_crypto21.sign)("sha256",Buffer.from(signingInput),ring.signer.key);return{token:`${signingInput}.${signature.toString("base64url")}`,expiresAt:new Date(expiresAtSeconds*1e3)}}function verifyPlatformToken(ring,token,now=new Date){let decoded=decode2(token);if(decoded===void 0||decoded.payload.iss!==PLATFORM_TOKEN_ISSUER)return{outcome:"foreign"};let signingInput=Buffer.from(`${decoded.encodedHeader}.${decoded.encodedPayload}`);if(!ring.verificationKeys.some(key=>(0,import_node_crypto21.verify)("sha256",signingInput,key,decoded.signature)))return{outcome:"refused",refusal:"signature"};let exp=decoded.payload.exp;if(typeof exp!="number"||exp*1e3<=now.getTime())return{outcome:"refused",refusal:"expired"};let aud=decoded.payload.aud;if(ring.audience!==""&&aud!==void 0&&!audienceMatches(aud,ring.audience))return{outcome:"refused",refusal:"audience"};let sub=decoded.payload.sub;return typeof sub!="string"||sub===""?{outcome:"refused",refusal:"subject"}:{outcome:"verified",token:{subject:sub,tokenType:stringClaim(decoded.payload,TOKEN_TYPE_CLAIM),payload:decoded.payload}}}function platformTokenRefusalError(refusal2){return new ConnectError(PLATFORM_TOKEN_REFUSAL_MESSAGES[refusal2],Code.Unauthenticated)}function decodeVerifiedPlatformTokenPayload(token){let decoded=decode2(token);return decoded!==void 0&&decoded.payload.iss===PLATFORM_TOKEN_ISSUER?decoded.payload:void 0}function stringClaim(payload,name){let value=payload[name];return typeof value=="string"&&value!==""?value:void 0}function decode2(token){let parts=token.split(".");if(parts.length!==3)return;let[encodedHeader="",encodedPayload="",encodedSignature=""]=parts,header=parseJsonObject(encodedHeader),payload=parseJsonObject(encodedPayload);if(!(header===void 0||payload===void 0))return{encodedHeader,encodedPayload,payload,signature:Buffer.from(encodedSignature,"base64url")}}function parseJsonObject(segment){try{let value=JSON.parse(Buffer.from(segment,"base64url").toString("utf8"));return typeof value=="object"&&value!==null&&!Array.isArray(value)?value:void 0}catch{return}}function audienceMatches(aud,expected){return typeof aud=="string"?aud===expected:Array.isArray(aud)&&aud.includes(expected)}function base64UrlJson(value){return Buffer.from(JSON.stringify(value)).toString("base64url")}var OPAQUE_ORIGIN="null";function newPlatformClientOriginGuard(deps){return{name:"platform-client-origin",async guard(caller,method,headers2){let origin=headers2.get("origin")??"";if(origin.trim()==="")return;let platformClientId=mintingClientOf(caller);if(platformClientId===void 0)return;let procedure=`/${method.parent.typeName}/${method.name}`,client=await deps.clients.findById(platformClientId);if(client===void 0)throw new ConnectError(DELETED_CLIENT_MESSAGE,Code.Unauthenticated);if(!originAllowed(origin,client.spec?.allowedOrigins??[]))throw deps.logger.warn("origin refusal: origin not in allowed_origins",{procedure,platformClientId,origin}),new ConnectError(originRefusalMessage(origin),Code.PermissionDenied)}}}function mintingClientOf(caller){let payload=decodeVerifiedPlatformTokenPayload(caller.rawToken);if(!(payload===void 0||stringClaim(payload,TOKEN_TYPE_CLAIM)!==void 0))return stringClaim(payload,USER_TOKEN_CLAIMS.platformClientId)}function originAllowed(origin,allowed){if(allowed.length===0)return!0;if(origin===OPAQUE_ORIGIN)return!1;let presented=origin.toLowerCase();return allowed.some(entry=>entry.toLowerCase()===presented)}var KIND5=ApiResourceKind.platform_client;function newResourcePlatformClientStore(store){async function readById(id){try{return await store.getResource(KIND5,id,PlatformClientSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function readByClientId(clientId){if(clientId!=="")try{return await store.findByField(KIND5,"spec.clientId",clientId,PlatformClientSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function listOrg(org){let clients=[];for(let data of await store.listResources(KIND5)){let client;try{client=fromBinary2(PlatformClientSchema,data)}catch{continue}(client.metadata?.org??"")===org&&clients.push(client)}return clients}async function readByOrgAndSlug(org,slug){if(!(org===""||slug===""))return(await listOrg(org)).find(client=>(client.metadata?.slug??"")===slug)}return{async save(client){let id=client.metadata?.id??"",org=client.metadata?.org??"",slug=client.metadata?.slug??"";if(await readById(id)!==void 0)throw new DuplicatePlatformClientError(`platform client '${id}' already exists`);if(await readByOrgAndSlug(org,slug)!==void 0)throw new DuplicatePlatformClientError(`platform client '${org}/${slug}' already exists`);if(await readByClientId(client.spec?.clientId??"")!==void 0)throw new DuplicatePlatformClientError("a platform client already holds this client_id");await store.saveResource(KIND5,id,PlatformClientSchema,client)},async update(client){let id=client.metadata?.id??"";await readById(id)!==void 0&&await store.saveResource(KIND5,id,PlatformClientSchema,client)},async modifyById(id,modify){try{return await store.updateResource(KIND5,id,PlatformClientSchema,modify)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}},async deleteById(id){await store.deleteResource(KIND5,id)},findById:readById,findByClientId:readByClientId,findByOrgAndSlug:readByOrgAndSlug,findByOrg:listOrg}}var file_ai_stigmer_iam_platformclient_v1_token=fileDesc("CixhaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS90b2tlbi5wcm90bxIgYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEiugEKFE1pbnRVc2VyVG9rZW5SZXF1ZXN0EhoKCWNsaWVudF9pZBgBIAEoCUIHukgEcgIQARIeCg1jbGllbnRfc2VjcmV0GAIgASgJQge6SARyAhABEhsKB3VzZXJfaWQYAyABKAlCCrpIB3IFEAEYgAISHAoKdXNlcl9lbWFpbBgEIAEoCUIIukgFcgMYwAISGwoJdXNlcl9uYW1lGAUgASgJQgi6SAVyAxiAAhIOCgZvcmdfaWQYBiABKAkiVQoVTWludFVzZXJUb2tlblJlc3BvbnNlEhQKDGFjY2Vzc190b2tlbhgBIAEoCRISCgp0b2tlbl90eXBlGAIgASgJEhIKCmV4cGlyZXNfaW4YAyABKAUiyQMKFU1pbnRHdWVzdFRva2VuUmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESFQoEc2x1ZxgCIAEoCUIHukgEcgIQARIXCg9ndWVzdF9jb29raWVfaWQYAyABKAkSywIKDGVtYmVkX29yaWdpbhgEIAEoCUK0ArpIsAK6AawCChNlbWJlZF9vcmlnaW4uZm9ybWF0EndlbWJlZF9vcmlnaW4gbXVzdCBiZSBlbXB0eSwgIm51bGwiLCBvciBhbiBleGFjdCB3ZWIgb3JpZ2luIGxpa2UgaHR0cHM6Ly9leGFtcGxlLmNvbSAobm8gcGF0aCwgcXVlcnksIG9yIHRyYWlsaW5nIHNsYXNoKRqbAXRoaXMgPT0gJycgfHwgdGhpcyA9PSAnbnVsbCcgfHwgdGhpcy5tYXRjaGVzKCdeaHR0cHM/Oi8vW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8oXFwuW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8pKig6WzAtOV17MSw1fSk/JCcpEhwKCmxpbmtfdG9rZW4YBSABKAlCCLpIBXIDGIABIm8KFk1pbnRHdWVzdFRva2VuUmVzcG9uc2USFAoMYWNjZXNzX3Rva2VuGAEgASgJEhIKCnRva2VuX3R5cGUYAiABKAkSEgoKZXhwaXJlc19pbhgDIAEoBRIXCg9ndWVzdF9jb29raWVfaWQYBCABKAkytAIKHVBsYXRmb3JtQ2xpZW50VG9rZW5Db250cm9sbGVyEoYBCg1taW50VXNlclRva2VuEjYuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuTWludFVzZXJUb2tlblJlcXVlc3QaNy5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5NaW50VXNlclRva2VuUmVzcG9uc2UiBMi4GAESiQEKDm1pbnRHdWVzdFRva2VuEjcuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuTWludEd1ZXN0VG9rZW5SZXF1ZXN0GjguYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuTWludEd1ZXN0VG9rZW5SZXNwb25zZSIEyLgYAWIGcHJvdG8z",[file_ai_stigmer_commons_rpc_method_options,file_buf_validate_validate]);var MintUserTokenResponseSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_token,1);var PlatformClientTokenController=serviceDesc(file_ai_stigmer_iam_platformclient_v1_token,0);var import_node_crypto22=require("node:crypto");var PLATFORM_TOKEN_KEY_ENV_VAR="STIGMER_PLATFORM_TOKEN_KEY",PLATFORM_TOKEN_KEY_FILE_NAME="platform-token.key",DEFAULT_PLATFORM_TOKEN_TTL_SECONDS=900,MIN_RSA_MODULUS_BITS=2048;function canSign(ring){return ring.signer!==void 0}function resolvePlatformTokenKeys(input){if(input.requireAuthentication){if(input.supplied!==void 0)return input.supplied;if(input.edition!==ServerEdition.oss)throw new Error(`the ${ServerEdition[input.edition]} edition requires authentication but registers no platform-token key ring \u2014 register drivers.platformTokenKeys; only open source generates its own key`);return openSourcePlatformTokenKeyRing(input.options)}}function openSourcePlatformTokenKeyRing(options={}){let privateKey=getOrCreateKey(RSA_PRIVATE_KEY,PLATFORM_TOKEN_KEY_ENV_VAR,PLATFORM_TOKEN_KEY_FILE_NAME,options);return{signer:{key:privateKey,kid:kidOf(privateKey)},verificationKeys:[(0,import_node_crypto22.createPublicKey)(privateKey)],audience:"",ttlSeconds:DEFAULT_PLATFORM_TOKEN_TTL_SECONDS}}var RSA_PRIVATE_KEY={fromEnv(envVar,decoded){let key=parseKey2(()=>(0,import_node_crypto22.createPrivateKey)(decoded.toString("utf8")),envVar);return requireRsa(key,envVar)},fromFile(content){try{let key=(0,import_node_crypto22.createPrivateKey)(content.toString("utf8"));return isUsableRsa(key)?key:void 0}catch{return}},generate(){return(0,import_node_crypto22.generateKeyPairSync)("rsa",{modulusLength:MIN_RSA_MODULUS_BITS}).privateKey},toFile(key){return Buffer.from(key.export({format:"pem",type:"pkcs8"}))}};function kidOf(key){let publicKey=key.type==="private"?(0,import_node_crypto22.createPublicKey)(key):key;return(0,import_node_crypto22.createHash)("sha256").update(spkiOf(publicKey)).digest("base64url").slice(0,16)}function spkiOf(publicKey){return publicKey.export({format:"der",type:"spki"})}function parseKey2(parse5,what){try{return parse5()}catch(error2){throw new Error(`${what} is not a readable PEM key: ${error2 instanceof Error?error2.message:String(error2)}`)}}function requireRsa(key,what){if(!isUsableRsa(key))throw new Error(`${what} must be an RSA key of at least ${MIN_RSA_MODULUS_BITS} bits`);return key}function isUsableRsa(key){return key.asymmetricKeyType==="rsa"&&(key.asymmetricKeyDetails?.modulusLength??0)>=MIN_RSA_MODULUS_BITS}var SUBJECT_SEPARATOR="|",DEFAULT_AUTO_GRANT_ROLE=IamRole.viewer;async function mintUserToken(deps,request){let keys=deps.keys;if(keys===void 0)throw new ConnectError(MINTING_REQUIRES_AUTHENTICATION_MESSAGE,Code.FailedPrecondition);if(!canSign(keys))throw new ConnectError(MINTING_DISABLED_MESSAGE,Code.FailedPrecondition);let client=await authenticateClient(deps,request),owningOrg=client.metadata?.org??"";if(request.orgId!==""&&request.orgId!==owningOrg)throw new ConnectError(organizationMismatchMessage(owningOrg),Code.InvalidArgument);let user={externalUserId:request.userId,email:request.userEmail,name:request.userName},accountId=await resolveOrProvisionAccount(deps,client,owningOrg,user),now=deps.now(),signed=signPlatformToken(keys,{[USER_TOKEN_CLAIMS.subject]:accountId,[USER_TOKEN_CLAIMS.externalUserId]:user.externalUserId,[USER_TOKEN_CLAIMS.email]:user.email,[USER_TOKEN_CLAIMS.name]:user.name,[USER_TOKEN_CLAIMS.org]:owningOrg,[USER_TOKEN_CLAIMS.platformClientId]:client.metadata?.id??""},{now});return await recordClientUse(deps,client,now),create2(MintUserTokenResponseSchema,{accessToken:signed.token,tokenType:BEARER_TOKEN_TYPE,expiresIn:keys.ttlSeconds})}async function authenticateClient(deps,request){let client;try{client=await deps.clients.findByClientId(request.clientId)}catch(error2){throw internalError(error2,"failed to authenticate platform client")}if(client===void 0||!secretMatchesHash(request.clientSecret,client.spec?.clientSecretHash??""))throw new ConnectError(INVALID_CLIENT_CREDENTIALS_MESSAGE,Code.Unauthenticated);let spec=client.spec;if(spec?.neverExpires!==!0&&spec?.expiresAt!==void 0&&deps.now().getTime()>timestampDate(spec.expiresAt).getTime())throw new ConnectError(EXPIRED_CLIENT_SECRET_MESSAGE,Code.FailedPrecondition);return client}function recordClientUse(deps,client,now){let id=client.metadata?.id??"";return recordCredentialUse({credential:"platform client",id,lastUsedAt:client.status?.lastUsedAt,now,logger:deps.logger,write:stamp2=>deps.clients.modifyById(id,live=>{live.status??=create2(PlatformClientStatusSchema),stamp2(live.status)})})}async function resolveOrProvisionAccount(deps,client,org,user){let idpId=platformClientSubject(org,user.externalUserId),existing=await findAccount(deps,idpId);if(existing!==void 0)return platformClientAccountId(existing,user,org);let spec=client.spec;if(spec?.autoProvisionAccounts!==!0)throw new ConnectError(noAccountMessage(user.externalUserId,org),Code.FailedPrecondition);let input=accountInput(idpId,org,user),actor=serverActingFor(client.metadata?.id??"");spec.autoGrantOnOrg&&await grantAutoRole(deps,client,org,accountIdFor(idpId),actor);try{return(await deps.createAccount(input,actor)).metadata?.id??""}catch(error2){let winner=await resolveCreateRace(error2,()=>deps.accounts.findByIdpId(idpId));return platformClientAccountId(winner,user,org)}}async function findAccount(deps,idpId){try{return await deps.accounts.findByIdpId(idpId)}catch(error2){throw internalError(error2,"failed to resolve platform client user")}}function platformClientAccountId(account2,user,org){if(account2.spec?.provisioningMode!==IdentityAccountProvisioningMode.platform_client)throw new ConnectError(foreignAccountMessage(user.externalUserId,org),Code.FailedPrecondition);return account2.metadata?.id??""}function accountInput(idpId,org,user){let input={name:user.email!==""?user.email:user.externalUserId,spec:create2(IdentityAccountSpecSchema,{idpId,email:user.email,...splitName(user.name,user.email)}),provisioning:{mode:"platform_client",org}},result=validator().validate(IdentityAccountSchema,create2(IdentityAccountSchema,{apiVersion:"iam.stigmer.ai/v1",kind:"IdentityAccount",metadata:{name:input.name,org},spec:input.spec}));if(result.kind==="invalid")throw new ConnectError(result.error.message,Code.InvalidArgument);if(result.kind==="error")throw new ConnectError(`validation could not run: ${result.error.message}`,Code.Internal);return input}async function grantAutoRole(deps,client,org,accountId,actor){let configured=client.spec?.autoGrantRole??IamRole.iam_role_unspecified;if(configured===IamRole.owner)throw new ConnectError(OWNER_AUTO_GRANT_MESSAGE,Code.InvalidArgument);let role=configured===IamRole.iam_role_unspecified?DEFAULT_AUTO_GRANT_ROLE:configured;try{await deps.grantPath.grant(organizationRole(accountId,role,org),actor)}catch(error2){throw deps.logger.error("platform client auto-grant failed; nothing was provisioned",{accountId,platformClientId:client.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)}),new ConnectError(PROVISIONING_FAILED_MESSAGE,Code.Internal)}}function platformClientSubject(org,externalUserId){return requireSubjectPart("org",org),requireSubjectPart("externalUserId",externalUserId),`${PLATFORM_CLIENT_SUBJECT_PREFIX}${org}${SUBJECT_SEPARATOR}${externalUserId}`}function requireSubjectPart(part,value){if(value.trim()==="")throw new ConnectError(blankSubjectPartMessage(part),Code.InvalidArgument);if(value.includes(SUBJECT_SEPARATOR))throw new ConnectError(subjectSeparatorMessage(part,value),Code.InvalidArgument)}function splitName(name,email){if(name!==""){let space=name.indexOf(" ");return space>0?{firstName:name.slice(0,space),lastName:name.slice(space+1)}:{firstName:name,lastName:""}}let at2=email.indexOf("@");return{firstName:at2>=0?email.slice(0,at2):email,lastName:""}}function registerPlatformClientTokenService(router,deps){router.service(PlatformClientTokenController,{mintUserToken:request=>mintUserToken(deps.mint,request),mintGuestToken:(request,ctx)=>{if(deps.guestTokenMinting===void 0)throw new ConnectError(GUEST_MINT_UNIMPLEMENTED_MESSAGE,Code.Unimplemented);return deps.guestTokenMinting.mintGuestToken(request,ctx.requestHeader)}})}function newPlatformClientTokenVerifier(deps){return{name:"platform-client",async verify(token){let result=verifyPlatformToken(deps.keys,token,deps.now?.());switch(result.outcome){case"foreign":return null;case"refused":throw platformTokenRefusalError(result.refusal);case"verified":break;default:{let exhaustive=result;throw new Error(`unknown verification ${JSON.stringify(exhaustive)}`)}}let verified=result.token;if(verified.tokenType!==void 0)return null;let platformClientId=stringClaim(verified.payload,USER_TOKEN_CLAIMS.platformClientId);if(platformClientId===void 0)throw new ConnectError(TOKEN_NAMES_NO_CLIENT_MESSAGE,Code.Unauthenticated);if(await deps.clients.findById(platformClientId)===void 0)throw new ConnectError(DELETED_CLIENT_MESSAGE,Code.Unauthenticated);let email=stringClaim(verified.payload,USER_TOKEN_CLAIMS.email),displayName=stringClaim(verified.payload,USER_TOKEN_CLAIMS.name);return{identityId:verified.subject,callerClass:"user",issuer:PLATFORM_TOKEN_ISSUER,rawToken:token,...email!==void 0?{email}:{},...displayName!==void 0?{displayName}:{},platformClientId}}}}var file_ai_stigmer_tenancy_organization_v1_io=fileDesc("CithaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2lvLnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxIlIKDU9yZ2FuaXphdGlvbnMSQQoHZW50cmllcxgBIAMoCzIwLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uImoKEE9yZ2FuaXphdGlvbkxpc3QSEwoLdG90YWxfcGFnZXMYASABKAUSQQoHZW50cmllcxgCIAMoCzIwLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIioKDk9yZ2FuaXphdGlvbklkEhgKBXZhbHVlGAEgASgJQgm6SAZyBBABGEAimwEKGk9yZ2FuaXphdGlvbkV4dGVybmFsTG9va3VwElsKFWlkZW50aXR5X3Byb3ZpZGVyX3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUIGukgDyAEBEiAKD2V4dGVybmFsX29yZ19pZBgCIAEoCUIHukgEcgIQAWIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_tenancy_organization_v1_api,file_buf_validate_validate]),OrganizationsSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,0),OrganizationListSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,1);var file_ai_stigmer_tenancy_organization_v1_command=fileDesc("CjBhaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2NvbW1hbmQucHJvdG8SImFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEy2AQKHU9yZ2FuaXphdGlvbkNvbW1hbmRDb250cm9sbGVyEmsKBWFwcGx5EjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24aMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhJyCgZjcmVhdGUSMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhowLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIgTQuBgBEqgBCgZ1cGRhdGUSMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhowLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIjrCuBg2CAIQHiILbWV0YWRhdGEuaWQqI3VuYXV0aG9yaXplZCB0byB1cGRhdGUgb3JnYW5pemF0aW9uEqQBCgZkZWxldGUSMi5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbklkGjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iNMK4GDAIAxAeIgV2YWx1ZSojdW5hdXRob3JpemVkIHRvIGRlbGV0ZSBvcmdhbml6YXRpb24aBKD/Kx5iBnByb3RvMw",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io]),OrganizationCommandController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_command,0);var file_ai_stigmer_tenancy_organization_v1_query=fileDesc("Ci5haS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL3F1ZXJ5LnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxMrkEChtPcmdhbml6YXRpb25RdWVyeUNvbnRyb2xsZXISnwEKA2dldBIyLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uSWQaMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbiIywrgYLggBEB4iBXZhbHVlKiF1bmF1dGhvcml6ZWQgdG8gdmlldyBvcmdhbml6YXRpb24SewoEZmluZBI3LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5GaW5kQXBpUmVzb3VyY2VzUmVxdWVzdBo0LmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uTGlzdCIE0LgYARJmChNmaW5kTXlPcmdhbml6YXRpb25zEhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5GjEuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb25zIgTQuBgBEowBChJnZXRCeUV4dGVybmFsT3JnSWQSPi5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbkV4dGVybmFsTG9va3VwGjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iBNC4GAEaBKD/Kx5iBnByb3RvMw",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io,file_google_protobuf_empty]),OrganizationQueryController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_query,0);var organizationSearchExtractor={kind:ApiResourceKind.organization,schema:OrganizationSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let org=resource;return buildSearchResult({kind:ApiResourceKind.organization,metadata:org.metadata,summary:org.spec?.description??"",score,createdAt:org.status?.audit?.specAudit?.createdAt,updatedAt:org.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let org=resource,metadata=org.metadata;if(metadata!==void 0)return{name:metadata.name,description:org.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(org.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function newCheckOrgDuplicateStep(store){return{name:"CheckDuplicate",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("organization metadata is nil"),"duplicate check");if(metadata.slug==="")throw internalError(new Error("organization slug is empty"),"duplicate check");try{await store.getResource(ctx.apiResourceKind,metadata.slug,OrganizationSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw internalError(error2,"failed to check for duplicate organization")}throw alreadyExistsError("Organization",`slug '${metadata.slug}'`)}}}function newCopySlugToIdStep(){return{name:"CopySlugToId",execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("organization metadata is nil"),"copy slug to id");if(metadata.slug==="")throw internalError(new Error("organization slug is empty"),"copy slug to id");metadata.id=metadata.slug}}}function registerOrganizationServices(router,deps){router.service(OrganizationCommandController,{apply:(org,ctx)=>apply10(deps,org,ctx),create:(org,ctx)=>createOrganization(deps,org,ctx),update:(org,ctx)=>update13(deps,org,ctx),delete:(orgId,ctx)=>deleteOrganization(deps,orgId,ctx)});let externalLookup=deps.organizationDirectory?.getOrganizationIdByExternalOrgId?.bind(deps.organizationDirectory);router.service(OrganizationQueryController,{get:(orgId,ctx)=>get18(deps,orgId,ctx),find:(req,ctx)=>find(deps,req,ctx),findMyOrganizations:(_,ctx)=>findMyOrganizations(deps,ctx),...externalLookup===void 0?{}:{getByExternalOrgId:(lookup3,ctx)=>getByExternalOrgId(deps,externalLookup,lookup3,ctx)}})}function kindOf17(ctx){return ctx.values.get(apiResourceKindKey)}async function createOrganization(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx)),builder2=newPipeline("organization-create",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckOrgDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newCopySlugToIdStep());for(let step of stepsForSlot(deps.gateSteps,"org-create:pre-side-effect-gate"))builder2.addStep(step);builder2.addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger));for(let step of stepsForSlot(deps.gateSteps,"org-create:post-persist"))builder2.addStep(step);return await builder2.addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update13(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-update",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply10(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx));await newPipeline("organization-apply",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOrganization(deps,org,ctx):update13(deps,withResolvedApplyId(OrganizationSchema,org,reqCtx),ctx)}async function deleteOrganization(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationCommandController.method.delete.input,orgId,callerIdentityOf(ctx),kindOf17(ctx));await newPipeline("organization-delete",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,OrganizationSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted organization not found in context"),"delete operation lost its loaded resource");return deleted}async function get18(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.get.input,orgId,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-get",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OrganizationSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var FIND_RESULT_KEY="findResult";async function find(deps,req,ctx){if(deps.organizationDirectory?.refusesEnumeration===!0)throw new ConnectError("ai.stigmer.tenancy.organization.v1.OrganizationQueryController.find is not implemented",Code.Unimplemented);let reqCtx=new RequestContext(OrganizationQueryController.method.find.input,req,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-find",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.find,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListAllOrganizationsStep(deps.store)).build().execute(reqCtx),reqCtx.get(FIND_RESULT_KEY)}function newListAllOrganizationsStep(store){return{name:"ListAllOrganizations",async execute(ctx){let data;try{data=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list organizations")}let orgs=[];for(let bytes of data)try{orgs.push(fromBinary2(OrganizationSchema,bytes))}catch{continue}let req=ctx.input,pageSize=req.pageSize,pageNumber=req.pageNumber;req.page!==void 0&&(req.page.size>0&&(pageSize=req.page.size),req.page.num>0&&(pageNumber=req.page.num)),pageSize<=0&&(pageSize=20),pageSize>100&&(pageSize=100),pageNumber<=0&&(pageNumber=1);let totalPages=Math.ceil(orgs.length/pageSize),start=(pageNumber-1)*pageSize,entries=start>=orgs.length?[]:orgs.slice(start,start+pageSize);ctx.set(FIND_RESULT_KEY,create2(OrganizationListSchema,{totalPages,entries}))}}}async function findMyOrganizations(deps,ctx){let directory=deps.organizationDirectory;if(directory!==void 0){let authorized=await directory.listMyOrganizationIds(callerIdentityOf(ctx));if(authorized!=="all"){let entries2=[];for(let id of authorized)try{entries2.push(await deps.store.getResource(ApiResourceKind.organization,id,OrganizationSchema))}catch(error2){if(error2 instanceof ResourceNotFoundError)continue;throw internalError(error2,"failed to list organizations")}return create2(OrganizationsSchema,{entries:entries2})}}let data;try{data=await deps.store.listResources(ApiResourceKind.organization)}catch(error2){throw internalError(error2,"failed to list organizations")}let entries=[];for(let bytes of data)try{entries.push(fromBinary2(OrganizationSchema,bytes))}catch{continue}return create2(OrganizationsSchema,{entries})}async function getByExternalOrgId(deps,lookup3,input,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.getByExternalOrgId.input,input,callerIdentityOf(ctx),kindOf17(ctx));if(await newPipeline("organization-get-by-external-org-id",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.getByExternalOrgId,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx),input.externalOrgId==="")throw invalidArgumentError("external_org_id is required");let orgId=await lookup3(input.externalOrgId);if(orgId===void 0)throw notFoundError("Organization",input.externalOrgId);try{return await deps.store.getResource(ApiResourceKind.organization,orgId,OrganizationSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Organization",input.externalOrgId):internalError(error2,"failed to load organization")}}var file_ai_stigmer_agentic_mcpserver_v1_io=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2lvLnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxIiQKC01jcFNlcnZlcklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiggIKDENvbm5lY3RJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESUgoLcnVudGltZV9lbnYYAiADKAsyPS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dC5SdW50aW1lRW52RW50cnkSFAoDb3JnGAMgASgJQge6SARyAhABGmkKD1J1bnRpbWVFbnZFbnRyeRILCgNrZXkYASABKAkSRQoFdmFsdWUYAiABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25WYWx1ZToCOAEiUAoZSW5pdGlhdGVPQXV0aENvbm5lY3RJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESFAoDb3JnGAIgASgJQge6SARyAhABIm0KGkluaXRpYXRlT0F1dGhDb25uZWN0T3V0cHV0EhkKEWF1dGhvcml6YXRpb25fdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEg4KBnNjb3BlcxgDIAMoCRIVCg1wcm92aWRlcl9uYW1lGAQgASgJIncKGUNvbXBsZXRlT0F1dGhDb25uZWN0SW5wdXQSHQoNbWNwX3NlcnZlcl9pZBgBIAEoCUIGukgDyAEBEiMKEmF1dGhvcml6YXRpb25fY29kZRgCIAEoCUIHukgEcgIQARIWCgVzdGF0ZRgDIAEoCUIHukgEcgIQASJkChpDb21wbGV0ZU9BdXRoQ29ubmVjdE91dHB1dBIRCgljb25uZWN0ZWQYASABKAgSFgoOdGFyZ2V0X2Vudl92YXIYAiABKAkSGwoTdG9rZW5fbGlmZXRpbWVfaGludBgDIAEoCSJNChhHZXRPQXV0aEdyYW50U3RhdHVzSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBARIUCgNvcmcYAiABKAlCB7pIBHICEAEizwEKGUdldE9BdXRoR3JhbnRTdGF0dXNPdXRwdXQSEQoJY29ubmVjdGVkGAEgASgIEh8KF2FjY2Vzc190b2tlbl9leHBpcmVzX2F0GAIgASgDEhYKDnRhcmdldF9lbnZfdmFyGAMgASgJEhMKC2F1dGhfbWV0aG9kGAQgASgJElEKEWNvbm5lY3Rpb25faGVhbHRoGAUgASgOMjYuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5PQXV0aENvbm5lY3Rpb25IZWFsdGgiSQoURGlzY29ubmVjdE9BdXRoSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBARIUCgNvcmcYAiABKAlCB7pIBHICEAEiLQoVRGlzY29ubmVjdE9BdXRoT3V0cHV0EhQKDGRpc2Nvbm5lY3RlZBgBIAEoCCKEAQoTU2V0T3JnT0F1dGhBcHBJbnB1dBIbCgtyZXNvdXJjZV9pZBgBIAEoCUIGukgDyAEBEhQKA29yZxgCIAEoCUIHukgEcgIQARIaCgljbGllbnRfaWQYAyABKAlCB7pIBHICEAESHgoNY2xpZW50X3NlY3JldBgEIAEoCUIHukgEcgIQASIsChRTZXRPcmdPQXV0aEFwcE91dHB1dBIUCgxvYXV0aF9hcHBfaWQYASABKAkiSAoTR2V0T3JnT0F1dGhBcHBJbnB1dBIbCgtyZXNvdXJjZV9pZBgBIAEoCUIGukgDyAEBEhQKA29yZxgCIAEoCUIHukgEcgIQASJVChRHZXRPcmdPQXV0aEFwcE91dHB1dBIUCgxoYXNfb3ZlcnJpZGUYASABKAgSFAoMb2F1dGhfYXBwX2lkGAIgASgJEhEKCWNsaWVudF9pZBgDIAEoCSJLChZEZWxldGVPcmdPQXV0aEFwcElucHV0EhsKC3Jlc291cmNlX2lkGAEgASgJQga6SAPIAQESFAoDb3JnGAIgASgJQge6SARyAhABIioKF0RlbGV0ZU9yZ09BdXRoQXBwT3V0cHV0Eg8KB2RlbGV0ZWQYASABKAgq7QEKFU9BdXRoQ29ubmVjdGlvbkhlYWx0aBInCiNPQVVUSF9DT05ORUNUSU9OX0hFQUxUSF9VTlNQRUNJRklFRBAAEiMKH09BVVRIX0NPTk5FQ1RJT05fSEVBTFRIX0hFQUxUSFkQARIpCiVPQVVUSF9DT05ORUNUSU9OX0hFQUxUSF9UT0tFTl9FWFBJUkVEEAISNQoxT0FVVEhfQ09OTkVDVElPTl9IRUFMVEhfVE9LRU5fRVhQSVJFRF9SRUZSRVNIQUJMRRADEiQKIE9BVVRIX0NPTk5FQ1RJT05fSEVBTFRIX05PX0dSQU5UEARiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_spec,file_buf_validate_validate]);var InitiateOAuthConnectOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,3);var CompleteOAuthConnectOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,5);var GetOAuthGrantStatusOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,7);var DisconnectOAuthOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,9);var OAuthConnectionHealth;(function(OAuthConnectionHealth2){OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_UNSPECIFIED=0]="OAUTH_CONNECTION_HEALTH_UNSPECIFIED",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_HEALTHY=1]="OAUTH_CONNECTION_HEALTH_HEALTHY",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED=2]="OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE=3]="OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_NO_GRANT=4]="OAUTH_CONNECTION_HEALTH_NO_GRANT"})(OAuthConnectionHealth||(OAuthConnectionHealth={}));var file_ai_stigmer_agentic_mcpserver_v1_command=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2NvbW1hbmQucHJvdG8SH2FpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEynREKGk1jcFNlcnZlckNvbW1hbmRDb250cm9sbGVyEl8KBWFwcGx5EiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchKwAQoGY3JlYXRlEiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciJOwrgYSggrEB4iDG1ldGFkYXRhLm9yZyo2dW5hdXRob3JpemVkIHRvIGNyZWF0ZSBtY3Agc2VydmVyIGluIHRoaXMgb3JnYW5pemF0aW9uEpoBCgZ1cGRhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIjjCuBg0CAIQLCILbWV0YWRhdGEuaWQqIXVuYXV0aG9yaXplZCB0byB1cGRhdGUgbWNwIHNlcnZlchKmAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI4wrgYNAgDECwiC3Jlc291cmNlX2lkKiF1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1jcCBzZXJ2ZXISugEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiQ8K4GD8IAhAsIgtyZXNvdXJjZV9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtY3Agc2VydmVyIHZpc2liaWxpdHkSpAEKB2Nvbm5lY3QSLS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dBoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIj7CuBg6CBYQLCINbWNwX3NlcnZlcl9pZColdW5hdXRob3JpemVkIHRvIGNvbm5lY3QgdG8gbWNwIHNlcnZlchKpAQoMc3RhcnRDb25uZWN0Ei0uYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Db25uZWN0SW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI+wrgYOggWECwiDW1jcF9zZXJ2ZXJfaWQqJXVuYXV0aG9yaXplZCB0byBjb25uZWN0IHRvIG1jcCBzZXJ2ZXIS3wEKFGluaXRpYXRlT0F1dGhDb25uZWN0EjouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Jbml0aWF0ZU9BdXRoQ29ubmVjdElucHV0GjsuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Jbml0aWF0ZU9BdXRoQ29ubmVjdE91dHB1dCJOwrgYSggWECwiDW1jcF9zZXJ2ZXJfaWQqNXVuYXV0aG9yaXplZCB0byBpbml0aWF0ZSBvYXV0aCBjb25uZWN0IGZvciBtY3Agc2VydmVyEt8BChRjb21wbGV0ZU9BdXRoQ29ubmVjdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuQ29tcGxldGVPQXV0aENvbm5lY3RJbnB1dBo7LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuQ29tcGxldGVPQXV0aENvbm5lY3RPdXRwdXQiTsK4GEoIFhAsIg1tY3Bfc2VydmVyX2lkKjV1bmF1dGhvcml6ZWQgdG8gY29tcGxldGUgb2F1dGggY29ubmVjdCBmb3IgbWNwIHNlcnZlchLIAQoPZGlzY29ubmVjdE9BdXRoEjUuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5EaXNjb25uZWN0T0F1dGhJbnB1dBo2LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuRGlzY29ubmVjdE9BdXRoT3V0cHV0IkbCuBhCCBYQLCILcmVzb3VyY2VfaWQqL3VuYXV0aG9yaXplZCB0byBkaXNjb25uZWN0IG9hdXRoIGZvciBtY3Agc2VydmVyErgBCg5zZXRPcmdPQXV0aEFwcBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU2V0T3JnT0F1dGhBcHBJbnB1dBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU2V0T3JnT0F1dGhBcHBPdXRwdXQiOcK4GDUIFxAeIgNvcmcqKnVuYXV0aG9yaXplZCB0byBzZXQgb3JnIG9hdXRoIGFwcCBvdmVycmlkZRLEAQoRZGVsZXRlT3JnT0F1dGhBcHASNy5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRlbGV0ZU9yZ09BdXRoQXBwSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRlbGV0ZU9yZ09BdXRoQXBwT3V0cHV0IjzCuBg4CBcQHiIDb3JnKi11bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG9yZyBvYXV0aCBhcHAgb3ZlcnJpZGUaBKD/KyxiBnByb3RvMw",[file_ai_stigmer_agentic_mcpserver_v1_api,file_ai_stigmer_agentic_mcpserver_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),McpServerCommandController=serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_command,0);var file_ai_stigmer_agentic_mcpserver_v1_query=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL3F1ZXJ5LnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxMssFChhNY3BTZXJ2ZXJRdWVyeUNvbnRyb2xsZXISkgEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiMMK4GCwIARAsIgV2YWx1ZSofdW5hdXRob3JpemVkIHRvIHZpZXcgbWNwIHNlcnZlchJ4Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBEtUBChNnZXRPQXV0aEdyYW50U3RhdHVzEjkuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5HZXRPQXV0aEdyYW50U3RhdHVzSW5wdXQaOi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkdldE9BdXRoR3JhbnRTdGF0dXNPdXRwdXQiR8K4GEMIARAsIgtyZXNvdXJjZV9pZCowdW5hdXRob3JpemVkIHRvIHZpZXcgb2F1dGggc3RhdHVzIGZvciBtY3Agc2VydmVyEsEBCg5nZXRPcmdPQXV0aEFwcBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuR2V0T3JnT0F1dGhBcHBJbnB1dBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuR2V0T3JnT0F1dGhBcHBPdXRwdXQiQsK4GD4IARAsIgtyZXNvdXJjZV9pZCordW5hdXRob3JpemVkIHRvIHZpZXcgb3JnIG9hdXRoIGFwcCBvdmVycmlkZRoEoP8rLGIGcHJvdG8z",[file_ai_stigmer_agentic_mcpserver_v1_api,file_ai_stigmer_agentic_mcpserver_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),McpServerQueryController=serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_query,0);async function completeOAuthConnect(deps,input,identity2){let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");let stateParam=input.state;if(stateParam==="")throw invalidArgumentError("state is required");let code=input.authorizationCode;if(code==="")throw invalidArgumentError("authorization_code is required");let pendingState;try{pendingState=await deps.pendingOAuthStates.getAndDelete(stateParam)}catch(error2){throw internalError(error2,"failed to load pending OAuth state")}if(pendingState===void 0)throw failedPreconditionError("no pending OAuth state found for the given state parameter (expired or already used)");if(pendingState.mcpServerId!==mcpServerId)throw failedPreconditionError("state parameter does not match the requested mcp_server_id");await authorizeDirect(McpServerCommandController.method.completeOAuthConnect,deps.authorizer,identity2,input,{resourceId:pendingState.mcpServerId});try{pendingState=await unsealPendingOAuthState(deps.secretService,pendingState)}catch(error2){throw deps.logger.error("Failed to decrypt pending OAuth state secrets",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to decrypt OAuth handshake secrets \u2014 please retry the connect flow")}let tokenResponse;try{tokenResponse=await exchangeCode(pendingState.tokenEndpoint,code,pendingState.redirectUri,pendingState.codeVerifier,pendingState.clientId,pendingState.clientSecret,pendingState.tokenAuthMethod,deps.outboundFetch)}catch(error2){throw unavailableError(`token exchange failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}let org=pendingState.org;org===""&&(org=mcpServer.metadata?.org??"");let managedEnvId=await resolveOrCreateManagedEnvironment(deps,pendingState.identityAccountId,mcpServerId,org,mcpServer.metadata?.name??"",identity2),tokenVars={[pendingState.targetEnvVar]:create2(EnvironmentValueSchema,{value:tokenResponse.accessToken,isSecret:!0})},refreshTokenEnvVar=`${pendingState.targetEnvVar}_REFRESH_TOKEN`;tokenResponse.refreshToken!==""&&(tokenVars[refreshTokenEnvVar]=create2(EnvironmentValueSchema,{value:tokenResponse.refreshToken,isSecret:!0}));try{await deps.managedEnv.updateSecrets(managedEnvId,tokenVars)}catch(error2){throw internalError(error2,"failed to store OAuth tokens in managed environment")}let expiresAt=0;tokenResponse.expiresIn>0&&(expiresAt=Math.floor(Date.now()/1e3)+tokenResponse.expiresIn);try{await deps.oauthGrants.upsert({identityAccountId:pendingState.identityAccountId,resourceId:mcpServerId,resourceKind:"mcp_server",orgId:org,accessTokenExpiresAt:expiresAt,clientId:pendingState.clientId,authMethod:pendingState.authMethod,tokenEndpoint:pendingState.tokenEndpoint,accessTokenEnvVar:pendingState.targetEnvVar,refreshTokenEnvVar,environmentId:managedEnvId,createdAt:0,updatedAt:0})}catch(error2){throw internalError(error2,"failed to create OAuth grant record")}let auth=mcpServer.spec?.auth;return deps.logger.info("OAuth Connect completed: tokens stored in managed environment",{mcp_server_id:mcpServerId,auth_method:pendingState.authMethod,target_env_var:pendingState.targetEnvVar,managed_env_id:managedEnvId,expires_at:expiresAt,has_refresh_token:tokenResponse.refreshToken!==""}),create2(CompleteOAuthConnectOutputSchema,{connected:!0,targetEnvVar:pendingState.targetEnvVar,tokenLifetimeHint:auth?.tokenLifetimeHint??""})}async function unsealPendingOAuthState(secretService,state2){let verifier;try{verifier=await secretService.decrypt(state2.codeVerifier)}catch(error2){throw new Error(`failed to decrypt code_verifier: ${error2 instanceof Error?error2.message:String(error2)}`)}let secret;try{secret=await secretService.decrypt(state2.clientSecret)}catch(error2){throw new Error(`failed to decrypt client_secret: ${error2 instanceof Error?error2.message:String(error2)}`)}return{...state2,codeVerifier:verifier,clientSecret:secret}}async function resolveOrCreateManagedEnvironment(deps,identityAccountId,mcpServerId,org,mcpServerName,caller){let existingGrant;try{existingGrant=await deps.oauthGrants.find(identityAccountId,mcpServerId,org)}catch(error2){deps.logger.warn("Failed to look up existing OAuth grant (non-fatal, will create new managed env)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}if(existingGrant!==void 0&&existingGrant.environmentId!=="")return deps.logger.info("Reusing existing managed environment for OAuth re-connect",{mcp_server_id:mcpServerId,environment_id:existingGrant.environmentId}),existingGrant.environmentId;let envName=`OAuth: ${mcpServerName}`;try{return await deps.managedEnv.createManagedEnvironment(envName,org,caller)}catch(error2){throw internalError(error2,"failed to create managed environment for OAuth tokens")}}function convertToDiscoveredCapabilities(output){let capabilities=create2(DiscoveredCapabilitiesSchema,{lastDiscoveredAt:timestampNow()});for(let t of output.tools??[]){let tool=create2(DiscoveredToolSchema,{name:t.name??"",description:t.description??""});t.input_schema!==void 0&&(tool.inputSchema=t.input_schema),capabilities.tools.push(tool)}for(let rt of output.resource_templates??[])capabilities.resourceTemplates.push(create2(DiscoveredResourceTemplateSchema,{uriTemplate:rt.uri_template??"",name:rt.name??"",description:rt.description??"",mimeType:rt.mime_type??""}));return capabilities}function convertToToolApprovals(output){let approvals=[];for(let a5 of output.tool_approvals??[])a5.requires_approval!==!0||(a5.tool_name??"")===""||approvals.push(create2(ToolApprovalPolicySchema,{toolName:a5.tool_name,message:a5.message??"",fromDestructiveHint:a5.from_destructive_hint??!1}));return approvals}function setToolApprovalsFromConnect(status,output){let approvals=convertToToolApprovals(output);return approvals.length>0&&(status.toolApprovals=approvals),approvals.length}function settleConnectStatus(mcpStatus,workflowId,failure){let cs=mcpStatus.connectStatus;if(cs===void 0&&(cs=create2(ConnectStatusSchema),mcpStatus.connectStatus=cs),cs.workflowId=workflowId,cs.finishedAt=timestampNow(),cs.warning="",failure===void 0){cs.phase=ConnectPhase.succeeded,cs.failureCode="",cs.failureMessage="";return}cs.phase=ConnectPhase.failed,cs.failureCode=grpcCodeName(failure.code),cs.failureMessage=failure.rawMessage}async function persistConnectResult(store,mcpServerId,workflowId,output){let toolApprovalCount=0;return{persisted:await store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),mcpServer.status.discoveredCapabilities=convertToDiscoveredCapabilities(output),toolApprovalCount=setToolApprovalsFromConnect(mcpServer.status,output),settleConnectStatus(mcpServer.status,workflowId,void 0)}),toolApprovalCount}}async function persistConnectStarting(store,mcpServerId,workflowId,warning2){return store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),mcpServer.status.connectStatus=create2(ConnectStatusSchema,{phase:ConnectPhase.connecting,workflowId,startedAt:timestampNow(),warning:warning2})})}async function persistConnectFailure(store,logger2,mcpServerId,failure){try{await store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),settleConnectStatus(mcpServer.status,mcpServer.status.connectStatus?.workflowId??"",failure)})}catch(error2){if(error2 instanceof ResourceNotFoundError){logger2.info("Skipping connect failure persistence: MCP server deleted before connect settled",{mcp_server_id:mcpServerId});return}logger2.warn("Failed to record connect failure on connect_status (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}}var CONNECT_TIMEOUT={ms:42e4,goLabel:"7m0s"},ASYNC_CONNECT_TIMEOUT={ms:3600*1e3,goLabel:"1h0m0s"},BEST_EFFORT_CONNECT_GET_BUFFER_MS=15e3;async function connect(deps,input,identity2){let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");if(input.org==="")throw invalidArgumentError("org is required for connect");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.connect,deps.authorizer,identity2,input);let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError("connect is not available: Temporal not configured");let prepared=await prepareConnect(deps,mcpServer,input,identity2);try{let run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,prepared.workflowInput,CONNECT_TIMEOUT.ms)}catch(error2){throw deps.logger.error("Failed to start MCP connect workflow",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to start connect workflow")}if(!run.attached)try{await persistConnectStarting(deps.store,mcpServerId,run.workflowId,"")}catch(error2){deps.logger.warn("Failed to record CONNECTING on connect_status (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let outcome=await run.result(CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,CONNECT_TIMEOUT);throw await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure),failure}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){throw internalError(error2,"failed to save mcp server after connect")}return deps.logger.info("MCP server connect completed and stored",{mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount}),persisted}finally{prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId)}}async function prepareConnect(deps,mcpServer,input,identity2){let mcpServerId=mcpServer.metadata?.id??"",callerOrg=input.org;Object.keys(input.runtimeEnv).length===0&&await refreshOAuthTokenIfNeeded(deps,mcpServer,callerOrg);let executionId=newConnectExecutionId(mcpServerId),ecResourceId=await createConnectExecutionContext(deps,mcpServer,executionId,callerOrg,input.runtimeEnv,identity2),workflowInput={mcp_server_id:mcpServerId,...ecResourceId!==""?{execution_context_id:executionId}:{}};if(ecResourceId!==""&&deps.runnerAuth.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))try{let minted=deps.runnerAuth.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return{workflowInput:{...workflowInput,execution_context_token:minted.token},ecResourceId,executionId}}catch(error2){deps.logger.warn("Failed to mint connect EC token \u2014 discovery will read redacted credentials",{execution_id:executionId,error:error2 instanceof Error?error2.message:String(error2)})}return{workflowInput,ecResourceId,executionId}}async function createConnectExecutionContext(deps,mcpServer,executionId,callerOrg,runtimeEnv,caller){let ecData;if(Object.keys(runtimeEnv).length>0)ecData=runtimeEnv,deps.logger.info("Using runtime_env for connect ExecutionContext (one-time use)",{execution_id:executionId,runtime_env_count:Object.keys(runtimeEnv).length});else{let envDecls=mcpServer.spec?.env??{};if(Object.keys(envDecls).length===0)return deps.logger.debug("MCP server has no env declarations \u2014 skipping ExecutionContext creation",{execution_id:executionId}),"";let mcpServerId=mcpServer.metadata?.id??"",{oauthVars,remainingDecls}=await resolveOAuthVarsFromManagedEnv(deps,mcpServerId,callerOrg,envDecls),personalVars={};Object.keys(remainingDecls).length>0&&(personalVars=await resolveFromPersonalEnvironment(deps,callerOrg,remainingDecls)),ecData={...personalVars,...oauthVars},deps.logger.info("Resolved env vars for connect ExecutionContext",{execution_id:executionId,oauth_count:Object.keys(oauthVars).length,personal_count:Object.keys(personalVars).length})}if(Object.keys(ecData).length===0)return"";let created;try{created=await deps.executionContext.create(create2(ExecutionContextSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"ExecutionContext",metadata:{name:`exec-ctx-${executionId}`,org:callerOrg},spec:{executionId,data:ecData}}),caller)}catch(error2){throw internalError(error2,"failed to create connect ExecutionContext")}let resourceId=created.metadata?.id??"";return deps.logger.info("Created ephemeral ExecutionContext for MCP connect",{execution_context_id:resourceId,execution_id:executionId,data_entries:Object.keys(ecData).length}),resourceId}async function resolveOAuthVarsFromManagedEnv(deps,mcpServerId,org,envDecls){let grant;try{grant=await deps.oauthGrants.find("",mcpServerId,org)}catch{return{oauthVars:{},remainingDecls:envDecls}}if(grant===void 0||grant.environmentId==="")return{oauthVars:{},remainingDecls:envDecls};let oauthKey=grant.accessTokenEnvVar;if(!(oauthKey in envDecls))return{oauthVars:{},remainingDecls:envDecls};let tokenValue="";try{tokenValue=await deps.managedEnv.readSecretValue(grant.environmentId,oauthKey)}catch(error2){return deps.logger.warn("Failed to read OAuth token from managed environment \u2014 falling back to personal env",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId,error:error2 instanceof Error?error2.message:String(error2)}),{oauthVars:{},remainingDecls:envDecls}}if(tokenValue==="")return deps.logger.warn("Failed to read OAuth token from managed environment \u2014 falling back to personal env",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId}),{oauthVars:{},remainingDecls:envDecls};let remainingDecls={};for(let[k5,v]of Object.entries(envDecls))k5!==oauthKey&&(remainingDecls[k5]=v);return deps.logger.debug("Resolved OAuth token from managed environment",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId}),{oauthVars:{[oauthKey]:create2(ExecutionValueSchema,{value:tokenValue,isSecret:!0})},remainingDecls}}async function resolveFromPersonalEnvironment(deps,org,envDecls){let resolution=await resolveDeclaredFromPersonalEnvironment(deps.environmentReader,deps.logger,org,envDecls);if(resolution.kind==="no-personal-environment"){let requiredKeys=Object.entries(envDecls).filter(([,decl])=>!decl.optional).map(([key])=>key);if(requiredKeys.length===0)return{};throw failedPreconditionError(`personal environment not found for org '${org}'; save required credentials first: [${requiredKeys.join(" ")}]`)}if(resolution.missing.length>0)throw failedPreconditionError(`missing required credentials in personal environment: [${resolution.missing.join(" ")}]`);return{...resolution.values}}async function deleteConnectExecutionContext(deps,resourceId,executionId){try{await deps.executionContext.delete({resourceId})}catch(error2){deps.logger.warn("Failed to delete connect ExecutionContext (non-fatal)",{resource_id:resourceId,execution_id:executionId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.debug("Deleted ephemeral connect ExecutionContext",{resource_id:resourceId,execution_id:executionId})}function mapConnectFailure(logger2,mcpServer,workflowId,failure,budget){let mcpServerId=mcpServer.metadata?.id??"";switch(logger2.error("MCP connect workflow failed",{workflow_id:workflowId,mcp_server_id:mcpServerId,failure_kind:failure.kind}),failure.kind){case"application":return failedPreconditionError(buildConnectFailureMessage(mcpServer,failure.message));case"timeout":return new ConnectError(`connect did not complete within the ${budget.goLabel} budget for MCP server '${mcpServerId}' \u2014 if this repeats, check that your runner is running and healthy`,Code.DeadlineExceeded);case"service-not-found":return unavailableError(`connect service temporarily unavailable for MCP server '${mcpServerId}'`);case"other":return new ConnectError(buildConnectFailureMessage(mcpServer,failure.message),Code.Internal);default:{let exhaustive=failure;throw new Error(`unhandled connect failure ${String(exhaustive)}`)}}}function buildConnectFailureMessage(mcpServer,cause){let name=mcpServer.metadata?.name??"";if(cause.includes("requires OAuth"))return cause;if(mcpServer.spec?.serverType.case==="stdio"){let slug=mcpServer.metadata?.slug??"";return`connect failed for MCP server '${name}': ${cause}. This is a stdio server launched by your local runner \u2014 verify the command is installed and its arguments and environment variables are correct. Preview discovery locally with: stigmer connect mcp-server ${slug} --dry-run`}return`connect failed for MCP server '${name}': ${cause}. Check that the server URL is reachable and your credentials are valid.`}async function refreshOAuthTokenIfNeeded(deps,mcpServer,callerOrg){if(mcpServer.spec?.auth===void 0)return;let mcpServerId=mcpServer.metadata?.id??"",grant;try{grant=await deps.oauthGrants.find("",mcpServerId,callerOrg)}catch(error2){deps.logger.warn("Failed to load OAuth grant for pre-flight check (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}if(grant===void 0)return;if(grant.environmentId===""){deps.logger.warn("OAuth grant has no managed environment ID \u2014 user must re-authenticate via OAuth Connect",{mcp_server_id:mcpServerId});return}let refreshTokenValue;try{refreshTokenValue=await deps.managedEnv.readSecretValue(grant.environmentId,grant.refreshTokenEnvVar)}catch(error2){deps.logger.debug("No refresh token found in managed environment (may not be OAuth-connected)",{mcp_server_id:mcpServerId,refresh_token_var:grant.refreshTokenEnvVar,managed_env_id:grant.environmentId,error:error2 instanceof Error?error2.message:String(error2)});return}let clientSecret="",tokenAuthMethod="";if(grant.authMethod==="vendor_oauth")try{({clientSecret,tokenAuthMethod}=await loadOAuthAppClientCredentials(deps,mcpServer))}catch(error2){deps.logger.warn("Failed to load OAuthApp client secret for refresh",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let result;try{result=await refreshTokenIfExpired(grant,refreshTokenValue,clientSecret,tokenAuthMethod,deps.logger,deps.outboundFetch)}catch(error2){throw failedPreconditionError(error2 instanceof Error?error2.message:String(error2))}if(!result.refreshed)return;let tokenVars={[grant.accessTokenEnvVar]:create2(EnvironmentValueSchema,{value:result.newAccessToken,isSecret:!0})};result.newRefreshToken!==refreshTokenValue&&(tokenVars[grant.refreshTokenEnvVar]=create2(EnvironmentValueSchema,{value:result.newRefreshToken,isSecret:!0}));try{await deps.managedEnv.updateSecrets(grant.environmentId,tokenVars)}catch(error2){throw internalError(error2,"failed to update refreshed tokens in managed environment")}try{await deps.oauthGrants.upsert({...grant,accessTokenExpiresAt:result.newExpiresAt})}catch(error2){deps.logger.warn("Failed to update OAuth grant after refresh (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}}async function loadOAuthAppClientCredentials(deps,mcpServer){let ref=mcpServer.spec?.auth?.oauthAppRef;if(ref===void 0||ref.slug==="")return{clientSecret:"",tokenAuthMethod:""};let app;try{app=await resolveOAuthAppRef(deps.store,ref,deps.logger)}catch(error2){throw new Error(`failed to list oauth apps: ${error2 instanceof Error?error2.message:String(error2)}`)}if(app===void 0)throw new Error(`OAuthApp '${ref.slug}' not found`);let tokenAuthMethod=tokenAuthMethodFromSpec(app.spec?.tokenEndpointAuthMethod??TokenEndpointAuthMethod.UNSPECIFIED),secret=app.spec?.clientSecret??"";return deps.secretService.isEncrypted(secret)&&(secret=await deps.secretService.decrypt(secret)),{clientSecret:secret,tokenAuthMethod}}function tokenAuthMethodFromSpec(method){return method===TokenEndpointAuthMethod.CLIENT_SECRET_POST?TOKEN_AUTH_METHOD_POST:TOKEN_AUTH_METHOD_BASIC}async function startBestEffortConnect(deps,mcpServer){let engineState=deps.engineState();if(!engineState.connected)return;let envKeys=Object.keys(mcpServer.spec?.env??{}).length;if(envKeys>0){deps.logger.debug("Skipping best-effort auto-connect: MCP server has env declarations (requires manual connect)",{mcp_server_id:mcpServer.metadata?.id??"",env_keys:envKeys});return}let mcpServerId=mcpServer.metadata?.id??"",run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,{mcp_server_id:mcpServerId},CONNECT_TIMEOUT.ms)}catch(error2){deps.logger.warn("Failed to start best-effort connect workflow (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}if(!run.attached)try{await persistConnectStarting(deps.store,mcpServerId,run.workflowId,"")}catch(error2){deps.logger.warn("Failed to record CONNECTING for best-effort connect (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let outcome=await run.result(CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,CONNECT_TIMEOUT);await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure);return}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){if(error2 instanceof ResourceNotFoundError){deps.logger.info("Skipping best-effort connect persistence: MCP server deleted before connect completed",{mcp_server_id:mcpServerId});return}deps.logger.warn("Failed to persist best-effort connect result (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.info("Best-effort auto-connect completed and stored",{workflow_id:run.workflowId,mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount})}async function disconnectOAuth(deps,input,identity2){let resourceId=input.resourceId;if(resourceId==="")throw invalidArgumentError("resource_id is required");let org=input.org;if(org==="")throw invalidArgumentError("org is required");await authorizeDirect(McpServerCommandController.method.disconnectOAuth,deps.authorizer,identity2,input);let grant;try{grant=await deps.oauthGrants.find("",resourceId,org)}catch(error2){throw internalError(error2,"failed to look up OAuth grant")}if(grant===void 0)return deps.logger.debug("No OAuth grant to disconnect",{resource_id:resourceId,org}),create2(DisconnectOAuthOutputSchema,{disconnected:!1});let envId=grant.environmentId;if(envId!=="")try{await deps.managedEnv.deleteManagedEnvironment(envId)}catch(error2){deps.logger.warn("Failed to delete managed environment \u2014 may already be deleted",{resource_id:resourceId,environment_id:envId,error:error2 instanceof Error?error2.message:String(error2)})}try{await deps.oauthGrants.delete("",resourceId,org)}catch(error2){throw internalError(error2,"failed to delete OAuth grant")}return deps.logger.info("OAuth connection disconnected",{resource_id:resourceId,org,env_deleted:envId!==""}),create2(DisconnectOAuthOutputSchema,{disconnected:!0})}function isOAuthChallenge(wwwAuthenticate){let value=wwwAuthenticate.toLowerCase();return value.includes("bearer")?value.includes("oauth")||value.includes("resource_metadata"):!1}function parseResourceMetadataUrl(wwwAuthenticate){return/resource_metadata="([^"]+)"/i.exec(wwwAuthenticate)?.[1]}function protectedResourceMetadataUrls(resource){let bare=`${resource.origin}/.well-known/oauth-protected-resource`,path14=resource.pathname.replace(/\/+$/,"");return path14===""?[bare]:[`${bare}${path14}`,bare]}function authorizationServerMetadataUrls(issuer){let path14=issuer.pathname.replace(/\/+$/,""),urls=[...path14===""?[]:[`${issuer.origin}/.well-known/oauth-authorization-server${path14}`],`${issuer.origin}/.well-known/oauth-authorization-server`,...path14===""?[]:[`${issuer.origin}${path14}/.well-known/openid-configuration`],`${issuer.origin}/.well-known/openid-configuration`];return[...new Set(urls)]}async function resolveAuthorizationServers(resourceUrl,pointer,deps){let attempts=[],candidates=pointer!==void 0?[pointer]:protectedResourceMetadataUrls(new URL(resourceUrl));for(let candidate of candidates){let read3=await readJson(candidate,deps,attempts);if(read3===void 0)continue;let issuers=readStringArray(read3,"authorization_servers");if(issuers.length>0)return{issuers,attempts}}return{issuers:[],attempts}}async function readAuthorizationServerMetadata(issuer,deps){let attempts=[],parsed;try{parsed=new URL(issuer)}catch{return{kind:"not-found",attempts}}for(let metadataUrl of authorizationServerMetadataUrls(parsed)){let document2=await readJson(metadataUrl,deps,attempts);if(document2===void 0)continue;let authorizationEndpoint=readString(document2,"authorization_endpoint"),tokenEndpoint=readString(document2,"token_endpoint");if(authorizationEndpoint===""||tokenEndpoint===""){let last=attempts.pop();last!==void 0&&attempts.push({...last,missing:authorizationEndpoint===""?"authorization_endpoint":"token_endpoint"});continue}return{kind:"found",attempts,metadata:{metadataUrl,issuer:readString(document2,"issuer"),authorizationEndpoint,tokenEndpoint,registrationEndpoint:readString(document2,"registration_endpoint"),scopesSupported:readStringArray(document2,"scopes_supported"),codeChallengeMethodsSupported:readStringArray(document2,"code_challenge_methods_supported")}}}return{kind:"not-found",attempts}}async function readJson(url,deps,attempts){let response;try{response=await deps.fetchImpl(url,{method:"GET",headers:{Accept:"application/json"},signal:AbortSignal.timeout(deps.timeoutMs)})}catch(error2){attempts.push({url,error:error2 instanceof Error?error2.message:String(error2)});return}if(attempts.push({url,status:response.status}),response.status!==200){await response.body?.cancel().catch(()=>{});return}try{let parsed=await response.json();return isRecord(parsed)?parsed:void 0}catch{return}}function readString(record2,key){let value=record2[key];return typeof value=="string"?value:""}function readStringArray(record2,key){let list12=record2[key];return Array.isArray(list12)?list12.filter(item=>typeof item=="string"):[]}function isRecord(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)}var MCP_PROTOCOL_VERSION="2025-06-18";function baseHeaders(headers2){return{"Content-Type":"application/json",Accept:"application/json, text/event-stream","MCP-Protocol-Version":MCP_PROTOCOL_VERSION,...headers2??{}}}function initializeRequest(clientName,headers2){return{method:"POST",headers:baseHeaders(headers2),body:JSON.stringify({jsonrpc:"2.0",id:1,method:"initialize",params:{protocolVersion:MCP_PROTOCOL_VERSION,capabilities:{},clientInfo:{name:clientName,version:"0"}}})}}async function probeEndpointAuth(url,headers2,deps){let request=initializeRequest(deps.clientName,headers2),response;try{response=await deps.fetchImpl(url,{method:request.method,headers:{...request.headers},body:request.body,signal:AbortSignal.timeout(deps.timeoutMs)})}catch(error2){return{kind:"unreachable",error:describeError(error2)}}if(await response.body?.cancel().catch(()=>{}),response.status===401){let challenge=response.headers.get("www-authenticate")??"";return isOAuthChallenge(challenge)?{kind:"oauth",challenge,resourceMetadataUrl:parseResourceMetadataUrl(challenge)}:{kind:"challenge-not-oauth",challenge}}return response.status>=200&&response.status<300?{kind:"accepted",status:response.status}:{kind:"http-other",status:response.status}}function describeError(error2){return error2 instanceof Error?`${error2.name}: ${error2.message}`:String(error2)}var ENDPOINT_PROBE_TIMEOUT_MS=3e3,PROBE_CLIENT_NAME="stigmer-server",ACCESS_TOKEN_VAR_SUFFIX="_ACCESS_TOKEN",AUTHORIZATION_HEADER="authorization";function newCompleteEndpointAuthStep(deps){return{name:"CompleteEndpointAuth",async execute(ctx){let server=ctx.newState,spec=server.spec;if(spec===void 0)return;applyTokenPathDefault(spec,server.metadata?.slug??"");let existing=ctx.get(EXISTING_RESOURCE_KEY),derived=existing!==void 0?derivedCompletionOf(existing):void 0,url=authorShapeUrl(spec);if(url===void 0){derived!==void 0&&echoesDerived(spec,derived)?stamp(ctx,server):dropLabel(server);return}if(derived!==void 0&&derived.url===url){applyCompletion(spec,derived.variable,derived.description),stamp(ctx,server);return}if(await probe(url,spec,deps)!=="oauth"){dropLabel(server);return}let variable=accessTokenVariable(server.metadata?.slug??"");applyCompletion(spec,variable,tokenDescription(server.metadata?.slug??"")),stamp(ctx,server)}}}function authorShapeUrl(spec){if(spec.serverType.case==="http"&&spec.auth===void 0&&!(Object.keys(spec.env).length>0)){for(let[name,value]of Object.entries(spec.serverType.value.headers))if(name.toLowerCase()===AUTHORIZATION_HEADER||value.includes("${"))return;return spec.serverType.value.url}}function derivedCompletionOf(existing){if(existing.metadata?.labels[MCP_AUTH_LABEL]!==MCP_AUTH_ENDPOINT)return;let spec=existing.spec;if(spec===void 0||spec.serverType.case!=="http")return;let variable=spec.auth?.targetEnvVar??"";if(variable!=="")return{url:spec.serverType.value.url,variable,description:spec.env[variable]?.description??""}}function echoesDerived(spec,derived){if(spec.serverType.case!=="http"||spec.serverType.value.url!==derived.url)return!1;let auth=spec.auth;if(auth===void 0||auth.targetEnvVar!==derived.variable||!auth.oauthOnly||(auth.oauthAppRef?.slug??"")!==""||auth.discoveryUrl!==""||auth.scopeHints.length>0||auth.tokenLifetimeHint!=="")return!1;let envKeys=Object.keys(spec.env);if(envKeys.length!==1||envKeys[0]!==derived.variable)return!1;let declaration=spec.env[derived.variable];if(declaration===void 0||!declaration.isSecret||declaration.optional)return!1;let headers2=Object.entries(spec.serverType.value.headers),authorization=headers2.filter(([name])=>name.toLowerCase()===AUTHORIZATION_HEADER);return authorization.length!==1||authorization[0]?.[1]!==bearerHeader(derived.variable)?!1:headers2.every(([name,value])=>name.toLowerCase()===AUTHORIZATION_HEADER||!value.includes("${"))}function applyCompletion(spec,variable,description){spec.auth=create2(McpServerAuthSchema,{targetEnvVar:variable,oauthOnly:!0}),spec.env[variable]=create2(EnvVarDeclarationSchema,{isSecret:!0,optional:!1,description}),applyTokenPathDefault(spec,"")}function applyTokenPathDefault(spec,slug){let variable=spec.auth?.targetEnvVar??"";if(variable===""||(spec.env[variable]===void 0&&(spec.env[variable]=create2(EnvVarDeclarationSchema,{isSecret:!0,optional:!1,description:tokenDescription(slug)})),spec.serverType.case!=="http"))return;let headers2=spec.serverType.value.headers,reference=`\${${variable}}`;Object.values(headers2).some(value=>value.includes(reference))||(headers2.Authorization=bearerHeader(variable))}function bearerHeader(variable){return`Bearer \${${variable}}`}function accessTokenVariable(slug){let stem=slug.toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/^_+|_+$/g,"");return`${stem===""?"MCP":stem}${ACCESS_TOKEN_VAR_SUFFIX}`}function tokenDescription(slug){return`OAuth access token for the '${slug}' MCP server; Sign in fills it`}function stamp(ctx,server){server.metadata!==void 0&&(server.metadata.labels[MCP_AUTH_LABEL]=MCP_AUTH_ENDPOINT,recordServerStampedReservedLabels(ctx,MCP_AUTH_LABEL))}function dropLabel(server){server.metadata!==void 0&&delete server.metadata.labels[MCP_AUTH_LABEL]}async function probe(url,spec,deps){let headers2=spec.serverType.case==="http"?spec.serverType.value.headers:{};try{let outcome=await probeEndpointAuth(url,headers2,{fetchImpl:deps.outboundFetch,timeoutMs:ENDPOINT_PROBE_TIMEOUT_MS,clientName:PROBE_CLIENT_NAME});return outcome.kind==="unreachable"&&deps.logger.debug("MCP endpoint probe got no answer; saving the spec as sent",{url,error:outcome.error}),outcome.kind==="oauth"?"oauth":"other"}catch(error2){return deps.logger.warn("MCP endpoint probe threw; saving the spec as sent",{url,error:error2 instanceof Error?error2.message:String(error2)}),"other"}}async function getOAuthGrantStatus(deps,input,identity2){if(input.resourceId==="")throw invalidArgumentError("resource_id is required");if(input.org==="")throw invalidArgumentError("org is required");await authorizeDirect(McpServerQueryController.method.getOAuthGrantStatus,deps.authorizer,identity2,input);let grant;try{grant=await deps.oauthGrants.find("",input.resourceId,input.org)}catch(error2){throw internalError(error2,"failed to look up OAuth grant")}return grant===void 0?create2(GetOAuthGrantStatusOutputSchema,{connected:!1,connectionHealth:OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_NO_GRANT}):create2(GetOAuthGrantStatusOutputSchema,{connected:!0,accessTokenExpiresAt:BigInt(grant.accessTokenExpiresAt),targetEnvVar:grant.accessTokenEnvVar,authMethod:grant.authMethod,connectionHealth:evaluateHealth(grant)})}function evaluateHealth(grant){return grant.accessTokenExpiresAt===0?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY:Math.floor(Date.now()/1e3)<grant.accessTokenExpiresAt-REFRESH_EXPIRY_BUFFER_SECONDS?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY:grant.refreshTokenEnvVar!==""?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE:OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED}var import_node_crypto24=require("node:crypto");var import_node_crypto23=require("node:crypto");function generatePkce(){let verifier=(0,import_node_crypto23.randomBytes)(32).toString("base64url"),challenge=(0,import_node_crypto23.createHash)("sha256").update(verifier).digest().toString("base64url");return{codeVerifier:verifier,codeChallenge:challenge}}var DISCOVERY_REQUEST_TIMEOUT_MS=1e4;async function discoverForResource(mcpUrl,fetchImpl){let resource=parseDiscoveryUrl(mcpUrl),deps={fetchImpl,timeoutMs:DISCOVERY_REQUEST_TIMEOUT_MS},resolved=await resolveAuthorizationServers(resource.href,void 0,deps),issuers=resolved.issuers.length>0?resolved.issuers:[resource.origin];return readIssuers(issuers,deps)}async function discoverAtIssuer(issuerUrl,fetchImpl){let issuer=parseDiscoveryUrl(issuerUrl);return readIssuers([issuer.href],{fetchImpl,timeoutMs:DISCOVERY_REQUEST_TIMEOUT_MS})}async function readIssuers(issuers,deps){let attempts=[];for(let issuer of issuers){let read3=await readAuthorizationServerMetadata(issuer,deps);if(attempts.push(...read3.attempts),read3.kind==="found"){let metadata=toAuthServerMetadata(read3.metadata);return validateMetadata(metadata,read3.metadata.metadataUrl),metadata}}throw discoveryFailure(issuers,attempts)}function toAuthServerMetadata(m3){return{issuer:m3.issuer,authorizationEndpoint:m3.authorizationEndpoint,tokenEndpoint:m3.tokenEndpoint,registrationEndpoint:m3.registrationEndpoint,scopesSupported:[...m3.scopesSupported],codeChallengeMethodsSupported:[...m3.codeChallengeMethodsSupported]}}function discoveryFailure(issuers,attempts){let firstIssuer=issuers[0]??"",named=firstDocumentFor(firstIssuer),attempt=attempts.find(a5=>a5.url===named)??attempts[0];if(attempt?.error!==void 0)return new Error(`discovery request to ${attempt.url} failed: ${attempt.error}`);if(attempt?.missing!==void 0)return new Error(`authorization server at ${attempt.url} is missing ${attempt.missing}`);let status=attempt?.status??0;return new Error(`authorization server discovery failed: ${named} returned HTTP ${status} (expected 200). This MCP server may not support the MCP Authorization specification`)}function firstDocumentFor(issuer){try{return authorizationServerMetadataUrls(new URL(issuer))[0]??issuer}catch{return issuer}}function parseDiscoveryUrl(serverUrl){let parsed;try{parsed=new URL(serverUrl)}catch(error2){throw new Error(`invalid server URL for discovery: ${error2 instanceof Error?error2.message:String(error2)}`)}let scheme=parsed.protocol.replace(/:$/,"");if(scheme!=="http"&&scheme!=="https")throw new Error(`invalid server URL for discovery: unsupported scheme "${scheme}": only http and https are supported`);if(parsed.host==="")throw new Error("invalid server URL for discovery: server URL has no host");return parsed}function validateMetadata(m3,sourceUrl){if(m3.authorizationEndpoint==="")throw new Error(`authorization server at ${sourceUrl} is missing authorization_endpoint`);if(m3.tokenEndpoint==="")throw new Error(`authorization server at ${sourceUrl} is missing token_endpoint`);if(m3.codeChallengeMethodsSupported.length>0&&!m3.codeChallengeMethodsSupported.includes("S256"))throw new Error(`authorization server at ${sourceUrl} does not support S256 PKCE (supports: [${m3.codeChallengeMethodsSupported.join(" ")}]). S256 is required by the MCP Authorization specification`)}var DCR_REQUEST_TIMEOUT_MS=15e3;async function registerClient(registrationEndpoint,redirectUri,clientName,fetchImpl){let requestBody=JSON.stringify({redirect_uris:[redirectUri],client_name:clientName,grant_types:["authorization_code"],response_types:["code"],token_endpoint_auth_method:"none"}),response;try{response=await fetchImpl(registrationEndpoint,{method:"POST",headers:{"Content-Type":"application/json",Accept:"application/json"},body:requestBody,signal:AbortSignal.timeout(DCR_REQUEST_TIMEOUT_MS)})}catch(error2){throw new Error(`DCR request to ${registrationEndpoint} failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let body=await response.text();if(response.status!==201&&response.status!==200)throw new Error(`DCR at ${registrationEndpoint} returned HTTP ${response.status}: ${truncateBody(body)}`);let raw;try{raw=JSON.parse(body)}catch(error2){throw new Error(`failed to parse DCR response: ${error2 instanceof Error?error2.message:String(error2)}`)}if((raw.client_id??"")==="")throw new Error(`DCR response from ${registrationEndpoint} is missing client_id`);return{clientId:raw.client_id,clientSecret:raw.client_secret??"",clientName:raw.client_name??"",tokenEndpointAuthMethod:raw.token_endpoint_auth_method??""}}var PREFLIGHT_REQUEST_TIMEOUT_MS=4e3,PREFLIGHT_BODY_READ_CAP=4096;async function preflightAuthorize(authorizationUrl,fetchImpl){let response=await fetchImpl(authorizationUrl,{method:"GET",redirect:"manual",signal:AbortSignal.timeout(PREFLIGHT_REQUEST_TIMEOUT_MS)});if(response.status!==400){await response.text().catch(()=>"");return}let body=(await response.text()).slice(0,PREFLIGHT_BODY_READ_CAP);return{statusCode:response.status,vendorDetail:extractVendorDetail(body),bodySnippet:truncateBody(body)}}function extractVendorDetail(body){let parsed;try{parsed=JSON.parse(body)}catch{return""}return(parsed.error_description??"")!==""?parsed.error_description:parsed.error??""}async function initiateOAuthConnect(deps,input,identity2){if(deps.oauthRedirectUri==="")throw failedPreconditionError("OAuth Connect is not configured: STIGMER_OAUTH_REDIRECT_URI is not set");let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.initiateOAuthConnect,deps.authorizer,identity2,input);let auth=mcpServer.spec?.auth;if(auth===void 0)throw failedPreconditionError(`MCP server '${mcpServerId}' does not have an auth block configured`);let pkcePair=generatePkce(),stateParam=generateState(),oauthAppRef=auth.oauthAppRef,isDcr=oauthAppRef===void 0||oauthAppRef.slug==="",result=isDcr?await initiateDcr(deps,mcpServer,pkcePair,stateParam):await initiateVendorOAuth(deps,mcpServer,pkcePair,stateParam),authMethod=isDcr?"mcp_oauth":"vendor_oauth",pendingState={state:stateParam,codeVerifier:pkcePair.codeVerifier,clientId:result.clientId,clientSecret:result.clientSecret,tokenEndpoint:result.tokenEndpoint,mcpServerId,identityAccountId:"",targetEnvVar:auth.targetEnvVar,authMethod,tokenAuthMethod:result.tokenAuthMethod,redirectUri:deps.oauthRedirectUri,org:input.org,createdAt:0},sealed;try{sealed=await sealPendingOAuthState(deps.secretService,deps.logger,pendingState)}catch(error2){throw internalError(error2,"failed to encrypt OAuth handshake secrets")}try{await deps.pendingOAuthStates.save(sealed)}catch(error2){throw internalError(error2,"failed to save pending OAuth state")}return deps.logger.info("Initiated OAuth Connect flow",{mcp_server_id:mcpServerId,auth_method:authMethod,provider:result.providerName}),create2(InitiateOAuthConnectOutputSchema,{authorizationUrl:result.authorizationUrl,state:stateParam,scopes:result.scopes,providerName:result.providerName})}async function initiateDcr(deps,mcpServer,pkcePair,stateParam){let discoveryUrl2=mcpServer.spec?.auth?.discoveryUrl??"",serverType=mcpServer.spec?.serverType,resourceUrl=serverType?.case==="http"?serverType.value.url:"",serverUrl=discoveryUrl2!==""?discoveryUrl2:resourceUrl;if(serverUrl==="")throw failedPreconditionError(`DCR requires a discoverable URL. MCP server '${mcpServer.metadata?.id??""}' has no http.url and no auth.discovery_url. Set auth.discovery_url for stdio servers, oauth_app_ref for vendor OAuth, or switch to HTTP transport`);let metadata;try{metadata=discoveryUrl2!==""?await discoverAtIssuer(discoveryUrl2,deps.outboundFetch):await discoverForResource(resourceUrl,deps.outboundFetch)}catch(error2){throw failedPreconditionError(`OAuth authorization server discovery failed for ${serverUrl}: ${error2 instanceof Error?error2.message:String(error2)}`)}if(metadata.registrationEndpoint==="")throw failedPreconditionError(`MCP server at ${serverUrl} does not advertise a registration_endpoint for DCR: ${loginServerHost(metadata,serverUrl)} does not allow automatic client registration, so this server needs an OAuth app registered with the vendor and referenced from its definition (auth.oauth_app_ref)`);let clientName=`Stigmer (${mcpServer.metadata?.name??""})`,dcrResponse;try{dcrResponse=await registerClient(metadata.registrationEndpoint,deps.oauthRedirectUri,clientName,deps.outboundFetch)}catch(error2){throw failedPreconditionError(`DCR registration failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let scopes=mcpServer.spec?.auth?.scopeHints??[];scopes.length===0&&metadata.scopesSupported.length>0&&(scopes=metadata.scopesSupported);let authUrl=buildAuthorizationUrl(metadata.authorizationEndpoint,dcrResponse.clientId,deps.oauthRedirectUri,pkcePair.codeChallenge,stateParam,scopes,"scope"),rejection;try{rejection=await preflightAuthorize(authUrl,deps.outboundFetch)}catch(probeError){deps.logger.debug("authorize pre-flight probe inconclusive; proceeding",{mcp_server_id:mcpServer.metadata?.id??"",error:probeError instanceof Error?probeError.message:String(probeError)})}if(rejection!==void 0)throw deps.logger.warn("authorization endpoint rejected the sign-in request pre-flight",{status_code:rejection.statusCode,mcp_server_id:mcpServer.metadata?.id??"",body_snippet:rejection.bodySnippet}),failedPreconditionError(dcrRejectionMessage(mcpServer.metadata?.name??"",deps.oauthRedirectUri,rejection));return{authorizationUrl:authUrl,providerName:mcpServer.metadata?.name??"",scopes,clientId:dcrResponse.clientId,clientSecret:"",tokenEndpoint:metadata.tokenEndpoint,tokenAuthMethod:""}}function loginServerHost(metadata,serverUrl){for(let candidate of[metadata.issuer,metadata.authorizationEndpoint,serverUrl])try{let host=new URL(candidate).host;if(host!=="")return host}catch{}return serverUrl}async function initiateVendorOAuth(deps,mcpServer,pkcePair,stateParam){let ref=mcpServer.spec?.auth?.oauthAppRef,oauthApp;try{oauthApp=await resolveOAuthAppRef(deps.store,ref,deps.logger)}catch(error2){throw internalError(error2,"failed to list oauth apps")}if(oauthApp===void 0)throw notFoundError("oauth_app",ref?.slug??"");let approvalStatus=oauthApp.spec?.vendorApprovalStatus;if(approvalStatus===VendorApprovalStatus.PENDING||approvalStatus===VendorApprovalStatus.REJECTED){let statusLabel=approvalStatus===VendorApprovalStatus.REJECTED?"rejected":"pending approval",alternative=mcpServer.spec?.auth?.oauthOnly?"This server only accepts OAuth sign-in; an org admin can configure your own OAuth app instead.":"Please enter a token manually instead.";throw failedPreconditionError(`OAuth sign-in is unavailable: the platform's OAuth app for '${oauthApp.spec?.provider??""}' is ${statusLabel} by the vendor. ${alternative}`)}let clientSecret=oauthApp.spec?.clientSecret??"";if(deps.secretService.isEncrypted(clientSecret))try{clientSecret=await deps.secretService.decrypt(clientSecret)}catch(error2){throw internalError(error2,"failed to decrypt OAuthApp client secret")}let scopes=oauthApp.spec?.scopes??[];return{authorizationUrl:buildAuthorizationUrl(oauthApp.spec?.authorizationUrl??"",oauthApp.spec?.clientId??"",deps.oauthRedirectUri,pkcePair.codeChallenge,stateParam,scopes,oauthApp.spec?.scopeParameterName??""),providerName:oauthApp.spec?.provider??"",scopes,clientId:oauthApp.spec?.clientId??"",clientSecret,tokenEndpoint:oauthApp.spec?.tokenUrl??"",tokenAuthMethod:tokenAuthMethodFromSpec(oauthApp.spec?.tokenEndpointAuthMethod??TokenEndpointAuthMethod.UNSPECIFIED)}}function buildAuthorizationUrl(authEndpoint,clientId,redirectUri,codeChallenge,state2,scopes,scopeParamName){let scopeParam=scopeParamName===""?"scope":scopeParamName,params=new URLSearchParams({response_type:"code",client_id:clientId,redirect_uri:redirectUri,code_challenge:codeChallenge,code_challenge_method:"S256",state:state2});scopes.length>0&&params.set(scopeParam,scopes.join(" ")),params.sort();let separator=authEndpoint.includes("?")?"&":"?";return authEndpoint+separator+params.toString()}function dcrRejectionMessage(providerName,redirectUri,rejection){let callbackHost=redirectUri;try{let parsed=new URL(redirectUri);parsed.host!==""&&(callbackHost=parsed.host)}catch{}let message6=`${providerName} rejected the sign-in request before showing a login page (HTTP ${rejection.statusCode}). The most common cause is a redirect-host allowlist: this deployment's OAuth callback host (${callbackHost}) is not on the provider's approved list. Self-hosted deployments with a localhost callback are typically unaffected.`;return rejection.vendorDetail!==""&&(message6+=" Provider detail: "+rejection.vendorDetail),message6}function generateState(){return(0,import_node_crypto24.randomBytes)(32).toString("base64url")}async function sealPendingOAuthState(secretService,logger2,state2){if(!secretService.isEnabled())return logger2.warn("Encryption disabled: pending OAuth state secrets will be stored in plaintext"),state2;let scope=EncryptionScope.forOrganization(state2.org),sealedVerifier;try{sealedVerifier=await secretService.encrypt(state2.codeVerifier,scope)}catch(error2){throw new Error(`failed to encrypt code_verifier: ${error2 instanceof Error?error2.message:String(error2)}`)}let sealedSecret=state2.clientSecret;if(state2.clientSecret!=="")try{sealedSecret=await secretService.encrypt(state2.clientSecret,scope)}catch(error2){throw new Error(`failed to encrypt client_secret: ${error2 instanceof Error?error2.message:String(error2)}`)}return{...state2,codeVerifier:sealedVerifier,clientSecret:sealedSecret}}var mcpServerSearchExtractor={kind:ApiResourceKind.mcp_server,schema:McpServerSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let mcpServer=resource;return buildSearchResult({kind:ApiResourceKind.mcp_server,metadata:mcpServer.metadata,summary:mcpServer.spec?.description??"",score,createdAt:mcpServer.status?.audit?.specAudit?.createdAt,updatedAt:mcpServer.status?.audit?.specAudit?.updatedAt,iconUrl:mcpServer.spec?.iconUrl??""})},getSearchIndexEntry(resource){let mcpServer=resource,metadata=mcpServer.metadata;if(metadata!==void 0)return{name:metadata.name,description:mcpServer.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(mcpServer.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var RUNNER_QUEUE_WARNING="no runner appears to be polling the task queue \u2014 the connect will wait for one to come up (start your local runner if it is not running)";async function startConnect(deps,input,identity2){let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");if(input.org==="")throw invalidArgumentError("org is required for connect");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.startConnect,deps.authorizer,identity2,input);let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError("connect is not available: Temporal not configured");let connectStatus=mcpServer.status?.connectStatus;if(connectStatus?.phase===ConnectPhase.connecting&&await engineState.engine.isConnectRunRunning(connectStatus.workflowId))return deps.logger.info("StartConnect attached to in-flight connect operation",{mcp_server_id:mcpServerId,workflow_id:connectStatus.workflowId}),mcpServer;let prepared=await prepareConnect(deps,mcpServer,input,identity2),warning2=await runnerQueueWarning(engineState.engine),run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,prepared.workflowInput,ASYNC_CONNECT_TIMEOUT.ms)}catch(error2){throw prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId),deps.logger.error("Failed to start MCP connect workflow",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to start connect workflow")}if(run.attached){prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId);try{return await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}}let persisted;try{persisted=await persistConnectStarting(deps.store,mcpServerId,run.workflowId,warning2)}catch(error2){throw detachSettle(deps,mcpServer,run,prepared),internalError(error2,"failed to record connect operation")}return detachSettle(deps,mcpServer,run,prepared),persisted}function detachSettle(deps,mcpServer,run,prepared){settleConnectAsync(deps,mcpServer,run,prepared.ecResourceId,prepared.executionId).catch(error2=>{deps.logger.warn("Async connect settle task failed unexpectedly",{mcp_server_id:mcpServer.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})})}async function settleConnectAsync(deps,mcpServer,run,ecResourceId,executionId){let mcpServerId=mcpServer.metadata?.id??"";try{let outcome=await run.result(ASYNC_CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,ASYNC_CONNECT_TIMEOUT);await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure);return}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){if(error2 instanceof ResourceNotFoundError){deps.logger.info("Skipping async connect persistence: MCP server deleted before connect completed",{mcp_server_id:mcpServerId});return}deps.logger.warn("Failed to persist async connect result",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.info("Async MCP server connect completed and stored",{workflow_id:run.workflowId,mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount})}finally{ecResourceId!==""&&await deleteConnectExecutionContext(deps,ecResourceId,executionId)}}async function runnerQueueWarning(engine){let hasPollers=await engine.hasRunnerQueuePollers();return hasPollers===void 0||hasPollers?"":RUNNER_QUEUE_WARNING}function newValidateDefaultEnabledToolsStep(){return{name:"ValidateDefaultEnabledTools",execute(ctx){let mcpServer=ctx.newState,requested=mcpServer.spec?.defaultEnabledTools??[];if(requested.length===0)return;let caps=mcpServer.status?.discoveredCapabilities;if(caps===void 0)return;let classification=classify(caps,requested);if(isValidClassification(classification))return;let problems=[];throw classification.unknown.length>0&&problems.push(`default_enabled_tools names tool(s) this server does not expose: ${quoteJoin(classification.unknown)}`),classification.resourceTemplates.length>0&&problems.push(`default_enabled_tools names resource template(s): ${quoteJoin(classification.resourceTemplates)} \u2014 resource templates are read-only data endpoints, not callable tools, and must not appear in default_enabled_tools`),invalidArgumentError(`MCP server '${mcpServer.metadata?.slug??""}': ${problems.join("; ")}. Discovered tools: ${quoteJoin(toolNames(caps))}. If the server's toolset changed, run 'stigmer connect' on it to refresh discovered capabilities.`)}}}function newEnrichOAuthStatusStep(store,logger2){return{name:"EnrichOAuthStatus",async execute(ctx){let mcpServer=ctx.get(TARGET_RESOURCE_KEY);if(mcpServer===void 0)return;let ref=mcpServer.spec?.auth?.oauthAppRef;if((ref?.slug??"")==="")return;let oauthApp;try{oauthApp=await resolveOAuthAppRef(store,ref,logger2)}catch(error2){logger2.warn("OAuthApp lookup failed; returning MCP server without oauth_status enrichment",{mcpServerId:mcpServer.metadata?.id??"",oauthAppSlug:ref?.slug??"",error:error2 instanceof Error?error2.message:String(error2)});return}if(oauthApp===void 0){logger2.debug("OAuthApp not found for ref; skipping oauth_status enrichment",{mcpServerId:mcpServer.metadata?.id??"",oauthAppSlug:ref?.slug??""});return}let approvalStatus=oauthApp.spec?.vendorApprovalStatus??VendorApprovalStatus.UNSPECIFIED,docsUrl=oauthApp.spec?.vendorApprovalDocsUrl??"";approvalStatus===VendorApprovalStatus.UNSPECIFIED&&docsUrl===""||(mcpServer.status??=create2(McpServerStatusSchema,{}),mcpServer.status.oauthStatus=create2(OAuthStatusSchema,{vendorApprovalStatus:approvalStatus,vendorApprovalDocsUrl:docsUrl}))}}}function registerMcpServerServices(router,deps){router.service(McpServerCommandController,{apply:(server,ctx)=>apply11(deps,server,ctx),create:(server,ctx)=>createMcpServer(deps,server,ctx),update:(server,ctx)=>update14(deps,server,ctx),updateVisibility:(input,ctx)=>updateVisibility4(deps,input,ctx),delete:(input,ctx)=>deleteMcpServer(deps,input,ctx),connect:(input,ctx)=>connect(deps.connect,input,callerIdentityOf(ctx)),startConnect:(input,ctx)=>startConnect(deps.connect,input,callerIdentityOf(ctx)),initiateOAuthConnect:(input,ctx)=>initiateOAuthConnect(deps.connect,input,callerIdentityOf(ctx)),completeOAuthConnect:(input,ctx)=>completeOAuthConnect(deps.connect,input,callerIdentityOf(ctx)),disconnectOAuth:(input,ctx)=>disconnectOAuth(deps.connect,input,callerIdentityOf(ctx)),setOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("SetOrgOAuthApp")},deleteOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("DeleteOrgOAuthApp")}}),router.service(McpServerQueryController,{get:(id,ctx)=>get19(deps,id,ctx),getByReference:(ref,ctx)=>getByReference11(deps,ref,ctx),getOAuthGrantStatus:(input,ctx)=>getOAuthGrantStatus(deps.connect,input,callerIdentityOf(ctx)),getOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("GetOrgOAuthApp")}})}function orgOAuthAppUnimplemented(method){return new ConnectError(`method ${method} not implemented`,Code.Unimplemented)}function kindOf18(ctx){return ctx.values.get(apiResourceKindKey)}function endpointAuthDeps(deps){return{outboundFetch:deps.connect.outboundFetch,logger:deps.logger}}async function createMcpServer(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-create",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newCompleteEndpointAuthStep(endpointAuthDeps(deps))).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,mcpServerSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update14(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-update",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newCompleteEndpointAuthStep(endpointAuthDeps(deps))).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newValidateDefaultEnabledToolsStep()).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,mcpServerSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply11(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf18(ctx));await newPipeline("mcpserver-apply",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");let result=shouldCreate?await createMcpServer(deps,server,ctx):await update14(deps,withResolvedApplyId(McpServerSchema,server,reqCtx),ctx);return startBestEffortConnect(deps.connect,result).catch(error2=>{deps.logger.warn("Best-effort connect task failed unexpectedly",{mcp_server_id:result.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}),result}async function deleteMcpServer(deps,input,ctx){let reqCtx=new RequestContext(McpServerCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf18(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("mcpserver-delete",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,McpServerSchema)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted mcp server not found in context"),"deleted mcp server not found in context");return deleted}var UPDATE_VISIBILITY_MCP_SERVER_KEY="updateVisibilityMcpServer";async function updateVisibility4(deps,input,ctx){let reqCtx=new RequestContext(McpServerCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-update-visibility",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadMcpServerForVisibilityUpdateStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store,{existingKey:UPDATE_VISIBILITY_MCP_SERVER_KEY})).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_MCP_SERVER_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newSetMcpServerVisibilityStep()).addStep(newPersistMcpServerForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_MCP_SERVER_KEY)).addStep(newIndexMcpServerAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY)}function newLoadMcpServerForVisibilityUpdateStep(store){return{name:"LoadMcpServerForVisibilityUpdate",async execute(ctx){let input=ctx.input,mcpServer;try{mcpServer=await store.getResource(ctx.apiResourceKind,input.resourceId,McpServerSchema)}catch{throw notFoundError("mcp_server",input.resourceId)}ctx.set(UPDATE_VISIBILITY_MCP_SERVER_KEY,mcpServer)}}}function newSetMcpServerVisibilityStep(){return{name:"SetMcpServerVisibility",execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY);mcpServer.metadata!==void 0&&(mcpServer.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(McpServerSchema,mcpServer,"status_audit",ctx.callerIdentity)}}}function newPersistMcpServerForVisibilityUpdateStep(store){return{name:"PersistMcpServerForVisibilityUpdate",async execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY);try{await store.saveResource(ctx.apiResourceKind,mcpServer.metadata?.id??"",McpServerSchema,mcpServer)}catch(error2){throw internalError(error2,"failed to save mcp server")}}}}function newIndexMcpServerAfterVisibilityUpdateStep(store,logger2){return{name:"IndexMcpServerAfterVisibilityUpdate",async execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY),entry=mcpServerSearchExtractor.getSearchIndexEntry(mcpServer);if(entry===void 0){logger2.warn("IndexMcpServerAfterVisibilityUpdate: extractor returned nil, skipping",{id:mcpServer.metadata?.id??""});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,mcpServer.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexMcpServerAfterVisibilityUpdate: failed (best-effort)",{id:mcpServer.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function get19(deps,id,ctx){let reqCtx=new RequestContext(McpServerQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-get",deps.logger).addStep(newAuthorizeStep(McpServerQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,McpServerSchema)).addStep(newEnrichOAuthStatusStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference11(deps,ref,ctx){let reqCtx=new RequestContext(McpServerQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-get-by-reference",deps.logger).addStep(newAuthorizeStep(McpServerQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,McpServerSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(McpServerQueryController.method.get))).addStep(newEnrichOAuthStatusStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}function registerPlatformServices(router,deps){router.service(PlatformQueryController,{getServerInfo:()=>getServerInfo(deps),getLicenseStatus:()=>getLicenseStatus(deps),getRunnerBootstrapConfig:(_input,ctx)=>getRunnerBootstrapConfig(deps,ctx),getRunnerScopedToken:(input,ctx)=>getRunnerScopedToken(deps,input,ctx)})}function getServerInfo(deps){return create2(GetServerInfoOutputSchema,{edition:deps.edition,version:deps.version,authenticationRequired:deps.authenticationRequired})}async function getLicenseStatus(deps){let now=deps.now(),report=await deps.licenseStatus.status(now),output=create2(GetLicenseStatusOutputSchema,{state:report.state,checkedAt:timestampFromDate(now)});switch(report.state){case LicenseState.absent:return output;case LicenseState.invalid:return output.keyId=report.keyId,output;case LicenseState.valid:case LicenseState.expiring:case LicenseState.grace:case LicenseState.expired:return output.keyId=report.keyId,output.claims=report.claims,output;default:{let exhaustive=report;throw new Error(`unhandled license report: ${JSON.stringify(exhaustive)}`)}}}async function getRunnerBootstrapConfig(deps,ctx){let output=create2(GetRunnerBootstrapConfigOutputSchema,{temporalAddress:deps.temporalHostPort,temporalNamespace:deps.temporalNamespace}),bootstrapCredentials=deps.runnerAuthService.bootstrapCredentials?.bind(deps.runnerAuthService);if(bootstrapCredentials===void 0)return output;try{let credentials=await bootstrapCredentials(callerIdentityOf(ctx));credentials.accessToken!==void 0&&(output.runnerAccessToken=credentials.accessToken.token,output.tokenType="Bearer",output.runnerAccessTokenExpiresInSeconds=credentials.accessToken.expiresInSeconds),credentials.payloadKeys!==void 0&&(output.payloadEncryptionKey=credentials.payloadKeys.keyBase64,output.payloadEncryptionKeyId=credentials.payloadKeys.keyId,output.payloadEncryptionSecondaryKey=credentials.payloadKeys.secondaryKeyBase64??"",output.payloadEncryptionSecondaryKeyId=credentials.payloadKeys.secondaryKeyId??"")}catch(error2){deps.logger.warn("Bootstrap credentials unavailable \u2014 answering coordinates without them",{error:error2 instanceof Error?error2.message:String(error2)})}return output}async function getRunnerScopedToken(deps,input,ctx){let exchange=deps.runnerAuthService.exchangeScopedToken?.bind(deps.runnerAuthService);if(exchange!==void 0){let minted=await exchange(exchangeRequestOf(input),callerIdentityOf(ctx));return minted.minted?create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.expiresInSeconds}):create2(GetRunnerScopedTokenOutputSchema)}let executionId;switch(input.scope.case){case"agentExecutionId":executionId=input.scope.value;break;case"workflowExecutionId":executionId=input.scope.value;break;case"poolClaim":case"renewal":case void 0:return create2(GetRunnerScopedTokenOutputSchema);default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}if(executionId===""||!deps.runnerAuthService.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))return create2(GetRunnerScopedTokenOutputSchema);try{let minted=deps.runnerAuthService.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.ttlSeconds})}catch(error2){return deps.logger.warn("failed to mint runner scoped token \u2014 answering not-minted",{executionId,error:error2 instanceof Error?error2.message:String(error2)}),create2(GetRunnerScopedTokenOutputSchema)}}function exchangeRequestOf(input){switch(input.scope.case){case"agentExecutionId":return{arm:"agent-execution",executionId:input.scope.value};case"workflowExecutionId":return{arm:"workflow-execution",executionId:input.scope.value};case"poolClaim":return{arm:"pool-claim",sessionId:input.scope.value.sessionId};case"renewal":return{arm:"renewal"};case void 0:return{arm:"unset"};default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}}var SERVER_VERSION="3.35.0";var file_ai_stigmer_agentic_session_v1_io=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9pby5wcm90bxIdYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEiIgoJU2Vzc2lvbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiIAoHQWdlbnRJZBIVCgV2YWx1ZRgBIAEoCUIGukgDyAEBInQKC1Nlc3Npb25MaXN0EhMKC3RvdGFsX3BhZ2VzGAEgASgFEjcKB2VudHJpZXMYAiADKAsyJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uEhcKD25leHRfcGFnZV90b2tlbhgDIAEoCSJgChNMaXN0U2Vzc2lvbnNSZXF1ZXN0EhoKCXBhZ2Vfc2l6ZRgBIAEoBUIHukgEGgIoABISCgpwYWdlX3Rva2VuGAIgASgJEgwKBHRhZ3MYAyADKAkSCwoDb3JnGAQgASgJIncKIkxpc3RTZXNzaW9uc0J5QWdlbnRJbnN0YW5jZVJlcXVlc3QSIQoRYWdlbnRfaW5zdGFuY2VfaWQYASABKAlCBrpIA8gBARIaCglwYWdlX3NpemUYAiABKAVCB7pIBBoCKAASEgoKcGFnZV90b2tlbhgDIAEoCSJqChxMaXN0U2Vzc2lvbnNCeUNoYW5uZWxSZXF1ZXN0EhoKCmNoYW5uZWxfaWQYASABKAlCBrpIA8gBARIaCglwYWdlX3NpemUYAiABKAVCB7pIBBoCKAASEgoKcGFnZV90b2tlbhgDIAEoCSJCChtVcGRhdGVTZXNzaW9uU3ViamVjdFJlcXVlc3QSEgoCaWQYASABKAlCBrpIA8gBARIPCgdzdWJqZWN0GAIgASgJYgZwcm90bzM",[file_ai_stigmer_agentic_session_v1_api,file_buf_validate_validate]),SessionIdSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_io,0);var SessionListSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_io,2);var file_ai_stigmer_agentic_session_v1_command=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9jb21tYW5kLnByb3RvEh1haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MTLtBQoYU2Vzc2lvbkNvbW1hbmRDb250cm9sbGVyElcKBWFwcGx5EiYuYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbhomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24SpQEKBmNyZWF0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24aJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uIkvCuBhHCAgQHiIMbWV0YWRhdGEub3JnKjN1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIHNlc3Npb24gaW4gdGhpcyBvcmdhbml6YXRpb24SjwEKBnVwZGF0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24aJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uIjXCuBgxCAIQKiILbWV0YWRhdGEuaWQqHnVuYXV0aG9yaXplZCB0byB1cGRhdGUgc2Vzc2lvbhKpAQoNdXBkYXRlU3ViamVjdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlVwZGF0ZVNlc3Npb25TdWJqZWN0UmVxdWVzdBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iNMK4GDAIAhAqIgJpZComdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBzZXNzaW9uIHN1YmplY3QSiwEKBmRlbGV0ZRIoLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iL8K4GCsIAxAqIgV2YWx1ZSoedW5hdXRob3JpemVkIHRvIGRlbGV0ZSBzZXNzaW9uGgSg/ysqYgZwcm90bzM",[file_ai_stigmer_agentic_session_v1_api,file_ai_stigmer_agentic_session_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SessionCommandController=serviceDesc(file_ai_stigmer_agentic_session_v1_command,0);var file_ai_stigmer_agentic_session_v1_query=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9xdWVyeS5wcm90bxIdYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEyoQQKFlNlc3Npb25RdWVyeUNvbnRyb2xsZXIShQEKA2dldBIoLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iLMK4GCgIARAqIgV2YWx1ZSobdW5hdXRob3JpemVkIHRvIGdldCBzZXNzaW9uEmwKBGxpc3QSMi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5MaXN0U2Vzc2lvbnNSZXF1ZXN0GiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbkxpc3QiBNC4GAESigEKE2xpc3RCeUFnZW50SW5zdGFuY2USQS5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5MaXN0U2Vzc2lvbnNCeUFnZW50SW5zdGFuY2VSZXF1ZXN0GiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbkxpc3QiBNC4GAESfgoNbGlzdEJ5Q2hhbm5lbBI7LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLkxpc3RTZXNzaW9uc0J5Q2hhbm5lbFJlcXVlc3QaKi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uTGlzdCIE0LgYARoEoP8rKmIGcHJvdG8z",[file_ai_stigmer_agentic_session_v1_api,file_ai_stigmer_agentic_session_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SessionQueryController=serviceDesc(file_ai_stigmer_agentic_session_v1_query,0);function runAgentInstanceDeniedMessage2(agentInstanceId){return`unauthorized to run agent instance '${agentInstanceId}'`}function sessionRunTarget(session){let agentInstanceId=session.spec?.agentInstanceId??"";if(agentInstanceId!=="")return{...RUN_GATE_CHECKS.agentInstance,resourceId:agentInstanceId,deniedMessage:runAgentInstanceDeniedMessage2(agentInstanceId)}}var sessionSearchExtractor={kind:ApiResourceKind.session,schema:SessionSchema,getSearchSummary(resource){return resource.spec?.subject??""},toSearchResult(resource,score){let session=resource;return buildSearchResult({kind:ApiResourceKind.session,metadata:session.metadata,summary:session.spec?.subject??"",score,createdAt:session.status?.audit?.specAudit?.createdAt,updatedAt:session.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let session=resource,metadata=session.metadata;if(metadata!==void 0)return{name:metadata.name,description:session.spec?.subject??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(session.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var SESSION_CHANNEL_ID_LABEL="stigmer.ai/channel-id",sessionListIndex=declareListIndex({kind:ApiResourceKind.session,schema:SessionSchema,revision:1,keys:{agent_instance:field2("spec.agent_instance_id"),channel:label(SESSION_CHANNEL_ID_LABEL)}});var LIST_RESULT_KEY8="listResult";function newValidateHarnessImmutabilityStep(){return{name:"ValidateHarnessImmutability",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0||existingSpec.harnessStateId==="")return;let inputSpec=ctx.input.spec;if(inputSpec===void 0)return;let existingHarness=existingSpec.harness,inputHarness=inputSpec.harness;if(existingHarness===Harness.UNSPECIFIED&&(existingHarness=Harness.NATIVE),inputHarness===Harness.UNSPECIFIED&&(inputHarness=Harness.NATIVE),inputHarness!==existingHarness)throw failedPreconditionError("session harness cannot be changed after the first execution \u2014 each harness owns its conversation state independently")}}}var EXECUTION_TARGET_GO_NAMES={[ExecutionTarget.UNSPECIFIED]:"EXECUTION_TARGET_UNSPECIFIED",[ExecutionTarget.LOCAL]:"EXECUTION_TARGET_LOCAL",[ExecutionTarget.CLOUD]:"EXECUTION_TARGET_CLOUD"};function newValidateExecutionTargetImmutabilityStep(temporalConfig){return{name:"ValidateExecutionTargetImmutability",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0||existingSpec.harnessStateId==="")return;let inputSpec=ctx.input.spec;if(inputSpec===void 0)return;let existingTarget=temporalConfig.resolveExecutionTarget(existingSpec.executionTarget),inputTarget=temporalConfig.resolveExecutionTarget(inputSpec.executionTarget);if(inputTarget!==existingTarget)throw failedPreconditionError(`session execution_target cannot be changed after the first execution (${EXECUTION_TARGET_GO_NAMES[existingTarget]} \u2192 ${EXECUTION_TARGET_GO_NAMES[inputTarget]}; unset resolves to the deployment default, ${temporalConfig.defaultExecutionTarget}) \u2014 workspace state may not be portable between local and cloud environments`)}}}function newRecordHarnessStateHistoryStep(){return{name:"RecordHarnessStateHistory",execute(ctx){let mergedSpec=ctx.newState.spec;if(mergedSpec===void 0)return;let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0||existing.spec===void 0)return;let existingSpec=existing.spec,history=[...existingSpec.harnessStateIdHistory],previousId=existingSpec.harnessStateId;previousId!==""&&previousId!==mergedSpec.harnessStateId&&!history.includes(previousId)&&history.push(previousId),mergedSpec.harnessStateIdHistory=history}}}function isActiveExecutionPhase(phase){switch(phase){case ExecutionPhase.EXECUTION_PENDING:case ExecutionPhase.EXECUTION_IN_PROGRESS:case ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL:case ExecutionPhase.EXECUTION_PAUSED:return!0;default:return!1}}async function listExecutionsBySession(store,logger2,sessionId){let rows;try{rows=await store.queryResources(agentExecutionListIndex,{anyKey:[{name:"session",value:sessionId}]})}catch(error2){throw internalError(error2,"failed to list agent executions")}let executions=[];for(let row of rows)try{executions.push(fromBinary2(AgentExecutionSchema,row.data))}catch(error2){logger2.warn("Failed to unmarshal execution, skipping",{error:error2 instanceof Error?error2.message:String(error2)})}return executions}function newRejectDeleteWithActiveExecutionsStep(store,logger2){return{name:"RejectDeleteWithActiveExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId),activeCount=0;for(let execution of executions)isActiveExecutionPhase(execution.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED)&&activeCount++;if(activeCount>0)throw failedPreconditionError(`session has ${activeCount} active execution(s); cancel them or wait for completion before deleting`)}}}function newCascadeDeleteAgentExecutionsStep(store,logger2){return{name:"CascadeDeleteAgentExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId);if(executions.length!==0){for(let execution of executions){let executionId=execution.metadata?.id??"";try{await store.deleteResource(ApiResourceKind.agent_execution,executionId)}catch(error2){throw internalError(error2,`failed to cascade-delete execution ${executionId} of session ${sessionId}`)}try{await store.deleteSearchIndex(ApiResourceKind.agent_execution,executionId)}catch(error2){logger2.warn("CascadeDeleteAgentExecutions: failed to remove search index entry (best-effort)",{executionId,error:error2 instanceof Error?error2.message:String(error2)})}}logger2.info("Cascade-deleted executions of session",{sessionId,count:executions.length})}}}}function requireSessionId(ctx){let sessionId=ctx.get(RESOURCE_ID_KEY);if(typeof sessionId!="string"||sessionId==="")throw internalError(new Error("session id not found in context (ExtractResourceId must run first)"),"session id not found in context (ExtractResourceId must run first)");return sessionId}function newListAllSessionsStep(store,logger2,listReadScope){return{name:"ListAllSessions",async execute(ctx){let input=ctx.input,page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{org:input.org},fingerprint:{lane:"session.list",org:input.org,tags:input.tags}});ctx.set(LIST_RESULT_KEY8,page)}}}function newFilterByAgentInstanceStep(store,logger2,listReadScope){return{name:"FilterByAgentInstance",async execute(ctx){let agentInstanceId=ctx.input.agentInstanceId;if(agentInstanceId==="")throw invalidArgumentError("agent_instance_id is required");let page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{anyKey:[{name:"agent_instance",value:agentInstanceId}]},fingerprint:{lane:"session.listByAgentInstance",agentInstanceId}});ctx.set(LIST_RESULT_KEY8,page)}}}function newAuthorizeChannelAccessStep(authorizer){return newAuthorizeResolvedTargetStep(authorizer,({input})=>input.channelId===""?[]:[{permission:IamPermission.can_view,resourceKind:ApiResourceKind.agent_channel,resourceId:input.channelId,deniedMessage:"unauthorized to list channel conversations"}],"AuthorizeChannelAccess")}function newFilterByChannelStep(store,logger2,listReadScope){return{name:"FilterByChannel",async execute(ctx){let channelId=ctx.input.channelId;if(channelId==="")throw invalidArgumentError("channel_id is required");let page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{anyKey:[{name:"channel",value:channelId}]},fingerprint:{lane:"session.listByChannel",channelId}});ctx.set(LIST_RESULT_KEY8,page)}}}async function readSessionPage(store,logger2,listReadScope,caller,request,lane){let page=await readListPage({store,declaration:sessionListIndex,query:lane.query,request,fingerprint:listPageFingerprint(lane.fingerprint),decode:data=>{try{return fromBinary2(SessionSchema,data)}catch(error2){logger2.warn("Failed to unmarshal session, skipping",{error:error2 instanceof Error?error2.message:String(error2)});return}},scope:sessions=>restrictListByReadScope(listReadScope,caller,ApiResourceKind.session,sessions,""),failure:"failed to list sessions"});return create2(SessionListSchema,{entries:page.entries,nextPageToken:page.nextPageToken,totalPages:page.nextPageToken===""?1:0})}function registerSessionServices(router,deps){router.service(SessionCommandController,{apply:(session,ctx)=>apply12(deps,session,ctx),create:(session,ctx)=>createSession(deps,session,ctx),update:(session,ctx)=>update15(deps,session,ctx),updateSubject:(req,ctx)=>updateSubject(deps,req,callerIdentityOf(ctx)),delete:(id,ctx)=>deleteSession(deps,id,ctx)}),router.service(SessionQueryController,{get:(id,ctx)=>get20(deps,id,ctx),list:(req,ctx)=>list10(deps,req,ctx),listByAgentInstance:(req,ctx)=>listByAgentInstance(deps,req,ctx),listByChannel:(req,ctx)=>listByChannel(deps,req,ctx)})}function kindOf19(ctx){return ctx.values.get(apiResourceKindKey)}async function createSession(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx)),builder2=newPipeline("session-create",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.create,deps.authorizer)).addStep(newAuthorizeRunTargetStep(deps.authorizer,sessionRunTarget)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store));for(let step of stepsForSlot(deps.gateSteps,"session-create:pre-side-effect-gate"))builder2.addStep(step);return await builder2.addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update15(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-update",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateHarnessImmutabilityStep()).addStep(newValidateExecutionTargetImmutabilityStep(deps.temporalConfig)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newRecordHarnessStateHistoryStep()).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply12(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("session-apply",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createSession(deps,session,ctx):update15(deps,withResolvedApplyId(SessionSchema,session,reqCtx),ctx)}async function deleteSession(deps,sessionId,ctx){let reqCtx=new RequestContext(SessionCommandController.method.delete.input,sessionId,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("session-delete",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,SessionSchema)).addStep(newRejectDeleteWithActiveExecutionsStep(deps.store,deps.logger)).addStep(newCascadeDeleteAgentExecutionsStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted session not found in context"),"deleted session not found in context");return await deprovisionSessionSandboxBestEffort(deps.sandboxLane,deps.logger,deleted.metadata?.id??""),deleted}async function updateSubject(deps,req,identity2){if(req.id==="")throw invalidArgumentError("id is required");let kind=ApiResourceKind.session,session;try{session=await deps.store.getResource(kind,req.id,SessionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("session",req.id):internalError(error2,"failed to load session")}await authorizeDirect(SessionCommandController.method.updateSubject,deps.authorizer,identity2,req),session.spec===void 0&&(session.spec=create2(SessionSpecSchema,{})),session.spec.subject=req.subject,setAuditFieldsForUpdate(SessionSchema,session,"spec_audit",identity2);try{await deps.store.saveResource(kind,req.id,SessionSchema,session)}catch(error2){throw internalError(error2,"failed to persist session")}return await indexSessionSearch(deps,kind,session),session}async function indexSessionSearch(deps,kind,session){let entry=sessionSearchExtractor.getSearchIndexEntry(session);if(entry!==void 0)try{await deps.store.upsertSearchIndex(kind,session.metadata?.id??"",entry)}catch(error2){deps.logger.warn("UpdateSubject: failed to update search index (best-effort)",{id:session.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}async function get20(deps,id,ctx){let reqCtx=new RequestContext(SessionQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-get",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,SessionSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function list10(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListAllSessionsStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}async function listByAgentInstance(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByAgentInstance.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list-by-agent-instance",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByAgentInstance,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newFilterByAgentInstanceStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}async function listByChannel(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByChannel.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list-by-channel",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByChannel,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeChannelAccessStep(deps.authorizer)).addStep(newFilterByChannelStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}function requireListResult2(result){if(result===void 0)throw internalError(new Error("session list not found in context"),"session list not found in context");return result}var file_ai_stigmer_agentic_plugin_v1_io=fileDesc("CiVhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2lvLnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxIiEKCFBsdWdpbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEi9wIKEVB1c2hQbHVnaW5SZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhAKCGFydGlmYWN0GAIgASgMEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYAyABKAkSUwoKdmlzaWJpbGl0eRgEIAEoDjI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVZpc2liaWxpdHlCCLpIBYIBAhABEg8KB21lc3NhZ2UYBSABKAk6twG6SLMBGrABCiNwdXNoX3BsdWdpbl9yZXF1ZXN0LmFydGlmYWN0X3NvdXJjZRJJZXhhY3RseSBvbmUgb2YgYXJ0aWZhY3QgKGlubGluZSBieXRlcykgb3IgYXJ0aWZhY3RfdXBsb2FkX3JlZiBtdXN0IGJlIHNldBo+KHRoaXMuYXJ0aWZhY3Quc2l6ZSgpID4gMCkgIT0gKHRoaXMuYXJ0aWZhY3RfdXBsb2FkX3JlZiAhPSAnJykiWAokQ3JlYXRlUGx1Z2luQXJ0aWZhY3RVcGxvYWRVcmxSZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhsKCnNpemVfYnl0ZXMYAiABKANCB7pIBCICIAAiWAoXUGx1Z2luQXJ0aWZhY3RVcGxvYWRVcmwSCwoDdXJsGAEgASgJEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYAiABKAkSEwoLdHRsX3NlY29uZHMYAyABKAUihQEKDFBsdWdpbk1lbWJlchJNCgRraW5kGAEgASgOMj8uYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUtpbmQSCgoCaWQYAiABKAkSDAoEc2x1ZxgDIAEoCRIMCgRuYW1lGAQgASgJIlgKGUxpc3RQbHVnaW5NZW1iZXJzUmVzcG9uc2USOwoHbWVtYmVycxgBIAMoCzIqLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luTWVtYmVyImsKF0xpc3RQbHVnaW5WZXJzaW9uc0lucHV0EhMKA29yZxgBIAEoCUIGukgDyAEBEhQKBHNsdWcYAiABKAlCBrpIA8gBARISCgpwYWdlX3Rva2VuGAMgASgJEhEKCXBhZ2Vfc2l6ZRgEIAEoBSLtAQoSUGx1Z2luVmVyc2lvbkVudHJ5Eg4KBmRpZ2VzdBgBIAEoCRItCglwdXNoZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkgKCXB1c2hlZF9ieRgDIAEoCzI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0QWN0b3ISCwoDdGFnGAQgASgJEhIKCmlzX2N1cnJlbnQYBSABKAgSDwoHbWVzc2FnZRgGIAEoCRIcChRhcnRpZmFjdF9zdG9yYWdlX2tleRgHIAEoCSKOAQoaTGlzdFBsdWdpblZlcnNpb25zUmVzcG9uc2USQgoIdmVyc2lvbnMYASADKAsyMC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpblZlcnNpb25FbnRyeRIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEwoLdG90YWxfY291bnQYAyABKAViBnByb3RvMw",[file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind,file_ai_stigmer_commons_apiresource_enum,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_timestamp]);var PushPluginRequestSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,1);var PluginArtifactUploadUrlSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,3),PluginMemberSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,4),ListPluginMembersResponseSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,5);var PluginVersionEntrySchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,7),ListPluginVersionsResponseSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,8);var file_ai_stigmer_agentic_plugin_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEy2gUKF1BsdWdpbkNvbW1hbmRDb250cm9sbGVyEqEBCgRwdXNoEi8uYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QdXNoUGx1Z2luUmVxdWVzdBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24S2AEKF2NyZWF0ZUFydGlmYWN0VXBsb2FkVXJsEkIuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5DcmVhdGVQbHVnaW5BcnRpZmFjdFVwbG9hZFVybFJlcXVlc3QaNS5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbkFydGlmYWN0VXBsb2FkVXJsIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24SsAEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiQuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW4iP8K4GDsIAhA6IgtyZXNvdXJjZV9pZCoodW5hdXRob3JpemVkIHRvIHVwZGF0ZSBwbHVnaW4gdmlzaWJpbGl0eRKGAQoGZGVsZXRlEiYuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5JZBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIi7CuBgqCAMQOiIFdmFsdWUqHXVuYXV0aG9yaXplZCB0byBkZWxldGUgcGx1Z2luGgSg/ys6YgZwcm90bzM",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginCommandController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_command,0);var file_ai_stigmer_agentic_plugin_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxMsMEChVQbHVnaW5RdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luSWQaJC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbiIrwrgYJwgBEDoiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IHBsdWdpbhJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIgTQuBgBEqQBCgtsaXN0TWVtYmVycxImLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luSWQaNy5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5NZW1iZXJzUmVzcG9uc2UiNMK4GDAIARA6IgV2YWx1ZSojdW5hdXRob3JpemVkIHRvIGxpc3QgcGx1Z2luIG1lbWJlcnMShQEKDGxpc3RWZXJzaW9ucxI1LmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuTGlzdFBsdWdpblZlcnNpb25zSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5WZXJzaW9uc1Jlc3BvbnNlIgTQuBgBGgSg/ys6YgZwcm90bzM",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginQueryController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_query,0);var PLATFORM_ARCHIVE_LIMITS={maxFiles:1e4,maxUncompressedSize:524288e3,maxCompressionRatio:100};var import_node_fs8=__toESM(require("node:fs"),1),import_node_path11=__toESM(require("node:path"),1),import_promises6=require("node:stream/promises"),SlotUnknownError=class extends Error{constructor(){super("upload reference unknown or expired"),this.name="SlotUnknownError"}},SlotConsumedError=class extends Error{constructor(){super("upload reference already carries an upload"),this.name="SlotConsumedError"}},SizeMismatchError=class extends Error{constructor(received,declared){super(`upload size mismatch: received ${received} bytes, declared ${declared}`),this.name="SizeMismatchError"}},STAGED_FILE_NAME=/^[0-9a-f]+\.zip$/,UploadSlots=class{root;stagingPrefix;ttlMs;maxSize;slots=new Map;stagingDir;now;constructor(root5,stagingPrefix,ttlMs,maxSize,now=Date.now){this.root=root5,this.stagingPrefix=stagingPrefix,this.ttlMs=ttlMs,this.maxSize=maxSize,this.stagingDir=import_node_path11.default.join(root5,stagingPrefix),import_node_fs8.default.rmSync(this.stagingDir,{recursive:!0,force:!0}),import_node_fs8.default.mkdirSync(this.stagingDir,{recursive:!0,mode:448}),this.now=now}reserve(key,declaredSize){if(declaredSize<=0||declaredSize>this.maxSize)throw new Error(`declared size ${declaredSize} outside (0, ${this.maxSize}]`);if(this.stagePath(key),this.slots.has(key))throw new Error(`staging key ${key} is already reserved`);return this.sweep(),this.slots.set(key,{declaredSize,expiresAtMs:this.now()+this.ttlMs,uploaded:!1}),{ttlMs:this.ttlMs}}async receive(key,body){let slot=this.slots.get(key);if(slot===void 0||this.now()>slot.expiresAtMs)throw new SlotUnknownError;if(slot.uploaded)throw new SlotConsumedError;let declared=slot.declaredSize,filePath=this.stagePath(key),written=0;try{await import_node_fs8.default.promises.mkdir(import_node_path11.default.dirname(filePath),{recursive:!0,mode:448}),await(0,import_promises6.pipeline)(body,limitBytes(declared+1,n3=>{written+=n3}),import_node_fs8.default.createWriteStream(filePath,{flags:"w",mode:384}))}catch(error2){throw await import_node_fs8.default.promises.rm(filePath,{force:!0}),new Error(`failed to receive upload: ${error2 instanceof Error?error2.message:String(error2)}`)}if(written!==declared)throw await import_node_fs8.default.promises.rm(filePath,{force:!0}),new SizeMismatchError(written,declared);let current=this.slots.get(key);if(current===void 0||this.now()>current.expiresAtMs)throw await import_node_fs8.default.promises.rm(filePath,{force:!0}),new SlotUnknownError;current.uploaded=!0}sweep(){let nowMs=this.now();for(let[key,slot]of this.slots)nowMs>slot.expiresAtMs&&(this.slots.delete(key),import_node_fs8.default.rmSync(this.stagePath(key),{force:!0}))}stagePath(key){if(!key.startsWith(this.stagingPrefix))throw new Error(`staging key ${key} is outside ${this.stagingPrefix}`);let fileName=key.slice(this.stagingPrefix.length);if(!STAGED_FILE_NAME.test(fileName))throw new Error(`staging key ${key} does not name a staged archive`);return import_node_path11.default.join(this.root,key)}};function limitBytes(limit,onBytes){return async function*(source){let remaining=limit;for await(let chunk of source){if(remaining<=0)return;let slice=chunk.length<=remaining?chunk:chunk.subarray(0,remaining);remaining-=slice.length,onBytes(slice.length),yield slice}}}var ARTIFACT_BYTES_KEY="pushArtifactBytes";function newResolveArtifactSourceStep(staging,binding){return{name:"ResolveArtifactSource",async execute(ctx){let{artifact,artifactUploadRef}=binding.source(ctx.input);if(artifactUploadRef===""){ctx.set(ARTIFACT_BYTES_KEY,artifact);return}if(staging===void 0)throw failedPreconditionError(binding.laneNotConfigured);let data;try{data=await staging.consume(artifactUploadRef)}catch(error2){throw error2 instanceof SlotUnknownError?invalidArgumentError(`artifact_upload_ref not usable: ${error2.message} \u2014 request a new upload URL via createArtifactUploadUrl`):error2}ctx.set(ARTIFACT_BYTES_KEY,data)}}}function newArchiveCurrentVersionStep(store,logger2,binding){return{name:binding.stepName,async execute(ctx){let resource=ctx.get(binding.resourceKey),versionHash=binding.headHashOf(resource);if(versionHash==="")return;let tag2=binding.liveTagOf(resource),resourceId=metadataOf(resource)?.id??"",idField=`${binding.noun}Id`,alreadyArchived=!1;try{await store.getAuditByHash(ctx.apiResourceKind,resourceId,versionHash,binding.schema),alreadyArchived=!0}catch(error2){error2 instanceof AuditNotFoundError||logger2.warn(`Could not check for an existing archived ${binding.noun} version \u2014 archiving anyway`,{[idField]:resourceId,versionHash,error:error2 instanceof Error?error2.message:String(error2)})}if(!alreadyArchived)try{await store.saveAudit(ctx.apiResourceKind,resourceId,binding.schema,resource,versionHash,"")}catch(error2){logger2.error(`Failed to archive ${binding.noun} version \u2014 reverting the version hash to maintain the audit-resolvability invariant`,{[idField]:resourceId,versionHash,error:error2 instanceof Error?error2.message:String(error2)}),binding.clearHeadHash(resource);return}if(tag2!=="")try{await store.setAuditTag(ctx.apiResourceKind,resourceId,versionHash,tag2)}catch(error2){logger2.error(`Archived ${binding.noun} version but failed to assign its tag \u2014 clearing the live tag to stay consistent with the audit column`,{[idField]:resourceId,versionHash,tag:tag2,error:error2 instanceof Error?error2.message:String(error2)}),binding.clearLiveTag(resource)}alreadyArchived?logger2.info(`${capitalize(binding.noun)} version content already archived \u2014 repointed head without a new history row`,{[idField]:resourceId,versionHash,tag:tag2}):logger2.info(`Archived ${binding.noun} version to audit history`,{[idField]:resourceId,versionHash,tag:tag2})}}}function newDeleteVersionArchivesStep(store,logger2,binding){return{name:binding.stepName,async execute(ctx){let resourceId=ctx.get(RESOURCE_ID_KEY);if(typeof resourceId!="string")throw new Error("resource id not found in context (ExtractResourceIdStep must run first)");let idField=`${binding.noun}Id`;try{let deletedCount=await store.deleteAuditByResourceId(ctx.apiResourceKind,resourceId);deletedCount>0&&logger2.info(`Deleted archive records for ${binding.noun}`,{[idField]:resourceId,count:deletedCount})}catch(error2){logger2.warn(`failed to delete ${binding.noun} archives (best-effort)`,{[idField]:resourceId,error:error2 instanceof Error?error2.message:String(error2)})}}}}function capitalize(word){return word.charAt(0).toUpperCase()+word.slice(1)}var HASH_PATTERN=/^[a-f0-9]{64}$/;function isVersionHash(version){return HASH_PATTERN.test(version)}function newLoadByReferenceWithVersionStep(store,binding,stepName){return{name:stepName,async execute(ctx){let ref=ctx.input;if(ref.slug==="")throw invalidArgumentError("slug is required in reference");if(requireOrgForReference(ctx.apiResourceKind,ref.org),ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==binding.kind)throw invalidArgumentError(`kind mismatch: expected ${ApiResourceKind[binding.kind]}, got ${ApiResourceKind[ref.kind]}`);let head;try{head=await findResourceBySlug(store,ctx.apiResourceKind,binding.schema,ref.slug,ref.org)}catch(error2){throw internalError(error2,`failed to list ${binding.noun}s`)}if(head===void 0)throw notFoundError(binding.noun,ref.slug);let version=ref.version.trim();if(version===""||version==="latest"){ctx.set(TARGET_RESOURCE_KEY,head);return}if(headMatchesVersion(binding,head,version)){ctx.set(TARGET_RESOURCE_KEY,head);return}let archived=await findAuditByVersion(store,ctx.apiResourceKind,binding.schema,idOf(head),version);if(archived===void 0)throw notFoundError(`${binding.noun} version`,`${ref.slug}:${version}`);ctx.set(TARGET_RESOURCE_KEY,archived)}}}function headMatchesVersion(binding,head,version){if(isVersionHash(version))return binding.headHashOf(head)===version;let liveTag=binding.liveTagOf(head);return liveTag!==""&&liveTag===version}async function findAuditByVersion(store,kind,schema2,resourceId,version){if(isVersionHash(version))try{return await store.getAuditByHash(kind,resourceId,version,schema2)}catch(error2){if(error2 instanceof AuditNotFoundError)return;throw internalError(error2,"failed to query audit by hash")}try{return await store.getAuditByTag(kind,resourceId,version,schema2)}catch(error2){if(error2 instanceof AuditNotFoundError)return;throw internalError(error2,"failed to query audit by tag")}}var DEFAULT_PAGE_SIZE=50,MAX_PAGE_SIZE=100,LIST_VERSIONS_RESOURCE_ID_KEY="listVersionsResourceId",LIST_VERSIONS_HEAD_HASH_KEY="listVersionsHeadHash",LIST_VERSIONS_RESPONSE_KEY="listVersionsResponse";function versionHistoryTarget(kind,deniedMessage,idKey=LIST_VERSIONS_RESOURCE_ID_KEY){return ctx=>{let resourceId=ctx.get(idKey);if(typeof resourceId!="string"||resourceId==="")throw new Error(`ListVersions: no resolved resource id under ${idKey}; the slug resolver must run first`);return[{permission:IamPermission.can_view,resourceKind:kind,resourceId,deniedMessage}]}}function newResolveBySlugForVersionsStep(store,binding,stepName){return{name:stepName,async execute(ctx){let req=binding.input(ctx.input),head;try{head=await findResourceBySlug(store,ctx.apiResourceKind,binding.schema,req.slug,req.org)}catch(error2){throw internalError(error2,`failed to search for ${binding.noun}`)}if(head===void 0)throw notFoundError(binding.noun,`${req.slug} (org: ${req.org})`);ctx.set(LIST_VERSIONS_RESOURCE_ID_KEY,idOf(head)),ctx.set(LIST_VERSIONS_HEAD_HASH_KEY,binding.headHashOf(head))}}}function newLoadAndMapVersionsStep(store,binding,stepName){return{name:stepName,async execute(ctx){let req=binding.input(ctx.input),resourceId=ctx.get(LIST_VERSIONS_RESOURCE_ID_KEY),records;try{records=await store.listAuditRecords(ctx.apiResourceKind,resourceId)}catch(error2){throw internalError(error2,"failed to load version history")}let headHash=ctx.get(LIST_VERSIONS_HEAD_HASH_KEY),currentMarked=!1,entries=[];for(let record2 of records){let snapshot;try{snapshot=fromBinary2(binding.schema,record2.data)}catch{continue}let isCurrent=!currentMarked&&headHash!==""&&binding.headHashOf(snapshot)===headHash;currentMarked=currentMarked||isCurrent,entries.push(binding.mapEntry(snapshot,isCurrent,record2.tag))}let pageSize=req.pageSize;pageSize<=0&&(pageSize=DEFAULT_PAGE_SIZE),pageSize>MAX_PAGE_SIZE&&(pageSize=MAX_PAGE_SIZE);let startIndex=0;req.pageToken!==""&&(startIndex=decodePageToken(req.pageToken));let pageEntries=[],nextPageToken="";if(startIndex<entries.length){let end=Math.min(startIndex+pageSize,entries.length);pageEntries=entries.slice(startIndex,end),end<entries.length&&(nextPageToken=Buffer.from(String(end)).toString("base64"))}ctx.set(LIST_VERSIONS_RESPONSE_KEY,binding.response(pageEntries,nextPageToken,entries.length))}}}function decodePageToken(token){let decoded=Buffer.from(token,"base64");if(decoded.toString("base64")!==token)throw invalidArgumentError("invalid page_token");let text2=decoded.toString("utf8"),index2=Number.parseInt(text2,10);if(!Number.isSafeInteger(index2)||String(index2)!==text2||index2<0)throw invalidArgumentError("invalid page_token");return index2}function idOf(resource){return metadataOf(resource)?.id??""}var PLUGIN_ARTIFACT_KEY_PREFIX="plugins/",VERSION_TAG_PATTERN=/^[a-zA-Z0-9._-]+$/,BUILT_IN_SUB_AGENT_NAMES=new Set(["explore","shell","general-purpose"]);var TRANSFER_LANE_NOT_CONFIGURED="plugin artifact transfer lane is not configured on this server",SERVER_WARNING_KINDS={componentIgnored:"component-ignored",memberAdopted:"member-adopted",modelHintUnresolved:"model-hint-unresolved",subAgentNameBuiltin:"sub-agent-name-builtin",versionNotTaggable:"version-not-taggable"};var MEMBER_KINDS=[{kind:ApiResourceKind.skill,schema:SkillSchema},{kind:ApiResourceKind.mcp_server,schema:McpServerSchema},{kind:ApiResourceKind.agent,schema:AgentSchema},{kind:ApiResourceKind.workflow,schema:WorkflowSchema}];function memberOf(kind,metadata){return{kind,id:metadata.id,slug:metadata.slug,name:metadata.name,version:metadata.labels[PLUGIN_VERSION_LABEL]??"",system:isSystemContent(metadata)}}async function findMembers(store,pluginId,org){let members=[];for(let{kind,schema:schema2}of MEMBER_KINDS){let raws=await store.findAllByLabel(kind,PLUGIN_LABEL,pluginId,schema2);for(let raw of raws){let metadata=metadataOf(fromBinary2(schema2,raw));metadata!==void 0&&metadata.org===org&&members.push(memberOf(kind,metadata))}}return members}async function slugHolder(store,planned,org){let entry=MEMBER_KINDS.find(candidate=>candidate.kind===planned.kind);if(entry===void 0)throw new Error(`kind ${ApiResourceKind[planned.kind]} is not a plugin member kind`);let existing=await findResourceBySlug(store,planned.kind,entry.schema,planned.slug,org),metadata=existing===void 0?void 0:metadataOf(existing);return metadata===void 0?{held:!1}:{held:!0,byPlugin:pluginIdOf(metadata),holder:memberOf(planned.kind,metadata)}}function judgeSlug(holder,planned,pluginId){return holder.held?holder.byPlugin===pluginId?{kind:"ours",holder:holder.holder}:holder.byPlugin!==void 0?{kind:"held-by-plugin",holder:holder.holder,pluginId:holder.byPlugin}:holder.holder.system&&planned.system?{kind:"adopt",holder:holder.holder}:{kind:"held-unmanaged",holder:holder.holder}:{kind:"free"}}function membersConverge(existing,planned,digest3){if(existing.length!==planned.length)return!1;let byKey=new Map(existing.map(member2=>[`${member2.kind}:${member2.slug}`,member2]));return planned.every(member2=>{let found=byKey.get(`${member2.kind}:${member2.slug}`);return found!==void 0&&found.version===digest3})}function droppedMembers(existing,planned){let keep=new Set(planned.map(member2=>`${member2.kind}:${member2.slug}`));return existing.filter(member2=>!keep.has(`${member2.kind}:${member2.slug}`))}var PLUGIN_DOCUMENT_LIMITS={manifest:262144,mcpConfig:262144,skillMd:1048576,subAgent:1048576,overlay:1048576,logo:1048576,marketplace:1048576},encoder5=new TextEncoder,decoder3=new TextDecoder("utf-8",{fatal:!1});function comparePaths(a5,b7){return a5<b7?-1:a5>b7?1:0}function decodeUtf8(bytes){let text2=decoder3.decode(bytes);return text2.charCodeAt(0)===65279?text2.slice(1):text2}function isContainedPath(path14){return path14===""||path14.startsWith("/")||path14.includes("\\")?!1:path14.split("/").every(segment=>segment!==""&&segment!=="."&&segment!=="..")}var GLOB_CHARACTERS=/[*?[\]{}]/;function resolveDeclaredPath(value){if(GLOB_CHARACTERS.test(value))return{ok:!1,kind:"path-glob-unsupported"};if(value==="."||value==="./")return{ok:!0,path:""};if(!value.startsWith("./"))return{ok:!1,kind:"path-not-relative"};let trimmed=value.slice(2).replace(/\/+$/,"");return trimmed===""?{ok:!0,path:""}:isContainedPath(trimmed)?{ok:!0,path:trimmed}:{ok:!1,kind:"path-escapes-root"}}function joinPath(dir,name){return dir===""?name:`${dir}/${name}`}function basename(path14){let slash=path14.lastIndexOf("/");return slash===-1?path14:path14.slice(slash+1)}function dirname(path14){let slash=path14.lastIndexOf("/");return slash===-1?"":path14.slice(0,slash)}var PluginFileIndex=class{files;byPath;constructor(files){this.files=files,this.byPath=new Map(files.entries.map(entry=>[entry.path,entry]))}has(path14){return this.byPath.has(path14)}entry(path14){return this.byPath.get(path14)}filesUnder(dir){if(dir==="")return this.files.entries.map(entry=>entry.path);let prefix=`${dir}/`;return this.files.entries.filter(entry=>entry.path.startsWith(prefix)).map(entry=>entry.path)}isDirectory(dir){if(dir==="")return this.files.entries.length>0;let prefix=`${dir}/`;return this.files.entries.some(entry=>entry.path.startsWith(prefix))}childDirectories(dir){let prefix=dir===""?"":`${dir}/`,names=new Set;for(let entry of this.files.entries){if(!entry.path.startsWith(prefix))continue;let rest=entry.path.slice(prefix.length),slash=rest.indexOf("/");slash!==-1&&names.add(rest.slice(0,slash))}return[...names].sort(comparePaths)}childFiles(dir){let prefix=dir===""?"":`${dir}/`,names=[];for(let entry of this.files.entries){if(!entry.path.startsWith(prefix))continue;let rest=entry.path.slice(prefix.length);rest.includes("/")||names.push(rest)}return names.sort(comparePaths)}};function readText(index2,path14,cls,findings){let bytes=readBytes(index2,path14,cls,findings);return bytes===void 0?void 0:decodeUtf8(bytes)}function readBytes(index2,path14,cls,findings){let limit=PLUGIN_DOCUMENT_LIMITS[cls],entry=index2.entry(path14);if(entry===void 0)throw new Error(`plugin file '${path14}' is not listed`);if(entry.size>limit){findings.error("document-too-large",{path:path14,subject:String(entry.size),detail:String(limit)});return}let bytes=index2.files.read(path14);if(bytes.length>limit){findings.error("document-too-large",{path:path14,subject:String(bytes.length),detail:String(limit)});return}return bytes}function parseJsonObject2(text2,path14,kind,findings){let value;try{value=JSON.parse(text2)}catch(error2){findings.error(kind,{path:path14,detail:error2 instanceof Error?error2.message:String(error2)});return}if(!isJsonObject2(value)){findings.error(kind,{path:path14,detail:"the document is not a JSON object"});return}return value}function isJsonObject2(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)}function isStringArray(value){return Array.isArray(value)&&value.every(item=>typeof item=="string")}function isStringRecord(value){return isJsonObject2(value)&&Object.values(value).every(item=>typeof item=="string")}function describeValue(value){return typeof value=="string"?value:JSON.stringify(value)}function fields(object){return Object.entries(object)}function optionalString(object,field3,path14,findings){let value=object[field3];if(value!==void 0){if(typeof value!="string"){findings.error("manifest-field-type",{path:path14,subject:field3,detail:"a string"});return}return value}}function optionalStringArray(object,field3,path14,findings){let value=object[field3];if(value!==void 0){if(!isStringArray(value)){findings.error("manifest-field-type",{path:path14,subject:field3,detail:"an array of strings"});return}return value}}function stringOrStringArray(object,field3,path14,findings){let value=object[field3];if(value!==void 0){if(typeof value=="string")return[value];if(isStringArray(value))return value;findings.error("manifest-field-type",{path:path14,subject:field3,detail:"a string or an array of strings"})}}function warnUnknownFields(object,known,path14,findings){for(let[name]of fields(object))known.has(name)||findings.warn("manifest-field-unknown",{path:path14,subject:name})}function readIdentity(object,path14,findings){let identity2={},name=optionalString(object,"name",path14,findings);name!==void 0&&(identity2.name=name);let version=optionalString(object,"version",path14,findings);version!==void 0&&(identity2.version=version);let description=optionalString(object,"description",path14,findings);description!==void 0&&(identity2.description=description);let homepage=optionalString(object,"homepage",path14,findings);homepage!==void 0&&(identity2.homepage=homepage);let repository=optionalString(object,"repository",path14,findings);repository!==void 0&&(identity2.repository=repository);let license=optionalString(object,"license",path14,findings);license!==void 0&&(identity2.license=license);let keywords=optionalStringArray(object,"keywords",path14,findings);keywords!==void 0&&(identity2.keywords=keywords);let author=readAuthor(object,path14,findings);return author!==void 0&&(identity2.author=author),identity2}function readAuthor(object,path14,findings){let value=object.author;if(value===void 0)return;if(!isJsonObject2(value)){findings.error("manifest-field-type",{path:path14,subject:"author",detail:"an object"});return}let author={},name=optionalString(value,"name",path14,findings);name!==void 0&&(author.name=name);let email=optionalString(value,"email",path14,findings);email!==void 0&&(author.email=email);let url=optionalString(value,"url",path14,findings);return url!==void 0&&(author.url=url),author}function readDeclaredPaths(object,field3,path14,findings){let values=stringOrStringArray(object,field3,path14,findings);if(values===void 0)return;let declared=[];for(let value of values){let resolved=resolveDeclaredPath(value);if(!resolved.ok){findings.error(resolved.kind,{path:path14,subject:value});continue}declared.push({path:resolved.path,manifest:path14})}return declared}function readMcpSources(object,field3,path14,dialect,findings){let value=object[field3];if(value===void 0)return[];let items=Array.isArray(value)?value:[value],sources=[];for(let item of items)if(typeof item=="string"){let resolved=resolveDeclaredPath(item);if(!resolved.ok){findings.error(resolved.kind,{path:path14,subject:item});continue}sources.push({kind:"file",path:resolved.path,dialect,manifest:path14})}else isJsonObject2(item)?sources.push({kind:"inline",manifest:path14,servers:item,dialect}):findings.error("manifest-field-type",{path:path14,subject:field3,detail:"a path, an object, or an array of either"});return sources}var IGNORED_FIELD_KINDS={hooks:"hooks",rules:"rules",commands:"commands",workflows:"workflows",outputStyles:"output-styles",lspServers:"lsp-servers",channels:"channels",dependencies:"dependencies",defaultEnabled:"default-enabled",minClientVersions:"min-client-versions",logo:"logo",apps:"apps"};function ignoredFieldComponents(object,path14){let ignored=[];for(let[name,value]of fields(object)){let kind=IGNORED_FIELD_KINDS[name];if(kind!==void 0&&ignored.push({kind,path:`${path14}#${name}`}),name==="experimental"&&isJsonObject2(value))for(let[sub]of fields(value)){let subKind=EXPERIMENTAL_KINDS[sub];subKind!==void 0&&ignored.push({kind:subKind,path:`${path14}#experimental.${sub}`})}}return ignored}var EXPERIMENTAL_KINDS={themes:"themes",monitors:"monitors",evals:"evals"},STIGMER_EXTENSION_NAMESPACE="ai.stigmer",STIGMER_EXTENSION_FIELDS=new Set(["displayName","logo","category"]);function extensionComponents(object,path14,findings){let value=object.extensions;if(value===void 0)return[];if(!isJsonObject2(value))return findings.warn("manifest-extensions-invalid",{path:path14}),[];let ignored=[];for(let[namespace,content]of fields(value)){if(isJsonObject2(content)&&fields(content).length===0)continue;let at2=`${path14}#extensions.${namespace}`;if(namespace===STIGMER_EXTENSION_NAMESPACE&&isJsonObject2(content)){content.logo!==void 0&&ignored.push({kind:"logo",path:`${at2}.logo`}),fields(content).some(([name])=>!STIGMER_EXTENSION_FIELDS.has(name))&&ignored.push({kind:"extension",path:at2});continue}ignored.push({kind:"extension",path:at2})}return ignored}var CLAUDE_KNOWN_FIELDS=new Set(["name","version","description","author","homepage","repository","license","keywords","skills","commands","agents","workflows","hooks","mcpServers","outputStyles","lspServers","experimental","userConfig","channels","dependencies","defaultEnabled"]),CLAUDE_DEFAULT_MCP_CONFIG=".mcp.json";function readClaudeManifest(object,path14,findings){return readClaudeShapedManifest(object,path14,"claude",CLAUDE_KNOWN_FIELDS,findings)}function readClaudeShapedManifest(object,path14,dialect,known,findings){warnUnknownFields(object,known,path14,findings);let identity2=readIdentity(object,path14,findings),skillPaths=readDeclaredPaths(object,"skills",path14,findings)??[],agentPaths=readDeclaredPaths(object,"agents",path14,findings),declaredMcp=readMcpSources(object,"mcpServers",path14,dialect,findings),manifest={dialect,path:path14,identity:identity2,skillPaths,mcpConfigs:declaredMcp,ignored:ignoredFieldComponents(object,path14)};return agentPaths!==void 0&&(manifest.agentPaths=agentPaths),object.userConfig!==void 0&&(manifest.variables={dialect:"claude",value:object.userConfig,manifest:path14}),manifest}var KNOWN_FIELDS=new Set([...CLAUDE_KNOWN_FIELDS,"apps","interface"]);function readCodexManifest(object,path14,findings){return readClaudeShapedManifest(object,path14,"codex",KNOWN_FIELDS,findings)}var KNOWN_FIELDS2=new Set(["name","displayName","description","version","minClientVersions","author","publisher","homepage","repository","license","logo","keywords","category","tags","commands","agents","skills","rules","hooks","variables","mcpServers"]);function readCursorManifest(object,path14,findings){warnUnknownFields(object,KNOWN_FIELDS2,path14,findings);let identity2=readIdentity(object,path14,findings),skillPaths=readDeclaredPaths(object,"skills",path14,findings)??[],agentPaths=readDeclaredPaths(object,"agents",path14,findings),manifest={dialect:"cursor",path:path14,identity:identity2,skillPaths,mcpConfigs:readMcpSources(object,"mcpServers",path14,"cursor",findings),ignored:ignoredFieldComponents(object,path14)};return agentPaths!==void 0&&(manifest.agentPaths=agentPaths),object.variables!==void 0&&(manifest.variables={dialect:"cursor",value:object.variables,manifest:path14}),manifest}var AGENT_PLUGINS_MANIFEST_SCHEMA="https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",AGENT_PLUGINS_MCP_SCHEMA="https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",MANIFEST_LOCATIONS={"agent-plugins":"plugin.json",claude:".claude-plugin/plugin.json",cursor:".cursor-plugin/plugin.json",codex:".codex-plugin/plugin.json"},q3=value=>`'${value??""}'`,at=path14=>path14===void 0?"":` in ${q3(path14)}`,ERROR_MESSAGES={"no-manifest":()=>`no plugin manifest found: expected one of ${Object.values(MANIFEST_LOCATIONS).map(p3=>q3(p3)).join(", ")}`,"manifest-unreadable":c5=>`manifest ${q3(c5.path)} is not valid JSON: ${c5.detail??"parse error"}`,"manifest-schema-missing":c5=>`manifest ${q3(c5.path)} is missing the required '$schema' field; an Agent Plugins manifest declares ${q3(AGENT_PLUGINS_MANIFEST_SCHEMA)}`,"manifest-schema-unsupported":c5=>`manifest ${q3(c5.path)} declares an unsupported '$schema' ${q3(c5.detail)}; this reader supports ${q3(AGENT_PLUGINS_MANIFEST_SCHEMA)}`,"manifest-name-missing":c5=>`manifest ${q3(c5.path)} is missing the required 'name' field`,"manifest-name-invalid":c5=>`plugin name ${q3(c5.subject)}${at(c5.path)} is invalid: 1 to 64 characters of lowercase letters, digits, hyphens and periods, starting and ending alphanumeric, with no '--' or '..'`,"manifest-name-conflict":c5=>`manifests disagree on the plugin name: ${q3(c5.subject)} in ${q3(c5.path)} versus ${c5.detail??"another manifest"}`,"manifest-field-type":c5=>`field ${q3(c5.subject)}${at(c5.path)} has the wrong type: expected ${c5.detail??"a different type"}`,"path-not-relative":c5=>`path ${q3(c5.subject)}${at(c5.path)} must be plugin-relative and begin with './'`,"path-escapes-root":c5=>`path ${q3(c5.subject)}${at(c5.path)} escapes the plugin root`,"path-glob-unsupported":c5=>`path ${q3(c5.subject)}${at(c5.path)} is a glob pattern; declare directories and files by path`,"path-uncontained":c5=>`the reader listed a path outside the plugin root: ${q3(c5.path)}`,"document-too-large":c5=>`${q3(c5.path)} is ${c5.subject??"too many"} bytes, over the ${c5.detail??""}-byte limit for this kind of document`,"skill-frontmatter-missing":c5=>`${q3(c5.path)} must start with YAML frontmatter ('---')`,"skill-frontmatter-unclosed":c5=>`${q3(c5.path)} frontmatter is not closed (missing the closing '---')`,"skill-frontmatter-unreadable":c5=>`${q3(c5.path)} frontmatter is not valid YAML: ${c5.detail??"parse error"}`,"skill-name-invalid":c5=>`skill name ${q3(c5.subject)}${at(c5.path)} is invalid: lowercase letters, digits and hyphens, optionally dot-scoped, with every segment alphanumeric`,"skill-name-duplicate":c5=>`skill name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"mcp-config-unreadable":c5=>`MCP configuration ${q3(c5.path)} is not valid JSON: ${c5.detail??"parse error"}`,"mcp-config-shape":c5=>`MCP configuration ${q3(c5.path)} must be an object with an 'mcpServers' object`,"mcp-config-schema-missing":c5=>`MCP configuration ${q3(c5.path)} is missing the required '$schema' field; an Agent Plugins configuration declares ${q3(AGENT_PLUGINS_MCP_SCHEMA)}`,"mcp-config-schema-unsupported":c5=>`MCP configuration ${q3(c5.path)} declares an unsupported '$schema' ${q3(c5.detail)}; this reader supports ${q3(AGENT_PLUGINS_MCP_SCHEMA)}`,"mcp-config-field-unknown":c5=>`MCP configuration ${q3(c5.path)} has an unexpected top-level field ${q3(c5.subject)}; only '$schema' and 'mcpServers' are allowed`,"mcp-server-shape":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} must be an object`,"mcp-server-type-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'type' field the Agent Plugins format requires ('stdio', 'streamable-http' or 'sse')`,"mcp-server-transport-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has no 'type' and neither a 'command' nor a 'url' to infer it from`,"mcp-server-type-ambiguous":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares both 'command' and 'url'; a server is either stdio or HTTP`,"mcp-server-type-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an unknown 'type' ${q3(c5.detail)}; expected 'stdio', 'http', 'streamable-http' or 'sse'`,"mcp-server-field-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} that its transport does not define`,"mcp-server-field-type":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} field ${q3(c5.detail)} has the wrong type`,"mcp-server-url-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'url' its HTTP transport requires`,"mcp-server-url-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an invalid 'url' ${q3(c5.detail)}: expected an absolute HTTPS URL (HTTP only for localhost) with no user information or fragment`,"mcp-server-url-variable":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a variable in its 'url'; Stigmer sends the URL as written, so write the URL out and put variables in 'headers'`,"mcp-server-command-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'command' its stdio transport requires`,"mcp-server-command-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a 'command' that is not a single executable name; put arguments in 'args'`,"mcp-server-command-relative":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} runs a command bundled in the plugin ${q3(c5.detail)}; Stigmer runs only commands on the runner's PATH (for example 'npx' or 'uvx')`,"mcp-server-plugin-root-reference":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} references the plugin's own files through ${q3(c5.detail)}; Stigmer does not mount plugin files into the runner`,"mcp-server-cwd-unsupported":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} sets a working directory; Stigmer does not mount plugin files, so a bundled directory cannot be reached`,"mcp-server-env-literal":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} sets environment variable ${q3(c5.detail)} to a literal value; Stigmer passes declared variables by name, so write ${q3(`${c5.detail??"KEY"}: "\${${c5.detail??"KEY"}}"`)} and declare the variable`,"mcp-server-env-rename":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} maps environment variable ${q3(c5.detail)} to a differently named variable; Stigmer passes declared variables by name, so use the same name on both sides`,"mcp-server-name-duplicate":c5=>`MCP server name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"mcp-server-header-duplicate":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares header ${q3(c5.detail)} more than once (header names are case-insensitive)`,"mcp-server-header-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an invalid header name ${q3(c5.detail)}`,"sub-agent-frontmatter-unreadable":c5=>`${q3(c5.path)} frontmatter is not valid YAML: ${c5.detail??"parse error"}`,"sub-agent-instructions-short":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} has instructions under ${c5.detail??""} characters; the body of the file is the sub-agent's prompt`,"sub-agent-name-duplicate":c5=>`sub-agent name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"variable-name-invalid":c5=>`variable name ${q3(c5.subject)}${at(c5.path)} is invalid: an environment variable name is letters, digits and underscores, not starting with a digit`,"overlay-server-unknown":c5=>`${q3(c5.path)} overlays MCP server ${q3(c5.subject)}, which the plugin does not declare`,"overlay-document-unknown":c5=>`${q3(c5.path)} is not a document Stigmer reads; the 'ai.stigmer/' folder holds 'agent.yaml', 'workflows/<name>.yaml' and 'mcp-servers/<server>.yaml'`},WARNING_MESSAGES={"manifest-field-unknown":c5=>`manifest ${q3(c5.path)} has an unknown field ${q3(c5.subject)}, ignored`,"manifest-extensions-invalid":c5=>`manifest ${q3(c5.path)} has an 'extensions' field that is not an object, ignored`,"path-missing":c5=>`path ${q3(c5.subject)} declared${at(c5.path)} does not exist in the plugin`,"skill-name-defaulted":c5=>`${q3(c5.path)} has no 'name' in its frontmatter; the skill is named after its directory, ${q3(c5.subject)}`,"skill-name-differs-from-directory":c5=>`skill ${q3(c5.subject)}${at(c5.path)} is named differently from its directory ${q3(c5.detail)}`,"skill-description-missing":c5=>`skill ${q3(c5.subject)}${at(c5.path)} has no 'description'`,"mcp-config-field-ignored":c5=>`MCP configuration ${q3(c5.path)} has a top-level field ${q3(c5.subject)} Stigmer does not read, ignored`,"mcp-server-sse-mapped":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares the legacy 'sse' transport; Stigmer connects over Streamable HTTP and falls back to SSE only when the server rejects it`,"mcp-server-field-ignored":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} Stigmer does not read, ignored`,"mcp-server-auth-ignored":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an 'auth' block Stigmer does not read; OAuth for a server is declared in 'ai.stigmer/mcp-servers/${c5.subject??"<server>"}.yaml'`,"variable-inferred":c5=>`variable ${q3(c5.subject)} is referenced by MCP server ${q3(c5.detail)} but not declared; it is declared as a required secret`,"variable-unreferenced":c5=>`variable ${q3(c5.subject)}${at(c5.path)} is declared but no MCP server references it`,"variable-default-dropped":c5=>`variable ${q3(c5.subject)}${at(c5.path)} has a default value, which Stigmer does not carry; the user supplies the value`,"variable-type-narrowed":c5=>`variable ${q3(c5.subject)}${at(c5.path)} is typed ${q3(c5.detail)}; Stigmer variables are strings`,"variable-option-dropped":c5=>`variable ${q3(c5.subject)}${at(c5.path)} has a ${q3(c5.detail)} constraint, which Stigmer does not carry`,"sub-agent-name-defaulted":c5=>`${q3(c5.path)} has no 'name' in its frontmatter; the sub-agent is named after the file, ${q3(c5.subject)}`,"sub-agent-skill-unknown":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} asks for skill ${q3(c5.detail)}, which the plugin does not ship`,"sub-agent-model-unknown":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} names model ${q3(c5.detail)}, which Stigmer cannot map; the sub-agent runs on the session's model`,"sub-agent-field-ignored":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} Stigmer does not read, ignored`};var FindingCollector=class{errorSentences;warningSentences;errors=[];warnings=[];constructor(errorSentences,warningSentences){this.errorSentences=errorSentences,this.warningSentences=warningSentences}error(kind,ctx={}){this.errors.push(compose(kind,ctx,this.errorSentences[kind](ctx)))}warn(kind,ctx={}){this.warnings.push(compose(kind,ctx,this.warningSentences[kind](ctx)))}},Findings=class extends FindingCollector{constructor(){super(ERROR_MESSAGES,WARNING_MESSAGES)}};function compose(kind,ctx,message6){return{kind,...ctx.path!==void 0&&{path:ctx.path},...ctx.subject!==void 0&&{subject:ctx.subject},...ctx.detail!==void 0&&{detail:ctx.detail},message:message6}}var KNOWN_FIELDS3=new Set(["$schema","name","version","description","author","homepage","repository","license","keywords","extensions"]);function readOpenManifest(object,path14,findings){let schema2=object.$schema;return schema2===void 0?findings.error("manifest-schema-missing",{path:path14}):schema2!==AGENT_PLUGINS_MANIFEST_SCHEMA&&findings.error("manifest-schema-unsupported",{path:path14,detail:describeValue(schema2)}),warnUnknownFields(object,KNOWN_FIELDS3,path14,findings),{dialect:"agent-plugins",path:path14,identity:readIdentity(object,path14,findings),skillPaths:[],mcpConfigs:[],ignored:extensionComponents(object,path14,findings)}}var OPEN_MCP_CONFIG="mcp.json",VENDOR_PRECEDENCE=["claude","cursor","codex"],MANIFEST_PRECEDENCE=["agent-plugins",...VENDOR_PRECEDENCE],NAME_MAX_LENGTH=64,NAME_PATTERN=/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/;function detectManifests(index2,findings){let manifests=[],present=dialect=>{let path14=MANIFEST_LOCATIONS[dialect];if(!index2.has(path14))return;let object=readManifestObject(index2,path14,findings),manifest=object===void 0?emptyManifest(dialect,path14):readDialect(dialect,object,path14,findings);return manifests.push(manifest),manifest},root5=present("agent-plugins"),vendors=VENDOR_PRECEDENCE.map(present).filter(m3=>m3!==void 0);if(manifests.length===0){findings.error("no-manifest");return}let identity2=root5??vendors[0];if(identity2===void 0)throw new Error("manifest set without an identity manifest");let ordered=[identity2,...manifests.filter(m3=>m3!==identity2)],name=resolveName(identity2,ordered,findings);return{dialect:identity2.dialect,manifests:ordered,name,readsAgents:vendors.length>0,mcpSources:resolveMcpSources(index2,root5,vendors)}}function readManifestObject(index2,path14,findings){let text2=readText(index2,path14,"manifest",findings);return text2===void 0?void 0:parseJsonObject2(text2,path14,"manifest-unreadable",findings)}function readDialect(dialect,object,path14,findings){switch(dialect){case"agent-plugins":return readOpenManifest(object,path14,findings);case"claude":return readClaudeManifest(object,path14,findings);case"cursor":return readCursorManifest(object,path14,findings);case"codex":return readCodexManifest(object,path14,findings);default:{let exhaustive=dialect;throw new Error(`unknown dialect ${String(exhaustive)}`)}}}function emptyManifest(dialect,path14){return{dialect,path:path14,identity:{},skillPaths:[],mcpConfigs:[],ignored:[]}}function resolveName(identity2,all,findings){let name=identity2.identity.name;if(name===void 0){if(findings.errors.some(f5=>f5.kind==="manifest-unreadable"&&f5.path===identity2.path))return;findings.error("manifest-name-missing",{path:identity2.path});return}let valid=!0;isValidPluginName(name)||(findings.error("manifest-name-invalid",{path:identity2.path,subject:name}),valid=!1);for(let other of all){if(other===identity2)continue;let otherName=other.identity.name;otherName!==void 0&&otherName!==name&&(findings.error("manifest-name-conflict",{path:identity2.path,subject:name,detail:`'${otherName}' in '${other.path}'`}),valid=!1)}return valid?name:void 0}function isValidPluginName(name){return name.length<=NAME_MAX_LENGTH&&NAME_PATTERN.test(name)&&!name.includes("--")&&!name.includes("..")}function resolveMcpSources(index2,root5,vendors){let sources=[];root5!==void 0&&index2.has(OPEN_MCP_CONFIG)&&sources.push({kind:"file",path:OPEN_MCP_CONFIG,dialect:"agent-plugins",manifest:root5.path});for(let vendor of vendors)vendor.mcpConfigs.length>0?sources.push(...vendor.mcpConfigs):vendor.dialect!=="cursor"&&index2.has(CLAUDE_DEFAULT_MCP_CONFIG)&&sources.push({kind:"file",path:CLAUDE_DEFAULT_MCP_CONFIG,dialect:vendor.dialect,manifest:vendor.path});let seen=new Set;return sources.filter(source=>source.kind==="inline"?!0:seen.has(source.path)?!1:(seen.add(source.path),!0))}var import_yaml=__toESM(require_dist2(),1);var SKILL_NAME_PATTERN=/^[a-z0-9]+([.-][a-z0-9]+)*$/;function extractFrontmatter(content){let lines=content.split(/\r?\n/);if(lines.length===0||lines[0]?.trim()!=="---")return{ok:!1,reason:"missing"};for(let i6=1;i6<lines.length;i6++)if(lines[i6]?.trim()==="---")return{ok:!0,yaml:lines.slice(1,i6).join(`
 `),body:lines.slice(i6+1).join(`
 `)};return{ok:!1,reason:"unclosed"}}function parseFrontmatter(yaml2){let value;try{value=(0,import_yaml.parse)(yaml2)}catch(error2){return{ok:!1,detail:error2 instanceof Error?error2.message:String(error2)}}return value==null?{ok:!0,fields:{}}:isJsonObject2(value)?{ok:!0,fields:value}:{ok:!1,detail:"the frontmatter is not a mapping"}}var DEFAULT_AGENTS_DIR="agents",SUB_AGENT_INSTRUCTIONS_MIN=10,READ_FIELDS=new Set(["name","description","model","skills"]);function normaliseSubAgents(index2,set2,skills,findings){if(!set2.readsAgents)return[];let skillNames=new Set(skills.map(skill=>skill.name)),agents=[],seen=new Set;for(let path14 of discoverAgentFiles(index2,set2,findings)){let agent=readSubAgent(index2,path14,skillNames,findings);if(agent!==void 0){if(seen.has(agent.name)){findings.error("sub-agent-name-duplicate",{subject:agent.name,path:path14});continue}seen.add(agent.name),agents.push(agent)}}return agents}function discoverAgentFiles(index2,set2,findings){let files=new Set,addMarkdownUnder=dir=>{for(let name of index2.childFiles(dir))name.endsWith(".md")&&files.add(joinPath(dir,name))},declared=set2.manifests.flatMap(m3=>m3.agentPaths??[]);set2.manifests.every(m3=>m3.agentPaths===void 0)&&addMarkdownUnder(DEFAULT_AGENTS_DIR);for(let{path:path14,manifest}of declared)path14!==""&&index2.has(path14)&&path14.endsWith(".md")?files.add(path14):index2.isDirectory(path14)?addMarkdownUnder(path14):findings.warn("path-missing",{path:manifest,subject:path14===""?".":`./${path14}`});return[...files].sort(comparePaths)}function readSubAgent(index2,path14,skillNames,findings){let text2=readText(index2,path14,"subAgent",findings);if(text2===void 0)return;let extracted=extractFrontmatter(text2),fieldsMap={},body=text2;if(extracted.ok){let parsed=parseFrontmatter(extracted.yaml);if(!parsed.ok){findings.error("sub-agent-frontmatter-unreadable",{path:path14,detail:parsed.detail});return}fieldsMap=parsed.fields,body=extracted.body}else if(extracted.reason==="unclosed"){findings.error("sub-agent-frontmatter-unreadable",{path:path14,detail:"the frontmatter is not closed (missing the closing '---')"});return}let stem=basename(path14).replace(/\.md$/,""),name;typeof fieldsMap.name=="string"&&fieldsMap.name!==""?name=fieldsMap.name:(name=stem,findings.warn("sub-agent-name-defaulted",{path:path14,subject:name}));let instructions=body.trim();if(instructions.length<SUB_AGENT_INSTRUCTIONS_MIN){findings.error("sub-agent-instructions-short",{path:path14,subject:name,detail:String(SUB_AGENT_INSTRUCTIONS_MIN)});return}let description=fieldsMap.description,requested=fieldsMap.skills,matchedSkills=[];if(Array.isArray(requested))for(let skill of requested)typeof skill=="string"&&(skillNames.has(skill)?matchedSkills.push(skill):findings.warn("sub-agent-skill-unknown",{path:path14,subject:name,detail:skill}));let modelHint,model=fieldsMap.model;typeof model=="string"&&model.trim()!==""&&(modelHint=classifyModel(model),modelHint.alias==="unknown"&&findings.warn("sub-agent-model-unknown",{path:path14,subject:name,detail:model}));for(let field3 of Object.keys(fieldsMap))READ_FIELDS.has(field3)||findings.warn("sub-agent-field-ignored",{path:path14,subject:name,detail:field3});return{name,...typeof description=="string"&&description!==""&&{description},instructions,skillNames:matchedSkills,...modelHint!==void 0&&{modelHint},path:path14}}function classifyModel(raw){let value=raw.trim().toLowerCase(),alias=value==="inherit"?"inherit":value==="fast"?"fast":value.includes("haiku")?"haiku":value.includes("sonnet")?"sonnet":value.includes("opus")?"opus":"unknown";return{raw,alias}}var PLACEHOLDER_PATTERN=/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,VARIABLE_NAME_PATTERN=/^[A-Za-z_][A-Za-z0-9_]*$/,USER_CONFIG_PATTERN=/\$\{user_config\.([A-Za-z_][A-Za-z0-9_]*)\}/g,PLUGIN_ROOT_PLACEHOLDERS=new Set(["${PLUGIN_ROOT}","${PLUGIN_DATA}","${CLAUDE_PLUGIN_ROOT}","${CLAUDE_PLUGIN_DATA}","${CLAUDE_PROJECT_DIR}","${CURSOR_PLUGIN_ROOT}"]),PLUGIN_ROOT_ENV_NAMES=new Set(["PLUGIN_ROOT","PLUGIN_DATA"]);function rewriteUserConfig(value){return value.replace(USER_CONFIG_PATTERN,(_match,key)=>`\${${key}}`)}function findPluginRootPlaceholder(value){for(let placeholder of PLUGIN_ROOT_PLACEHOLDERS)if(value.includes(placeholder))return placeholder}function referencedVariables(value){let names=[];for(let match of value.matchAll(PLACEHOLDER_PATTERN)){let name=match[1];name!==void 0&&!names.includes(name)&&names.push(name)}return names}function singlePlaceholderName(value){return/^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/.exec(value)?.[1]}var IGNORED_DIRECTORIES={rules:"rules",hooks:"hooks",commands:"commands",canvases:"canvases",workflows:"workflows","output-styles":"output-styles",themes:"themes",monitors:"monitors",bin:"bin",assets:"assets",evals:"evals"},IGNORED_FILES={".lsp.json":"lsp-servers","settings.json":"settings",".app.json":"apps"};function ignoredOnDisk(index2,readsAgents){let ignored=[];for(let dir of index2.childDirectories("")){let kind=IGNORED_DIRECTORIES[dir];kind!==void 0&&ignored.push({kind,path:`${dir}/`}),dir==="agents"&&!readsAgents&&ignored.push({kind:"agents",path:`${dir}/`})}for(let file of index2.childFiles("")){let kind=IGNORED_FILES[file];kind!==void 0&&ignored.push({kind,path:file})}return ignored}function dedupeIgnored(lists){let seen=new Set,out=[];for(let list12 of lists)for(let component of list12){let key=`${component.kind}\0${component.path}`;seen.has(key)||(seen.add(key),out.push(component))}return out}var OPEN_CONFIG_FIELDS=new Set(["$schema","mcpServers"]),OPEN_STDIO_FIELDS=new Set(["type","command","args","env","cwd"]),OPEN_HTTP_FIELDS=new Set(["type","url","headers"]),VENDOR_STDIO_FIELDS=new Set(["type","command","args","env","cwd"]),VENDOR_HTTP_FIELDS=new Set(["type","url","headers"]),HEADER_NAME_PATTERN=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;function normaliseMcpServers(index2,sources,findings){let servers=[],seen=new Set,refused=0;for(let source of sources){let entries=readSource(index2,source,findings);if(entries===void 0){refused++;continue}for(let[name,raw]of fields(entries.servers)){if(seen.has(name)){findings.error("mcp-server-name-duplicate",{subject:name,path:entries.path}),refused++;continue}seen.add(name);let server=readServer(name,raw,entries.path,source.dialect==="agent-plugins",findings);server!==void 0?servers.push(server):refused++}}return{servers,refused,declaredNames:seen}}function readSource(index2,source,findings){let open=source.dialect==="agent-plugins";if(source.kind==="inline"){let wrapped=isJsonObject2(source.servers)?source.servers.mcpServers:void 0,servers2=isJsonObject2(wrapped)?wrapped:source.servers;if(!isJsonObject2(servers2)){findings.error("mcp-config-shape",{path:source.manifest});return}return{path:source.manifest,servers:servers2}}if(!index2.has(source.path)){findings.warn("path-missing",{path:source.manifest,subject:`./${source.path}`});return}let text2=readText(index2,source.path,"mcpConfig",findings);if(text2===void 0)return;let object=parseJsonObject2(text2,source.path,"mcp-config-unreadable",findings);if(object===void 0)return;if(open){let schema2=object.$schema;schema2===void 0?findings.error("mcp-config-schema-missing",{path:source.path}):schema2!==AGENT_PLUGINS_MCP_SCHEMA&&findings.error("mcp-config-schema-unsupported",{path:source.path,detail:describeValue(schema2)})}for(let[name]of fields(object))OPEN_CONFIG_FIELDS.has(name)||(open?findings.error("mcp-config-field-unknown",{path:source.path,subject:name}):findings.warn("mcp-config-field-ignored",{path:source.path,subject:name}));let servers=object.mcpServers;if(!isJsonObject2(servers)){findings.error("mcp-config-shape",{path:source.path});return}return{path:source.path,servers}}function readServer(name,raw,path14,open,findings){let ctx={subject:name,path:path14};if(!isJsonObject2(raw)){findings.error("mcp-server-shape",ctx);return}let transport=resolveTransport(raw,ctx,open,findings);if(transport===void 0)return;let known=transport==="stdio"?open?OPEN_STDIO_FIELDS:VENDOR_STDIO_FIELDS:open?OPEN_HTTP_FIELDS:VENDOR_HTTP_FIELDS,references=new Set,valid=!0;for(let[field3,value]of fields(raw))if(!known.has(field3))if(open)findings.error("mcp-server-field-unknown",{...ctx,detail:field3}),valid=!1;else if(field3==="auth"){findings.warn("mcp-server-auth-ignored",ctx);for(let text2 of stringsWithin(value))collectReferences(text2,references)}else findings.warn("mcp-server-field-ignored",{...ctx,detail:field3});if(valid)return transport==="stdio"?readStdio(name,raw,ctx,references,findings):readHttp(name,raw,ctx,references,findings)}function resolveTransport(raw,ctx,open,findings){let type2=raw.type;if(type2!==void 0&&typeof type2!="string"){findings.error("mcp-server-field-type",{...ctx,detail:"type"});return}if(type2===void 0){if(open){findings.error("mcp-server-type-missing",ctx);return}let hasCommand=raw.command!==void 0,hasUrl=raw.url!==void 0;if(hasCommand&&hasUrl){findings.error("mcp-server-type-ambiguous",ctx);return}if(hasCommand)return"stdio";if(hasUrl)return"http";findings.error("mcp-server-transport-unknown",ctx);return}switch(type2){case"stdio":return"stdio";case"streamable-http":return"http";case"http":if(open){findings.error("mcp-server-type-unknown",{...ctx,detail:type2});return}return"http";case"sse":return findings.warn("mcp-server-sse-mapped",ctx),"http";default:findings.error("mcp-server-type-unknown",{...ctx,detail:type2});return}}function readStdio(name,raw,ctx,references,findings){let valid=!0,fail=()=>{valid=!1},command5=raw.command;if(command5===void 0)findings.error("mcp-server-command-missing",ctx),fail();else if(typeof command5!="string")findings.error("mcp-server-field-type",{...ctx,detail:"command"}),fail();else{let root5=findPluginRootPlaceholder(command5);root5!==void 0?(findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail()):command5.startsWith("./")?(findings.error("mcp-server-command-relative",{...ctx,detail:command5}),fail()):(command5===""||/\s/.test(command5)||command5.includes("/"))&&(findings.error("mcp-server-command-invalid",ctx),fail())}let args=[],rawArgs=raw.args;if(rawArgs!==void 0)if(!isStringArray(rawArgs))findings.error("mcp-server-field-type",{...ctx,detail:"args"}),fail();else for(let arg of rawArgs){let rewritten=rewriteUserConfig(arg),root5=findPluginRootPlaceholder(rewritten);if(root5!==void 0){findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail();continue}collectReferences(rewritten,references),args.push(rewritten)}let rawEnv=raw.env;if(rawEnv!==void 0)if(!isStringRecord(rawEnv))findings.error("mcp-server-field-type",{...ctx,detail:"env"}),fail();else for(let[key,value]of Object.entries(rawEnv)){if(PLUGIN_ROOT_ENV_NAMES.has(key)){findings.error("mcp-server-plugin-root-reference",{...ctx,detail:key}),fail();continue}if(!VARIABLE_NAME_PATTERN.test(key)){findings.error("variable-name-invalid",{subject:key,path:ctx.path}),fail();continue}let rewritten=rewriteUserConfig(value),root5=findPluginRootPlaceholder(rewritten);if(root5!==void 0){findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail();continue}let referenced=singlePlaceholderName(rewritten);referenced===void 0?(findings.error("mcp-server-env-literal",{...ctx,detail:key}),fail()):referenced!==key?(findings.error("mcp-server-env-rename",{...ctx,detail:key}),fail()):references.add(key)}if(raw.cwd!==void 0&&(findings.error("mcp-server-cwd-unsupported",ctx),fail()),!(!valid||typeof command5!="string"))return{name,transport:"stdio",command:command5,args,env:[...references].sort()}}function readHttp(name,raw,ctx,references,findings){let valid=!0,fail=()=>{valid=!1},url,rawUrl=raw.url;if(rawUrl===void 0)findings.error("mcp-server-url-missing",ctx),fail();else if(typeof rawUrl!="string")findings.error("mcp-server-field-type",{...ctx,detail:"url"}),fail();else{url=rewriteUserConfig(rawUrl);let root5=findPluginRootPlaceholder(url);root5!==void 0?(findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail()):referencedVariables(url).length>0?(findings.error("mcp-server-url-variable",ctx),fail()):isAcceptableServerUrl(url)||(findings.error("mcp-server-url-invalid",{...ctx,detail:url}),fail())}let headers2=[],rawHeaders=raw.headers;if(rawHeaders!==void 0)if(!isStringRecord(rawHeaders))findings.error("mcp-server-field-type",{...ctx,detail:"headers"}),fail();else{let lowered=new Set;for(let[header,value]of Object.entries(rawHeaders)){if(!HEADER_NAME_PATTERN.test(header)){findings.error("mcp-server-header-invalid",{...ctx,detail:header}),fail();continue}let key=header.toLowerCase();if(lowered.has(key)){findings.error("mcp-server-header-duplicate",{...ctx,detail:header}),fail();continue}lowered.add(key);let rewritten=rewriteUserConfig(value),root5=findPluginRootPlaceholder(rewritten);if(root5!==void 0){findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail();continue}collectReferences(rewritten,references),headers2.push([header,rewritten])}}if(!(!valid||url===void 0))return{name,transport:"http",url,headers:Object.fromEntries(headers2),env:[...references].sort()}}function isAcceptableServerUrl(value){let url;try{url=new URL(value)}catch{return!1}return url.username!==""||url.password!==""||url.hash!==""?!1:url.protocol==="https:"?!0:url.protocol!=="http:"?!1:isLoopbackHost(url.hostname)}function isLoopbackHost(hostname){return hostname==="localhost"||hostname==="[::1]"||hostname==="::1"?!0:/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname)}function collectReferences(text2,into){for(let name of referencedVariables(text2))into.add(name)}function stringsWithin(value){return typeof value=="string"?[rewriteUserConfig(value)]:Array.isArray(value)?value.flatMap(stringsWithin):isJsonObject2(value)?Object.values(value).flatMap(stringsWithin):[]}var OVERLAY_DIR="ai.stigmer",AGENT_DOCUMENT=`${OVERLAY_DIR}/agent.yaml`,WORKFLOWS_DIR=`${OVERLAY_DIR}/workflows`,MCP_SERVERS_DIR=`${OVERLAY_DIR}/mcp-servers`;function normaliseOverlay(index2,serverNames,findings){let overlay={workflows:[],mcpServers:[]},workflows=[],mcpServers=[];for(let path14 of index2.filesUnder(OVERLAY_DIR)){if(path14===AGENT_DOCUMENT){let bytes=readBytes(index2,path14,"overlay",findings);bytes!==void 0&&(overlay.agent={path:path14,bytes});continue}let name=yamlStem(path14);if(name!==void 0&&dirname(path14)===WORKFLOWS_DIR){let bytes=readBytes(index2,path14,"overlay",findings);bytes!==void 0&&workflows.push({path:path14,bytes,name});continue}if(name!==void 0&&dirname(path14)===MCP_SERVERS_DIR){if(!serverNames.has(name)){findings.error("overlay-server-unknown",{path:path14,subject:name});continue}let bytes=readBytes(index2,path14,"overlay",findings);bytes!==void 0&&mcpServers.push({path:path14,bytes,server:name});continue}findings.error("overlay-document-unknown",{path:path14})}return overlay.workflows=workflows,overlay.mcpServers=mcpServers,overlay}function yamlStem(path14){let name=basename(path14);return name.endsWith(".yaml")&&name.length>5?name.slice(0,-5):void 0}var SKILL_FILE="SKILL.md",DEFAULT_SKILLS_DIR="skills";function normaliseSkills(index2,set2,findings){let skills=[],seenNames=new Map;for(let dir of discoverSkillDirs(index2,set2,findings)){let skill=readSkill(index2,dir,set2,findings);if(skill===void 0)continue;if(seenNames.get(skill.name)!==void 0){findings.error("skill-name-duplicate",{subject:skill.name,path:joinPath(dir,SKILL_FILE)});continue}seenNames.set(skill.name,dir),skills.push(skill)}return skills}function discoverSkillDirs(index2,set2,findings){let dirs=new Set,addSkillsUnder=parent=>{for(let child of index2.childDirectories(parent)){let dir=joinPath(parent,child);index2.has(joinPath(dir,SKILL_FILE))&&dirs.add(dir)}};addSkillsUnder(DEFAULT_SKILLS_DIR);let declared=set2.manifests.flatMap(m3=>m3.skillPaths);for(let{path:path14,manifest}of declared)index2.has(joinPath(path14,SKILL_FILE))?dirs.add(path14):index2.isDirectory(path14)?addSkillsUnder(path14):findings.warn("path-missing",{path:manifest,subject:path14===""?".":`./${path14}`});return declared.length===0&&!index2.isDirectory(DEFAULT_SKILLS_DIR)&&index2.has(SKILL_FILE)&&dirs.add(""),[...dirs].sort(comparePaths)}function readSkill(index2,dir,set2,findings){let path14=joinPath(dir,SKILL_FILE),text2=readText(index2,path14,"skillMd",findings);if(text2===void 0)return;let extracted=extractFrontmatter(text2);if(!extracted.ok){findings.error(extracted.reason==="missing"?"skill-frontmatter-missing":"skill-frontmatter-unclosed",{path:path14});return}let parsed=parseFrontmatter(extracted.yaml);if(!parsed.ok){findings.error("skill-frontmatter-unreadable",{path:path14,detail:parsed.detail});return}let directoryName=dir===""?set2.name??"skill":basename(dir),name;if(typeof parsed.fields.name=="string"&&parsed.fields.name!==""?name=parsed.fields.name:(name=directoryName,findings.warn("skill-name-defaulted",{path:path14,subject:name})),!SKILL_NAME_PATTERN.test(name)){findings.error("skill-name-invalid",{path:path14,subject:name});return}dir!==""&&name!==directoryName&&findings.warn("skill-name-differs-from-directory",{path:path14,subject:name,detail:directoryName});let description=parsed.fields.description;return(typeof description!="string"||description==="")&&findings.warn("skill-description-missing",{path:path14,subject:name}),{name,...typeof description=="string"&&description!==""&&{description},dir,files:index2.filesUnder(dir)}}function normaliseVariables(set2,servers,findings){let declared=new Map,declaredIn=new Map;for(let manifest of set2.manifests){let declaration=manifest.variables;if(declaration===void 0)continue;let variables=declaration.dialect==="cursor"?readCursorVariables(declaration.value,declaration.manifest,findings):readClaudeVariables(declaration.value,declaration.manifest,findings);for(let variable of variables)declared.has(variable.name)||(declared.set(variable.name,variable),declaredIn.set(variable.name,declaration.manifest))}let referencedBy=new Map;for(let server of servers.servers)for(let name of server.env)referencedBy.has(name)||referencedBy.set(name,server.name);if(servers.refused===0)for(let[name,variable]of declared)referencedBy.has(name)||findings.warn("variable-unreferenced",{subject:variable.name,path:declaredIn.get(name)});let inferred=[];for(let[name,server]of[...referencedBy].sort(([a5],[b7])=>a5<b7?-1:a5>b7?1:0))declared.has(name)||(findings.warn("variable-inferred",{subject:name,detail:server}),inferred.push({name,isSecret:!0,optional:!1,declaredBy:"inferred"}));return[...declared.values(),...inferred]}function readCursorVariables(value,manifest,findings){if(!isJsonObject2(value)||value.type!=="object")return findings.error("manifest-field-type",{path:manifest,subject:"variables",detail:"a JSON Schema object with type 'object'"}),[];let properties=value.properties??{};if(!isJsonObject2(properties))return findings.error("manifest-field-type",{path:manifest,subject:"variables.properties",detail:"an object"}),[];let required=value.required??[];if(!isStringArray(required))return findings.error("manifest-field-type",{path:manifest,subject:"variables.required",detail:"an array of strings"}),[];let variables=[];for(let[name,schema2]of fields(properties)){if(!VARIABLE_NAME_PATTERN.test(name)){findings.error("variable-name-invalid",{subject:name,path:manifest});continue}let property=isJsonObject2(schema2)?schema2:{},type2=property.type;type2!==void 0&&type2!=="string"&&findings.warn("variable-type-narrowed",{subject:name,path:manifest,detail:describeValue(type2)}),property.default!==void 0&&findings.warn("variable-default-dropped",{subject:name,path:manifest}),property.enum!==void 0&&findings.warn("variable-option-dropped",{subject:name,path:manifest,detail:"enum"});let description=describe(property);variables.push({name,...description!==void 0&&{description},isSecret:!0,optional:!required.includes(name),declaredBy:"cursor"})}return variables}function readClaudeVariables(value,manifest,findings){if(!isJsonObject2(value))return findings.error("manifest-field-type",{path:manifest,subject:"userConfig",detail:"an object"}),[];let variables=[];for(let[name,entry]of fields(value)){if(!VARIABLE_NAME_PATTERN.test(name)){findings.error("variable-name-invalid",{subject:name,path:manifest});continue}if(!isJsonObject2(entry)){findings.error("manifest-field-type",{path:manifest,subject:`userConfig.${name}`,detail:"an object"});continue}let type2=entry.type;type2!==void 0&&type2!=="string"&&findings.warn("variable-type-narrowed",{subject:name,path:manifest,detail:describeValue(type2)}),entry.default!==void 0&&findings.warn("variable-default-dropped",{subject:name,path:manifest});for(let option of["options","multiple","min","max"])entry[option]!==void 0&&findings.warn("variable-option-dropped",{subject:name,path:manifest,detail:option});let description=describe(entry);variables.push({name,...description!==void 0&&{description},isSecret:entry.sensitive===!0,optional:entry.required!==!0,declaredBy:"claude"})}return variables}function describe(entry){let parts=[entry.title,entry.description].filter(part=>typeof part=="string"&&part!=="");return parts.length===0?void 0:parts.join(": ")}function readPluginPackage(files){let findings=new Findings;for(let entry of files.entries)isContainedPath(entry.path)||findings.error("path-uncontained",{path:entry.path});let index2=new PluginFileIndex(files),set2=detectManifests(index2,findings);if(set2===void 0)return{ok:!1,errors:findings.errors,warnings:findings.warnings};let skills=normaliseSkills(index2,set2,findings),servers=normaliseMcpServers(index2,set2.mcpSources,findings),mcpServers=servers.servers,variables=normaliseVariables(set2,servers,findings),subAgents=normaliseSubAgents(index2,set2,skills,findings),overlay=normaliseOverlay(index2,servers.declaredNames,findings),ignored=dedupeIgnored([ignoredOnDisk(index2,set2.readsAgents),...set2.manifests.map(m3=>m3.ignored)]);if(findings.errors.length>0||set2.name===void 0)return{ok:!1,errors:findings.errors,warnings:findings.warnings};let identity2=set2.manifests[0]?.identity??{};return{ok:!0,plugin:{name:set2.name,...identity2.version!==void 0&&{version:identity2.version},...identity2.description!==void 0&&{description:identity2.description},...identity2.author!==void 0&&{author:identity2.author},...identity2.homepage!==void 0&&{homepage:identity2.homepage},...identity2.repository!==void 0&&{repository:identity2.repository},...identity2.license!==void 0&&{license:identity2.license},keywords:identity2.keywords??[],dialect:set2.dialect,manifestsFound:set2.manifests.map(m3=>m3.path),skills,mcpServers,subAgents,variables,overlay,ignored},warnings:findings.warnings}}var import_node_zlib=require("node:zlib");function parseZipStructure(data){let view=new DataView(data.buffer,data.byteOffset,data.byteLength),eocd=findEndOfCentralDirectory(data,view),entries=[],offset=eocd.centralDirectoryOffset;for(let i6=0;i6<eocd.entryCount;i6++){if(offset+46>data.length||view.getUint32(offset,!0)!==33639248)throw new Error(`invalid central directory record at offset ${offset}`);let versionMadeBy=view.getUint16(offset+4,!0),compressionMethod=view.getUint16(offset+10,!0),crc323=view.getUint32(offset+16,!0),compressedSize=view.getUint32(offset+20,!0),uncompressedSize=view.getUint32(offset+24,!0),fileNameLength=view.getUint16(offset+28,!0),extraFieldLength=view.getUint16(offset+30,!0),commentLength=view.getUint16(offset+32,!0),externalAttributes=view.getUint32(offset+38,!0),localHeaderOffset=view.getUint32(offset+42,!0),fileName=new TextDecoder().decode(data.subarray(offset+46,offset+46+fileNameLength)),dataStart=payloadStart(data,view,localHeaderOffset,fileName);if(dataStart+compressedSize>data.length)throw new Error(`entry "${fileName}" payload runs past end of archive`);entries.push({name:fileName,isDirectory:fileName.endsWith("/"),compressionMethod,uncompressedSize,compressedSize,crc32:crc323,versionMadeBy,externalAttributes,compressedData:data.subarray(dataStart,dataStart+compressedSize)}),offset+=46+fileNameLength+extraFieldLength+commentLength}return entries}function findEndOfCentralDirectory(data,view){let scanFloor=Math.max(0,data.length-22-65535);for(let pos=data.length-22;pos>=scanFloor;pos--){if(view.getUint32(pos,!0)!==101010256)continue;let entryCount=view.getUint16(pos+10,!0),centralDirectorySize=view.getUint32(pos+12,!0),centralDirectoryOffset=view.getUint32(pos+16,!0),directoryEndsAtRecord=centralDirectoryOffset+centralDirectorySize<=pos,directoryLooksReal=entryCount===0||centralDirectoryOffset+4<=data.length&&view.getUint32(centralDirectoryOffset,!0)===33639248;if(directoryEndsAtRecord&&directoryLooksReal)return{centralDirectoryOffset,entryCount}}throw new Error("no end-of-central-directory record found")}var CRC_TABLE=(()=>{let table2=new Uint32Array(256);for(let n3=0;n3<256;n3++){let c5=n3;for(let bit=0;bit<8;bit++)c5=c5>>>1^3988292384&-(c5&1);table2[n3]=c5}return table2})();function crc322(data){let crc2=4294967295;for(let i6=0;i6<data.length;i6++)crc2=crc2>>>8^CRC_TABLE[(crc2^data[i6])&255];return(crc2^4294967295)>>>0}function payloadStart(data,view,localHeaderOffset,fileName){if(localHeaderOffset+30>data.length||view.getUint32(localHeaderOffset,!0)!==67324752)throw new Error(`entry "${fileName}" has no local file header at offset ${localHeaderOffset}`);let localNameLength=view.getUint16(localHeaderOffset+26,!0),localExtraLength=view.getUint16(localHeaderOffset+28,!0);return localHeaderOffset+30+localNameLength+localExtraLength}var METHOD_STORED=0,METHOD_DEFLATED=8,InflateError=class extends Error{kind;detail;constructor(kind,detail){super(`${kind}: ${detail}`),this.kind=kind,this.detail=detail,this.name="InflateError"}};function inflateEntry(entry,maxSize){let content;switch(entry.compressionMethod){case METHOD_STORED:content=entry.compressedData;break;case METHOD_DEFLATED:try{content=new Uint8Array((0,import_node_zlib.inflateRawSync)(entry.compressedData,{maxOutputLength:maxSize+1}))}catch(error2){throw isOutputLengthError(error2)?new InflateError("too-large",`output exceeds ${maxSize} bytes`):new InflateError("read-failed",error2 instanceof Error?error2.message:String(error2))}break;default:throw new InflateError("unsupported-method","zip: unsupported compression algorithm")}if(content.length>maxSize)throw new InflateError("too-large",`output exceeds ${maxSize} bytes`);if(crc322(content)!==entry.crc32)throw new InflateError("checksum","zip: checksum error");return content}function isOutputLengthError(error2){return error2 instanceof Error&&("code"in error2&&error2.code==="ERR_BUFFER_TOO_LARGE"||error2.message.includes("maxOutputLength"))}var import_node_crypto25=require("node:crypto");function sanitizePath(input){let sanitized=sanitizeCore(input);return input.length>0&&(input.endsWith("/")||input.endsWith("\\"))&&sanitized.length>0?`${sanitized}/`:sanitized}function sanitizeCore(input){let segments=`/${input.replaceAll("\\","/")}`.split("/"),resolved=[];for(let segment of segments)if(!(segment===""||segment===".")){if(segment===".."){resolved.pop();continue}resolved.push(segment)}return resolved.join("/")}var WINDOWS_SHORT_FILENAME_PATTERN=/~\d+\.?/;function hasWindowsShortFilenames(input){return input.replaceAll("\\","/").split("/").some(part=>WINDOWS_SHORT_FILENAME_PATTERN.test(part))}var CREATOR_UNIX=3,CREATOR_MACOSX=19,S_IFMT=61440,S_IFBLK=24576,S_IFCHR=8192,S_IFIFO=4096,S_IFLNK=40960,S_IFSOCK=49152;function entryTypeBits(entry){let creator=entry.versionMadeBy>>8;if(creator!==CREATOR_UNIX&&creator!==CREATOR_MACOSX)return{isSymlink:!1,isSpecial:!1};let fileType=entry.externalAttributes>>>16&65535&S_IFMT;return{isSymlink:fileType===S_IFLNK,isSpecial:fileType===S_IFBLK||fileType===S_IFCHR||fileType===S_IFIFO||fileType===S_IFSOCK}}function applyEntryPrefilter(entries){let symlinks=new Set,result=[];for(let entry of entries){let name=sanitizePath(entry.name);if(hasWindowsShortFilenames(name))continue;let shadowKey=trimTrailingSlash(sanitizePath(name)).toLowerCase(),parts=shadowKey.split("/"),traversal=!1;for(let i6=1;i6<=parts.length;i6++)if(symlinks.has(parts.slice(0,i6).join("/"))){traversal=!0;break}if(traversal)continue;let typeBits=entryTypeBits(entry);typeBits.isSymlink&&symlinks.add(shadowKey),!typeBits.isSpecial&&result.push({name,entry})}return result}function trimTrailingSlash(path14){return path14.endsWith("/")?path14.slice(0,-1):path14}function openArchive(bytes,maxZipSize=104857600){if(bytes.length>maxZipSize)throw new Error(`ZIP file too large: ${bytes.length} bytes (max: ${maxZipSize})`);let hash=calculateHash(bytes),entries;try{entries=parseZipStructure(bytes)}catch{throw new Error("invalid ZIP file: zip: not a valid zip file")}return{hash,entries:applyEntryPrefilter(entries)}}function validateArchiveStructure(entries,limits,onEntry){if(entries.length===0)throw new Error("ZIP file is empty");if(entries.length>limits.maxFiles)throw new Error(`too many files in ZIP: ${entries.length} (max: ${limits.maxFiles})`);let totalUncompressedSize=0;for(let{name,entry}of entries){onEntry?.(name);for(let ch of name){let codePoint=ch.codePointAt(0);if(codePoint<32||codePoint===127)throw new Error(`invalid character in filename: ${name}`)}if(totalUncompressedSize+=entry.uncompressedSize,totalUncompressedSize>limits.maxUncompressedSize)throw new Error(`total uncompressed size too large: ${totalUncompressedSize} bytes (max: ${limits.maxUncompressedSize})`);if(entry.compressedSize>0){let ratio=Math.floor(entry.uncompressedSize/entry.compressedSize);if(ratio>limits.maxCompressionRatio)throw new Error(`suspicious compression ratio in ${name}: ${ratio}:1 (max: ${limits.maxCompressionRatio}:1)`)}}}function calculateHash(data){return(0,import_node_crypto25.createHash)("sha256").update(data).digest("hex")}function openPluginArchive(bytes){let{hash,entries}=openArchive(bytes,104857600);validateArchiveStructure(entries,PLATFORM_ARCHIVE_LIMITS);let byPath=new Map;for(let prefiltered of entries){let{name}=prefiltered;name.endsWith("/")||!isContainedPath(name)||byPath.has(name)||byPath.set(name,prefiltered)}let files={entries:[...byPath.values()].map(({name,entry})=>({path:name,size:entry.uncompressedSize})).sort((a5,b7)=>comparePaths(a5.path,b7.path)),read(path14){let prefiltered=byPath.get(path14);if(prefiltered===void 0)throw new Error(`plugin file '${path14}' is not listed`);try{return inflateEntry(prefiltered.entry,prefiltered.entry.uncompressedSize)}catch(error2){throw error2 instanceof InflateError?new Error(`failed to read '${path14}' from the plugin archive: ${error2.detail}`):error2}}};return{digest:hash,files}}function memberLabels(identity2){return{[PLUGIN_LABEL]:identity2.id,[PLUGIN_VERSION_LABEL]:identity2.digest}}function memberMetadata(identity2,member2,authored){let metadata=authored===void 0?create2(ApiResourceMetadataSchema,{}):authored;return metadata.org=identity2.org,metadata.name=member2.name,metadata.slug=member2.slug,metadata.id="",identity2.visibility!==ApiResourceVisibility.api_resource_visibility_unspecified&&(metadata.visibility=identity2.visibility),metadata.labels={...metadata.labels,...memberLabels(identity2)},metadata}var McpServerOverlayError=class extends Error{constructor(server,reason){super(`overlay for MCP server '${server}': ${reason}`),this.name="McpServerOverlayError"}};function mcpServerSlugOf(server){return generateSlug(server.name)}function planMcpServers(plugin2,overlays,identity2){let env2=declaredVariables(plugin2);return plugin2.mcpServers.map(server=>{let overlay=overlays.get(server.name),spec=create2(McpServerSpecSchema,{description:plugin2.description??"",env:Object.fromEntries(server.env.map(name=>[name,env2.get(name)??inferredSecret()]))});switch(server.transport){case"http":spec.serverType={case:"http",value:create2(HttpServerConfigSchema,{url:server.url,headers:{...server.headers}})};break;case"stdio":spec.serverType={case:"stdio",value:create2(StdioServerConfigSchema,{command:server.command,args:[...server.args]})};break;default:{let exhaustive=server;throw new Error(`unknown transport ${JSON.stringify(exhaustive)}`)}}overlay!==void 0&&layerOverlay(server.name,spec,overlay);let slug=mcpServerSlugOf(server);return{name:server.name,slug,resource:create2(McpServerSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"McpServer",metadata:memberMetadata(identity2,{name:server.name,slug},overlay?.metadata),spec})}})}function declaredVariables(plugin2){return new Map(plugin2.variables.map(variable=>[variable.name,create2(EnvVarDeclarationSchema,{isSecret:variable.isSecret,description:variable.description??"",optional:variable.optional})]))}function inferredSecret(){return create2(EnvVarDeclarationSchema,{isSecret:!0,optional:!1})}function layerOverlay(serverName,spec,overlay){let authored=overlay.spec;if(authored!==void 0){if(authored.serverType.case!==void 0)throw new McpServerOverlayError(serverName,"the transport (http or stdio) lives in mcp.json, where every client reads it; the overlay may not redefine it");if(Object.keys(authored.env).length>0)throw new McpServerOverlayError(serverName,"variables are declared where mcp.json references them (the plugin's variables or userConfig); the overlay may not declare env");authored.description!==""&&(spec.description=authored.description),authored.iconUrl!==""&&(spec.iconUrl=authored.iconUrl),authored.tags.length>0&&(spec.tags=[...authored.tags]),authored.defaultEnabledTools.length>0&&(spec.defaultEnabledTools=[...authored.defaultEnabledTools]),authored.pinnedToolApprovals.length>0&&(spec.pinnedToolApprovals=[...authored.pinnedToolApprovals]),authored.repositoryUrl!==""&&(spec.repositoryUrl=authored.repositoryUrl),authored.auth!==void 0&&(spec.auth=authored.auth)}}function renderDefaultAgentInstructions(plugin2){let lines=[],description=plugin2.description?.trim()??"";if(lines.push(description===""?`You are ${plugin2.name}, an agent installed from the ${plugin2.name} plugin.`:`You are ${plugin2.name}: ${description}`),plugin2.skills.length>0){lines.push(""),lines.push("Your skills:");for(let skill of plugin2.skills){let summary=skill.description?.trim()??"";lines.push(summary===""?`- ${skill.name}`:`- ${skill.name}: ${summary}`)}}if(plugin2.mcpServers.length>0){lines.push(""),lines.push("Your tools come from these MCP servers:");for(let server of plugin2.mcpServers)lines.push(`- ${server.name}`)}return lines.push(""),lines.push("Before acting on a task a skill covers, read that skill and follow it. Use the tools your servers provide rather than guessing at their results. When you finish, state what you did and what you could not do."),lines.join(`
 `)}var file_ai_stigmer_agentic_skill_v1_io=fileDesc("CiRhaS9zdGlnbWVyL2FnZW50aWMvc2tpbGwvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MSIgCgdTa2lsbElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEijgQKEFB1c2hTa2lsbFJlcXVlc3QSEwoDb3JnGAEgASgJQga6SAPIAQESEAoIYXJ0aWZhY3QYAiABKAwSKAoDdGFnGAMgASgJQhu6SBhyFjIUXiR8XlthLXpBLVowLTkuXy1dKyQSQgoOZ2l0X3Byb3ZlbmFuY2UYBCABKAsyKi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuR2l0UHJvdmVuYW5jZRIPCgdtZXNzYWdlGAYgASgJEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYByABKAkSSQoGbGFiZWxzGAggAygLMjkuYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlB1c2hTa2lsbFJlcXVlc3QuTGFiZWxzRW50cnkaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ATq2AbpIsgEarwEKInB1c2hfc2tpbGxfcmVxdWVzdC5hcnRpZmFjdF9zb3VyY2USSWV4YWN0bHkgb25lIG9mIGFydGlmYWN0IChpbmxpbmUgYnl0ZXMpIG9yIGFydGlmYWN0X3VwbG9hZF9yZWYgbXVzdCBiZSBzZXQaPih0aGlzLmFydGlmYWN0LnNpemUoKSA+IDApICE9ICh0aGlzLmFydGlmYWN0X3VwbG9hZF9yZWYgIT0gJycpSgQIBRAGIlcKI0NyZWF0ZVNraWxsQXJ0aWZhY3RVcGxvYWRVcmxSZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhsKCnNpemVfYnl0ZXMYAiABKANCB7pIBCICIAAiVwoWU2tpbGxBcnRpZmFjdFVwbG9hZFVybBILCgN1cmwYASABKAkSGwoTYXJ0aWZhY3RfdXBsb2FkX3JlZhgCIAEoCRITCgt0dGxfc2Vjb25kcxgDIAEoBSJQChhTa2lsbEFydGlmYWN0RG93bmxvYWRVcmwSCwoDdXJsGAEgASgJEhMKC3R0bF9zZWNvbmRzGAIgASgFEhIKCnNpemVfYnl0ZXMYAyABKAMiowEKJVB1c2hTa2lsbEZyb21FeGVjdXRpb25BcnRpZmFjdFJlcXVlc3QSEwoDb3JnGAEgASgJQga6SAPIAQESHQoMZXhlY3V0aW9uX2lkGAIgASgJQge6SARyAhABEhwKC3N0b3JhZ2Vfa2V5GAMgASgJQge6SARyAhABEigKA3RhZxgEIAEoCUIbukgYchYyFF4kfF5bYS16QS1aMC05Ll8tXSskIjoKEkdldEFydGlmYWN0UmVxdWVzdBIkChRhcnRpZmFjdF9zdG9yYWdlX2tleRgBIAEoCUIGukgDyAEBIicKE0dldEFydGlmYWN0UmVzcG9uc2USEAoIYXJ0aWZhY3QYASABKAwiagoWTGlzdFNraWxsVmVyc2lvbnNJbnB1dBITCgNvcmcYASABKAlCBrpIA8gBARIUCgRzbHVnGAIgASgJQga6SAPIAQESEgoKcGFnZV90b2tlbhgDIAEoCRIRCglwYWdlX3NpemUYBCABKAUitgIKEVNraWxsVmVyc2lvbkVudHJ5EhQKDHZlcnNpb25faGFzaBgBIAEoCRItCglwdXNoZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkgKCXB1c2hlZF9ieRgDIAEoCzI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0QWN0b3ISCwoDdGFnGAQgASgJEhIKCmlzX2N1cnJlbnQYBSABKAgSQgoOZ2l0X3Byb3ZlbmFuY2UYBiABKAsyKi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuR2l0UHJvdmVuYW5jZRIPCgdtZXNzYWdlGAcgASgJEhwKFGFydGlmYWN0X3N0b3JhZ2Vfa2V5GAggASgJIosBChlMaXN0U2tpbGxWZXJzaW9uc1Jlc3BvbnNlEkAKCHZlcnNpb25zGAEgAygLMi4uYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlNraWxsVmVyc2lvbkVudHJ5EhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRITCgt0b3RhbF9jb3VudBgDIAEoBWIGcHJvdG8z",[file_ai_stigmer_agentic_skill_v1_status,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_timestamp]),SkillIdSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,0),PushSkillRequestSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,1);var SkillArtifactUploadUrlSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,3),SkillArtifactDownloadUrlSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,4);var GetArtifactResponseSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,7);var SkillVersionEntrySchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,9),ListSkillVersionsResponseSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,10);var DETERMINISTIC_ZIP_MTIME=new Date(1980,0,1),DEFLATE_LEVEL=6;function writeArchive(files){let sorted=[...files].sort((a5,b7)=>a5.path<b7.path?-1:a5.path>b7.path?1:0),tree={};for(let file of sorted){if(file.path in tree)throw new Error(`archive path '${file.path}' listed twice`);tree[file.path]=file.bytes}return zipSync(tree,{level:DEFLATE_LEVEL,mtime:DETERMINISTIC_ZIP_MTIME})}function skillSlugOf(skill){return generateSlug(skill.name)}function planSkills(plugin2,files,identity2,tag2,message6){return plugin2.skills.map(skill=>{let prefix=skill.dir===""?"":`${skill.dir}/`,archive=writeArchive(skill.files.map(path14=>({path:path14.startsWith(prefix)?path14.slice(prefix.length):path14,bytes:files.read(path14)})));return{name:skill.name,slug:skillSlugOf(skill),request:create2(PushSkillRequestSchema,{org:identity2.org,artifact:archive,tag:tag2,message:message6,labels:memberLabels(identity2)})}})}function carriesAgent(plugin2){return plugin2.skills.length>0||plugin2.subAgents.length>0||plugin2.overlay.agent!==void 0}function planAgent(plugin2,overlayAgent,mcpServers,identity2,warnings){if(!carriesAgent(plugin2))return;let member2={name:identity2.name,slug:identity2.slug};if(overlayAgent!==void 0)return{...member2,resource:create2(AgentSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Agent",metadata:memberMetadata(identity2,member2,overlayAgent.metadata),spec:overlayAgent.spec})};let serverSlugs=plugin2.mcpServers.map(mcpServerSlugOf),skillSlugByName=new Map(plugin2.skills.map(skill=>[skill.name,skillSlugOf(skill)])),spec=create2(AgentSpecSchema,{description:plugin2.description??"",instructions:renderDefaultAgentInstructions(plugin2),env:toolVariables(mcpServers),skillRefs:[...skillSlugByName.values()].map(slug=>create2(ApiResourceReferenceSchema,{org:identity2.org,kind:ApiResourceKind.skill,slug})),mcpServerUsages:serverSlugs.map(slug=>create2(McpServerUsageSchema,{mcpServerRef:create2(ApiResourceReferenceSchema,{org:identity2.org,kind:ApiResourceKind.mcp_server,slug})})),subAgents:plugin2.subAgents.map(subAgent=>planSubAgent(subAgent,identity2,serverSlugs,skillSlugByName,warnings))});return{...member2,resource:create2(AgentSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Agent",metadata:memberMetadata(identity2,member2),spec})}}function toolVariables(mcpServers){let declarations={};for(let server of mcpServers){let spec=server.resource.spec;if(spec===void 0)continue;let oauthTarget=spec.auth?.targetEnvVar??"";for(let[name,declaration]of Object.entries(spec.env))name===oauthTarget||name in declarations||(declarations[name]=declaration)}return declarations}function planSubAgent(subAgent,identity2,serverSlugs,skillSlugByName,warnings){BUILT_IN_SUB_AGENT_NAMES.has(subAgent.name)&&warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.subAgentNameBuiltin,path:subAgent.path,message:`sub-agent '${subAgent.name}' shares its name with a built-in sub-agent; the runner warns and runs the plugin's`}));let hint=subAgent.modelHint;return hint!==void 0&&hint.alias!=="inherit"&&hint.alias!=="unknown"&&warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.modelHintUnresolved,path:subAgent.path,message:`sub-agent '${subAgent.name}' names model '${hint.raw}'; Stigmer does not pin a model from a plugin, so it runs on the session's model`})),create2(SubAgentSchema,{name:subAgent.name,description:subAgent.description??"",instructions:subAgent.instructions,mcpAccess:serverSlugs.map(slug=>create2(McpAccessSchema,{mcpServer:slug})),skillRefs:subAgent.skillNames.flatMap(name=>{let slug=skillSlugByName.get(name);return slug===void 0?[]:[create2(ApiResourceReferenceSchema,{org:identity2.org,kind:ApiResourceKind.skill,slug})]})})}function workflowSlugOf(name){return generateSlug(name)}function planWorkflows(overlays,identity2){return overlays.map(({name,resource})=>{let slug=workflowSlugOf(name);return{name,slug,resource:create2(WorkflowSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Workflow",metadata:memberMetadata(identity2,{name,slug},resource.metadata),spec:resource.spec})}})}function versionTag(version,warnings){return version===void 0||version===""?"":VERSION_TAG_PATTERN.test(version)?version:(warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.versionNotTaggable,message:`version '${version}' cannot be a tag (letters, digits, '.', '_' and '-' only); this version is reachable by its digest but not by name`})),"")}function planMaterialization(plugin2,files,overlays,identity2,message6){let warnings=[];for(let ignored of plugin2.ignored)warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.componentIgnored,path:ignored.path,message:`${ignored.kind} at '${ignored.path}' is not installed; Stigmer reads skills, MCP servers, sub-agents and the ai.stigmer/ overlay`}));let tag2=versionTag(plugin2.version,warnings),skills=planSkills(plugin2,files,identity2,tag2,message6),mcpServers=planMcpServers(plugin2,new Map(overlays.mcpServers.map(document2=>[document2.server,document2.resource])),identity2),agent=planAgent(plugin2,overlays.agent?.resource,mcpServers,identity2,warnings),workflows=planWorkflows(overlays.workflows,identity2),members=[...skills.map(skill=>({kind:ApiResourceKind.skill,slug:skill.slug,name:skill.name,system:skill.request.labels[SYSTEM_LABEL]===RESERVED_LABEL_TRUE})),...mcpServers.map(server=>({kind:ApiResourceKind.mcp_server,slug:server.slug,name:server.name,system:isSystemContent(server.resource.metadata)})),...agent===void 0?[]:[{kind:ApiResourceKind.agent,slug:agent.slug,name:agent.name,system:isSystemContent(agent.resource.metadata)}],...workflows.map(workflow=>({kind:ApiResourceKind.workflow,slug:workflow.slug,name:workflow.name,system:isSystemContent(workflow.resource.metadata)}))];return{skills,mcpServers,agent,workflows,members,tag:tag2,warnings}}function getDefaultExportFromCjs(x2){return x2&&x2.__esModule&&Object.prototype.hasOwnProperty.call(x2,"default")?x2.default:x2}var jsYaml={},loader={},common={},hasRequiredCommon;function requireCommon(){if(hasRequiredCommon)return common;hasRequiredCommon=1;function isNothing(subject){return typeof subject>"u"||subject===null}function isObject4(subject){return typeof subject=="object"&&subject!==null}function toArray(sequence){return Array.isArray(sequence)?sequence:isNothing(sequence)?[]:[sequence]}function extend(target,source){if(source){let sourceKeys=Object.keys(source);for(let index2=0,length=sourceKeys.length;index2<length;index2+=1){let key=sourceKeys[index2];target[key]=source[key]}}return target}function repeat(string,count){let result="";for(let cycle=0;cycle<count;cycle+=1)result+=string;return result}function isNegativeZero(number){return number===0&&Number.NEGATIVE_INFINITY===1/number}return common.isNothing=isNothing,common.isObject=isObject4,common.toArray=toArray,common.repeat=repeat,common.isNegativeZero=isNegativeZero,common.extend=extend,common}var exception,hasRequiredException;function requireException(){if(hasRequiredException)return exception;hasRequiredException=1;function formatError2(exception2,compact){let where="",message6=exception2.reason||"(unknown reason)";return exception2.mark?(exception2.mark.name&&(where+='in "'+exception2.mark.name+'" '),where+="("+(exception2.mark.line+1)+":"+(exception2.mark.column+1)+")",!compact&&exception2.mark.snippet&&(where+=`
@@ -1231,7 +1231,7 @@ Examples: 'calculator', 'web-scraper', 'math-utils', 'platform.planton-architect
   task_config:
     error: "ValidationError"
     message: "Required field missing: \${ $context.missing_field }"
-`],documentationUrl:"/docs/guides/workflows/task-types/raise-error",isAiNative:!1,requiresExternalService:!1},{kind:"run_workflow",displayName:"Run Workflow",description:"Execute a sub-workflow as a child of the current workflow.",category:"invocation",icon:"workflow",configProtoType:"ai.stigmer.agentic.workflow.v1.tasks.RunTaskConfig",fields:[{name:"workflow",displayName:"Workflow",description:"Sub-workflow name/identifier to execute.",type:"string",required:!0,groupId:"core",fieldNumber:1,validationHints:["required","min_length: 1"]},{name:"input",displayName:"Input",description:"Sub-workflow input (optional). Can be any JSON structure. Supports expressions in string values.",type:"struct",required:!1,groupId:"core",fieldNumber:2}],fieldGroups:[{id:"core",displayName:"Sub-Workflow"}],configJsonSchema:{$schema:"https://json-schema.org/draft/2020-12/schema",additionalProperties:!1,properties:{input:{description:"Sub-workflow input (optional). Can be any JSON structure. Supports expressions in string values.",type:"object"},workflow:{description:"Sub-workflow name/identifier to execute.",minLength:1,type:"string"}},required:["workflow"],title:"RunTaskConfig",type:"object"},outputJsonSchema:{description:"Output from the child workflow execution.",type:"object"},yamlExamples:[`- name: run_enrichment
+`],documentationUrl:"/docs/guides/workflows/task-types/raise-error",isAiNative:!1,requiresExternalService:!1},{kind:"run_workflow",displayName:"Run Workflow",description:"Execute a sub-workflow as a child of the current workflow. Not supported yet: a Workflow containing this task is refused when it is saved.",category:"invocation",icon:"workflow",configProtoType:"ai.stigmer.agentic.workflow.v1.tasks.RunTaskConfig",fields:[{name:"workflow",displayName:"Workflow",description:"Sub-workflow name/identifier to execute.",type:"string",required:!0,groupId:"core",fieldNumber:1,validationHints:["required","min_length: 1"]},{name:"input",displayName:"Input",description:"Sub-workflow input (optional). Can be any JSON structure.",type:"struct",required:!1,groupId:"core",fieldNumber:2}],fieldGroups:[{id:"core",displayName:"Sub-Workflow"}],configJsonSchema:{$schema:"https://json-schema.org/draft/2020-12/schema",additionalProperties:!1,properties:{input:{description:"Sub-workflow input (optional). Can be any JSON structure.",type:"object"},workflow:{description:"Sub-workflow name/identifier to execute.",minLength:1,type:"string"}},required:["workflow"],title:"RunTaskConfig",type:"object"},outputJsonSchema:{description:"Output from the child workflow execution.",type:"object"},yamlExamples:[`- name: run_enrichment
   kind: run_workflow
   task_config:
     workflow: "data-enrichment"
@@ -1491,7 +1491,7 @@ Examples: 'calculator', 'web-scraper', 'math-utils', 'platform.planton-architect
     on_fail: EVAL_FAIL_RAISE
   export:
     as: "\${ . }"
-`],documentationUrl:"/docs/guides/workflows/task-types/eval",isAiNative:!0,requiresExternalService:!1}]};function bundledModelRegistryDocument(){return JSON.stringify(model_registry_default)}function bundledTaskKindRegistryDocument(){return JSON.stringify(task_kind_registry_default)}function convertTaskByKind(kind,typedProto,convertList){switch(kind){case WorkflowTaskKind.set_vars:return convertSetTask(typedProto);case WorkflowTaskKind.http_call:return convertHttpCallTask(typedProto);case WorkflowTaskKind.grpc_call:return convertGrpcCallTask(typedProto);case WorkflowTaskKind.switch_case:return convertSwitchTask(typedProto);case WorkflowTaskKind.for_each:return convertForTask(typedProto,convertList);case WorkflowTaskKind.fork:return convertForkTask(typedProto,convertList);case WorkflowTaskKind.try_catch:return convertTryTask(typedProto,convertList);case WorkflowTaskKind.listen:return convertListenTask(typedProto);case WorkflowTaskKind.wait:return convertWaitTask(typedProto);case WorkflowTaskKind.raise_error:return convertRaiseTask(typedProto);case WorkflowTaskKind.run_workflow:return convertRunTask(typedProto);case WorkflowTaskKind.agent_call:return convertAgentCallTask(typedProto);case WorkflowTaskKind.llm_call:return convertLlmCallTask(typedProto);case WorkflowTaskKind.transform:return convertTransformTask(typedProto);case WorkflowTaskKind.human_input:return convertHumanInputTask(typedProto);case WorkflowTaskKind.validate:return convertValidateTask(typedProto);case WorkflowTaskKind.emit_event:return convertEmitEventTask(typedProto);case WorkflowTaskKind.notification:return convertNotificationTask(typedProto);case WorkflowTaskKind.eval:return convertEvalTask(typedProto);case WorkflowTaskKind.activity_call:throw new Error("activity_call not yet implemented");default:throw new Error(`unsupported task kind: ${WorkflowTaskKind[kind]??kind}`)}}function convertSetTask(cfg){return{set:cfg.variables}}function convertHttpCallTask(cfg){let withBlock={method:cfg.method};cfg.endpoint!==void 0&&(withBlock.endpoint={uri:cfg.endpoint.uri}),Object.keys(cfg.headers).length>0&&(withBlock.headers=cfg.headers),cfg.timeoutSeconds>0&&(withBlock.timeout_seconds=cfg.timeoutSeconds);let body=structAsMap(cfg.body);return body!==void 0&&(withBlock.body=body),{call:"http",with:withBlock}}function convertGrpcCallTask(cfg){let withBlock={service:cfg.service,method:cfg.method},request=structAsMap(cfg.request);return request!==void 0&&(withBlock.request=request),{call:"grpc",with:withBlock}}function convertSwitchTask(cfg){return{switch:cfg.cases.map(switchCase=>{let caseBody={};return switchCase.when!==""&&(caseBody.when=switchCase.when),switchCase.then!==""&&(caseBody.then=switchCase.then),{[switchCase.name!==""?switchCase.name:"default"]:caseBody}})}}function convertForTask(cfg,convertList){let forMap={in:cfg.in};cfg.each!==""&&(forMap.each=cfg.each);let result={for:forMap};return cfg.do.length>0&&(result.do=wrapNestedError("for_each do block",()=>convertList(cfg.do))),result}function convertForkTask(cfg,convertList){let forkMap={branches:cfg.branches.map(branch=>{let branchBody={};return branch.do.length>0&&(branchBody.do=wrapNestedError(`fork branch "${branch.name}" do block`,()=>convertList(branch.do))),{[branch.name]:branchBody}})};return cfg.compete&&(forkMap.compete=!0),{fork:forkMap}}function convertTryTask(cfg,convertList){let result={};if(cfg.try.length>0&&(result.try=wrapNestedError("try block",()=>convertList(cfg.try))),cfg.catch!==void 0){let catchMap={};cfg.catch.as!==""&&(catchMap.as=cfg.catch.as),cfg.catch.do.length>0&&(catchMap.do=wrapNestedError("catch block",()=>convertList(cfg.catch.do))),cfg.catch.compensate&&(catchMap.compensate=!0),result.catch=catchMap}return result}function convertListenTask(cfg){if(cfg.to===void 0)throw new Error("listen task config carries no 'to' block");let eventFilters=cfg.to.signals.map(sig2=>({with:{id:sig2.id,type:sig2.type}})),to={};return cfg.to.mode==="one"&&eventFilters.length===1?to.one=eventFilters[0]:cfg.to.mode==="one"?to.any=eventFilters:to.all=eventFilters,{listen:{to}}}function convertWaitTask(cfg){switch(cfg.waitType.case){case"duration":{let d5=cfg.waitType.value,duration={};return d5.days>0&&(duration.days=d5.days),d5.hours>0&&(duration.hours=d5.hours),d5.minutes>0&&(duration.minutes=d5.minutes),d5.seconds>0&&(duration.seconds=d5.seconds),d5.milliseconds>0&&(duration.milliseconds=d5.milliseconds),{wait:duration}}case"until":return{wait:rfc3339Seconds3(timestampDate(cfg.waitType.value))};default:return{wait:{seconds:0}}}}function rfc3339Seconds3(date2){return date2.toISOString().replace(/\.\d{3}Z$/,"Z")}var RAISE_ERROR_TYPE_MAPPING={validationerror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/validation",status:400},authenticationerror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/authentication",status:401},authorizationerror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/authorization",status:403},configurationerror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/configuration",status:400},timeouterror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/timeout",status:408},communicationerror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/communication",status:502},expressionerror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/expression",status:400},runtimeerror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/runtime",status:500}};function convertRaiseTask(cfg){let typeUri="https://serverlessworkflow.io/spec/1.0.0/errors/runtime",status=500,key=cfg.error.toLowerCase(),mapped=Object.hasOwn(RAISE_ERROR_TYPE_MAPPING,key)?RAISE_ERROR_TYPE_MAPPING[key]:void 0;mapped!==void 0?(typeUri=mapped.typeUri,status=mapped.status):cfg.error.startsWith("https://")&&(typeUri=cfg.error);let errorDef={type:typeUri,status,title:cfg.error};return cfg.message!==""&&(errorDef.detail=cfg.message),{raise:{error:errorDef}}}function convertRunTask(cfg){let run={workflow:{name:cfg.workflow}},input=structAsMap(cfg.input);return input!==void 0&&(run.with=input),{run}}function convertLlmCallTask(cfg){let withBlock={model:cfg.model,prompt:cfg.prompt};cfg.systemPrompt!==""&&(withBlock.system_prompt=cfg.systemPrompt);let responseSchema=structAsMap(cfg.responseSchema);return responseSchema!==void 0&&(withBlock.response_schema=responseSchema),cfg.temperature!==0&&(withBlock.temperature=cfg.temperature),cfg.maxTokens>0&&(withBlock.max_tokens=cfg.maxTokens),cfg.timeout>0&&(withBlock.timeout=cfg.timeout),cfg.onInvalid!==OnInvalidOutputPolicy.ON_INVALID_POLICY_UNSPECIFIED&&(withBlock.on_invalid=enumToJson(OnInvalidOutputPolicySchema,cfg.onInvalid)),cfg.maxRetries>0&&(withBlock.max_retries=cfg.maxRetries),cfg.fallbackTask!==""&&(withBlock.fallback_task=cfg.fallbackTask),cfg.maxCostMicros>0n&&(withBlock.max_cost_micros=Number(cfg.maxCostMicros)),cfg.maxTotalTokens>0n&&(withBlock.max_total_tokens=Number(cfg.maxTotalTokens)),{call:"llm",with:withBlock}}function convertTransformTask(cfg){let withBlock={engine:enumToJson(TransformEngineSchema,cfg.engine),expression:cfg.expression};return cfg.input!==""&&(withBlock.input=cfg.input),{call:"transform",with:withBlock}}function convertHumanInputTask(cfg){let withBlock={prompt:cfg.prompt},formSchema=structAsMap(cfg.formSchema);return formSchema!==void 0&&(withBlock.form_schema=formSchema),cfg.outcomes.length>0&&(withBlock.outcomes=cfg.outcomes.map(o3=>{let om={name:o3.name};return o3.label!==""&&(om.label=o3.label),o3.then!==""&&(om.then=o3.then),om})),cfg.approvers.length>0&&(withBlock.approvers=cfg.approvers),cfg.timeout>0&&(withBlock.timeout=cfg.timeout),cfg.onTimeout!==HumanInputTimeoutPolicy.HUMAN_INPUT_TIMEOUT_POLICY_UNSPECIFIED&&(withBlock.on_timeout=enumToJson(HumanInputTimeoutPolicySchema,cfg.onTimeout)),cfg.notificationChannels.length>0&&(withBlock.notification_channels=cfg.notificationChannels),cfg.payload!==void 0&&(withBlock.payload=valueAsInterface(cfg.payload)),cfg.uiHint!==""&&(withBlock.ui_hint=cfg.uiHint),{call:"human_input",with:withBlock}}function convertValidateTask(cfg){let withBlock={input:cfg.input},schema2=structAsMap(cfg.schema);return schema2!==void 0&&(withBlock.schema=schema2),cfg.rules.length>0&&(withBlock.rules=cfg.rules.map(r5=>{let rm2={name:r5.name,expression:r5.expression};return r5.message!==""&&(rm2.message=r5.message),rm2})),cfg.onFail!==ValidationFailPolicy.VALIDATION_FAIL_POLICY_UNSPECIFIED&&(withBlock.on_fail=enumToJson(ValidationFailPolicySchema,cfg.onFail)),cfg.fallbackTask!==""&&(withBlock.fallback_task=cfg.fallbackTask),{call:"validate",with:withBlock}}function convertEmitEventTask(cfg){if(cfg.event===void 0)throw new Error("emit_event task config carries no 'event' block");let event={type:cfg.event.type};cfg.event.source!==""&&(event.source=cfg.event.source),cfg.event.subject!==""&&(event.subject=cfg.event.subject);let data=structAsMap(cfg.event.data);data!==void 0&&(event.data=data);let withBlock={event};if(cfg.delivery.length>0){let targets=[];for(let target of cfg.delivery)switch(target.target.case){case"webhook":{let webhook={url:target.target.value.url};Object.keys(target.target.value.headers).length>0&&(webhook.headers=target.target.value.headers),targets.push({webhook});break}case"signal":targets.push({signal:{execution_id:target.target.value.executionId,signal_name:target.target.value.signalName}});break}withBlock.delivery=targets}return{call:"emit_event",with:withBlock}}function convertNotificationTask(cfg){let withBlock={channel:cfg.channel,recipients:cfg.recipients,body:cfg.body};return cfg.subject!==""&&(withBlock.subject=cfg.subject),cfg.template!==""&&(withBlock.template=cfg.template),Object.keys(cfg.metadata).length>0&&(withBlock.metadata=cfg.metadata),{call:"notification",with:withBlock}}function convertEvalTask(cfg){let withBlock={model:cfg.model,subject:cfg.subject,rubric:cfg.rubric};return cfg.scoringMode!==EvalScoringMode.EVAL_SCORING_MODE_UNSPECIFIED&&(withBlock.scoring_mode=enumToJson(EvalScoringModeSchema,cfg.scoringMode)),cfg.threshold!==0&&(withBlock.threshold=cfg.threshold),cfg.onFail!==EvalFailPolicy.EVAL_FAIL_POLICY_UNSPECIFIED&&(withBlock.on_fail=enumToJson(EvalFailPolicySchema,cfg.onFail)),cfg.fallbackTask!==""&&(withBlock.fallback_task=cfg.fallbackTask),cfg.systemPrompt!==""&&(withBlock.system_prompt=cfg.systemPrompt),cfg.criteria.length>0&&(withBlock.criteria=cfg.criteria.map(cr=>{let cm={name:cr.name,description:cr.description};return cr.weight!==0&&(cm.weight=cr.weight),cm})),cfg.maxCostMicros>0n&&(withBlock.max_cost_micros=Number(cfg.maxCostMicros)),{call:"eval",with:withBlock}}function convertAgentCallTask(cfg){let withBlock={agent:cfg.agent,message:cfg.message};Object.keys(cfg.env).length>0&&(withBlock.env=cfg.env);let rc=cfg.runConfig;if(rc!==void 0){let runConfig={};switch(rc.modelName!==""&&(runConfig.model_name=rc.modelName),rc.maxCostUsd>0&&(runConfig.max_cost_usd=rc.maxCostUsd),rc.maxToolRounds>0&&(runConfig.max_tool_rounds=rc.maxToolRounds),rc.serviceTier){case ServiceTier.STANDARD:runConfig.service_tier="standard";break;case ServiceTier.FAST:runConfig.service_tier="fast";break}switch(rc.thinkingMode){case ThinkingMode.DISABLED:runConfig.thinking_mode="disabled";break;case ThinkingMode.ENABLED:runConfig.thinking_mode="enabled";break}Object.keys(runConfig).length>0&&(withBlock.run_config=runConfig)}if(cfg.output!==void 0){let output={};cfg.output.schema!==void 0&&(output.schema=cfg.output.schema),cfg.output.onInvalid!==OnInvalidOutputPolicy.ON_INVALID_POLICY_UNSPECIFIED&&(output.on_invalid=enumToJson(OnInvalidOutputPolicySchema,cfg.output.onInvalid)),cfg.output.maxRetries>0&&(output.max_retries=cfg.output.maxRetries),cfg.output.fallbackTask!==""&&(output.fallback_task=cfg.output.fallbackTask),Object.keys(output).length>0&&(withBlock.output=output)}switch(cfg.harness){case Harness.NATIVE:withBlock.harness="native";break;case Harness.CURSOR:withBlock.harness="cursor";break}if(cfg.workspaceEntries.length>0){let entries=[];for(let entry of cfg.workspaceEntries){let m3={};if(entry.name!==""&&(m3.name=entry.name),entry.source?.source.case==="gitRepo"){let git=entry.source.source.value,gitRepo={url:git.url};git.branch!==""&&(gitRepo.branch=git.branch),m3.source={git_repo:gitRepo}}entries.push(m3)}withBlock.workspace_entries=entries}return{call:"agent",with:withBlock}}function structAsMap(s2){if(s2!==void 0)return Object.keys(s2).length>0?s2:void 0}function valueAsInterface(v){return toJson(ValueSchema,v)}function wrapNestedError(context2,fn){try{return fn()}catch(error2){throw new Error(`${context2}: ${error2 instanceof Error?error2.message:String(error2)}`)}}function protoToYaml(spec){if(spec===void 0)throw new Error("workflow spec cannot be nil");if(spec.document===void 0)throw new Error("workflow document cannot be nil");if(spec.tasks.length===0)throw new Error("workflow must have at least one task");let doTasks=spec.tasks.map(task=>{try{return convertTask(task)}catch(error2){throw new Error(`failed to convert task '${task.name}': ${errorMessage2(error2)}`)}}),workflow={document:buildDocument(spec.document),do:doTasks};return yaml.dump(workflow,{sortKeys:!0,lineWidth:-1,noRefs:!0})}function buildDocument(doc){let result={dsl:doc.dsl,namespace:doc.namespace,name:doc.name,version:doc.version};return doc.description!==""&&(result.description=doc.description),result}function convertTask(task){if(task.name==="")throw new Error("task name is required");let taskConfig;try{taskConfig=unmarshalTaskConfig(task.kind,task.taskConfig)}catch(error2){throw new Error(`failed to unmarshal task '${task.name}' config: ${errorMessage2(error2)}`)}let taskDef;try{taskDef=convertTaskByKind(task.kind,taskConfig,convertTaskList)}catch(error2){throw new Error(`task '${task.name}': ${errorMessage2(error2)}`)}if(task.export!==void 0&&task.export.as!==""&&(taskDef.export={as:task.export.as}),task.flow!==void 0&&task.flow.then!==""&&(taskDef.then=task.flow.then),task.compensate.length>0){let compTasks=wrapCompensateError(task.name,()=>convertTaskList(task.compensate)),metadata=taskDef.metadata??{};metadata.__stigmer_compensate=compTasks,taskDef.metadata=metadata}return{[task.name]:taskDef}}function convertTaskList(tasks){return tasks.map(task=>convertTask(task))}function wrapCompensateError(taskName,fn){try{return fn()}catch(error2){throw new Error(`task '${taskName}' compensate: ${errorMessage2(error2)}`)}}function errorMessage2(error2){return error2 instanceof Error?error2.message:String(error2)}var GO_2DP=new Intl.NumberFormat("en-US",{minimumFractionDigits:2,maximumFractionDigits:2,useGrouping:!1,roundingMode:"halfEven"});function checkBudgetWarnings(budget,tasks){let hasCostBearingTasks=tasks.some(task=>task.kind===WorkflowTaskKind.llm_call||task.kind===WorkflowTaskKind.agent_call);if(budget===void 0)return hasCostBearingTasks?["Workflow contains cost-incurring tasks (agent_call, llm_call) but no budget limit is set. Consider adding a budget to prevent unexpected costs."]:[];let warnings=[],hasLimits=budget.maxCostMicros>0n||budget.maxTotalTokens>0n||budget.maxDurationSeconds>0;if(budget.onExceeded===BudgetExceededPolicy.budget_exceeded_terminate&&(budget.maxCostMicros===0n&&warnings.push("Budget has zero max_cost_micros with terminate policy; workflow will fail immediately on first cost-bearing task"),budget.maxTotalTokens===0n&&warnings.push("Budget has zero max_total_tokens with terminate policy; workflow will fail immediately on first cost-bearing task")),!hasCostBearingTasks&&(budget.maxCostMicros>0n||budget.maxTotalTokens>0n)&&warnings.push("Budget is configured but workflow contains no cost-bearing task kinds (llm_call, agent_call)"),hasLimits&&budget.onExceeded===BudgetExceededPolicy.budget_exceeded_policy_unspecified&&warnings.push("Budget limits are set but on_exceeded policy is not specified; defaults to terminate"),budget.maxDurationSeconds>0&&budget.maxDurationSeconds<10&&warnings.push(`Budget duration of ${budget.maxDurationSeconds} seconds may be too short for workflow execution`),budget.maxCostMicros>0n){let perTaskEntries=[];for(let task of tasks)switch(task.kind){case WorkflowTaskKind.llm_call:{let cfg=tryUnmarshalTaskConfig(task.kind,task.taskConfig);cfg!==void 0&&cfg.maxCostMicros>0n&&perTaskEntries.push({name:task.name,costMicros:Number(cfg.maxCostMicros),fieldLabel:`max_cost_micros (${cfg.maxCostMicros})`});break}case WorkflowTaskKind.agent_call:{let usd=tryUnmarshalTaskConfig(task.kind,task.taskConfig)?.runConfig?.maxCostUsd??0;usd>0&&perTaskEntries.push({name:task.name,costMicros:usdToMicros(usd),fieldLabel:`run_config.max_cost_usd ($${GO_2DP.format(usd)})`});break}}let budgetMicros=Number(budget.maxCostMicros),perTaskCostSum=0;for(let entry of perTaskEntries)perTaskCostSum+=entry.costMicros,entry.costMicros>budgetMicros&&warnings.push(`Task '${entry.name}' has ${entry.fieldLabel} that exceeds the workflow budget max_cost_micros (${budget.maxCostMicros}).`);perTaskCostSum>budgetMicros&&perTaskEntries.length>1&&warnings.push(`Combined per-task cost limits ($${GO_2DP.format(perTaskCostSum/1e6)}) exceed the workflow budget ($${GO_2DP.format(budgetMicros/1e6)}). Some tasks may be terminated before reaching their individual limits.`)}return warnings}function usdToMicros(usd){return Math.round(usd*1e6)}function validateTaskKinds(spec){if(spec===void 0||spec.tasks.length===0)return[];let errors=[];for(let task of spec.tasks)(WorkflowTaskKind[task.kind]===void 0||task.kind===0)&&errors.push(`task '${task.name}': unknown or unspecified task kind (value=${task.kind})`);return errors}function validateCrossTaskReferences(spec){if(spec===void 0||spec.tasks.length===0)return[];let errors=[],taskNames=buildTaskNameSet(spec.tasks);errors.push(...validateUniqueTaskNames(spec.tasks)),errors.push(...validateFlowReferences(spec.tasks,taskNames));for(let task of spec.tasks)task.taskConfig!==void 0&&errors.push(...extractAndValidateRefs(task.name,task.kind,task.taskConfig,taskNames));return errors.push(...validateNoCycles(spec.tasks,taskNames)),errors}function buildTaskNameSet(tasks){let names=new Set;for(let t of tasks)t.name!==""&&names.add(t.name);return names}function validateUniqueTaskNames(tasks){let seen=new Map,errors=[];return tasks.forEach((task,i6)=>{if(task.name==="")return;let firstIdx=seen.get(task.name);firstIdx!==void 0&&errors.push(`duplicate task name "${task.name}" at tasks[${i6}]: already defined at tasks[${firstIdx}]`),seen.set(task.name,i6)}),errors}function validateFlowReferences(tasks,taskNames){let errors=[];for(let task of tasks){if(task.flow===void 0||task.flow.then==="")continue;let then=task.flow.then;if(then!=="end"&&!taskNames.has(then)){let suggestion=suggestSimilar(then,taskNames),msg=`task '${task.name}' flow.then references unknown task '${then}'`;suggestion!==""&&(msg+=` (did you mean '${suggestion}'?)`),errors.push(msg)}}return errors}function validateNoCycles(tasks,taskNames){let graph=new Map;for(let task of tasks)task.flow===void 0||task.flow.then===""||graph.set(task.name,task.flow.then);let visited=new Set,path14=new Set,pathOrder=[],errors=[],dfs=node=>{if(path14.has(node)){let startIdx=pathOrder.indexOf(node),cycleParts=[...pathOrder.slice(startIdx),node];errors.push(`circular dependency detected: ${cycleParts.join(" -> ")}`);return}if(visited.has(node))return;visited.add(node),path14.add(node),pathOrder.push(node);let next=graph.get(node);next!==void 0&&next!=="end"&&taskNames.has(next)&&dfs(next),path14.delete(node),pathOrder.pop()};for(let name of taskNames)visited.has(name)||dfs(name);return errors}function extractAndValidateRefs(taskName,kind,config2,validNames){let errors=[],fields2=config2;switch(kind){case WorkflowTaskKind.llm_call:case WorkflowTaskKind.validate:{let ref=getStringField(fields2,"fallbackTask","fallback_task");if(ref!==""&&!validNames.has(ref)){let suggestion=suggestSimilar(ref,validNames),msg=`task '${taskName}' (${enumToJson(WorkflowTaskKindSchema,kind)}) fallback_task references unknown task '${ref}'`;suggestion!==""&&(msg+=` (did you mean '${suggestion}'?)`),errors.push(msg)}break}case WorkflowTaskKind.agent_call:{let output=getStructField(fields2,"output");if(output!==void 0){let ref=getStringField(output,"fallbackTask","fallback_task");if(ref!==""&&!validNames.has(ref)){let suggestion=suggestSimilar(ref,validNames),msg=`task '${taskName}' (agent_call) output.fallback_task references unknown task '${ref}'`;suggestion!==""&&(msg+=` (did you mean '${suggestion}'?)`),errors.push(msg)}}break}case WorkflowTaskKind.switch_case:{getListField(fields2,"cases").forEach((c5,i6)=>{let caseStruct=structValueOf(c5);if(caseStruct===void 0)return;let ref=getStringField(caseStruct,"then");if(ref!==""&&ref!=="end"&&!validNames.has(ref)){let suggestion=suggestSimilar(ref,validNames),msg=`task '${taskName}' (switch_case) cases[${i6}].then references unknown task '${ref}'`;suggestion!==""&&(msg+=` (did you mean '${suggestion}'?)`),errors.push(msg)}});break}case WorkflowTaskKind.human_input:{getListField(fields2,"outcomes").forEach((o3,i6)=>{let outcomeStruct=structValueOf(o3);if(outcomeStruct===void 0)return;let ref=getStringField(outcomeStruct,"then");if(ref!==""&&ref!=="end"&&!validNames.has(ref)){let suggestion=suggestSimilar(ref,validNames),msg=`task '${taskName}' (human_input) outcomes[${i6}].then references unknown task '${ref}'`;suggestion!==""&&(msg+=` (did you mean '${suggestion}'?)`),errors.push(msg)}});break}}return errors}function validateTaskConfigSurfaceRules(spec){if(spec===void 0||spec.tasks.length===0)return[];let errors=[];for(let task of spec.tasks)task.kind!==WorkflowTaskKind.agent_call||task.taskConfig===void 0||getListField(task.taskConfig,"workspace_entries").forEach((v,i6)=>{let entry=structValueOf(v);if(entry===void 0)return;let source=getStructField(entry,"source");source!==void 0&&getStructField(source,"git_repo")===void 0&&errors.push(`task '${task.name}' (agent_call): workspace_entries[${i6}] must use a git_repo source \u2014 no client is connected to serve a local_path when a workflow task fires`)});return errors}function getStringField(fields2,...keys){for(let key of keys){let v=fields2[key];if(typeof v=="string"&&v!=="")return v}return""}function getStructField(fields2,...keys){for(let key of keys){let v=fields2[key];if(v!==void 0)return structValueOf(v)}}function getListField(fields2,key){let v=fields2[key];return Array.isArray(v)?v:[]}function structValueOf(v){return typeof v=="object"&&v!==null&&!Array.isArray(v)?v:void 0}function suggestSimilar(target,names){let bestName="",bestDist=4;for(let name of[...names].sort()){let d5=levenshtein(target.toLowerCase(),name.toLowerCase());d5<bestDist&&(bestDist=d5,bestName=name)}return bestDist<=3?bestName:""}function levenshtein(a5,b7){let la=a5.length,lb=b7.length;if(la===0)return lb;if(lb===0)return la;let prev=new Array(lb+1),curr=new Array(lb+1);for(let j5=0;j5<=lb;j5++)prev[j5]=j5;for(let i6=1;i6<=la;i6++){curr[0]=i6;for(let j5=1;j5<=lb;j5++){let cost=a5.charCodeAt(i6-1)===b7.charCodeAt(j5-1)?0:1;curr[j5]=Math.min(curr[j5-1]+1,prev[j5]+1,prev[j5-1]+cost)}[prev,curr]=[curr,prev]}return prev[lb]}function checkExpressionWarnings(spec){if(spec===void 0||spec.tasks.length===0)return[];let warnings=[];for(let task of spec.tasks)if(task.taskConfig!==void 0)for(let envKey of findContextEnvRefs(task.taskConfig))warnings.push(`task '${task.name}': expression references '$context.env.${envKey}' which resolves to null. Environment variables are accessed via '$env.${envKey}', not '$context.env.${envKey}'. $context holds accumulated task outputs, not environment variables.`);return warnings}function findContextEnvRefs(s2){let keys=[];for(let v of Object.values(s2))keys.push(...findContextEnvRefsInValue(v));return keys}function findContextEnvRefsInValue(v){if(typeof v=="string")return extractContextEnvKeys(v);if(Array.isArray(v)){let keys=[];for(let elem of v)keys.push(...findContextEnvRefsInValue(elem));return keys}return typeof v=="object"&&v!==null?findContextEnvRefs(v):[]}function extractContextEnvKeys(s2){let pattern="$context.env.",keys=[];for(;;){let idx=s2.indexOf(pattern);if(idx<0)break;let rest=s2.slice(idx+pattern.length),keyEnd=0;for(;keyEnd<rest.length&&isEnvKeyChar(rest.charCodeAt(keyEnd));)keyEnd++;keyEnd>0&&keys.push(rest.slice(0,keyEnd)),s2=rest.slice(keyEnd)}return keys}function isEnvKeyChar(c5){return c5>=65&&c5<=90||c5>=97&&c5<=122||c5>=48&&c5<=57||c5===95}function validateHumanInputTimeoutPolicies(spec){if(spec===void 0||spec.tasks.length===0)return[];let escalate=HumanInputTimeoutPolicy.HUMAN_INPUT_TIMEOUT_ESCALATE,escalateName=enumToJson(HumanInputTimeoutPolicySchema,escalate),errors=[];for(let task of spec.tasks){if(task.kind!==WorkflowTaskKind.human_input||task.taskConfig===void 0)continue;let fields2=task.taskConfig,value=fields2.on_timeout;if(value===void 0)continue;let isEscalate=!1;typeof value=="string"?isEscalate=value===escalateName:typeof value=="number"&&(isEscalate=value===escalate),isEscalate&&(hasEscalateOutcomeWithThen(fields2.outcomes)||errors.push(`task '${task.name}' (human_input): on_timeout policy ${escalateName} requires an outcome named 'escalate' with 'then' set \u2014 the timeout resolves to that outcome and follows its 'then' branch`))}return errors}function hasEscalateOutcomeWithThen(outcomes){if(!Array.isArray(outcomes))return!1;for(let entry of outcomes)if(!(typeof entry!="object"||entry===null||Array.isArray(entry))&&stringValueOf(entry.name)==="escalate"&&stringValueOf(entry.then)!=="")return!0;return!1}function stringValueOf(v){return typeof v=="string"?v:""}function validateModelReferences(models,spec){if(spec===void 0||spec.tasks.length===0)return[];if(!models.hasAnyModels())return[];let errors=[];for(let task of spec.tasks){if(task.taskConfig===void 0)continue;let model,harness,kindLabel;switch(task.kind){case WorkflowTaskKind.agent_call:{kindLabel="agent_call";let cfg=tryUnmarshalTaskConfig(task.kind,task.taskConfig);if(cfg===void 0)continue;harness=harnessName(cfg.harness);let tierErr=validateAgentCallServiceTier(models,task.name,harness,cfg.runConfig);tierErr!==""&&errors.push(tierErr);let thinkingErr=validateAgentCallThinkingMode(models,task.name,harness,cfg.runConfig);if(thinkingErr!==""&&errors.push(thinkingErr),(cfg.runConfig?.modelName??"")==="")continue;model=cfg.runConfig.modelName;break}case WorkflowTaskKind.llm_call:{kindLabel="llm_call";let cfg=tryUnmarshalTaskConfig(task.kind,task.taskConfig);if(cfg===void 0||cfg.model==="")continue;model=cfg.model,harness=HARNESS_NAME_NATIVE;break}case WorkflowTaskKind.eval:{kindLabel="eval";let cfg=tryUnmarshalTaskConfig(task.kind,task.taskConfig);if(cfg===void 0||cfg.model==="")continue;model=cfg.model,harness=HARNESS_NAME_NATIVE;break}default:continue}models.hasHarness(harness)&&(models.isValidModel(harness,model)||errors.push(buildModelError(models,task.name,kindLabel,model,harness)))}return errors}function validateAgentCallServiceTier(models,taskName,harness,rc){if(rc?.serviceTier!==ServiceTier.FAST)return"";let modelName=(rc.modelName??"").trim();return modelName===""?`task '${taskName}' (agent_call): run_config.service_tier 'fast' requires run_config.model_name \u2014 the fast tier is a per-model price`:models.hasPricingVariantForHarness(harness,modelName,FAST_VARIANT_KEY)?"":`task '${taskName}' (agent_call): run_config.service_tier 'fast' is not available for model '${modelName}' on harness '${harness}': the model registry prices no fast variant for it${fastCapableSuffix2(models,harness)}`}function validateAgentCallThinkingMode(models,taskName,harness,rc){if(rc?.thinkingMode!==ThinkingMode.ENABLED)return"";let modelName=(rc.modelName??"").trim();return modelName===""?`task '${taskName}' (agent_call): run_config.thinking_mode 'enabled' requires run_config.model_name \u2014 thinking is a per-model capability`:models.hasCapabilityForHarness(harness,modelName,THINKING_CAPABILITY_KEY)?"":`task '${taskName}' (agent_call): run_config.thinking_mode 'enabled' is not available for model '${modelName}' on harness '${harness}': the model registry declares no thinking capability for it${thinkingCapableSuffix2(models,harness)}`}function thinkingCapableSuffix2(models,harness){let capable=models.canonicalModelsWithCapabilityForHarness(harness,THINKING_CAPABILITY_KEY);return capable.length===0?"":`; models with a thinking mode on '${harness}': ${capable.join(", ")}`}function fastCapableSuffix2(models,harness){let capable=models.canonicalModelsWithVariantForHarness(harness,FAST_VARIANT_KEY);return capable.length===0?"":`; models with a fast tier on '${harness}': ${capable.join(", ")}`}function buildModelError(models,taskName,kindLabel,model,harness){let suggestions=suggestSimilarModels(model,models.canonicalModels(harness)),msg=`task '${taskName}' (${kindLabel}): model '${model}' is not a valid model for harness '${harness}'`;if(suggestions.length>0){let quoted=suggestions.map(s2=>`'${s2}'`);msg+=`. Did you mean: ${quoted.join(", ")}?`}return msg}var InProcessValidator=class{modelRegistry;logger;constructor(modelRegistry,logger2){this.modelRegistry=modelRegistry,this.logger=logger2}validate(spec){if(spec===void 0)return create2(ServerlessWorkflowValidationSchema,{state:ValidationState2.FAILED,errors:["WorkflowSpec cannot be nil"],validatedAt:timestampNow()});this.logger.debug("starting in-process workflow validation");let kindErrors=validateTaskKinds(spec);if(kindErrors.length>0)return create2(ServerlessWorkflowValidationSchema,{state:ValidationState2.INVALID,errors:kindErrors,validatedAt:timestampNow()});let yaml2;try{yaml2=protoToYaml(spec)}catch(error2){let message6=error2 instanceof Error?error2.message:String(error2);return this.logger.error("YAML generation failed",{error:message6}),create2(ServerlessWorkflowValidationSchema,{state:ValidationState2.INVALID,errors:[`Failed to generate YAML: ${message6}`],validatedAt:timestampNow()})}this.logger.debug("YAML generation succeeded",{yamlLength:yaml2.length});let errors=[],warnings=[];return errors.push(...validateCrossTaskReferences(spec)),errors.push(...validateTaskConfigConstraints(spec)),errors.push(...validateTaskConfigSurfaceRules(spec)),errors.push(...validateModelReferences(this.modelRegistry,spec)),errors.push(...validateHumanInputTimeoutPolicies(spec)),warnings.push(...checkBudgetWarnings(spec.budget,spec.tasks)),warnings.push(...checkExpressionWarnings(spec)),errors.length>0?(this.logger.warn("validation failed (state: INVALID)",{errors:errors.length,warnings:warnings.length}),create2(ServerlessWorkflowValidationSchema,{state:ValidationState2.INVALID,yaml:yaml2,errors,warnings,validatedAt:timestampNow()})):(this.logger.info("validation passed (state: VALID)",{warnings:warnings.length}),create2(ServerlessWorkflowValidationSchema,{state:ValidationState2.VALID,yaml:yaml2,errors,warnings,validatedAt:timestampNow()}))}};var file_ai_stigmer_agentic_workflowinstance_v1_io=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dpbnN0YW5jZS92MS9pby5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEiKwoSV29ya2Zsb3dJbnN0YW5jZUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEihgEKJUdldFdvcmtmbG93SW5zdGFuY2VzQnlXb3JrZmxvd1JlcXVlc3QSGwoLd29ya2Zsb3dfaWQYASABKAlCBrpIA8gBARIzCglwYWdlX2luZm8YAiABKAsyIC5haS5zdGlnbWVyLmNvbW1vbnMucnBjLlBhZ2VJbmZvEgsKA29yZxgDIAEoCSKsAQoeVXBkYXRlRXhlY3V0aW9uVmlzaWJpbGl0eUlucHV0EhsKC3Jlc291cmNlX2lkGAEgASgJQga6SAPIAQESbQoUZXhlY3V0aW9uX3Zpc2liaWxpdHkYAiABKA4yQy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MS5Xb3JrZmxvd0V4ZWN1dGlvblZpc2liaWxpdHlCCrpIB4IBBBABIAAidgoUV29ya2Zsb3dJbnN0YW5jZUxpc3QSEwoLdG90YWxfcGFnZXMYASABKAUSSQoHZW50cmllcxgCIAMoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93SW5zdGFuY2ViBnByb3RvMw",[file_ai_stigmer_agentic_workflowinstance_v1_api,file_ai_stigmer_agentic_workflowinstance_v1_spec,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]),WorkflowInstanceIdSchema=messageDesc2(file_ai_stigmer_agentic_workflowinstance_v1_io,0);var WorkflowInstanceListSchema=messageDesc2(file_ai_stigmer_agentic_workflowinstance_v1_io,3);var file_ai_stigmer_agentic_workflowinstance_v1_command=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dpbnN0YW5jZS92MS9jb21tYW5kLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MTLvCAohV29ya2Zsb3dJbnN0YW5jZUNvbW1hbmRDb250cm9sbGVyEnsKBWFwcGx5EjguYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEuV29ya2Zsb3dJbnN0YW5jZRo4LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93SW5zdGFuY2USggEKBmNyZWF0ZRI4LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93SW5zdGFuY2UaOC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MS5Xb3JrZmxvd0luc3RhbmNlIgTQuBgBEr0BCgZ1cGRhdGUSOC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MS5Xb3JrZmxvd0luc3RhbmNlGjguYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEuV29ya2Zsb3dJbnN0YW5jZSI/wrgYOwgCEDMiC21ldGFkYXRhLmlkKih1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIHdvcmtmbG93IGluc3RhbmNlEs8BChB1cGRhdGVWaXNpYmlsaXR5EjUuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlVwZGF0ZVZpc2liaWxpdHlJbnB1dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93SW5zdGFuY2UiSsK4GEYIAhAzIgtyZXNvdXJjZV9pZCozdW5hdXRob3JpemVkIHRvIHVwZGF0ZSB3b3JrZmxvdyBpbnN0YW5jZSB2aXNpYmlsaXR5EvMBChl1cGRhdGVFeGVjdXRpb25WaXNpYmlsaXR5EkYuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEuVXBkYXRlRXhlY3V0aW9uVmlzaWJpbGl0eUlucHV0GjguYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEuV29ya2Zsb3dJbnN0YW5jZSJUwrgYUAgEEDMiC3Jlc291cmNlX2lkKj11bmF1dGhvcml6ZWQgdG8gdXBkYXRlIHdvcmtmbG93IGluc3RhbmNlIGV4ZWN1dGlvbiB2aXNpYmlsaXR5ErkBCgZkZWxldGUSOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MS5Xb3JrZmxvd0luc3RhbmNlSWQaOC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MS5Xb3JrZmxvd0luc3RhbmNlIjnCuBg1CAMQMyIFdmFsdWUqKHVuYXV0aG9yaXplZCB0byBkZWxldGUgd29ya2Zsb3cgaW5zdGFuY2UaBKD/KzNiBnByb3RvMw",[file_ai_stigmer_agentic_workflowinstance_v1_api,file_ai_stigmer_agentic_workflowinstance_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),WorkflowInstanceCommandController=serviceDesc(file_ai_stigmer_agentic_workflowinstance_v1_command,0);var file_ai_stigmer_agentic_workflowinstance_v1_query=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dpbnN0YW5jZS92MS9xdWVyeS5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEyiwQKH1dvcmtmbG93SW5zdGFuY2VRdWVyeUNvbnRyb2xsZXISswEKA2dldBI6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93SW5zdGFuY2VJZBo4LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93SW5zdGFuY2UiNsK4GDIIARAzIgV2YWx1ZSoldW5hdXRob3JpemVkIHRvIGdldCB3b3JrZmxvdyBpbnN0YW5jZRKiAQoNZ2V0QnlXb3JrZmxvdxJNLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLkdldFdvcmtmbG93SW5zdGFuY2VzQnlXb3JrZmxvd1JlcXVlc3QaPC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MS5Xb3JrZmxvd0luc3RhbmNlTGlzdCIE0LgYARKGAQoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaOC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MS5Xb3JrZmxvd0luc3RhbmNlIgTQuBgBGgSg/yszYgZwcm90bzM",[file_ai_stigmer_agentic_workflowinstance_v1_api,file_ai_stigmer_agentic_workflowinstance_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),WorkflowInstanceQueryController=serviceDesc(file_ai_stigmer_agentic_workflowinstance_v1_query,0);var PARENT_WORKFLOW_KEY="parent_workflow";function newLoadParentWorkflowStep(loaderProvider,logger2){return{name:"LoadParentWorkflow",async execute(ctx){let workflowId=ctx.input.spec?.workflowId??"";logger2.info("Loading parent workflow",{workflowId});let parent;try{parent=await loaderProvider().get(workflowId)}catch(error2){throw logger2.warn("Parent workflow not found",{error:error2 instanceof ConnectError?error2.rawMessage:String(error2),workflowId}),notFoundError("Workflow",workflowId)}ctx.set(PARENT_WORKFLOW_KEY,parent)}}}var WORKFLOW_INSTANCE_PARENT_DENIED_MESSAGE="You don't have permission to create instances of this workflow";function resolveWorkflowInstanceCreateTargets(ctx){let parent=ctx.get(PARENT_WORKFLOW_KEY);if(parent===void 0)throw new Error("parent workflow not found in context");let metadata=ctx.newState.metadata;return isDefaultInstance(metadata)&&isServerComposedRequest(ctx.callerIdentity)&&(metadata?.org??"")===(parent.metadata?.org??"")?[]:[{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.workflow,resourceId:parent.metadata?.id??"",deniedMessage:WORKFLOW_INSTANCE_PARENT_DENIED_MESSAGE}]}function newValidateSameOrgBusinessRuleStep(logger2){return{name:"ValidateSameOrgBusinessRule",execute(ctx){let parent=ctx.get(PARENT_WORKFLOW_KEY);if(parent===void 0)throw new Error("parent workflow not found in context");let targetOrg=ctx.newState.metadata?.org??"",workflowOrg=parent.metadata?.org??"";if(workflowOrg!==targetOrg)throw logger2.warn("Business rule violation: cannot create instance of workflow in different org",{workflowId:parent.metadata?.id??"",workflowOrg,instanceOrg:targetOrg}),invalidArgumentError(`Cannot create instance of workflow in a different organization. Workflow belongs to org '${workflowOrg}', instance target is org '${targetOrg}'.`)}}}function newValidateInstanceUpdateStep2(){return{name:"ValidateInstanceUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing workflow instance not found in context"),"existing workflow instance not found in context");if(ctx.input.spec?.workflowId!==existing.spec?.workflowId)throw failedPreconditionError(`spec.workflow_id is immutable (instance runs workflow ${existing.spec?.workflowId??""}) \u2014 create a new instance to run a different workflow`)}}}function newRejectDefaultWorkflowInstanceVisibilityUpdateStep(store,instanceKey){return{name:"RejectDefaultInstanceVisibilityUpdate",async execute(ctx){let instance=ctx.get(instanceKey);isDefaultInstance(instance.metadata)&&rejectDefaultInstanceVisibilityUpdate();let parentId=instance.spec?.workflowId??"";if(parentId==="")return;let parent;try{parent=await store.getResource(ApiResourceKind.workflow,parentId,WorkflowSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw internalError(error2,"failed to load parent workflow for default-instance check")}parent.status?.defaultInstanceId===instance.metadata?.id&&rejectDefaultInstanceVisibilityUpdate()}}}function registerWorkflowInstanceServices(router,deps){router.service(WorkflowInstanceCommandController,{apply:(instance,ctx)=>apply14(deps,instance,ctx),create:(instance,ctx)=>createInstance2(deps,instance,ctx),update:(instance,ctx)=>update17(deps,instance,ctx),updateVisibility:(input,ctx)=>updateVisibility8(deps,input,ctx),updateExecutionVisibility:(input,ctx)=>updateExecutionVisibility(deps,input,ctx),delete:(id,ctx)=>deleteInstance2(deps,id,ctx)}),router.service(WorkflowInstanceQueryController,{get:(id,ctx)=>get24(deps,id,ctx),getByReference:(ref,ctx)=>getByReference15(deps,ref,ctx),getByWorkflow:(req,ctx)=>getByWorkflow(deps,req,ctx)})}function kindOf23(ctx){return ctx.values.get(apiResourceKindKey)}async function createInstance2(deps,instance,ctx){let reqCtx=new RequestContext(WorkflowInstanceSchema,instance,callerIdentityOf(ctx),kindOf23(ctx));return await newPipeline("workflow-instance-create",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newLoadParentWorkflowStep(deps.parentWorkflowLoader,deps.logger)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveWorkflowInstanceCreateTargets)).addStep(newValidateSameOrgBusinessRuleStep(deps.logger)).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,workflowInstanceSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update17(deps,instance,ctx){let reqCtx=new RequestContext(WorkflowInstanceSchema,instance,callerIdentityOf(ctx),kindOf23(ctx));return await newPipeline("workflow-instance-update",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateInstanceUpdateStep2()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,workflowInstanceSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply14(deps,instance,ctx){let reqCtx=new RequestContext(WorkflowInstanceSchema,instance,callerIdentityOf(ctx),kindOf23(ctx));await newPipeline("workflow-instance-apply",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createInstance2(deps,instance,ctx):update17(deps,withResolvedApplyId(WorkflowInstanceSchema,instance,reqCtx),ctx)}async function deleteInstance2(deps,instanceId,ctx){let reqCtx=new RequestContext(WorkflowInstanceCommandController.method.delete.input,instanceId,callerIdentityOf(ctx),kindOf23(ctx));await newPipeline("workflow-instance-delete",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,WorkflowInstanceSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted workflow instance not found in context"),"deleted workflow instance not found in context");return deleted}var UPDATE_VISIBILITY_INSTANCE_KEY2="updateVisibilityInstance";async function updateVisibility8(deps,input,ctx){let reqCtx=new RequestContext(WorkflowInstanceCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf23(ctx));return await newPipeline("workflow-instance-update-visibility",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadInstanceStep(deps.store,UPDATE_VISIBILITY_INSTANCE_KEY2,"LoadInstanceForVisibilityUpdate",c5=>c5.input.resourceId)).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_INSTANCE_KEY2)).addStep(newRejectDefaultWorkflowInstanceVisibilityUpdateStep(deps.store,UPDATE_VISIBILITY_INSTANCE_KEY2)).addStep(newValidateVisibilityUpdateStep()).addStep(newSetInstanceVisibilityStep2()).addStep(newPersistInstanceStep(deps.store,UPDATE_VISIBILITY_INSTANCE_KEY2,"PersistInstanceForVisibilityUpdate")).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_INSTANCE_KEY2)).addStep(newIndexInstanceStep(deps.store,deps.logger,UPDATE_VISIBILITY_INSTANCE_KEY2,"IndexInstanceAfterVisibilityUpdate")).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_INSTANCE_KEY2)}function newSetInstanceVisibilityStep2(){return{name:"SetInstanceVisibility",execute(ctx){let input=ctx.input,instance=ctx.get(UPDATE_VISIBILITY_INSTANCE_KEY2);instance.metadata.visibility=input.visibility;try{setAuditFieldsForUpdate(WorkflowInstanceSchema,instance,"status_audit",ctx.callerIdentity)}catch(error2){throw new Error(`failed to set audit fields: ${error2 instanceof Error?error2.message:String(error2)}`)}ctx.set(UPDATE_VISIBILITY_INSTANCE_KEY2,instance)}}}var UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY="updateExecutionVisibilityInstance";async function updateExecutionVisibility(deps,input,ctx){let reqCtx=new RequestContext(WorkflowInstanceCommandController.method.updateExecutionVisibility.input,input,callerIdentityOf(ctx),kindOf23(ctx));return await newPipeline("workflow-instance-update-execution-visibility",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceCommandController.method.updateExecutionVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadInstanceStep(deps.store,UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY,"LoadInstanceForExecutionVisibilityUpdate",c5=>c5.input.resourceId)).addStep(newSetInstanceExecutionVisibilityStep()).addStep(newPersistInstanceStep(deps.store,UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY,"PersistInstanceForExecutionVisibilityUpdate")).addStep(newIndexInstanceStep(deps.store,deps.logger,UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY,"IndexInstanceAfterExecutionVisibilityUpdate")).build().execute(reqCtx),reqCtx.get(UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY)}function newSetInstanceExecutionVisibilityStep(){return{name:"SetInstanceExecutionVisibility",execute(ctx){let input=ctx.input,instance=ctx.get(UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY);instance.spec??=create2(WorkflowInstanceSpecSchema),instance.spec.executionVisibility=input.executionVisibility;try{setAuditFieldsForUpdate(WorkflowInstanceSchema,instance,"status_audit",ctx.callerIdentity)}catch(error2){throw new Error(`failed to set audit fields: ${error2 instanceof Error?error2.message:String(error2)}`)}ctx.set(UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY,instance)}}}function newLoadInstanceStep(store,instanceKey,stepName,resourceIdOf2){return{name:stepName,async execute(ctx){let resourceId=resourceIdOf2(ctx),instance;try{instance=await store.getResource(ApiResourceKind.workflow_instance,resourceId,WorkflowInstanceSchema)}catch{throw notFoundError("workflow instance",resourceId)}ctx.set(instanceKey,instance)}}}function newPersistInstanceStep(store,instanceKey,stepName){return{name:stepName,async execute(ctx){let instance=ctx.get(instanceKey);try{await store.saveResource(ApiResourceKind.workflow_instance,instance.metadata?.id??"",WorkflowInstanceSchema,instance)}catch(error2){throw internalError(error2,"failed to save workflow instance")}}}}function newIndexInstanceStep(store,logger2,instanceKey,stepName){return{name:stepName,async execute(ctx){let instance=ctx.get(instanceKey),entry=workflowInstanceSearchExtractor.getSearchIndexEntry(instance);if(entry===void 0){logger2.warn(`${stepName}: extractor returned nil, skipping`,{id:instance.metadata?.id??""});return}try{await store.upsertSearchIndex(ApiResourceKind.workflow_instance,instance.metadata?.id??"",entry)}catch(error2){logger2.warn(`${stepName}: failed (best-effort)`,{error:error2 instanceof Error?error2.message:String(error2),id:instance.metadata?.id??""})}}}}async function get24(deps,instanceId,ctx){let reqCtx=new RequestContext(WorkflowInstanceQueryController.method.get.input,instanceId,callerIdentityOf(ctx),kindOf23(ctx));return await newPipeline("workflow-instance-get",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,WorkflowInstanceSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference15(deps,ref,ctx){let reqCtx=new RequestContext(WorkflowInstanceQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf23(ctx));return await newPipeline("workflow-instance-get-by-reference",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,WorkflowInstanceSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(WorkflowInstanceQueryController.method.get))).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var WORKFLOW_INSTANCE_LIST_KEY="workflow_instance_list";async function getByWorkflow(deps,request,ctx){let reqCtx=new RequestContext(WorkflowInstanceQueryController.method.getByWorkflow.input,request,callerIdentityOf(ctx),kindOf23(ctx));await newPipeline("workflow-instance-get-by-workflow",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceQueryController.method.getByWorkflow,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByWorkflowStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx);let list12=reqCtx.get(WORKFLOW_INSTANCE_LIST_KEY);return list12===void 0?create2(WorkflowInstanceListSchema):list12}function newLoadByWorkflowStep(store,logger2,listReadScope){return{name:"LoadByWorkflow",async execute(ctx){let request=ctx.input,workflowId=request.workflowId,rows;try{rows=await store.listResources(ctx.apiResourceKind)}catch(error2){throw logger2.error("failed to list workflow instances",{error:error2 instanceof Error?error2.message:String(error2),workflowId}),internalError(error2,"failed to list workflow instances")}let decoded=[];for(let data of rows)try{decoded.push(fromBinary2(WorkflowInstanceSchema,data))}catch(error2){logger2.warn("failed to unmarshal workflow instance, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}let filtered=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.workflow_instance,decoded.filter(instance=>instance.spec?.workflowId===workflowId&&(request.org===""||instance.metadata?.org===request.org)),"");logger2.info("found workflow instances for workflow",{workflowId,count:filtered.length}),ctx.set(WORKFLOW_INSTANCE_LIST_KEY,create2(WorkflowInstanceListSchema,{entries:filtered}))}}}var file_ai_stigmer_agentic_workflowexecution_v1_event=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvZXZlbnQucHJvdG8SJ2FpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MSKGEQoWV29ya2Zsb3dFeGVjdXRpb25FdmVudBIZCghldmVudF9pZBgBIAEoCUIHukgEcgIQARJYCgpldmVudF90eXBlGAIgASgOMjouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXZlbnRUeXBlQgi6SAWCAQIQARIXCg9zZXF1ZW5jZV9udW1iZXIYAyABKAQSHAoLb2NjdXJyZWRfYXQYBCABKAlCB7pIBHICEAESEQoJdGFza19uYW1lGAUgASgJEl0KEWV4ZWN1dGlvbl9zdGFydGVkGAogASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvblN0YXJ0ZWRQYXlsb2FkSAASYQoTZXhlY3V0aW9uX2NvbXBsZXRlZBgLIAEoCzJCLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5FeGVjdXRpb25Db21wbGV0ZWRQYXlsb2FkSAASWwoQZXhlY3V0aW9uX2ZhaWxlZBgMIAEoCzI/LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5FeGVjdXRpb25GYWlsZWRQYXlsb2FkSAASWwoQZXhlY3V0aW9uX3BhdXNlZBgNIAEoCzI/LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5FeGVjdXRpb25QYXVzZWRQYXlsb2FkSAASXQoRZXhlY3V0aW9uX3Jlc3VtZWQYDiABKAsyQC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuRXhlY3V0aW9uUmVzdW1lZFBheWxvYWRIABJhChNleGVjdXRpb25fY2FuY2VsbGVkGA8gASgLMkIuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvbkNhbmNlbGxlZFBheWxvYWRIABJjChRleGVjdXRpb25fdGVybWluYXRlZBgQIAEoCzJDLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5FeGVjdXRpb25UZXJtaW5hdGVkUGF5bG9hZEgAElMKDHRhc2tfc3RhcnRlZBgUIAEoCzI7LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5UYXNrU3RhcnRlZFBheWxvYWRIABJXCg50YXNrX2NvbXBsZXRlZBgVIAEoCzI9LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5UYXNrQ29tcGxldGVkUGF5bG9hZEgAElEKC3Rhc2tfZmFpbGVkGBYgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLlRhc2tGYWlsZWRQYXlsb2FkSAASUwoMdGFza19za2lwcGVkGBcgASgLMjsuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLlRhc2tTa2lwcGVkUGF5bG9hZEgAElUKDXRhc2tfcmV0cnlpbmcYGCABKAsyPC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuVGFza1JldHJ5aW5nUGF5bG9hZEgAEl4KEmFnZW50X2NhbGxfc3RhcnRlZBgeIAEoCzJALmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5BZ2VudENhbGxTdGFydGVkUGF5bG9hZEgAEmAKE2FnZW50X2NhbGxfcHJvZ3Jlc3MYHyABKAsyQS5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuQWdlbnRDYWxsUHJvZ3Jlc3NQYXlsb2FkSAASYgoUYWdlbnRfY2FsbF9jb21wbGV0ZWQYICABKAsyQi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuQWdlbnRDYWxsQ29tcGxldGVkUGF5bG9hZEgAEl8KEmFwcHJvdmFsX3JlcXVlc3RlZBgoIAEoCzJBLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5BcHByb3ZhbFJlcXVlc3RlZFBheWxvYWRIABJdChFhcHByb3ZhbF9yZXNvbHZlZBgpIAEoCzJALmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5BcHByb3ZhbFJlc29sdmVkUGF5bG9hZEgAEl0KEWJ1ZGdldF9jaGVja3BvaW50GDIgASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkJ1ZGdldENoZWNrcG9pbnRQYXlsb2FkSAASWQoPc2lnbmFsX3JlY2VpdmVkGDwgASgLMj4uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLlNpZ25hbFJlY2VpdmVkUGF5bG9hZEgAElUKDWV2ZW50X2VtaXR0ZWQYPSABKAsyPC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuRXZlbnRFbWl0dGVkUGF5bG9hZEgAElsKEGFydGlmYWN0X2NyZWF0ZWQYRiABKAsyPy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuQXJ0aWZhY3RDcmVhdGVkUGF5bG9hZEgAQgkKB3BheWxvYWQiYQoXRXhlY3V0aW9uU3RhcnRlZFBheWxvYWQSEwoLdG90YWxfdGFza3MYASABKAUSEwoLd29ya2Zsb3dfaWQYAiABKAkSHAoUd29ya2Zsb3dfaW5zdGFuY2VfaWQYAyABKAkikgEKGUV4ZWN1dGlvbkNvbXBsZXRlZFBheWxvYWQSLwoOb3V0cHV0X3N1bW1hcnkYASABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0EhMKC2R1cmF0aW9uX21zGAIgASgDEhkKEXRvdGFsX2Nvc3RfbWljcm9zGAMgASgDEhQKDHRvdGFsX3Rva2VucxgEIAEoAyJWChZFeGVjdXRpb25GYWlsZWRQYXlsb2FkEg0KBWVycm9yGAEgASgJEhgKEGZhaWxlZF90YXNrX25hbWUYAiABKAkSEwoLZHVyYXRpb25fbXMYAyABKAMiOwoWRXhlY3V0aW9uUGF1c2VkUGF5bG9hZBIOCgZyZWFzb24YASABKAkSEQoJcGF1c2VkX2J5GAIgASgJIi0KF0V4ZWN1dGlvblJlc3VtZWRQYXlsb2FkEhIKCnJlc3VtZWRfYnkYASABKAkiQQoZRXhlY3V0aW9uQ2FuY2VsbGVkUGF5bG9hZBIOCgZyZWFzb24YASABKAkSFAoMY2FuY2VsbGVkX2J5GAIgASgJIkMKGkV4ZWN1dGlvblRlcm1pbmF0ZWRQYXlsb2FkEg4KBnJlYXNvbhgBIAEoCRIVCg10ZXJtaW5hdGVkX2J5GAIgASgJIqEBChJUYXNrU3RhcnRlZFBheWxvYWQSQwoJdGFza19raW5kGAEgASgOMjAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLldvcmtmbG93VGFza0tpbmQSLgoNaW5wdXRfc3VtbWFyeRgCIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSFgoOYXR0ZW1wdF9udW1iZXIYAyABKAUiywEKFFRhc2tDb21wbGV0ZWRQYXlsb2FkEkMKCXRhc2tfa2luZBgBIAEoDjIwLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS5Xb3JrZmxvd1Rhc2tLaW5kEhMKC2R1cmF0aW9uX21zGAIgASgDEi8KDm91dHB1dF9zdW1tYXJ5GAMgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBITCgtjb3N0X21pY3JvcxgEIAEoAxITCgt0b2tlbnNfdXNlZBgFIAEoAyK+AQoRVGFza0ZhaWxlZFBheWxvYWQSQwoJdGFza19raW5kGAEgASgOMjAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLldvcmtmbG93VGFza0tpbmQSDQoFZXJyb3IYAiABKAkSFgoOYXR0ZW1wdF9udW1iZXIYAyABKAUSFAoMbWF4X2F0dGVtcHRzGAQgASgFEhIKCndpbGxfcmV0cnkYBSABKAgSEwoLZHVyYXRpb25fbXMYBiABKAMiaQoSVGFza1NraXBwZWRQYXlsb2FkEkMKCXRhc2tfa2luZBgBIAEoDjIwLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS5Xb3JrZmxvd1Rhc2tLaW5kEg4KBnJlYXNvbhgCIAEoCSJVChNUYXNrUmV0cnlpbmdQYXlsb2FkEhYKDmZhaWxlZF9hdHRlbXB0GAEgASgFEhQKDG5leHRfYXR0ZW1wdBgCIAEoBRIQCghkZWxheV9tcxgDIAEoAyJiChdBZ2VudENhbGxTdGFydGVkUGF5bG9hZBIaChJjaGlsZF9leGVjdXRpb25faWQYASABKAkSEgoKYWdlbnRfc2x1ZxgCIAEoCRIXCg9tZXNzYWdlX3N1bW1hcnkYAyABKAki5wEKGEFnZW50Q2FsbFByb2dyZXNzUGF5bG9hZBIaChJjaGlsZF9leGVjdXRpb25faWQYASABKAkSSQoLYWdlbnRfcGhhc2UYAiABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRXhlY3V0aW9uUGhhc2USGQoRY3VycmVudF90b29sX25hbWUYAyABKAkSFwoPdG9rZW5zX2NvbnN1bWVkGAQgASgDEhYKDm1lc3NhZ2VzX2NvdW50GAUgASgFEhgKEHRvb2xfY2FsbHNfY291bnQYBiABKAUi1AEKGUFnZW50Q2FsbENvbXBsZXRlZFBheWxvYWQSGgoSY2hpbGRfZXhlY3V0aW9uX2lkGAEgASgJEkkKC2FnZW50X3BoYXNlGAIgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvblBoYXNlEhMKC2R1cmF0aW9uX21zGAMgASgDEhcKD3Rva2Vuc19jb25zdW1lZBgEIAEoAxITCgtjb3N0X21pY3JvcxgFIAEoAxINCgVlcnJvchgGIAEoCSI0ChVIdW1hbklucHV0T3V0Y29tZUluZm8SDAoEbmFtZRgBIAEoCRINCgVsYWJlbBgCIAEoCSLfAgoYQXBwcm92YWxSZXF1ZXN0ZWRQYXlsb2FkEg4KBnByb21wdBgBIAEoCRIRCglhcHByb3ZlcnMYAiADKAkSFwoPdGltZW91dF9zZWNvbmRzGAMgASgFEhQKDHRvb2xfY2FsbF9pZBgEIAEoCRIaChJjaGlsZF9leGVjdXRpb25faWQYBSABKAkSUAoIb3V0Y29tZXMYBiADKAsyPi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuSHVtYW5JbnB1dE91dGNvbWVJbmZvEiwKC2Zvcm1fc2NoZW1hGAcgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBInCgdwYXlsb2FkGAggASgLMhYuZ29vZ2xlLnByb3RvYnVmLlZhbHVlEg8KB3VpX2hpbnQYCSABKAkSGwoTcGF5bG9hZF9hcnRpZmFjdF9pZBgKIAEoCSLxAQoXQXBwcm92YWxSZXNvbHZlZFBheWxvYWQSRAoGYWN0aW9uGAEgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsQWN0aW9uEhMKC3Jlc29sdmVkX2J5GAIgASgJEg8KB2NvbW1lbnQYAyABKAkSGAoQd2FpdF9kdXJhdGlvbl9tcxgEIAEoAxJQChFyZXNvbHZlZF9ieV9hY3RvchgFIAEoCzI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0QWN0b3Ii9wEKF0J1ZGdldENoZWNrcG9pbnRQYXlsb2FkEhwKFGNvc3RfY29uc3VtZWRfbWljcm9zGAEgASgDEh0KFWNvc3RfcmVtYWluaW5nX21pY3JvcxgCIAEoAxIXCg90b2tlbnNfY29uc3VtZWQYAyABKAMSGAoQdG9rZW5zX3JlbWFpbmluZxgEIAEoAxIaChJ0aHJlc2hvbGRfYnJlYWNoZWQYBSABKAgSUAoSb25fZXhjZWVkZWRfcG9saWN5GAYgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLkJ1ZGdldEV4Y2VlZGVkUG9saWN5Il4KFVNpZ25hbFJlY2VpdmVkUGF5bG9hZBITCgtzaWduYWxfbmFtZRgBIAEoCRIwCg9wYXlsb2FkX3N1bW1hcnkYAiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0IlYKE0V2ZW50RW1pdHRlZFBheWxvYWQSEgoKZXZlbnRfdHlwZRgBIAEoCRIUCgxldmVudF9zb3VyY2UYAiABKAkSFQoNZXZlbnRfc3ViamVjdBgDIAEoCSJtChZBcnRpZmFjdENyZWF0ZWRQYXlsb2FkEhMKC2FydGlmYWN0X2lkGAEgASgJEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRIUCgxjb250ZW50X3R5cGUYAyABKAkSEgoKc2l6ZV9ieXRlcxgEIAEoAyqJBAoRV29ya2Zsb3dFdmVudFR5cGUSIwofd29ya2Zsb3dfZXZlbnRfdHlwZV91bnNwZWNpZmllZBAAEhUKEWV4ZWN1dGlvbl9zdGFydGVkEAESFwoTZXhlY3V0aW9uX2NvbXBsZXRlZBACEhQKEGV4ZWN1dGlvbl9mYWlsZWQQAxIUChBleGVjdXRpb25fcGF1c2VkEAQSFQoRZXhlY3V0aW9uX3Jlc3VtZWQQBRIXChNleGVjdXRpb25fY2FuY2VsbGVkEAYSGAoUZXhlY3V0aW9uX3Rlcm1pbmF0ZWQQBxIQCgx0YXNrX3N0YXJ0ZWQQCxISCg50YXNrX2NvbXBsZXRlZBAMEg8KC3Rhc2tfZmFpbGVkEA0SEAoMdGFza19za2lwcGVkEA4SEQoNdGFza19yZXRyeWluZxAPEhYKEmFnZW50X2NhbGxfc3RhcnRlZBAVEhcKE2FnZW50X2NhbGxfcHJvZ3Jlc3MQFhIYChRhZ2VudF9jYWxsX2NvbXBsZXRlZBAXEhYKEmFwcHJvdmFsX3JlcXVlc3RlZBAfEhUKEWFwcHJvdmFsX3Jlc29sdmVkECASFQoRYnVkZ2V0X2NoZWNrcG9pbnQQKRITCg9zaWduYWxfcmVjZWl2ZWQQMxIRCg1ldmVudF9lbWl0dGVkEDQSFAoQYXJ0aWZhY3RfY3JlYXRlZBA1YgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_workflow_v1_enum,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_struct]),WorkflowExecutionEventSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_event,0);var WorkflowEventType;(function(WorkflowEventType2){WorkflowEventType2[WorkflowEventType2.workflow_event_type_unspecified=0]="workflow_event_type_unspecified",WorkflowEventType2[WorkflowEventType2.execution_started=1]="execution_started",WorkflowEventType2[WorkflowEventType2.execution_completed=2]="execution_completed",WorkflowEventType2[WorkflowEventType2.execution_failed=3]="execution_failed",WorkflowEventType2[WorkflowEventType2.execution_paused=4]="execution_paused",WorkflowEventType2[WorkflowEventType2.execution_resumed=5]="execution_resumed",WorkflowEventType2[WorkflowEventType2.execution_cancelled=6]="execution_cancelled",WorkflowEventType2[WorkflowEventType2.execution_terminated=7]="execution_terminated",WorkflowEventType2[WorkflowEventType2.task_started=11]="task_started",WorkflowEventType2[WorkflowEventType2.task_completed=12]="task_completed",WorkflowEventType2[WorkflowEventType2.task_failed=13]="task_failed",WorkflowEventType2[WorkflowEventType2.task_skipped=14]="task_skipped",WorkflowEventType2[WorkflowEventType2.task_retrying=15]="task_retrying",WorkflowEventType2[WorkflowEventType2.agent_call_started=21]="agent_call_started",WorkflowEventType2[WorkflowEventType2.agent_call_progress=22]="agent_call_progress",WorkflowEventType2[WorkflowEventType2.agent_call_completed=23]="agent_call_completed",WorkflowEventType2[WorkflowEventType2.approval_requested=31]="approval_requested",WorkflowEventType2[WorkflowEventType2.approval_resolved=32]="approval_resolved",WorkflowEventType2[WorkflowEventType2.budget_checkpoint=41]="budget_checkpoint",WorkflowEventType2[WorkflowEventType2.signal_received=51]="signal_received",WorkflowEventType2[WorkflowEventType2.event_emitted=52]="event_emitted",WorkflowEventType2[WorkflowEventType2.artifact_created=53]="artifact_created"})(WorkflowEventType||(WorkflowEventType={}));var file_ai_stigmer_agentic_workflowexecution_v1_io=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvaW8ucHJvdG8SJ2FpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MSIsChNXb3JrZmxvd0V4ZWN1dGlvbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiIwoKV29ya2Zsb3dJZBIVCgV2YWx1ZRgBIAEoCUIGukgDyAEBIpIBChVXb3JrZmxvd0V4ZWN1dGlvbkxpc3QSEwoLdG90YWxfcGFnZXMYASABKAUSSwoHZW50cmllcxgCIAMoCzI6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbhIXCg9uZXh0X3BhZ2VfdG9rZW4YAyABKAki7QIKHUxpc3RXb3JrZmxvd0V4ZWN1dGlvbnNSZXF1ZXN0EhoKCXBhZ2Vfc2l6ZRgBIAEoBUIHukgEGgIoABISCgpwYWdlX3Rva2VuGAIgASgJEkYKBXBoYXNlGAMgASgOMjcuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvblBoYXNlEgwKBHRhZ3MYBCADKAkSUAoGZmlsdGVyGAUgASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvbkZpbHRlckNyaXRlcmlhEk8KCnNvcnRfZmllbGQYBiABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuRXhlY3V0aW9uU29ydEZpZWxkEhYKDnNvcnRfYXNjZW5kaW5nGAcgASgIEgsKA29yZxgIIAEoCSKxAgonTGlzdFdvcmtmbG93RXhlY3V0aW9uc0J5V29ya2Zsb3dSZXF1ZXN0EhsKC3dvcmtmbG93X2lkGAEgASgJQga6SAPIAQESGgoJcGFnZV9zaXplGAIgASgFQge6SAQaAigAEhIKCnBhZ2VfdG9rZW4YAyABKAkSUAoGZmlsdGVyGAQgASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvbkZpbHRlckNyaXRlcmlhEk8KCnNvcnRfZmllbGQYBSABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuRXhlY3V0aW9uU29ydEZpZWxkEhYKDnNvcnRfYXNjZW5kaW5nGAYgASgIIuYCCiJXb3JrZmxvd0V4ZWN1dGlvblVwZGF0ZVN0YXR1c0lucHV0Eh0KDGV4ZWN1dGlvbl9pZBgBIAEoCUIHukgEcgIQARJYCgZzdGF0dXMYAiABKAsyQC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb25TdGF0dXNCBrpIA8gBARJPCgZldmVudHMYCiADKAsyPy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb25FdmVudBIgChh1cGRhdGVfcGVuZGluZ19hcHByb3ZhbHMYCyABKAgSIwobdXBkYXRlX3BlbmRpbmdfZmlsZV9yZXZpZXdzGAwgASgIEi8KJ3BlbmRpbmdfdXBkYXRlX2NoaWxkX2FnZW50X2V4ZWN1dGlvbl9pZBgNIAEoCSK+AQobU3VibWl0V29ya2Zsb3dBcHByb3ZhbElucHV0Eh0KDGV4ZWN1dGlvbl9pZBgBIAEoCUIHukgEcgIQARIdCgx0b29sX2NhbGxfaWQYAiABKAlCB7pIBHICEAESUAoGYWN0aW9uGAMgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsQWN0aW9uQgq6SAeCAQQQASAAEg8KB2NvbW1lbnQYBCABKAkioQMKH1N1Ym1pdFdvcmtmbG93RmlsZURlY2lzaW9uSW5wdXQSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABEikKGGNoaWxkX2FnZW50X2V4ZWN1dGlvbl9pZBgCIAEoCUIHukgEcgIQARIeCg1jaGFuZ2Vfc2V0X2lkGAMgASgJQge6SARyAhABElIKBXNjb3BlGAQgASgOMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVEZWNpc2lvblNjb3BlQgq6SAeCAQQQASAAEhYKDmZpbGVfY2hhbmdlX2lkGAUgASgJElQKBmFjdGlvbhgGIAEoDjI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlRGVjaXNpb25BY3Rpb25CCrpIB4IBBBABIAASIAoPZXhwZWN0ZWRfZGlnZXN0GAcgASgJQge6SARyAhABEg4KBnJlYXNvbhgIIAEoCRIgChhhY2tub3dsZWRnZV91bnJldmlld2FibGUYCSABKAgixQEKH1N1Ym1pdFdvcmtmbG93VGFza0FwcHJvdmFsSW5wdXQSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABEhoKCXRhc2tfbmFtZRgCIAEoCUIHukgEcgIQARIYCgdvdXRjb21lGAMgASgJQge6SARyAhABEioKCWZvcm1fZGF0YRgEIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSEAoIcmV2aWV3ZXIYBSABKAkSDwoHY29tbWVudBgGIAEoCSJBCiFTdWJzY3JpYmVXb3JrZmxvd0V4ZWN1dGlvblJlcXVlc3QSHAoMZXhlY3V0aW9uX2lkGAEgASgJQga6SAPIAQEiQwocQ2FuY2VsV29ya2Zsb3dFeGVjdXRpb25JbnB1dBITCgJpZBgBIAEoCUIHukgEcgIQARIOCgZyZWFzb24YAiABKAkiRgofVGVybWluYXRlV29ya2Zsb3dFeGVjdXRpb25JbnB1dBITCgJpZBgBIAEoCUIHukgEcgIQARIOCgZyZWFzb24YAiABKAkiRAodUmVjb3ZlcldvcmtmbG93RXhlY3V0aW9uSW5wdXQSEwoCaWQYASABKAlCB7pIBHICEAESDgoGcmVhc29uGAIgASgJIkIKG1BhdXNlV29ya2Zsb3dFeGVjdXRpb25JbnB1dBITCgJpZBgBIAEoCUIHukgEcgIQARIOCgZyZWFzb24YAiABKAkiMwocUmVzdW1lV29ya2Zsb3dFeGVjdXRpb25JbnB1dBITCgJpZBgBIAEoCUIHukgEcgIQASKRAQoPU2VuZFNpZ25hbElucHV0Eh0KDGV4ZWN1dGlvbl9pZBgBIAEoCUIHukgEcgIQARIcCgtzaWduYWxfbmFtZRgCIAEoCUIHukgEcgIQARIoCgdwYXlsb2FkGAMgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBIXCg9pZGVtcG90ZW5jeV9rZXkYBCABKAkiwgEKEkdldEV2ZW50TG9nUmVxdWVzdBIdCgxleGVjdXRpb25faWQYASABKAlCB7pIBHICEAESFgoOYWZ0ZXJfc2VxdWVuY2UYAiABKAQSTwoLZXZlbnRfdHlwZXMYAyADKA4yOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFdmVudFR5cGUSEQoJdGFza19uYW1lGAQgASgJEhEKCXBhZ2Vfc2l6ZRgFIAEoBSKRAQoTR2V0RXZlbnRMb2dSZXNwb25zZRJPCgZldmVudHMYASADKAsyPy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb25FdmVudBIQCghoYXNfbW9yZRgCIAEoCBIXCg9sYXRlc3Rfc2VxdWVuY2UYAyABKAQioAEKFlN1YnNjcmliZUV2ZW50c1JlcXVlc3QSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABEhYKDmFmdGVyX3NlcXVlbmNlGAIgASgEEk8KC2V2ZW50X3R5cGVzGAMgAygOMjouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXZlbnRUeXBlIowDChdFeGVjdXRpb25GaWx0ZXJDcml0ZXJpYRJHCgZwaGFzZXMYASADKA4yNy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuRXhlY3V0aW9uUGhhc2USMQoNc3RhcnRlZF9hZnRlchgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASMgoOc3RhcnRlZF9iZWZvcmUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KDG1pbl9kdXJhdGlvbhgEIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhIvCgxtYXhfZHVyYXRpb24YBSABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb24SFwoPbWluX2Nvc3RfbWljcm9zGAYgASgDEhcKD21heF9jb3N0X21pY3JvcxgHIAEoAxIYChBmYWlsZWRfdGFza19uYW1lGAggASgJEhMKC2hhc19yZXRyaWVzGAkgASgIIpgBChpHZXRFeGVjdXRpb25TdW1tYXJ5UmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESTwoLdGltZV93aW5kb3cYAiABKA4yOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuU3VtbWFyeVRpbWVXaW5kb3cSEwoLd29ya2Zsb3dfaWQYAyABKAkiowQKEEV4ZWN1dGlvblN1bW1hcnkSFAoMYWN0aXZlX2NvdW50GAEgASgFEmAKDHBoYXNlX2NvdW50cxgCIAMoCzJKLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5FeGVjdXRpb25TdW1tYXJ5LlBoYXNlQ291bnRzRW50cnkSUAoKdG90YWxfY29zdBgDIAEoCzI8LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0Nvc3RTdW1tYXJ5Ei8KDGF2Z19kdXJhdGlvbhgEIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhJbChV0b3BfZmFpbGluZ193b3JrZmxvd3MYBSADKAsyPC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dGYWlsdXJlUmFuaxJYChBjb3N0X2J5X3dvcmtmbG93GAYgAygLMj4uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93Q29zdEJyZWFrZG93bhITCgt0b3RhbF9jb3VudBgHIAEoBRIUCgxzdWNjZXNzX3JhdGUYCCABKAEaMgoQUGhhc2VDb3VudHNFbnRyeRILCgNrZXkYASABKAUSDQoFdmFsdWUYAiABKAU6AjgBImYKE1dvcmtmbG93Q29zdFN1bW1hcnkSFgoOdG90YWxfY29zdF91c2QYASABKAESGgoSdG90YWxfaW5wdXRfdG9rZW5zGAIgASgDEhsKE3RvdGFsX291dHB1dF90b2tlbnMYAyABKAMiWgoTV29ya2Zsb3dGYWlsdXJlUmFuaxIVCg13b3JrZmxvd19zbHVnGAEgASgJEhUKDXdvcmtmbG93X25hbWUYAiABKAkSFQoNZmFpbHVyZV9jb3VudBgDIAEoBSJ2ChVXb3JrZmxvd0Nvc3RCcmVha2Rvd24SFQoNd29ya2Zsb3dfc2x1ZxgBIAEoCRIVCg13b3JrZmxvd19uYW1lGAIgASgJEhYKDnRvdGFsX2Nvc3RfdXNkGAMgASgBEhcKD2V4ZWN1dGlvbl9jb3VudBgEIAEoBSJjChtMaXN0UGVuZGluZ0FwcHJvdmFsc1JlcXVlc3QSFAoDb3JnGAEgASgJQge6SARyAhABEhoKCXBhZ2Vfc2l6ZRgCIAEoBUIHukgEGgIoABISCgpwYWdlX3Rva2VuGAMgASgJIoUCCg9QZW5kaW5nQXBwcm92YWwSFAoMZXhlY3V0aW9uX2lkGAEgASgJEhUKDXdvcmtmbG93X25hbWUYAiABKAkSEQoJdGFza19uYW1lGAMgASgJEhEKCXJlcXVlc3RlchgEIAEoCRIwCgxyZXF1ZXN0ZWRfYXQYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnRpbWVvdXRfYXQYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEiwKC2Zvcm1fc2NoZW1hGAcgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBIPCgd1aV9oaW50GAggASgJIo8BChRQZW5kaW5nQXBwcm92YWxzTGlzdBJJCgdlbnRyaWVzGAEgAygLMjguYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLlBlbmRpbmdBcHByb3ZhbBITCgt0b3RhbF9jb3VudBgCIAEoBRIXCg9uZXh0X3BhZ2VfdG9rZW4YAyABKAkqwgEKEkV4ZWN1dGlvblNvcnRGaWVsZBIkCiBFWEVDVVRJT05fU09SVF9GSUVMRF9VTlNQRUNJRklFRBAAEiMKH0VYRUNVVElPTl9TT1JUX0ZJRUxEX1NUQVJURURfQVQQARIhCh1FWEVDVVRJT05fU09SVF9GSUVMRF9EVVJBVElPThACEh0KGUVYRUNVVElPTl9TT1JUX0ZJRUxEX0NPU1QQAxIfChtFWEVDVVRJT05fU09SVF9GSUVMRF9TVEFUVVMQBCq/AQoRU3VtbWFyeVRpbWVXaW5kb3cSIwofU1VNTUFSWV9USU1FX1dJTkRPV19VTlNQRUNJRklFRBAAEiAKHFNVTU1BUllfVElNRV9XSU5ET1dfTEFTVF8yNEgQARIfChtTVU1NQVJZX1RJTUVfV0lORE9XX0xBU1RfN0QQAhIgChxTVU1NQVJZX1RJTUVfV0lORE9XX0xBU1RfMzBEEAMSIAocU1VNTUFSWV9USU1FX1dJTkRPV19BTExfVElNRRAEYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_workflowexecution_v1_api,file_ai_stigmer_agentic_workflowexecution_v1_enum,file_ai_stigmer_agentic_workflowexecution_v1_event,file_buf_validate_validate,file_google_protobuf_duration,file_google_protobuf_struct,file_google_protobuf_timestamp]);var WorkflowExecutionListSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,2);var GetEventLogResponseSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,17);var ExecutionSummarySchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,21),WorkflowCostSummarySchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,22),WorkflowFailureRankSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,23),WorkflowCostBreakdownSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,24);var PendingApprovalSchema2=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,26),PendingApprovalsListSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,27),ExecutionSortField;(function(ExecutionSortField2){ExecutionSortField2[ExecutionSortField2.UNSPECIFIED=0]="UNSPECIFIED",ExecutionSortField2[ExecutionSortField2.STARTED_AT=1]="STARTED_AT",ExecutionSortField2[ExecutionSortField2.DURATION=2]="DURATION",ExecutionSortField2[ExecutionSortField2.COST=3]="COST",ExecutionSortField2[ExecutionSortField2.STATUS=4]="STATUS"})(ExecutionSortField||(ExecutionSortField={}));var SummaryTimeWindow;(function(SummaryTimeWindow2){SummaryTimeWindow2[SummaryTimeWindow2.UNSPECIFIED=0]="UNSPECIFIED",SummaryTimeWindow2[SummaryTimeWindow2.LAST_24H=1]="LAST_24H",SummaryTimeWindow2[SummaryTimeWindow2.LAST_7D=2]="LAST_7D",SummaryTimeWindow2[SummaryTimeWindow2.LAST_30D=3]="LAST_30D",SummaryTimeWindow2[SummaryTimeWindow2.ALL_TIME=4]="ALL_TIME"})(SummaryTimeWindow||(SummaryTimeWindow={}));var file_ai_stigmer_agentic_workflowexecution_v1_command=fileDesc("CjVhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvY29tbWFuZC5wcm90bxInYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxMo0VCiJXb3JrZmxvd0V4ZWN1dGlvbkNvbW1hbmRDb250cm9sbGVyEoYBCgZjcmVhdGUSOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb24aOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb24iBNC4GAESwgEKBnVwZGF0ZRI6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbho6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiJAwrgYPAgCEDQiC21ldGFkYXRhLmlkKil1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIHdvcmtmbG93IGV4ZWN1dGlvbhLhAQoMdXBkYXRlU3RhdHVzEksuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uVXBkYXRlU3RhdHVzSW5wdXQaOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb24iSMK4GEQIAhA0IgxleGVjdXRpb25faWQqMHVuYXV0aG9yaXplZCB0byB1cGRhdGUgd29ya2Zsb3cgZXhlY3V0aW9uIHN0YXR1cxLiAQoOc3VibWl0QXBwcm92YWwSRC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuU3VibWl0V29ya2Zsb3dBcHByb3ZhbElucHV0GjouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uIk7CuBhKCAIQNCIMZXhlY3V0aW9uX2lkKjZ1bmF1dGhvcml6ZWQgdG8gc3VibWl0IGFwcHJvdmFsIGZvciB3b3JrZmxvdyBleGVjdXRpb24S7wEKEnN1Ym1pdEZpbGVEZWNpc2lvbhJILmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5TdWJtaXRXb3JrZmxvd0ZpbGVEZWNpc2lvbklucHV0GjouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uIlPCuBhPCAIQNCIMZXhlY3V0aW9uX2lkKjt1bmF1dGhvcml6ZWQgdG8gc3VibWl0IGZpbGUgZGVjaXNpb24gZm9yIHdvcmtmbG93IGV4ZWN1dGlvbhLpAQoac3VibWl0V29ya2Zsb3dUYXNrQXBwcm92YWwSSC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuU3VibWl0V29ya2Zsb3dUYXNrQXBwcm92YWxJbnB1dBo6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiJFwrgYQQgCEDQiDGV4ZWN1dGlvbl9pZCotdW5hdXRob3JpemVkIHRvIHN1Ym1pdCB3b3JrZmxvdyB0YXNrIGFwcHJvdmFsEq8BCgZkZWxldGUSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBo6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiI6wrgYNggCEDQiBXZhbHVlKil1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIHdvcmtmbG93IGV4ZWN1dGlvbhLNAQoKc2VuZFNpZ25hbBI4LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5TZW5kU2lnbmFsSW5wdXQaOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb24iScK4GEUIAhA0IgxleGVjdXRpb25faWQqMXVuYXV0aG9yaXplZCB0byBzZW5kIHNpZ25hbCB0byB3b3JrZmxvdyBleGVjdXRpb24SxAEKBmNhbmNlbBJFLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5DYW5jZWxXb3JrZmxvd0V4ZWN1dGlvbklucHV0GjouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uIjfCuBgzCAIQNCICaWQqKXVuYXV0aG9yaXplZCB0byBjYW5jZWwgd29ya2Zsb3cgZXhlY3V0aW9uEs0BCgl0ZXJtaW5hdGUSSC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuVGVybWluYXRlV29ya2Zsb3dFeGVjdXRpb25JbnB1dBo6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiI6wrgYNggCEDQiAmlkKix1bmF1dGhvcml6ZWQgdG8gdGVybWluYXRlIHdvcmtmbG93IGV4ZWN1dGlvbhLHAQoHcmVjb3ZlchJGLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5SZWNvdmVyV29ya2Zsb3dFeGVjdXRpb25JbnB1dBo6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiI4wrgYNAgCEDQiAmlkKip1bmF1dGhvcml6ZWQgdG8gcmVjb3ZlciB3b3JrZmxvdyBleGVjdXRpb24SwQEKBXBhdXNlEkQuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLlBhdXNlV29ya2Zsb3dFeGVjdXRpb25JbnB1dBo6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiI2wrgYMggCEDQiAmlkKih1bmF1dGhvcml6ZWQgdG8gcGF1c2Ugd29ya2Zsb3cgZXhlY3V0aW9uEsQBCgZyZXN1bWUSRS5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuUmVzdW1lV29ya2Zsb3dFeGVjdXRpb25JbnB1dBo6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiI3wrgYMwgCEDQiAmlkKil1bmF1dGhvcml6ZWQgdG8gcmVzdW1lIHdvcmtmbG93IGV4ZWN1dGlvbhoEoP8rNGIGcHJvdG8z",[file_ai_stigmer_agentic_workflowexecution_v1_api,file_ai_stigmer_agentic_workflowexecution_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),WorkflowExecutionCommandController=serviceDesc(file_ai_stigmer_agentic_workflowexecution_v1_command,0);var file_ai_stigmer_agentic_workflowexecution_v1_query=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvcXVlcnkucHJvdG8SJ2FpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MTKDDAogV29ya2Zsb3dFeGVjdXRpb25RdWVyeUNvbnRyb2xsZXISuAEKA2dldBI8LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbklkGjouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uIjfCuBgzCAEQNCIFdmFsdWUqJnVuYXV0aG9yaXplZCB0byBnZXQgd29ya2Zsb3cgZXhlY3V0aW9uEpQBCgRsaXN0EkYuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkxpc3RXb3JrZmxvd0V4ZWN1dGlvbnNSZXF1ZXN0Gj4uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uTGlzdCIE0LgYARKoAQoObGlzdEJ5V29ya2Zsb3cSUC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuTGlzdFdvcmtmbG93RXhlY3V0aW9uc0J5V29ya2Zsb3dSZXF1ZXN0Gj4uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uTGlzdCIE0LgYARLcAQoJc3Vic2NyaWJlEkouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLlN1YnNjcmliZVdvcmtmbG93RXhlY3V0aW9uUmVxdWVzdBo6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiJFwrgYQQgBEDQiDGV4ZWN1dGlvbl9pZCotdW5hdXRob3JpemVkIHRvIGdldCB3b3JrZmxvdyBleGVjdXRpb24gc3RyZWFtMAES0gEKC2dldEV2ZW50TG9nEjsuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkdldEV2ZW50TG9nUmVxdWVzdBo8LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5HZXRFdmVudExvZ1Jlc3BvbnNlIkjCuBhECAEQNCIMZXhlY3V0aW9uX2lkKjB1bmF1dGhvcml6ZWQgdG8gZ2V0IHdvcmtmbG93IGV4ZWN1dGlvbiBldmVudCBsb2cS5QEKD3N1YnNjcmliZUV2ZW50cxI/LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5TdWJzY3JpYmVFdmVudHNSZXF1ZXN0Gj8uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uRXZlbnQiTsK4GEoIARA0IgxleGVjdXRpb25faWQqNnVuYXV0aG9yaXplZCB0byBzdWJzY3JpYmUgdG8gd29ya2Zsb3cgZXhlY3V0aW9uIGV2ZW50czABEpsBChNnZXRFeGVjdXRpb25TdW1tYXJ5EkMuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkdldEV4ZWN1dGlvblN1bW1hcnlSZXF1ZXN0GjkuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvblN1bW1hcnkiBNC4GAESoQEKFGxpc3RQZW5kaW5nQXBwcm92YWxzEkQuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkxpc3RQZW5kaW5nQXBwcm92YWxzUmVxdWVzdBo9LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5QZW5kaW5nQXBwcm92YWxzTGlzdCIE0LgYARoEoP8rNGIGcHJvdG8z",[file_ai_stigmer_agentic_workflowexecution_v1_api,file_ai_stigmer_agentic_workflowexecution_v1_event,file_ai_stigmer_agentic_workflowexecution_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),WorkflowExecutionQueryController=serviceDesc(file_ai_stigmer_agentic_workflowexecution_v1_query,0);var TARGET_EXECUTION_KEY="targetResource",CHILD_EXECUTION_ID_KEY="childAgentExecutionId";async function submitApproval2(deps,input,identity2){let reqCtx=new RequestContext(WorkflowExecutionCommandController.method.submitApproval.input,input,identity2,ApiResourceKind.workflow_execution);await newPipeline("workflow-execution-submit-approval",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.submitApproval,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"LoadExisting",async execute(ctx){if(ctx.input.executionId==="")throw invalidArgumentError("execution_id is required");let execution2;try{execution2=await deps.store.getResource(ApiResourceKind.workflow_execution,ctx.input.executionId,WorkflowExecutionSchema)}catch{throw notFoundError("workflow_execution",ctx.input.executionId)}ctx.set(TARGET_EXECUTION_KEY,execution2)}}).addStep({name:"ValidateApproval",execute(ctx){let execution2=ctx.get(TARGET_EXECUTION_KEY),executionId=execution2.metadata?.id??"",requestedToolCallId=ctx.input.toolCallId,pendingApprovals=execution2.status?.pendingApprovals??[];if(pendingApprovals.length===0)throw failedPreconditionError(`workflow execution ${executionId} has no pending approvals`);let matched=pendingApprovals.find(entry=>entry.approval?.toolCallId===requestedToolCallId);if(matched===void 0)throw invalidArgumentError(`tool_call_id ${requestedToolCallId} not found in pending_approvals for workflow execution ${executionId}`);let childExecutionId=matched.childAgentExecutionId;if(childExecutionId==="")throw failedPreconditionError(`workflow execution ${executionId} has no child agent execution ID for tool_call ${requestedToolCallId} - approval must be submitted directly to the agent`);ctx.set(CHILD_EXECUTION_ID_KEY,childExecutionId)}}).addStep({name:"ForwardToChild",async execute(ctx){let childExecutionId=ctx.get(CHILD_EXECUTION_ID_KEY);deps.logger.info("Forwarding approval to child AgentExecution",{childExecutionId,toolCallId:ctx.input.toolCallId});try{await deps.approvalForwarder().submitApproval(create2(SubmitApprovalInputSchema,{agentExecutionId:childExecutionId,toolCallId:ctx.input.toolCallId,action:ctx.input.action,comment:ctx.input.comment}))}catch(error2){let embedded=error2 instanceof ConnectError?goGrpcErrorText(error2):error2 instanceof Error?error2.message:String(error2);throw unavailableError(`failed to forward approval to child agent: ${embedded}`)}}}).addStep({name:"BuildResponse",execute(ctx){let execution2=ctx.get(TARGET_EXECUTION_KEY);deps.logger.info("AUDIT: Workflow approval decision submitted and forwarded to child agent",{workflowExecutionId:execution2.metadata?.id??"",org:execution2.metadata?.org??"",toolCallId:ctx.input.toolCallId,childExecutionId:ctx.get(CHILD_EXECUTION_ID_KEY)})}}).build().execute(reqCtx);let execution=reqCtx.get(TARGET_EXECUTION_KEY);if(execution===void 0)throw internalError(new Error("execution not found in context"),"execution not found in context");return execution}var TARGET_EXECUTION_KEY2="targetResource";async function submitFileDecision2(deps,input,identity2){let reqCtx=new RequestContext(WorkflowExecutionCommandController.method.submitFileDecision.input,input,identity2,ApiResourceKind.workflow_execution);await newPipeline("workflow-execution-submit-file-decision",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.submitFileDecision,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"LoadExisting",async execute(ctx){if(ctx.input.executionId==="")throw invalidArgumentError("execution_id is required");let execution2;try{execution2=await deps.store.getResource(ApiResourceKind.workflow_execution,ctx.input.executionId,WorkflowExecutionSchema)}catch{throw notFoundError("workflow_execution",ctx.input.executionId)}ctx.set(TARGET_EXECUTION_KEY2,execution2)}}).addStep({name:"ValidateFileDecision",execute(ctx){let execution2=ctx.get(TARGET_EXECUTION_KEY2),executionId=execution2.metadata?.id??"",childId=ctx.input.childAgentExecutionId,changeSetId=ctx.input.changeSetId,pendingFileReviews=execution2.status?.pendingFileReviews??[];if(pendingFileReviews.length===0)throw failedPreconditionError(`workflow execution ${executionId} has no pending file reviews`);if(!pendingFileReviews.some(review=>review.childAgentExecutionId===childId&&review.changeSetId.includes(changeSetId)))throw failedPreconditionError(`workflow execution ${executionId} has no pending file review for child ${childId} change set ${changeSetId}`)}}).addStep({name:"ForwardToChild",async execute(ctx){deps.logger.info("Forwarding file decision to child AgentExecution",{childExecutionId:ctx.input.childAgentExecutionId,changeSetId:ctx.input.changeSetId});try{await deps.fileDecisionForwarder().submitFileDecision(create2(SubmitFileDecisionInputSchema,{agentExecutionId:ctx.input.childAgentExecutionId,changeSetId:ctx.input.changeSetId,scope:ctx.input.scope,fileChangeId:ctx.input.fileChangeId,action:ctx.input.action,expectedDigest:ctx.input.expectedDigest,reason:ctx.input.reason,acknowledgeUnreviewable:ctx.input.acknowledgeUnreviewable}))}catch(error2){throw error2 instanceof ConnectError?new ConnectError(error2.rawMessage,error2.code):error2}}}).addStep({name:"BuildResponse",execute(ctx){let execution2=ctx.get(TARGET_EXECUTION_KEY2);deps.logger.info("AUDIT: Workflow file decision submitted and forwarded to child agent",{workflowExecutionId:execution2.metadata?.id??"",org:execution2.metadata?.org??"",childExecutionId:ctx.input.childAgentExecutionId,changeSetId:ctx.input.changeSetId})}}).build().execute(reqCtx);let execution=reqCtx.get(TARGET_EXECUTION_KEY2);if(execution===void 0)throw internalError(new Error("execution not found in context"),"execution not found in context");return execution}var LOADED_EXECUTION_KEY2="loadedExecution";async function submitWorkflowTaskApproval(deps,input,identity2){let reqCtx=new RequestContext(WorkflowExecutionCommandController.method.submitWorkflowTaskApproval.input,input,identity2,ApiResourceKind.workflow_execution);await newPipeline("workflowexecution-submit-task-approval",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.submitWorkflowTaskApproval,deps.authorizer)).addStep({name:"ValidateTaskApprovalInput",execute(ctx){if(ctx.input.executionId==="")throw invalidArgumentError("execution_id is required");if(ctx.input.taskName==="")throw invalidArgumentError("task_name is required");if(ctx.input.outcome==="")throw invalidArgumentError("outcome is required")}}).addStep({name:"LoadExecutionForApproval",async execute(ctx){let execution2;try{execution2=await deps.store.getResource(ApiResourceKind.workflow_execution,ctx.input.executionId,WorkflowExecutionSchema)}catch{throw notFoundError("WorkflowExecution",ctx.input.executionId)}ctx.set(LOADED_EXECUTION_KEY2,execution2)}}).addStep({name:"ValidateApprovalSignalable",execute(ctx){let phase=ctx.get(LOADED_EXECUTION_KEY2).status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;if(phase!==ExecutionPhase2.EXECUTION_PENDING&&phase!==ExecutionPhase2.EXECUTION_IN_PROGRESS)throw failedPreconditionError(`cannot submit task approval: execution is in ${ExecutionPhase2[phase]} phase`)}}).addStep({name:"ValidateHumanInputTask",execute(ctx){let execution2=ctx.get(LOADED_EXECUTION_KEY2),taskName=ctx.input.taskName,task=(execution2.status?.tasks??[]).find(candidate=>candidate.taskName===taskName);if(task===void 0)throw invalidArgumentError(`task '${taskName}' not found in execution status`);if(task.taskType!==WorkflowTaskType.WORKFLOW_TASK_APPROVAL)throw invalidArgumentError(`task '${taskName}' is not a human_input task (type: ${WorkflowTaskType[task.taskType]})`)}}).addStep({name:"SendTaskApprovalSignal",async execute(ctx){let execution2=ctx.get(LOADED_EXECUTION_KEY2),executionId=ctx.input.executionId,humanInputSignalName=HUMAN_INPUT_SIGNAL_PREFIX+ctx.input.taskName,signalPayload={outcome:ctx.input.outcome,reviewer:ctx.input.reviewer,responded_at:new Date().toISOString().replace(/\.\d{3}Z$/,"Z")};ctx.input.formData!==void 0&&(signalPayload.form_data=ctx.input.formData),ctx.input.comment!==""&&(signalPayload.comment=ctx.input.comment);let engineState=deps.engineState();if(!engineState.connected)throw unavailableError(`workflow creator not configured for task '${ctx.input.taskName}'`);try{await engineState.engine.signalWithStart({executionId,workflowInstanceId:execution2.spec?.workflowInstanceId??"",workflowId:execution2.status?.temporalWorkflowId??"",orgId:execution2.metadata?.org??"",recoveryMode:!1,executionTarget:execution2.spec?.executionTarget??0},RELAY_SIGNAL_CHANNEL_NAME,{signalName:humanInputSignalName,payload:signalPayload})}catch(error2){throw unavailableError(`failed to send approval signal for task '${ctx.input.taskName}': ${error2 instanceof Error?error2.message:String(error2)}`)}deps.logger.info("AUDIT: Workflow task approval submitted via relaySignal",{executionId,taskName:ctx.input.taskName,outcome:ctx.input.outcome,signalName:humanInputSignalName})}}).build().execute(reqCtx);let execution=reqCtx.get(LOADED_EXECUTION_KEY2);if(execution===void 0)throw internalError(new Error("execution not found in context after pipeline"),"execution not found in context after pipeline");return execution}function newValidateWorkflowOrInstanceStep(){return{name:"ValidateWorkflowOrInstance",execute(ctx){let spec=ctx.input.spec;if((spec?.workflowInstanceId??"")===""&&(spec?.workflowId??"")==="")throw invalidArgumentError("either workflow_id or workflow_instance_id must be provided")}}}function newCreateDefaultInstanceIfNeededStep2(deps){return{name:"CreateDefaultInstanceIfNeeded",async execute(ctx){let input=ctx.input;if((input.spec?.workflowInstanceId??"")!=="")return;let workflowId=input.spec?.workflowId??"",execution=ctx.newState,workflow;try{workflow=await deps.store.getResource(ApiResourceKind.workflow,workflowId,WorkflowSchema)}catch{throw notFoundError("Workflow",workflowId)}let defaultInstanceId=workflow.status?.defaultInstanceId??"";if(defaultInstanceId!==""){setInstanceId(execution,defaultInstanceId);return}let slug=defaultWorkflowInstanceSlug(workflow.metadata?.slug??""),existingInstance;try{existingInstance=await findInstanceBySlug(deps,slug)}catch(error2){throw internalError(error2,"failed to look up existing default instance")}if(existingInstance!==void 0){let existingId=existingInstance.metadata?.id??"";deps.logger.info("Found existing default instance, updating workflow status",{instanceId:existingId,workflowId}),await backfillDefaultInstanceId(deps,workflow,workflowId,existingId,"failed to update workflow with existing default instance"),setInstanceId(execution,existingId);return}deps.logger.info("Default instance not found, creating new one",{workflowId});let instanceRequest=buildDefaultWorkflowInstanceRequest(workflow.metadata),createdInstance;try{createdInstance=await deps.workflowInstanceCreator().createAsCaller(instanceRequest,ctx.callerIdentity)}catch(error2){throw error2 instanceof ConnectError?goWrappedStatusError("failed to create default workflow instance",error2):internalError(error2,"failed to create default workflow instance")}let createdId=createdInstance.metadata?.id??"";await backfillDefaultInstanceId(deps,workflow,workflowId,createdId,"failed to update workflow with default instance"),setInstanceId(execution,createdId),deps.logger.info("Successfully created and registered default instance",{instanceId:createdId,workflowId})}}}function setInstanceId(execution,instanceId){execution.spec!==void 0&&(execution.spec.workflowInstanceId=instanceId)}async function backfillDefaultInstanceId(deps,workflow,workflowId,instanceId,failureMessage){let status=workflow.status??create2(WorkflowStatusSchema);workflow.status=status,status.defaultInstanceId=instanceId;try{await deps.store.saveResource(ApiResourceKind.workflow,workflowId,WorkflowSchema,workflow)}catch(error2){throw internalError(error2,failureMessage)}await notifyDefaultInstanceLinked(deps.authorizationLifecycle,{instanceKind:ApiResourceKind.workflow_instance,instanceId,blueprintKind:ApiResourceKind.workflow,blueprintId:workflowId})}async function findInstanceBySlug(deps,slug){let rows=await deps.store.listResources(ApiResourceKind.workflow_instance);for(let data of rows){let instance;try{instance=fromBinary2(WorkflowInstanceSchema,data)}catch{deps.logger.warn("Failed to unmarshal workflow instance during slug lookup");continue}if(instance.metadata?.slug===slug)return instance}}function newSetInitialPhaseStep2(){return{name:"SetInitialPhase",execute(ctx){let execution=ctx.newState;execution.status===void 0&&(execution.status=create2(WorkflowExecutionStatusSchema)),execution.status.phase=ExecutionPhase2.EXECUTION_PENDING}}}function newStartWorkflowStep2(deps){return{name:"StartWorkflow",async execute(ctx){let execution=ctx.newState,executionId=execution.metadata?.id??"",engineState=deps.engineState(),startError;if(!engineState.connected)startError=new Error("workflow engine disconnected after the create gate");else try{await engineState.engine.startInvokeWorkflow({executionId,workflowInstanceId:execution.spec?.workflowInstanceId??"",workflowId:execution.spec?.workflowId??"",orgId:execution.metadata?.org??"",recoveryMode:!1,executionTarget:execution.spec?.executionTarget??0})}catch(error2){startError=error2 instanceof Error?error2:new Error(String(error2))}if(startError===void 0){deps.logger.info("Temporal workflow started successfully",{executionId});return}deps.logger.error("Failed to start Temporal workflow - marking execution as FAILED",{executionId,error:startError.message}),execution.status===void 0&&(execution.status=create2(WorkflowExecutionStatusSchema)),execution.status.phase=ExecutionPhase2.EXECUTION_FAILED,execution.status.error=`Failed to start Temporal workflow: ${goErrorText(startError)}`;try{await deps.store.saveResource(ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema,execution)}catch(persistError){throw internalError(persistError,"failed to start workflow and failed to update status")}throw internalError(startError,"failed to start workflow")}}}function goErrorText(error2){return error2.message}function newCreateExecutionContextStep2(deps){return{name:"CreateExecutionContext",async execute(ctx){let execution=ctx.newState,executionId=execution.metadata?.id??"",executionOrg=execution.metadata?.org??"",workflowInstanceId=execution.spec?.workflowInstanceId??"";if(workflowInstanceId==="")throw internalError(new Error("workflow_instance_id not resolved from context or execution spec"),"workflow_instance_id not resolved from context or execution spec");let instance;try{instance=await deps.workflowInstanceLoader().get(workflowInstanceId)}catch(error2){throw error2 instanceof ConnectError?goWrappedStatusError(`load workflow instance ${workflowInstanceId}`,error2):internalError(error2,`load workflow instance ${workflowInstanceId}`)}let workflowId=instance.spec?.workflowId??"",workflow;try{workflow=await deps.store.getResource(ApiResourceKind.workflow,workflowId,WorkflowSchema)}catch(error2){throw internalError(error2,`load workflow ${workflowId}`)}let environments=await resolveEnvironments2(deps,instance.spec?.environmentRefs??[]),merged=mergeEnvironmentLayers(environments,execution.spec?.runtimeEnv??{}),workflowEnvDecls=workflow.spec?.env??{},{filtered,excludedKeys}=filterByDeclaredKeys(merged,workflowEnvDecls);excludedKeys.length>0&&deps.logger.warn("Filtered env vars not declared in workflow env",{executionId,workflowId,excludedKeys});let missingRequired=validateRequiredKeys(filtered,workflowEnvDecls);missingRequired.length>0&&deps.logger.warn("Required env vars missing after environment merge \u2014 execution may fail",{executionId,workflowId,missingRequired});let executionContext=create2(ExecutionContextSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"ExecutionContext",metadata:{name:`exec-ctx-${executionId}`,org:executionOrg},spec:{executionId,data:Object.fromEntries(filtered)}});try{let created=await deps.executionContextCreator().create(executionContext);deps.logger.info("Successfully created execution context",{executionContextId:created.metadata?.id??"",executionId,dataEntries:filtered.size})}catch(error2){throw error2 instanceof ConnectError?goWrappedStatusError(`create execution context for ${executionId}`,error2):internalError(error2,`create execution context for ${executionId}`)}execution.spec!==void 0&&Object.keys(execution.spec.runtimeEnv).length>0&&(execution.spec.runtimeEnv={})}}}async function resolveEnvironments2(deps,refs){if(refs.length===0)return[];let environments=[];for(let ref of refs)try{environments.push(await deps.environmentResolution.resolveByReference(ref))}catch(error2){let prefix=`resolve environment ref (org=${ref.org}, slug=${ref.slug})`;throw error2 instanceof ConnectError?goWrappedStatusError(prefix,error2):internalError(error2,prefix)}return environments}var EngineWorkflowNotFoundError2=class extends Error{constructor(workflowId){super(`workflow not found: ${workflowId}`),this.name="EngineWorkflowNotFoundError"}},ENGINE_DISCONNECTED2=Object.freeze({connected:!1});function newEnsureEngineAvailableStep2(engineState){return{name:"EnsureEngineAvailable",execute(_ctx){if(!engineState().connected)throw unavailableError(ENGINE_UNAVAILABLE_MESSAGE2)}}}var RFC3339_PATTERN2=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;function parseRfc3339Ms2(iso){return iso===""||!RFC3339_PATTERN2.test(iso)?Number.NaN:Date.parse(iso)}function matchesFilterCriteria(execution,filter){return filter===void 0||matchesFilter(execution,filter)}function matchesFilter(execution,f5){let status=execution.status;if(f5.phases.length>0){let phase=status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;if(!f5.phases.includes(phase))return!1}if(f5.startedAfter!==void 0){let started=parseRfc3339Ms2(status?.startedAt??"");if(Number.isNaN(started)||started<timestampMs(f5.startedAfter))return!1}if(f5.startedBefore!==void 0){let started=parseRfc3339Ms2(status?.startedAt??"");if(Number.isNaN(started)||started>timestampMs(f5.startedBefore))return!1}if(f5.minDuration!==void 0||f5.maxDuration!==void 0){let started=parseRfc3339Ms2(status?.startedAt??""),completed=parseRfc3339Ms2(status?.completedAt??"");if(Number.isNaN(started)||Number.isNaN(completed))return!1;let durationMs=completed-started;if(f5.minDuration!==void 0&&durationMs<durationToMs(f5.minDuration)||f5.maxDuration!==void 0&&durationMs>durationToMs(f5.maxDuration))return!1}let costMicros=status?.totalCostMicros??0n;return!(f5.minCostMicros>0n&&costMicros<f5.minCostMicros||f5.maxCostMicros>0n&&costMicros>f5.maxCostMicros||f5.failedTaskName!==""&&!(status?.tasks??[]).some(task=>task.status===WorkflowTaskStatus.WORKFLOW_TASK_FAILED&&task.taskName===f5.failedTaskName)||f5.hasRetries&&!(status?.tasks??[]).some(task=>extractRetryCountFromMetadata(task)>0))}function extractRetryCountFromMetadata(task){let fields2=task.metadata;if(fields2===void 0)return 0;let retryField=fields2.retry_count??fields2.retryCount;return typeof retryField!="number"||retryField<=0?0:Math.trunc(retryField)}function durationToMs(duration){return Number(duration.seconds)*1e3+duration.nanos/1e6}function applySortField(executions,sortField,ascending){executions.length<=1||executions.sort((a5,b7)=>lessBySortField(a5,b7,sortField)?ascending?-1:1:lessBySortField(b7,a5,sortField)?ascending?1:-1:0)}function lessBySortField(a5,b7,field3){switch(field3){case ExecutionSortField.DURATION:return executionDurationMs(a5)<executionDurationMs(b7);case ExecutionSortField.COST:return(a5.status?.totalCostMicros??0n)<(b7.status?.totalCostMicros??0n);case ExecutionSortField.STATUS:return(a5.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED)<(b7.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED);case ExecutionSortField.UNSPECIFIED:case ExecutionSortField.STARTED_AT:{let ta=orNegativeInfinity(parseRfc3339Ms2(a5.status?.startedAt??"")),tb=orNegativeInfinity(parseRfc3339Ms2(b7.status?.startedAt??""));return ta<tb}default:{let exhaustive=field3;throw new Error(`unhandled sort field: ${String(exhaustive)}`)}}}function executionDurationMs(execution){let started=parseRfc3339Ms2(execution.status?.startedAt??""),completed=parseRfc3339Ms2(execution.status?.completedAt??"");return Number.isNaN(started)||Number.isNaN(completed)?-1:completed-started}function orNegativeInfinity(value){return Number.isNaN(value)?Number.NEGATIVE_INFINITY:value}function matchesLegacyPhase(execution,phase){return phase===ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED||(execution.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED)===phase}var REASON_KEY2="reason",ALREADY_IN_TARGET_STATE_KEY2="alreadyInTargetState";function loadedExecution2(ctx){return ctx.get(LOADED_EXECUTION_KEY)}function newLoadExecutionByIdStep2(deps){return{name:"LoadExecutionById",async execute(ctx){let executionId=ctx.input.id;if(executionId==="")throw invalidArgumentError("execution id is required");let execution;try{execution=await deps.store.getResource(ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema)}catch{throw notFoundError("workflow_execution",executionId)}ctx.set(LOADED_EXECUTION_KEY,execution)}}}function newValidatePhaseStep2(name,idempotentPhase,allowedPhases,refusalMessage){return{name,execute(ctx){let phase=loadedExecution2(ctx).status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;if(phase===idempotentPhase){ctx.set(ALREADY_IN_TARGET_STATE_KEY2,!0);return}if(!allowedPhases.includes(phase))throw failedPreconditionError(refusalMessage(ExecutionPhase2[phase]))}}}function newEngineLifecycleStep2(deps,name,failureMessage,operation2){return{name,async execute(ctx){if(ctx.get(ALREADY_IN_TARGET_STATE_KEY2)===!0)return;let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError(TEMPORAL_UNAVAILABLE_MESSAGE);let execution=loadedExecution2(ctx);try{await operation2(engineState.engine,execution,ctx)}catch(error2){if(error2 instanceof EngineWorkflowNotFoundError2){deps.logger.warn("Temporal workflow not found, may have already completed",{executionId:execution.metadata?.id??""});return}throw internalError(error2,failureMessage)}}}}function applyLifecyclePhaseTransition2(execution,targetPhase,setError,clearError,reason){execution.status??=create2(WorkflowExecutionStatusSchema);let status=execution.status;status.phase=targetPhase,(targetPhase===ExecutionPhase2.EXECUTION_CANCELLED||targetPhase===ExecutionPhase2.EXECUTION_TERMINATED)&&(status.completedAt=new Date().toISOString().replace(/\.\d{3}Z$/,"Z")),targetPhase===ExecutionPhase2.EXECUTION_IN_PROGRESS&&(status.completedAt=""),setError&&(status.error=reason!==""?`Terminated: ${reason}`:"Terminated by user"),clearError&&(status.error="")}function newUpdateExecutionPhaseAndPersistStep2(deps,targetPhase,setError,clearError){return{name:"UpdateExecutionPhaseAndPersist",async execute(ctx){if(ctx.get(ALREADY_IN_TARGET_STATE_KEY2)===!0)return;let executionId=loadedExecution2(ctx).metadata?.id??"",reasonValue=ctx.get(REASON_KEY2),reason=typeof reasonValue=="string"?reasonValue:"",updated,previousPhase=ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;try{updated=await deps.store.updateResource(ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema,loaded=>{previousPhase=loaded.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED,applyLifecyclePhaseTransition2(loaded,targetPhase,setError,clearError,reason)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("workflow_execution",executionId):internalError(error2,"failed to persist execution")}ctx.set(LOADED_EXECUTION_KEY,updated),deps.sandboxTerminalObserver(executionId,previousPhase,updated.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED)}}}function newLifecycleBroadcastStep2(deps){return{name:"LifecycleBroadcast",execute(ctx){ctx.get(ALREADY_IN_TARGET_STATE_KEY2)!==!0&&deps.broker.broadcast(loadedExecution2(ctx))}}}function newTerminateExistingWorkflowStep(deps){return{name:"TerminateExistingWorkflow",async execute(ctx){if(ctx.get(ALREADY_IN_TARGET_STATE_KEY2)===!0)return;let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError(TEMPORAL_UNAVAILABLE_MESSAGE);let executionId=loadedExecution2(ctx).metadata?.id??"",targets=[[orchestratorWorkflowId(executionId),"orchestrator workflow"],[childWorkflowId(executionId),"child TS workflow"]];for(let[workflowId,description]of targets)try{await engineState.engine.terminateWorkflow(workflowId,"Recovery: terminating before fresh workflow start"),deps.logger.info(`Successfully terminated ${description}`,{executionId,workflowId})}catch(error2){if(error2 instanceof EngineWorkflowNotFoundError2){deps.logger.info(`${description} already completed/terminated (NOT_FOUND). Proceeding.`,{executionId,workflowId});continue}throw internalError(error2,`failed to terminate ${description} during recovery`)}}}}function newRecreateExecutionContextStep2(deps){return{name:"RecreateExecutionContext",async execute(ctx){if(ctx.get(ALREADY_IN_TARGET_STATE_KEY2)===!0)return;let builder2=deps.executionContextBuilder,execution=loadedExecution2(ctx),executionId=execution.metadata?.id??"",executionOrg=execution.metadata?.org??"",workflowInstanceId=execution.spec?.workflowInstanceId??"";await deleteStaleExecutionContext2(deps,executionId);let instance;try{instance=await builder2.workflowInstanceLoader().get(workflowInstanceId)}catch(error2){deps.logger.warn("WorkflowInstance not found during recovery EC recreation. Proceeding without environment \u2014 workflow tasks may fail if they need env vars.",{executionId,workflowInstanceId,error:error2 instanceof Error?error2.message:String(error2)});return}let workflowId=instance.spec?.workflowId??"",workflow;try{workflow=await builder2.store.getResource(ApiResourceKind.workflow,workflowId,WorkflowSchema)}catch(error2){deps.logger.warn("Workflow not found during recovery EC recreation. Proceeding without environment.",{executionId,workflowId,error:error2 instanceof Error?error2.message:String(error2)});return}let environments=[];for(let ref of instance.spec?.environmentRefs??[])try{environments.push(await builder2.environmentResolution.resolveByReference(ref))}catch(error2){deps.logger.warn("Failed to resolve environments during recovery. Proceeding without environment.",{executionId,error:error2 instanceof Error?error2.message:String(error2)});return}let merged=mergeEnvironmentLayers(environments,{}),{filtered}=filterByDeclaredKeys(merged,workflow.spec?.env??{});if(filtered.size===0){deps.logger.info("No environment variables to recreate for recovered execution",{executionId});return}let executionContext=create2(ExecutionContextSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"ExecutionContext",metadata:{name:`exec-ctx-${executionId}`,org:executionOrg},spec:{executionId,data:Object.fromEntries(filtered)}});try{let created=await builder2.executionContextCreator().create(executionContext);deps.logger.info("Recreated ExecutionContext for recovered execution",{executionContextId:created.metadata?.id??"",executionId,dataEntries:filtered.size})}catch(error2){let prefix=`recreate execution context for recovered execution ${executionId}`;throw error2 instanceof ConnectError?goWrappedStatusError(prefix,error2):internalError(error2,prefix)}}}}async function deleteStaleExecutionContext2(deps,executionId){let staleId="";try{staleId=(await deps.executionContextBuilder.store.findByField(ApiResourceKind.execution_context,"spec.executionId",executionId,ExecutionContextSchema)).metadata?.id??""}catch{return}if(staleId!==""){deps.logger.info("Deleting stale ExecutionContext before recreation",{executionContextId:staleId,executionId});try{await deps.executionContextBuilder.store.deleteResource(ApiResourceKind.execution_context,staleId)}catch(error2){deps.logger.warn("Failed to delete stale ExecutionContext (proceeding anyway)",{executionContextId:staleId,error:error2 instanceof Error?error2.message:String(error2)})}}}function newStartFreshWorkflowStep2(deps){return{name:"StartFreshWorkflow",async execute(ctx){if(ctx.get(ALREADY_IN_TARGET_STATE_KEY2)===!0)return;let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError(TEMPORAL_UNAVAILABLE_CREATOR_MESSAGE);let execution=loadedExecution2(ctx),executionId=execution.metadata?.id??"";try{await engineState.engine.startInvokeWorkflow({executionId,workflowInstanceId:execution.spec?.workflowInstanceId??"",workflowId:execution.spec?.workflowId??"",orgId:execution.metadata?.org??"",recoveryMode:!0,executionTarget:execution.spec?.executionTarget??0})}catch(error2){throw internalError(error2,"failed to start fresh Temporal workflow for recovered execution")}deps.logger.info("Started fresh Temporal workflow for recovered execution (recovery_mode=true)",{executionId})}}}async function runLifecyclePipeline2(deps,pipelineName,schema2,input,method,identity2,steps){let reqCtx=new RequestContext(schema2,input,identity2,ApiResourceKind.workflow_execution),builder2=newPipeline(pipelineName,deps.logger);builder2.addStep(newAuthorizeStep(method,deps.authorizer));for(let step of steps)builder2.addStep(step);await builder2.build().execute(reqCtx);let execution=reqCtx.get(LOADED_EXECUTION_KEY);if(execution===void 0)throw internalError(new Error(`execution not found in context after ${pipelineName}`),`execution not found in context after ${pipelineName.replace("workflowexecution-","")} pipeline`);return execution}async function cancelExecution2(deps,input,identity2){return runLifecyclePipeline2(deps,"workflowexecution-cancel",WorkflowExecutionCommandController.method.cancel.input,input,WorkflowExecutionCommandController.method.cancel,identity2,[newLoadExecutionByIdStep2(deps),newValidatePhaseStep2("ValidateCancellable",ExecutionPhase2.EXECUTION_CANCELLED,[ExecutionPhase2.EXECUTION_PENDING,ExecutionPhase2.EXECUTION_IN_PROGRESS,ExecutionPhase2.EXECUTION_PAUSED],phase=>`cannot cancel execution in phase ${phase}; only PENDING, IN_PROGRESS, or PAUSED can be cancelled`),newEngineLifecycleStep2(deps,"CancelTemporalWorkflow","failed to cancel Temporal workflow",(engine,execution)=>engine.cancelWorkflow(orchestratorWorkflowId(execution.metadata?.id??""))),newUpdateExecutionPhaseAndPersistStep2(deps,ExecutionPhase2.EXECUTION_CANCELLED,!1,!1),newLifecycleBroadcastStep2(deps)])}async function terminateExecution2(deps,input,identity2){return runLifecyclePipeline2(deps,"workflowexecution-terminate",WorkflowExecutionCommandController.method.terminate.input,input,WorkflowExecutionCommandController.method.terminate,identity2,[newLoadExecutionByIdStep2(deps),newValidatePhaseStep2("ValidateTerminable",ExecutionPhase2.EXECUTION_TERMINATED,[ExecutionPhase2.EXECUTION_PENDING,ExecutionPhase2.EXECUTION_IN_PROGRESS,ExecutionPhase2.EXECUTION_PAUSED],phase=>`cannot terminate execution in phase ${phase}; only PENDING, IN_PROGRESS, or PAUSED can be terminated`),newEngineLifecycleStep2(deps,"TerminateTemporalWorkflow","failed to terminate Temporal workflow",async(engine,execution,ctx)=>{let inputReason=ctx.input.reason,reason=inputReason!==""?inputReason:"Terminated by user";await engine.terminateWorkflow(orchestratorWorkflowId(execution.metadata?.id??""),reason),ctx.set(REASON_KEY2,reason)}),newUpdateExecutionPhaseAndPersistStep2(deps,ExecutionPhase2.EXECUTION_TERMINATED,!0,!1),newLifecycleBroadcastStep2(deps)])}async function pauseExecution2(deps,input,identity2){return runLifecyclePipeline2(deps,"workflowexecution-pause",WorkflowExecutionCommandController.method.pause.input,input,WorkflowExecutionCommandController.method.pause,identity2,[newLoadExecutionByIdStep2(deps),newValidatePhaseStep2("ValidatePausable",ExecutionPhase2.EXECUTION_PAUSED,[ExecutionPhase2.EXECUTION_PENDING,ExecutionPhase2.EXECUTION_IN_PROGRESS],phase=>`cannot pause execution in phase ${phase}; only PENDING or IN_PROGRESS can be paused`),newEngineLifecycleStep2(deps,"SignalPauseToTemporal","failed to send pause signal to Temporal workflow",async(engine,execution,ctx)=>{let inputReason=ctx.input.reason,reason=inputReason!==""?inputReason:"Paused by user";await engine.signalWorkflow(orchestratorWorkflowId(execution.metadata?.id??""),PAUSE_SIGNAL_NAME,reason),ctx.set(REASON_KEY2,reason)}),newUpdateExecutionPhaseAndPersistStep2(deps,ExecutionPhase2.EXECUTION_PAUSED,!1,!1),newLifecycleBroadcastStep2(deps)])}async function resumeExecution2(deps,input,identity2){return runLifecyclePipeline2(deps,"workflowexecution-resume",WorkflowExecutionCommandController.method.resume.input,input,WorkflowExecutionCommandController.method.resume,identity2,[newLoadExecutionByIdStep2(deps),newValidatePhaseStep2("ValidateResumable",ExecutionPhase2.EXECUTION_IN_PROGRESS,[ExecutionPhase2.EXECUTION_PAUSED],phase=>`cannot resume execution in phase ${phase}; only PAUSED executions can be resumed`),newEngineLifecycleStep2(deps,"SignalResumeToTemporal","failed to send resume signal to Temporal workflow",(engine,execution)=>engine.signalWorkflow(orchestratorWorkflowId(execution.metadata?.id??""),RESUME_SIGNAL_NAME,void 0)),newUpdateExecutionPhaseAndPersistStep2(deps,ExecutionPhase2.EXECUTION_IN_PROGRESS,!1,!1),newLifecycleBroadcastStep2(deps)])}async function recoverExecution2(deps,input,identity2){return runLifecyclePipeline2(deps,"workflowexecution-recover",WorkflowExecutionCommandController.method.recover.input,input,WorkflowExecutionCommandController.method.recover,identity2,[newLoadExecutionByIdStep2(deps),newValidatePhaseStep2("ValidateRecoverable",ExecutionPhase2.EXECUTION_IN_PROGRESS,[ExecutionPhase2.EXECUTION_FAILED],phase=>`cannot recover execution in phase ${phase}; only FAILED executions can be recovered`),...stepsForSlot(deps.gateSteps,"sandbox-acquisition:gate"),newTerminateExistingWorkflowStep(deps),newRecreateExecutionContextStep2(deps),{name:"EnsureWorkflowSandbox",async execute(ctx){ctx.get(ALREADY_IN_TARGET_STATE_KEY2)!==!0&&await ensureWorkflowSandboxForExecution({logger:deps.logger,lane:deps.sandboxLane,temporalConfig:deps.temporalConfig},loadedExecution2(ctx),ctx.callerIdentity)}},newStartFreshWorkflowStep2(deps),newUpdateExecutionPhaseAndPersistStep2(deps,ExecutionPhase2.EXECUTION_IN_PROGRESS,!1,!0),newLifecycleBroadcastStep2(deps)])}function newNormalizeWorkflowRefStep(store,logger2){return{name:"NormalizeWorkflowRef",async execute(ctx){let execution=ctx.newState,executionId=execution.metadata?.id??"";if((execution.spec?.workflowId??"")!=="")return;let instanceId=execution.spec?.workflowInstanceId??"";if(instanceId===""){logger2.warn("Cannot resolve spec.workflow_id: workflow_instance_id is empty",{executionId});return}let instance;try{instance=await store.getResource(ApiResourceKind.workflow_instance,instanceId,WorkflowInstanceSchema)}catch(error2){logger2.warn("Cannot resolve spec.workflow_id: failed to load workflow instance",{executionId,workflowInstanceId:instanceId,error:error2 instanceof Error?error2.message:String(error2)});return}let workflowId=instance.spec?.workflowId??"";if(workflowId===""){logger2.warn("Cannot resolve spec.workflow_id: instance has no workflow_id",{executionId,workflowInstanceId:instanceId});return}execution.spec!==void 0&&(execution.spec.workflowId=workflowId)}}}function newPinWorkflowVersionStep(store,logger2){return{name:"PinWorkflowVersion",async execute(ctx){let execution=ctx.newState,workflowId=execution.spec?.workflowId??"";if(workflowId===""&&(workflowId=ctx.input.spec?.workflowId??""),workflowId===""&&(workflowId=await resolveWorkflowIdFromInstance(store,logger2,ctx)),workflowId==="")return;let workflow;try{workflow=await store.getResource(ApiResourceKind.workflow,workflowId,WorkflowSchema)}catch(error2){logger2.warn("Failed to load workflow for version pinning \u2014 execution will use live workflow at hydration",{workflowId,error:error2 instanceof Error?error2.message:String(error2)});return}let versionHash=workflow.status?.versionHash??"";versionHash!==""&&(execution.status===void 0&&(execution.status=create2(WorkflowExecutionStatusSchema)),execution.status.workflowVersionHash=versionHash,logger2.info("Pinned workflow version on execution",{workflowId,versionHash:`${versionHash.slice(0,12)}...`}))}}}async function resolveWorkflowIdFromInstance(store,logger2,ctx){let instanceId=ctx.newState.spec?.workflowInstanceId??"";if(instanceId===""&&(instanceId=ctx.input.spec?.workflowInstanceId??""),instanceId==="")return"";try{return(await store.getResource(ApiResourceKind.workflow_instance,instanceId,WorkflowInstanceSchema)).spec?.workflowId??""}catch(error2){return logger2.debug("Could not load workflow instance for version pin resolution",{workflowInstanceId:instanceId,error:error2 instanceof Error?error2.message:String(error2)}),""}}var LOADED_EXECUTION_KEY3="loadedExecution",DEDUPE_CLAIMED_KEY="dedupe_claimed",DEDUPE_SKIPPED_KEY="dedupe_skipped";async function sendSignal(deps,input,identity2){let reqCtx=new RequestContext(WorkflowExecutionCommandController.method.sendSignal.input,input,identity2,ApiResourceKind.workflow_execution),pipeline2=newPipeline("workflowexecution-send-signal",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.sendSignal,deps.authorizer)).addStep({name:"ValidateSignalInput",execute(ctx){if(ctx.input.executionId==="")throw invalidArgumentError("execution_id is required");if(ctx.input.signalName==="")throw invalidArgumentError("signal_name is required")}}).addStep({name:"LoadExecutionByExecutionId",async execute(ctx){let execution2;try{execution2=await deps.store.getResource(ApiResourceKind.workflow_execution,ctx.input.executionId,WorkflowExecutionSchema)}catch{throw notFoundError("workflow_execution",ctx.input.executionId)}ctx.set(LOADED_EXECUTION_KEY3,execution2)}}).addStep({name:"ValidateSignalable",execute(ctx){let phase=ctx.get(LOADED_EXECUTION_KEY3).status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;if(phase!==ExecutionPhase2.EXECUTION_PENDING&&phase!==ExecutionPhase2.EXECUTION_IN_PROGRESS)throw failedPreconditionError(`cannot send signal to execution in phase ${ExecutionPhase2[phase]}; only PENDING or IN_PROGRESS executions can receive signals`)}}).addStep({name:"DedupeClaimStep",async execute(ctx){let idempotencyKey=ctx.input.idempotencyKey;if(idempotencyKey===""){ctx.set(DEDUPE_SKIPPED_KEY,!0);return}let execution2=ctx.get(LOADED_EXECUTION_KEY3),org=execution2.metadata?.org??"",executionId=execution2.metadata?.id??"",result;try{result=await deps.store.signalDedupe.claim(org,idempotencyKey,executionId,ctx.input.signalName,IN_FLIGHT_CLAIM_TTL_MS)}catch(error2){deps.logger.error("Failed to claim idempotency key",{executionId,idempotencyKey,error:error2 instanceof Error?error2.message:String(error2)}),ctx.set(DEDUPE_SKIPPED_KEY,!0);return}if(result.status==="DUPLICATE")throw result.record?.status==="DELIVERED"?alreadyExistsError("signal_with_idempotency_key",idempotencyKey):abortedError(`signal with idempotency_key "${idempotencyKey}" is currently being delivered; retry shortly`);ctx.set(DEDUPE_CLAIMED_KEY,!0)}}).addStep({name:"SendSignalToWorkflow",async execute(ctx){let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError(WORKFLOW_CREATOR_UNAVAILABLE_MESSAGE);let execution2=ctx.get(LOADED_EXECUTION_KEY3),executionId=execution2.metadata?.id??"",relayPayload={signalName:ctx.input.signalName,payload:ctx.input.payload??null};try{await engineState.engine.signalWithStart({executionId,workflowInstanceId:execution2.spec?.workflowInstanceId??"",workflowId:execution2.spec?.workflowId??"",orgId:execution2.metadata?.org??"",recoveryMode:!1,executionTarget:execution2.spec?.executionTarget??0},RELAY_SIGNAL_CHANNEL_NAME,relayPayload)}catch(error2){throw internalError(error2,"failed to send signal to workflow")}}}).addStep({name:"DedupeMarkDeliveredStep",async execute(ctx){if(ctx.get(DEDUPE_SKIPPED_KEY)===!0||ctx.get(DEDUPE_CLAIMED_KEY)!==!0)return;let execution2=ctx.get(LOADED_EXECUTION_KEY3),org=execution2.metadata?.org??"";try{await deps.store.signalDedupe.markDelivered(org,ctx.input.idempotencyKey)}catch(error2){deps.logger.warn("Failed to mark idempotency key as delivered (signal was sent)",{executionId:execution2.metadata?.id??"",idempotencyKey:ctx.input.idempotencyKey,error:error2 instanceof Error?error2.message:String(error2)})}}}).build();try{await pipeline2.execute(reqCtx)}catch(error2){throw await releaseDedupeClaimAfterFailure(deps,reqCtx,input),error2}let execution=reqCtx.get(LOADED_EXECUTION_KEY3);if(execution===void 0)throw internalError(new Error("execution not found in context after send signal pipeline"),"execution not found in context after send signal pipeline");return execution}async function releaseDedupeClaimAfterFailure(deps,reqCtx,input){if(reqCtx.get(DEDUPE_CLAIMED_KEY)!==!0)return;let execution=reqCtx.get(LOADED_EXECUTION_KEY3);if(execution!==void 0)try{await deps.store.signalDedupe.release(execution.metadata?.org??"",input.idempotencyKey)}catch(error2){deps.logger.warn("Failed to release idempotency key after failed delivery (claim self-heals when its hold lapses)",{executionId:input.executionId,idempotencyKey:input.idempotencyKey,error:error2 instanceof Error?error2.message:String(error2)})}}function eventTypeName(eventType){return WorkflowEventType[eventType]??""}async function getEventLog(deps,req,identity2){if(req.executionId==="")throw invalidArgumentError("execution_id is required");await authorizeDirect(WorkflowExecutionQueryController.method.getEventLog,deps.authorizer,identity2,req);let pageSize=req.pageSize;pageSize<=0&&(pageSize=DEFAULT_EVENT_PAGE_SIZE),pageSize>MAX_EVENT_PAGE_SIZE&&(pageSize=MAX_EVENT_PAGE_SIZE);let eventTypeFilter="";req.eventTypes.length===1&&(eventTypeFilter=eventTypeName(req.eventTypes[0]));let records;try{records=await deps.store.getWorkflowExecutionEvents(req.executionId,Number(req.afterSequence),eventTypeFilter,req.taskName,pageSize+1)}catch(error2){throw deps.logger.error("Failed to query execution events",{executionId:req.executionId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to query execution events")}let hasMore=records.length>pageSize;hasMore&&(records=records.slice(0,pageSize));let typeFilter;req.eventTypes.length>1&&(typeFilter=new Set(req.eventTypes.map(eventTypeName)));let events=[],latestSequence=0n;for(let record2 of records){if(typeFilter!==void 0&&!typeFilter.has(record2.eventType))continue;let event;try{event=fromBinary2(WorkflowExecutionEventSchema,record2.data)}catch{deps.logger.warn("Skipping malformed event record",{executionId:req.executionId,sequenceNumber:record2.sequenceNumber});continue}events.push(event),BigInt(record2.sequenceNumber)>latestSequence&&(latestSequence=BigInt(record2.sequenceNumber))}return create2(GetEventLogResponseSchema,{events,hasMore,latestSequence})}function decodeWorkflowExecution(data,logger2){try{return fromBinary2(WorkflowExecutionSchema,data)}catch(error2){logger2.warn("Failed to unmarshal workflow execution, skipping",{error:error2 instanceof Error?error2.message:String(error2)});return}}async function loadWorkflowExecutions(store,logger2,query,internalMessage){let rows;try{rows=await store.queryResources(workflowExecutionListIndex,query)}catch(error2){throw internalError(error2,internalMessage)}let executions=[];for(let row of rows){let execution=decodeWorkflowExecution(row.data,logger2);execution!==void 0&&executions.push(execution)}return executions}async function readWorkflowExecutionList(read3){let scope=executions2=>restrictListByReadScope(read3.listReadScope,read3.identity,ApiResourceKind.workflow_execution,executions2,"");if(read3.sortField===ExecutionSortField.UNSPECIFIED){let page=await readListPage({store:read3.store,declaration:workflowExecutionListIndex,query:read3.query,request:read3.request,fingerprint:listPageFingerprint(read3.fingerprint),decode:data=>decodeWorkflowExecution(data,read3.logger),keep:read3.keep,scope,failure:"failed to list workflow executions"});return create2(WorkflowExecutionListSchema,{entries:page.entries,nextPageToken:page.nextPageToken,totalPages:page.nextPageToken===""?1:0})}if(read3.request.pageToken!=="")throw invalidArgumentError("invalid page_token");if(read3.request.pageSize<0)throw invalidArgumentError("page_size must not be negative");let executions=await scope((await loadWorkflowExecutions(read3.store,read3.logger,read3.query,"failed to list workflow executions")).filter(read3.keep));applySortField(executions,read3.sortField,read3.sortAscending);let size=Math.min(read3.request.pageSize,LIST_PAGE_MAX_SIZE);return create2(WorkflowExecutionListSchema,{entries:size===0?executions:executions.slice(0,size),totalPages:1})}var RANK_LIMIT=10;async function getExecutionSummary2(deps,req,identity2){let cutoffMs=resolveTimeCutoffMs(req.timeWindow),executions=await loadWorkflowExecutions(deps.store,deps.logger,{org:req.org,...cutoffMs===void 0?{}:{createdAtOrAfter:listIndexInstantOfMillis(cutoffMs-1)}},"failed to list workflow executions for summary");if(deps.listReadScope!==void 0&&(executions=await restrictListByReadScope(deps.listReadScope,identity2,ApiResourceKind.workflow_execution,executions,""),executions.length===0))return create2(ExecutionSummarySchema);let workflowFilter=req.workflowId,phaseCounts={},activeCount=0,totalCount=0,completedCount=0,failedCount=0,completedDurationsMs=[],failureCounts=new Map,workflowNames=new Map,execByWorkflow=new Map,costByWorkflow=new Map,totalCostMicros=0n,totalInputTokens=0n,totalOutputTokens=0n;for(let execution of executions){let createdAtMs=auditCreatedAtMs2(execution.status?.audit?.specAudit?.createdAt);if(createdAtMs!==void 0&&cutoffMs!==void 0&&createdAtMs<cutoffMs||workflowFilter!==""&&execution.spec?.workflowId!==workflowFilter&&execution.spec?.workflowInstanceId!==workflowFilter)continue;let phase=execution.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;phaseCounts[phase]=(phaseCounts[phase]??0)+1,totalCount++,isActivePhase(phase)&&activeCount++,phase===ExecutionPhase2.EXECUTION_COMPLETED&&completedCount++,phase===ExecutionPhase2.EXECUTION_FAILED&&failedCount++;let slug=execution.metadata?.slug??"";if(slug!==""){execByWorkflow.set(slug,(execByWorkflow.get(slug)??0)+1);let name=execution.metadata?.name??"";name!==""&&workflowNames.set(slug,name)}let execCostMicros=execution.status?.totalCostMicros??0n;if(totalCostMicros+=execCostMicros,totalInputTokens+=execution.status?.totalInputTokens??0n,totalOutputTokens+=execution.status?.totalOutputTokens??0n,slug!==""&&execCostMicros>0n&&costByWorkflow.set(slug,(costByWorkflow.get(slug)??0)+Number(execCostMicros)/1e6),phase===ExecutionPhase2.EXECUTION_COMPLETED){let durationMs=completionDurationMs2(execution);durationMs>0&&completedDurationsMs.push(durationMs)}phase===ExecutionPhase2.EXECUTION_FAILED&&slug!==""&&failureCounts.set(slug,(failureCounts.get(slug)??0)+1)}let successRate=-1,terminal=completedCount+failedCount;terminal>0&&(successRate=completedCount/terminal);let summary=create2(ExecutionSummarySchema,{activeCount,phaseCounts,totalCost:create2(WorkflowCostSummarySchema,{totalCostUsd:Number(totalCostMicros)/1e6,totalInputTokens,totalOutputTokens}),totalCount,successRate});if(completedDurationsMs.length>0){let totalMs=0;for(let durationMs of completedDurationsMs)totalMs+=durationMs;summary.avgDuration=durationFromMs2(totalMs/completedDurationsMs.length)}return summary.topFailingWorkflows=buildFailureRanks(failureCounts,workflowNames,RANK_LIMIT),summary.costByWorkflow=buildCostBreakdown(costByWorkflow,execByWorkflow,workflowNames,RANK_LIMIT),summary}function resolveTimeCutoffMs(timeWindow){let nowMs=Date.now();switch(timeWindow){case SummaryTimeWindow.LAST_24H:return nowMs-1440*60*1e3;case SummaryTimeWindow.LAST_7D:return nowMs-10080*60*1e3;case SummaryTimeWindow.LAST_30D:return nowMs-720*60*60*1e3;case SummaryTimeWindow.ALL_TIME:return;default:return nowMs-10080*60*1e3}}function isActivePhase(phase){return phase===ExecutionPhase2.EXECUTION_PENDING||phase===ExecutionPhase2.EXECUTION_IN_PROGRESS||phase===ExecutionPhase2.EXECUTION_PAUSED}function auditCreatedAtMs2(createdAt){if(createdAt!==void 0)return timestampMs(createdAt)}function completionDurationMs2(execution){let started=parseRfc3339Ms2(execution.status?.startedAt??""),completed=parseRfc3339Ms2(execution.status?.completedAt??"");return Number.isNaN(started)||Number.isNaN(completed)?0:completed-started}function durationFromMs2(ms){let truncatedMs=Math.trunc(ms),seconds=Math.trunc(truncatedMs/1e3),nanos=Math.trunc((truncatedMs-seconds*1e3)*1e6);return create2(DurationSchema,{seconds:BigInt(seconds),nanos})}function buildFailureRanks(counts,names,limit){return[...counts.entries()].sort((a5,b7)=>b7[1]-a5[1]).slice(0,limit).map(([slug,count])=>create2(WorkflowFailureRankSchema,{workflowSlug:slug,workflowName:names.get(slug)??"",failureCount:count}))}function buildCostBreakdown(costs,execCounts,names,limit){return[...costs.entries()].sort((a5,b7)=>b7[1]-a5[1]).slice(0,limit).map(([slug,cost])=>create2(WorkflowCostBreakdownSchema,{workflowSlug:slug,workflowName:names.get(slug)??"",totalCostUsd:cost,executionCount:execCounts.get(slug)??0}))}async function listPendingApprovals(deps,req,identity2){if(req.pageSize<0)throw invalidArgumentError("page_size must not be negative");let fingerprint=listPageFingerprint({lane:"workflowExecution.listPendingApprovals",org:req.org}),after=req.pageToken===""?void 0:decodeListPageToken(req.pageToken,fingerprint),executions=await restrictListByReadScope(deps.listReadScope,identity2,ApiResourceKind.workflow_execution,(await loadWorkflowExecutions(deps.store,deps.logger,{org:req.org},"failed to list workflow executions for pending approvals")).filter(mayHavePendingApproval),""),pageSize=req.pageSize;pageSize===0&&(pageSize=DEFAULT_PENDING_APPROVALS_PAGE_SIZE),pageSize>MAX_PENDING_APPROVALS_PAGE_SIZE&&(pageSize=MAX_PENDING_APPROVALS_PAGE_SIZE);let approvals=[];for(let execution of executions){let cursor={createdAt:listIndexInstant(execution.status?.audit?.specAudit?.createdAt),id:execution.metadata?.id??""},position=0;for(let task of execution.status?.tasks??[])task.status===WorkflowTaskStatus.WORKFLOW_TASK_WAITING_APPROVAL&&(approvals.push({approval:create2(PendingApprovalSchema2,{executionId:execution.metadata?.id??"",workflowName:execution.metadata?.name??"",taskName:task.taskName,requester:execution.status?.audit?.specAudit?.createdBy?.id??"",requestedAt:parseTimestampString(task.startedAt),uiHint:task.uiHint}),at:{cursor,position}}),position+=1)}let start=after===void 0?0:approvals.findIndex(a5=>comesAfter(a5.at,after)),remaining=start<0?[]:approvals.slice(start),page=remaining.slice(0,pageSize),last=page[page.length-1];return create2(PendingApprovalsListSchema,{entries:page.map(a5=>a5.approval),totalCount:approvals.length,nextPageToken:remaining.length>pageSize&&last!==void 0?encodeListPageToken(last.at.cursor,fingerprint,last.at.position):""})}function comesAfter(at2,after){let order=compareListIndexOrder(at2.cursor,after.cursor);return order>0||order===0&&at2.position>(after.position??-1)}function parseTimestampString(value){let ms=parseRfc3339Ms2(value);if(!Number.isNaN(ms))return timestampFromMs(ms)}function mayHavePendingApproval(execution){return(execution.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED)===ExecutionPhase2.EXECUTION_IN_PROGRESS&&(execution.status?.tasks??[]).some(task=>task.status===WorkflowTaskStatus.WORKFLOW_TASK_WAITING_APPROVAL)}function workflowExecutionRunTarget(execution){let spec=execution.spec,workflowInstanceId=spec?.workflowInstanceId??"";if(workflowInstanceId!=="")return{...RUN_GATE_CHECKS.workflowInstance,resourceId:workflowInstanceId,deniedMessage:runWorkflowInstanceDeniedMessage(workflowInstanceId)};let workflowId=spec?.workflowId??"";if(workflowId!=="")return{...RUN_GATE_CHECKS.workflow,resourceId:workflowId,deniedMessage:runWorkflowDeniedMessage(workflowId)}}function isWorkflowTerminalPhase(phase){return phase===ExecutionPhase2.EXECUTION_COMPLETED||phase===ExecutionPhase2.EXECUTION_FAILED||phase===ExecutionPhase2.EXECUTION_CANCELLED}async function*subscribeExecution2(deps,request,context2){if(request.executionId==="")throw invalidArgumentError("execution_id is required");await authorizeDirect(WorkflowExecutionQueryController.method.subscribe,deps.authorizer,callerIdentityOf(context2),request);let id=request.executionId;deps.logger.info("Starting workflow execution subscription",{executionId:id});let subscription=deps.broker.subscribe(id);try{let snapshot;try{snapshot=await deps.store.getResource(ApiResourceKind.workflow_execution,id,WorkflowExecutionSchema)}catch{throw notFoundError("WorkflowExecution",id)}yield snapshot,deps.logger.debug("Sent initial workflow execution state, streaming live updates",{executionId:id});let lastSent=snapshot,abort=new Promise(resolve=>{context2.signal.addEventListener("abort",()=>resolve(),{once:!0})});for(;!context2.signal.aborted;){if(subscription.closed){deps.logger.warn("Updates channel closed unexpectedly",{executionId:id});return}if(subscription.queue.length===0){await Promise.race([abort,new Promise(resolve=>subscription.notify=resolve)]),subscription.notify=void 0;continue}let updated=subscription.queue.shift();if(updated===void 0||equals(WorkflowExecutionSchema,updated,lastSent))continue;yield updated,lastSent=updated;let phase=updated.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;if(isWorkflowTerminalPhase(phase)){deps.logger.info("Workflow execution reached terminal state, ending subscription",{executionId:id,phase:ExecutionPhase2[phase]});return}}deps.logger.info("Workflow execution subscription cancelled by client",{executionId:id})}finally{deps.broker.unsubscribe(id,subscription)}}async function*subscribeEvents(deps,request,context2){if(request.executionId==="")throw invalidArgumentError("execution_id is required");await authorizeDirect(WorkflowExecutionQueryController.method.subscribeEvents,deps.authorizer,callerIdentityOf(context2),request);let executionId=request.executionId;try{await deps.store.getResource(ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema)}catch{throw notFoundError("WorkflowExecution",executionId)}let typeFilter;request.eventTypes.length>0&&(typeFilter=new Set(request.eventTypes.map(eventTypeName)));let cursor=Number(request.afterSequence);deps.logger.info("Starting event subscription",{executionId,afterSequence:cursor});let abort=new Promise(resolve=>{context2.signal.addEventListener("abort",()=>resolve(),{once:!0})});for(;!context2.signal.aborted;){let records;try{records=await deps.store.getWorkflowExecutionEvents(executionId,cursor,"","",DEFAULT_EVENT_PAGE_SIZE)}catch(error2){throw deps.logger.error("Failed to poll execution events",{executionId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to poll execution events")}for(let record2 of records){if(typeFilter!==void 0&&!typeFilter.has(record2.eventType)){cursor=record2.sequenceNumber;continue}let event;try{event=fromBinary2(WorkflowExecutionEventSchema,record2.data)}catch{deps.logger.warn("Skipping malformed event record",{executionId,sequenceNumber:record2.sequenceNumber}),cursor=record2.sequenceNumber;continue}if(context2.signal.aborted)return;yield event,cursor=record2.sequenceNumber}try{let phase=(await deps.store.getResource(ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema)).status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;if(isWorkflowTerminalPhase(phase)){let remaining=[];try{remaining=await deps.store.getWorkflowExecutionEvents(executionId,cursor,"","",DEFAULT_EVENT_PAGE_SIZE)}catch{remaining=[]}for(let record2 of remaining){if(typeFilter!==void 0&&!typeFilter.has(record2.eventType))continue;let event;try{event=fromBinary2(WorkflowExecutionEventSchema,record2.data)}catch{continue}if(context2.signal.aborted)return;yield event}deps.logger.info("Execution reached terminal state, closing event stream",{executionId,phase:ExecutionPhase2[phase]});return}}catch{}await Promise.race([abort,sleep3(EVENT_POLL_INTERVAL_MS)])}deps.logger.info("Event subscription cancelled by client",{executionId})}function sleep3(ms){return new Promise(resolve=>{setTimeout(resolve,ms).unref()})}var EXECUTION_KEY3="execution";async function updateStatus2(deps,input,identity2){let reqCtx=new RequestContext(WorkflowExecutionCommandController.method.updateStatus.input,input,identity2,ApiResourceKind.workflow_execution);await newPipeline("workflowexecution-update-status",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.updateStatus,deps.authorizer)).addStep({name:"ValidateUpdateStatusInput",execute(ctx){if(ctx.input.executionId==="")throw invalidArgumentError("execution_id is required");if(ctx.input.status===void 0)throw invalidArgumentError("status is required")}}).addStep({name:"MergeAndPersistExecution",async execute(ctx){let updated,previousPhase=ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;try{updated=await deps.store.updateResource(ApiResourceKind.workflow_execution,ctx.input.executionId,WorkflowExecutionSchema,execution=>{previousPhase=execution.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED,applyUpdateStatusMerge2(execution,ctx.input)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("WorkflowExecution",ctx.input.executionId):internalError(error2,"failed to update execution status")}ctx.set(EXECUTION_KEY3,updated),deps.sandboxTerminalObserver(ctx.input.executionId,previousPhase,updated.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED),deps.logger.info("Successfully updated execution status",{executionId:ctx.input.executionId,phase:ExecutionPhase2[updated.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED]})}}).addStep({name:"PersistEvents",async execute(ctx){await persistEvents(deps,ctx.input)}}).addStep({name:"BroadcastToStreams",execute(ctx){let execution=ctx.get(EXECUTION_KEY3);if(execution===void 0)throw internalError(new Error("execution not found in context"),"execution not found in context");deps.broker.broadcast(execution)}}).build().execute(reqCtx);let merged=reqCtx.get(EXECUTION_KEY3);if(merged===void 0)throw internalError(new Error("execution not found in context after pipeline"),"execution not found in context after pipeline");return merged}function mergePendingByChild(existing,incoming,childOf,scopeChildId){let merged=[];for(let entry of existing)childOf(entry)!==scopeChildId&&merged.push(entry);return merged.push(...incoming),merged}function applyUpdateStatusMerge2(execution,input){execution.status===void 0&&(execution.status=create2(WorkflowExecutionStatusSchema));let status=execution.status,requestStatus=input.status;if(requestStatus===void 0)return;let previousPhase=status.phase;requestStatus.tasks.length>0&&(status.tasks=requestStatus.tasks),requestStatus.phase!==ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED&&(status.phase=requestStatus.phase),requestStatus.output!==void 0&&(status.output=requestStatus.output),requestStatus.error!==""&&(status.error=requestStatus.error),requestStatus.startedAt!==""&&(status.startedAt=requestStatus.startedAt),requestStatus.completedAt!==""&&(status.completedAt=requestStatus.completedAt),requestStatus.temporalWorkflowId!==""&&(status.temporalWorkflowId=requestStatus.temporalWorkflowId),requestStatus.totalCostMicros>0n&&(status.totalCostMicros=requestStatus.totalCostMicros),requestStatus.totalInputTokens>0n&&(status.totalInputTokens=requestStatus.totalInputTokens),requestStatus.totalOutputTokens>0n&&(status.totalOutputTokens=requestStatus.totalOutputTokens);let scopeChildId=input.pendingUpdateChildAgentExecutionId;if(input.updatePendingApprovals&&(status.pendingApprovals=mergePendingByChild(status.pendingApprovals,requestStatus.pendingApprovals,entry=>entry.childAgentExecutionId,scopeChildId)),input.updatePendingFileReviews&&(status.pendingFileReviews=mergePendingByChild(status.pendingFileReviews,requestStatus.pendingFileReviews,entry=>entry.childAgentExecutionId,scopeChildId)),requestStatus.phase!==ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED&&requestStatus.phase!==previousPhase){let audit=status.audit??create2(ApiResourceAuditSchema);status.audit=audit;let statusAudit=audit.statusAudit??create2(ApiResourceAuditInfoSchema);audit.statusAudit=statusAudit,statusAudit.updatedAt=timestampNow(),statusAudit.event="updated"}}async function persistEvents(deps,input){if(input.events.length===0)return;let executionId=input.executionId,records=[];for(let event of input.events){let data;try{data=toBinary(WorkflowExecutionEventSchema,event)}catch(error2){deps.logger.error("Failed to marshal event \u2014 dropping batch (non-fatal, timeline data lost)",{executionId,sequenceNumber:event.sequenceNumber,eventCount:input.events.length,error:error2 instanceof Error?error2.message:String(error2)});return}records.push({executionId,sequenceNumber:Number(event.sequenceNumber),eventType:WorkflowEventType[event.eventType]??"",taskName:event.taskName,data,createdAt:""})}let appended;try{appended=await deps.store.appendWorkflowExecutionEvents(executionId,records)}catch(error2){deps.logger.error("Failed to persist execution events (non-fatal, timeline data lost)",{executionId,submitted:records.length,error:error2 instanceof Error?error2.message:String(error2)});return}let skipped=records.length-appended;skipped>0?deps.logger.debug("Persisted execution events (idempotent retry skipped already-persisted sequences)",{executionId,appended,skippedDuplicates:skipped}):deps.logger.debug("Persisted execution events",{executionId,appended})}function registerWorkflowExecutionServices(router,deps){let lifecycleDeps={store:deps.store,logger:deps.logger,authorizer:deps.authorizer,broker:deps.broker,engineState:deps.engineState,executionContextBuilder:deps.executionContextBuilder,sandboxLane:deps.sandboxLane,temporalConfig:deps.temporalConfig,sandboxTerminalObserver:deps.sandboxTerminalObserver,gateSteps:deps.gateSteps};router.service(WorkflowExecutionCommandController,{create:(execution,ctx)=>createExecution2(deps,execution,ctx),update:(execution,ctx)=>update18(deps,execution,ctx),updateStatus:(input,ctx)=>updateStatus2(deps,input,callerIdentityOf(ctx)),submitApproval:(input,ctx)=>submitApproval2(deps,input,callerIdentityOf(ctx)),submitFileDecision:(input,ctx)=>submitFileDecision2(deps,input,callerIdentityOf(ctx)),submitWorkflowTaskApproval:(input,ctx)=>submitWorkflowTaskApproval(deps,input,callerIdentityOf(ctx)),delete:(id,ctx)=>deleteExecution2(deps,id,ctx),sendSignal:(input,ctx)=>sendSignal(deps,input,callerIdentityOf(ctx)),cancel:(input,ctx)=>cancelExecution2(lifecycleDeps,input,callerIdentityOf(ctx)),terminate:(input,ctx)=>terminateExecution2(lifecycleDeps,input,callerIdentityOf(ctx)),recover:(input,ctx)=>recoverExecution2(lifecycleDeps,input,callerIdentityOf(ctx)),pause:(input,ctx)=>pauseExecution2(lifecycleDeps,input,callerIdentityOf(ctx)),resume:(input,ctx)=>resumeExecution2(lifecycleDeps,input,callerIdentityOf(ctx))}),router.service(WorkflowExecutionQueryController,{get:(id,ctx)=>get25(deps,id,ctx),list:(req,ctx)=>list11(deps,req,callerIdentityOf(ctx)),listByWorkflow:(req,ctx)=>listByWorkflow(deps,req,callerIdentityOf(ctx)),subscribe:(req,ctx)=>subscribeExecution2(deps,req,ctx),getEventLog:(req,ctx)=>getEventLog(deps,req,callerIdentityOf(ctx)),subscribeEvents:(req,ctx)=>subscribeEvents(deps,req,ctx),getExecutionSummary:(req,ctx)=>getExecutionSummary2(deps,req,callerIdentityOf(ctx)),listPendingApprovals:(req,ctx)=>listPendingApprovals(deps,req,callerIdentityOf(ctx))})}async function createExecution2(deps,execution,ctx){let reqCtx=new RequestContext(WorkflowExecutionSchema,execution,callerIdentityOf(ctx),kindOf24(ctx)),builder2=newPipeline("workflowexecution-create",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newValidateWorkflowOrInstanceStep()).addStep(newAuthorizeRunTargetStep(deps.authorizer,workflowExecutionRunTarget)).addStep(newEnsureEngineAvailableStep2(deps.engineState)).addStep(newCreateDefaultInstanceIfNeededStep2({store:deps.store,logger:deps.logger,workflowInstanceCreator:deps.workflowInstanceCreator,authorizationLifecycle:deps.authorizationLifecycle})).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store));for(let step of stepsForSlot(deps.gateSteps,"sandbox-acquisition:gate"))builder2.addStep(step);return await builder2.addStep(newSetInitialPhaseStep2()).addStep(newNormalizeWorkflowRefStep(deps.store,deps.logger)).addStep(newPinWorkflowVersionStep(deps.store,deps.logger)).addStep(newCreateExecutionContextStep2(deps.executionContextBuilder)).addStep(newEnsureWorkflowSandboxStep({logger:deps.logger,lane:deps.sandboxLane,temporalConfig:deps.temporalConfig})).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,workflowExecutionSearchExtractor,deps.logger)).addStep(newStartWorkflowStep2({store:deps.store,logger:deps.logger,engineState:deps.engineState})).build().execute(reqCtx),reqCtx.newState}function kindOf24(ctx){return ctx.values.get(apiResourceKindKey)}async function update18(deps,execution,ctx){let reqCtx=new RequestContext(WorkflowExecutionSchema,execution,callerIdentityOf(ctx),kindOf24(ctx));return await newPipeline("workflowexecution-update",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,workflowExecutionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function deleteExecution2(deps,id,ctx){let reqCtx=new RequestContext(WorkflowExecutionCommandController.method.delete.input,id,callerIdentityOf(ctx),kindOf24(ctx));await newPipeline("workflowexecution-delete",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,WorkflowExecutionSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted workflow execution not found in context"),"deleted workflow execution not found in context");return deleted}async function get25(deps,id,ctx){let reqCtx=new RequestContext(WorkflowExecutionQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf24(ctx));return await newPipeline("workflowexecution-get",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,WorkflowExecutionSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function list11(deps,req,identity2){let legacyPhase=req.filter===void 0||req.filter.phases.length===0;return readWorkflowExecutionList({store:deps.store,logger:deps.logger,listReadScope:deps.listReadScope,identity:identity2,query:{org:req.org},request:req,sortField:req.sortField,sortAscending:req.sortAscending,keep:execution=>(!legacyPhase||matchesLegacyPhase(execution,req.phase))&&matchesFilterCriteria(execution,req.filter),fingerprint:{lane:"workflowExecution.list",org:req.org,phase:req.phase,tags:req.tags,filter:req.filter,sortField:req.sortField,sortAscending:req.sortAscending}})}async function listByWorkflow(deps,req,identity2){if(req.workflowId==="")throw invalidArgumentError("workflow_id is required");return readWorkflowExecutionList({store:deps.store,logger:deps.logger,listReadScope:deps.listReadScope,identity:identity2,query:{anyKey:[{name:"workflow",value:req.workflowId},{name:"workflow_instance",value:req.workflowId}]},request:req,sortField:req.sortField,sortAscending:req.sortAscending,keep:execution=>matchesFilterCriteria(execution,req.filter),fingerprint:{lane:"workflowExecution.listByWorkflow",workflowId:req.workflowId,filter:req.filter,sortField:req.sortField,sortAscending:req.sortAscending}})}var StreamBroker2=class{logger;subscribers=new Map;constructor(logger2){this.logger=logger2}subscribe(executionId){let subscription={queue:[],notify:void 0,closed:!1},set2=this.subscribers.get(executionId)??new Set;return set2.add(subscription),this.subscribers.set(executionId,set2),this.logger.debug("New subscriber registered",{executionId,totalSubscribers:set2.size}),subscription}unsubscribe(executionId,subscription){let set2=this.subscribers.get(executionId);set2===void 0||!set2.has(subscription)||(set2.delete(subscription),subscription.closed=!0,subscription.notify?.(),subscription.notify=void 0,this.logger.debug("Subscriber unregistered",{executionId,remainingSubscribers:set2.size}),set2.size===0&&this.subscribers.delete(executionId))}broadcast(execution){let executionId=execution.metadata?.id??"";if(executionId==="")return;let set2=this.subscribers.get(executionId);if(!(set2===void 0||set2.size===0)){this.logger.debug("Broadcasting execution update",{executionId,subscribers:set2.size});for(let subscription of set2){if(subscription.queue.length>=100){this.logger.warn("Subscriber channel full, dropping update",{executionId});continue}subscription.queue.push(execution),subscription.notify?.(),subscription.notify=void 0}}}getSubscriberCount(executionId){return this.subscribers.get(executionId)?.size??0}};var import_node_child_process=require("node:child_process"),import_node_util=require("node:util");var import_node_crypto29=require("node:crypto"),SCOPE_CODES={session:"ses",workflow:"wfx",connect:"mcp"},SANDBOX_MANAGED_BY_LABEL="stigmer.ai/managed-by",SANDBOX_SCOPE_LABEL="stigmer.ai/scope",SANDBOX_ID_LABEL="stigmer.ai/sandbox-id",SANDBOX_MANAGED_BY_VALUE="stigmer-server";function sandboxBaseName(scope,id){let digest3=(0,import_node_crypto29.createHash)("sha256").update(id).digest("hex").slice(0,12);return`sbx-${SCOPE_CODES[scope]}-${digest3}`}var execFileAsync=(0,import_node_util.promisify)(import_node_child_process.execFile),RUNNER_CONTAINER_COMMAND=["node","/runner/dist/main.js"],CONTAINER_WORKSPACE_DIR="/workspace",newDockerSandboxProvisioner=({config:config2,logger:logger2})=>{if(config2.backendEndpoint==="")throw new Error("sandbox provisioner 'docker' requires STIGMER_SANDBOX_BACKEND_ENDPOINT \u2014 a container cannot reach the server on this process's localhost");if(config2.temporalAddress==="")throw new Error("sandbox provisioner 'docker' requires STIGMER_SANDBOX_TEMPORAL_ADDRESS (or TEMPORAL_HOST_PORT) reachable from inside a container");async function docker(args,env2){let{stdout}=await execFileAsync("docker",args,{env:env2??process.env});return stdout.trim()}async function inspectState(name){try{return await docker(["inspect","--format","{{.State.Running}}",name])==="true"?"running":"stopped"}catch(error2){if(isNoSuchContainer(error2))return"absent";throw error2}}async function ensure(scope,id,env2){let name=sandboxBaseName(scope,id),state2=await inspectState(name);if(state2==="running")return;if(state2==="stopped"){await docker(["start",name]),logger2.info("Docker sandbox restarted",{scope,id,container:name});return}let runArgs=["run","--detach","--name",name,"--label",`${SANDBOX_MANAGED_BY_LABEL}=${SANDBOX_MANAGED_BY_VALUE}`,"--label",`${SANDBOX_SCOPE_LABEL}=${scope}`,"--label",`${SANDBOX_ID_LABEL}=${id}`,"--env","MODE=local","--env",`STIGMER_TASK_QUEUE=${env2.taskQueue}`,"--env",`STIGMER_BACKEND_ENDPOINT=${config2.backendEndpoint}`,"--env",`TEMPORAL_SERVICE_ADDRESS=${config2.temporalAddress}`,"--env",`TEMPORAL_NAMESPACE=${config2.temporalNamespace}`,"--env",`WORKSPACE_ROOT_DIR=${CONTAINER_WORKSPACE_DIR}`],secretEnv={...config2.temporalConnectionEnv};env2.stigmerToken!==""&&(secretEnv.STIGMER_TOKEN=env2.stigmerToken);let runEnv;if(Object.keys(secretEnv).length>0){for(let name2 of Object.keys(secretEnv))runArgs.push("--env",name2);runEnv={...process.env,...secretEnv}}runArgs.push(config2.runnerImage,...RUNNER_CONTAINER_COMMAND),await docker(runArgs,runEnv),logger2.info("Docker sandbox provisioned",{scope,id,container:name,taskQueue:env2.taskQueue,image:config2.runnerImage})}async function deprovision(scope,id){let name=sandboxBaseName(scope,id);try{await docker(["rm","--force",name]),logger2.info("Docker sandbox deprovisioned",{scope,id,container:name})}catch(error2){if(isNoSuchContainer(error2))return;throw error2}}return{ensureSessionSandbox:(sessionId,env2)=>ensure("session",sessionId,env2),deprovisionSessionSandbox:sessionId=>deprovision("session",sessionId),ensureWorkflowSandbox:(executionId,env2)=>ensure("workflow",executionId,env2),deprovisionWorkflowSandbox:executionId=>deprovision("workflow",executionId),async createConnectSandbox(connectRequestId,env2){return await ensure("connect",connectRequestId,env2),connectRequestId},deprovisionConnectSandbox:sandboxId=>deprovision("connect",sandboxId),probe:(scope,id)=>inspectState(sandboxBaseName(scope,id))}};function isNoSuchContainer(error2){let text2=error2 instanceof Error?`${error2.message} ${error2.stderr??""}`:String(error2);return text2.includes("No such container")||text2.includes("No such object")}var import_node_buffer2=require("node:buffer");typeof globalThis.File>"u"&&(globalThis.File=import_node_buffer2.File);var import_node_fs12=__toESM(require("node:fs"),1),import_node_https2=__toESM(require("node:https"),1),import_node_http2=__toESM(require("node:http"),1),import_node_tls=__toESM(require("node:tls"),1);var NOT_RESOLVED=Symbol("NOT_RESOLVED");function defineScalarTag(tagName,options){return{tagName,nodeKind:"scalar",implicit:options.implicit??!1,matchByTagPrefix:options.matchByTagPrefix??!1,implicitFirstChars:options.implicitFirstChars??null,resolve:options.resolve,identify:options.identify,represent:options.represent??(data=>String(data)),representTagName:options.representTagName??(()=>tagName)}}function defineSequenceTag(tagName,options){let carrierIsResult=options.finalize===void 0;return{tagName,nodeKind:"sequence",implicit:!1,matchByTagPrefix:options.matchByTagPrefix??!1,create:options.create,addItem:options.addItem,finalize:options.finalize??(carrier=>carrier),carrierIsResult,identify:options.identify,represent:options.represent??(data=>data),representTagName:options.representTagName??(()=>tagName)}}function defineMappingTag(tagName,options){let carrierIsResult=options.finalize===void 0;return{tagName,nodeKind:"mapping",implicit:!1,matchByTagPrefix:options.matchByTagPrefix??!1,create:options.create,addPair:options.addPair,has:options.has,keys:options.keys,get:options.get,finalize:options.finalize??(carrier=>carrier),carrierIsResult,identify:options.identify,represent:options.represent??(data=>data),representTagName:options.representTagName??(()=>tagName)}}var strTag=defineScalarTag("tag:yaml.org,2002:str",{resolve:source=>source,identify:data=>typeof data=="string"}),NULL_VALUES$1=["","~","null","Null","NULL"],nullCoreTag=defineScalarTag("tag:yaml.org,2002:null",{implicit:!0,implicitFirstChars:["","~","n","N"],resolve:source=>NULL_VALUES$1.indexOf(source)!==-1?null:NOT_RESOLVED,identify:object=>object===null,represent:()=>"null"}),nullJsonTag=defineScalarTag("tag:yaml.org,2002:null",{implicit:!0,implicitFirstChars:["n"],resolve:(source,isExplicit)=>source==="null"||isExplicit&&source===""?null:NOT_RESOLVED,identify:object=>object===null,represent:()=>"null"}),NULL_VALUES=["","~","null","Null","NULL"],nullYaml11Tag=defineScalarTag("tag:yaml.org,2002:null",{implicit:!0,implicitFirstChars:["","~","n","N"],resolve:source=>NULL_VALUES.indexOf(source)!==-1?null:NOT_RESOLVED,identify:object=>object===null,represent:()=>"null"}),TRUE_VALUES$2=["true","True","TRUE"],FALSE_VALUES$2=["false","False","FALSE"],boolCoreTag=defineScalarTag("tag:yaml.org,2002:bool",{implicit:!0,implicitFirstChars:["t","T","f","F"],resolve:source=>TRUE_VALUES$2.indexOf(source)!==-1?!0:FALSE_VALUES$2.indexOf(source)!==-1?!1:NOT_RESOLVED,identify:object=>Object.prototype.toString.call(object)==="[object Boolean]",represent:object=>object?"true":"false"}),TRUE_VALUES$1=["true"],FALSE_VALUES$1=["false"],boolJsonTag=defineScalarTag("tag:yaml.org,2002:bool",{implicit:!0,implicitFirstChars:["t","f"],resolve:source=>TRUE_VALUES$1.indexOf(source)!==-1?!0:FALSE_VALUES$1.indexOf(source)!==-1?!1:NOT_RESOLVED,identify:object=>Object.prototype.toString.call(object)==="[object Boolean]",represent:object=>object?"true":"false"}),TRUE_VALUES=["true","True","TRUE","y","Y","yes","Yes","YES","on","On","ON"],FALSE_VALUES=["false","False","FALSE","n","N","no","No","NO","off","Off","OFF"],boolYaml11Tag=defineScalarTag("tag:yaml.org,2002:bool",{implicit:!0,implicitFirstChars:["y","Y","n","N","t","T","f","F","o","O"],resolve:source=>TRUE_VALUES.indexOf(source)!==-1?!0:FALSE_VALUES.indexOf(source)!==-1?!1:NOT_RESOLVED,identify:object=>Object.prototype.toString.call(object)==="[object Boolean]",represent:object=>object?"true":"false"}),YAML_INTEGER_IMPLICIT_PATTERN$1=new RegExp("^(?:0o[0-7]+|0x[0-9a-fA-F]+|[-+]?[0-9]+)$"),YAML_INTEGER_EXPLICIT_PATTERN$1=new RegExp("^(?:[-+]?0b[0-1]+|[-+]?0o[0-7]+|[-+]?0x[0-9a-fA-F]+|[-+]?[0-9]+)$");function parseYamlInteger$2(source){let value=source,sign4=1;return(value[0]==="-"||value[0]==="+")&&(value[0]==="-"&&(sign4=-1),value=value.slice(1)),value.startsWith("0b")?sign4*parseInt(value.slice(2),2):value.startsWith("0o")?sign4*parseInt(value.slice(2),8):value.startsWith("0x")?sign4*parseInt(value.slice(2),16):sign4*parseInt(value,10)}function resolveYamlInteger$2(source,isExplicit){if(isExplicit){if(!YAML_INTEGER_EXPLICIT_PATTERN$1.test(source))return NOT_RESOLVED}else if(!YAML_INTEGER_IMPLICIT_PATTERN$1.test(source))return NOT_RESOLVED;let result=parseYamlInteger$2(source);return Number.isFinite(result)?result:NOT_RESOLVED}var intCoreTag=defineScalarTag("tag:yaml.org,2002:int",{implicit:!0,implicitFirstChars:["-","+",..."0123456789"],resolve:resolveYamlInteger$2,identify:object=>Number.isInteger(object)&&!Object.is(object,-0)&&object.toString(10).indexOf("e")<0,represent:object=>object.toString(10)}),YAML_INTEGER_IMPLICIT_PATTERN=new RegExp("^-?(?:0|[1-9][0-9]*)$"),YAML_INTEGER_EXPLICIT_PATTERN=new RegExp("^(?:[-+]?0b[0-1]+|[-+]?0o[0-7]+|[-+]?0x[0-9a-fA-F]+|[-+]?[0-9]+)$");function parseYamlInteger$1(source){let value=source,sign4=1;return(value[0]==="-"||value[0]==="+")&&(value[0]==="-"&&(sign4=-1),value=value.slice(1)),value.startsWith("0b")?sign4*parseInt(value.slice(2),2):value.startsWith("0o")?sign4*parseInt(value.slice(2),8):value.startsWith("0x")?sign4*parseInt(value.slice(2),16):sign4*parseInt(value,10)}function resolveYamlInteger$1(source,isExplicit){if(isExplicit){if(!YAML_INTEGER_EXPLICIT_PATTERN.test(source))return NOT_RESOLVED}else if(!YAML_INTEGER_IMPLICIT_PATTERN.test(source))return NOT_RESOLVED;let result=parseYamlInteger$1(source);return Number.isFinite(result)?result:NOT_RESOLVED}var intJsonTag=defineScalarTag("tag:yaml.org,2002:int",{implicit:!0,implicitFirstChars:["-",..."0123456789"],resolve:resolveYamlInteger$1,identify:object=>Number.isInteger(object)&&!Object.is(object,-0)&&object.toString(10).indexOf("e")<0,represent:object=>object.toString(10)}),YAML_INTEGER_PATTERN=new RegExp("^(?:[-+]?0b[0-1_]+|[-+]?0[0-7_]+|[-+]?0x[0-9a-fA-F_]+|[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+|[-+]?(?:0|[1-9][0-9_]*))$");function parseYamlInteger(source){let value=source.replace(/_/g,""),sign4=1;if((value[0]==="-"||value[0]==="+")&&(value[0]==="-"&&(sign4=-1),value=value.slice(1)),value.startsWith("0b"))return sign4*parseInt(value.slice(2),2);if(value.startsWith("0x"))return sign4*parseInt(value.slice(2),16);if(value.includes(":")){let result=0;for(let part of value.split(":"))result=result*60+Number(part);return sign4*result}return value!=="0"&&value[0]==="0"?sign4*parseInt(value,8):sign4*parseInt(value,10)}function resolveYamlInteger(source){if(!YAML_INTEGER_PATTERN.test(source))return NOT_RESOLVED;let result=parseYamlInteger(source);return Number.isFinite(result)?result:NOT_RESOLVED}var intYaml11Tag=defineScalarTag("tag:yaml.org,2002:int",{implicit:!0,implicitFirstChars:["-","+",..."0123456789"],resolve:resolveYamlInteger,identify:object=>Number.isInteger(object)&&!Object.is(object,-0)&&object.toString(10).indexOf("e")<0,represent:object=>object.toString(10)}),YAML_FLOAT_PATTERN$1=new RegExp("^(?:[-+]?[0-9]+(?:\\.[0-9]*)?(?:[eE][-+]?[0-9]+)?|[-+]?\\.[0-9]+(?:[eE][-+]?[0-9]+)?|[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$"),YAML_FLOAT_SPECIAL_PATTERN$1=new RegExp("^(?:[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$");function resolveYamlFloat$2(source){if(!YAML_FLOAT_PATTERN$1.test(source))return NOT_RESOLVED;let value=source.toLowerCase(),sign4=value[0]==="-"?-1:1;if("+-".includes(value[0])&&(value=value.slice(1)),value===".inf")return sign4===1?Number.POSITIVE_INFINITY:Number.NEGATIVE_INFINITY;if(value===".nan")return NaN;let result=sign4*parseFloat(value);return Number.isFinite(result)||YAML_FLOAT_SPECIAL_PATTERN$1.test(source)?result:NOT_RESOLVED}function representYamlFloat$2(object){if(isNaN(object))return".nan";if(object===Number.POSITIVE_INFINITY)return".inf";if(object===Number.NEGATIVE_INFINITY)return"-.inf";if(Object.is(object,-0))return"-0.0";let result=object.toString(10);return/^[-+]?[0-9]+e/.test(result)?result.replace("e",".e"):result}var floatCoreTag=defineScalarTag("tag:yaml.org,2002:float",{implicit:!0,implicitFirstChars:["-","+",".",..."0123456789"],resolve:resolveYamlFloat$2,identify:object=>typeof object=="number"&&(!Number.isInteger(object)||Object.is(object,-0)||object.toString(10).indexOf("e")>=0),represent:representYamlFloat$2}),YAML_FLOAT_IMPLICIT_PATTERN=new RegExp("^-?(?:0|[1-9][0-9]*)(?:\\.[0-9]*)?(?:[eE][-+]?[0-9]+)?$"),YAML_FLOAT_EXPLICIT_PATTERN=new RegExp("^(?:[-+]?[0-9]+(?:\\.[0-9]*)?(?:[eE][-+]?[0-9]+)?|[-+]?\\.[0-9]+(?:[eE][-+]?[0-9]+)?|[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$");function resolveYamlFloat$1(source,isExplicit){if(isExplicit){if(!YAML_FLOAT_EXPLICIT_PATTERN.test(source))return NOT_RESOLVED;let value=source.toLowerCase(),sign4=value[0]==="-"?-1:1;if("+-".includes(value[0])&&(value=value.slice(1)),value===".inf")return sign4===1?Number.POSITIVE_INFINITY:Number.NEGATIVE_INFINITY;if(value===".nan")return NaN;let result2=sign4*parseFloat(value);return Number.isFinite(result2)?result2:NOT_RESOLVED}if(!YAML_FLOAT_IMPLICIT_PATTERN.test(source))return NOT_RESOLVED;let result=Number(source);return Number.isFinite(result)?result:NOT_RESOLVED}function representYamlFloat$1(object){if(isNaN(object))return".nan";if(object===Number.POSITIVE_INFINITY)return".inf";if(object===Number.NEGATIVE_INFINITY)return"-.inf";if(Object.is(object,-0))return"-0.0";let result=object.toString(10);return/^[-+]?[0-9]+e/.test(result)?result.replace("e",".e"):result}var floatJsonTag=defineScalarTag("tag:yaml.org,2002:float",{implicit:!0,implicitFirstChars:["-",..."0123456789"],resolve:resolveYamlFloat$1,identify:object=>typeof object=="number"&&(!Number.isInteger(object)||Object.is(object,-0)||object.toString(10).indexOf("e")>=0),represent:representYamlFloat$1}),YAML_FLOAT_PATTERN=new RegExp("^(?:[-+]?(?:(?:[0-9][0-9_]*)?\\.[0-9_]*)(?:[eE][-+][0-9]+)?|[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+\\.[0-9_]*|[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$"),YAML_FLOAT_SPECIAL_PATTERN=new RegExp("^(?:[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$");function resolveYamlFloat(source){if(!YAML_FLOAT_PATTERN.test(source))return NOT_RESOLVED;let value=source.toLowerCase().replace(/_/g,""),sign4=value[0]==="-"?-1:1;if("+-".includes(value[0])&&(value=value.slice(1)),value===".inf")return sign4===1?Number.POSITIVE_INFINITY:Number.NEGATIVE_INFINITY;if(value===".nan")return NaN;let result=0;if(value.includes(":")){for(let part of value.split(":"))result=result*60+Number(part);result*=sign4}else result=sign4*parseFloat(value);return Number.isFinite(result)||YAML_FLOAT_SPECIAL_PATTERN.test(source)?result:NOT_RESOLVED}function representYamlFloat(object){if(isNaN(object))return".nan";if(object===Number.POSITIVE_INFINITY)return".inf";if(object===Number.NEGATIVE_INFINITY)return"-.inf";if(Object.is(object,-0))return"-0.0";let result=object.toString(10);return/^[-+]?[0-9]+e/.test(result)?result.replace("e",".e"):result}var floatYaml11Tag=defineScalarTag("tag:yaml.org,2002:float",{implicit:!0,implicitFirstChars:["-","+",".",..."0123456789"],resolve:resolveYamlFloat,identify:object=>typeof object=="number"&&(!Number.isInteger(object)||Object.is(object,-0)||object.toString(10).indexOf("e")>=0),represent:representYamlFloat}),mergeTag=defineScalarTag("tag:yaml.org,2002:merge",{implicit:!0,implicitFirstChars:["<"],resolve:(source,isExplicit)=>source==="<<"||isExplicit&&source===""?"<<":NOT_RESOLVED,identify:()=>!1}),BASE64_PATTERN=/^[A-Za-z0-9+/]*={0,2}$/;function resolveYamlBinary(source){let input=source.replace(/\s/g,"");if(input.length%4!==0||!BASE64_PATTERN.test(input))return NOT_RESOLVED;let binary2=atob(input),result=new Uint8Array(binary2.length);for(let index2=0;index2<binary2.length;index2++)result[index2]=binary2.charCodeAt(index2);return result}function representYamlBinary(object){let binary2="";for(let index2=0;index2<object.length;index2++)binary2+=String.fromCharCode(object[index2]);return btoa(binary2)}var binaryTag=defineScalarTag("tag:yaml.org,2002:binary",{resolve:resolveYamlBinary,identify:object=>Object.prototype.toString.call(object)==="[object Uint8Array]",represent:representYamlBinary}),YAML_DATE_REGEXP=new RegExp("^([0-9][0-9][0-9][0-9])-([0-9][0-9])-([0-9][0-9])$"),YAML_TIMESTAMP_REGEXP=new RegExp("^([0-9][0-9][0-9][0-9])-([0-9][0-9]?)-([0-9][0-9]?)(?:[Tt]|[ \\t]+)([0-9][0-9]?):([0-9][0-9]):([0-9][0-9])(?:\\.([0-9]*))?(?:[ \\t]*(Z|([-+])([0-9][0-9]?)(?::([0-9][0-9]))?))?$");function makeUtcDate(year2,month,day,hour=0,minute=0,second=0,fraction=0){let date2=new Date(Date.UTC(year2,month,day,hour,minute,second,fraction));return date2.setUTCFullYear(year2,month,day),date2}function resolveYamlTimestamp(source){let match=YAML_DATE_REGEXP.exec(source);if(match===null&&(match=YAML_TIMESTAMP_REGEXP.exec(source)),match===null)return NOT_RESOLVED;let year2=+match[1],month=+match[2]-1,day=+match[3];if(!match[4]){let date3=makeUtcDate(year2,month,day);return date3.getUTCFullYear()!==year2||date3.getUTCMonth()!==month||date3.getUTCDate()!==day?NOT_RESOLVED:date3}let hour=+match[4],minute=+match[5],second=+match[6],fraction=0;if(hour>23||minute>59||second>59)return NOT_RESOLVED;if(match[7]){let value=match[7].slice(0,3);for(;value.length<3;)value+="0";fraction=+value}let date2=makeUtcDate(year2,month,day,hour,minute,second,fraction);if(date2.getUTCFullYear()!==year2||date2.getUTCMonth()!==month||date2.getUTCDate()!==day)return NOT_RESOLVED;if(match[9]){let offsetHour=+match[10],offsetMinute=+(match[11]||0);if(offsetHour>23||offsetMinute>59)return NOT_RESOLVED;let offset=(offsetHour*60+offsetMinute)*6e4;date2.setTime(date2.getTime()-(match[9]==="-"?-offset:offset))}return date2}var timestampTag=defineScalarTag("tag:yaml.org,2002:timestamp",{implicit:!0,implicitFirstChars:[..."0123456789"],resolve:resolveYamlTimestamp,identify:object=>object instanceof Date,represent:object=>object.toISOString()}),seqTag=defineSequenceTag("tag:yaml.org,2002:seq",{create:()=>[],addItem:(container,item)=>{container.push(item)},identify:Array.isArray});function isPlainObject(data){if(data===null||typeof data!="object"||Array.isArray(data))return!1;let prototype=Object.getPrototypeOf(data);return prototype===null||prototype===Object.prototype}function pick(object,keys){let result={};for(let key of keys)object[key]!==void 0&&(result[key]=object[key]);return result}var omapTag=defineSequenceTag("tag:yaml.org,2002:omap",{create:()=>({list:[],seen:new Set}),addItem:(carrier,item)=>{let key;if(item instanceof Map){if(item.size!==1)return"cannot resolve an ordered map item";key=item.keys().next().value}else if(isPlainObject(item)){let itemKeys=Object.keys(item);if(itemKeys.length!==1)return"cannot resolve an ordered map item";key=itemKeys[0]}else return"cannot resolve an ordered map item";return carrier.seen.has(key)?"duplicate key in ordered map":(carrier.seen.add(key),carrier.list.push(item),"")},finalize:carrier=>carrier.list,identify:()=>!1}),pairsTag=defineSequenceTag("tag:yaml.org,2002:pairs",{create:()=>[],addItem:(container,item)=>{if(item instanceof Map)return item.size!==1?"cannot resolve a pairs item":(container.push(item.entries().next().value),"");if(Object.prototype.toString.call(item)!=="[object Object]")return"cannot resolve a pairs item";let object=item,keys=Object.keys(object);return keys.length!==1?"cannot resolve a pairs item":(container.push([keys[0],object[keys[0]]]),"")},identify:()=>!1}),mapTag=defineMappingTag("tag:yaml.org,2002:map",{create:()=>({}),identify:isPlainObject,represent:o3=>{let map5=new Map;for(let key of Object.keys(o3))map5.set(key,o3[key]);return map5},addPair:(container,key,value)=>{if(key!==null&&typeof key=="object")return"object-based map does not support complex keys";let normalizedKey=String(key);return normalizedKey==="__proto__"?Object.defineProperty(container,normalizedKey,{value,enumerable:!0,configurable:!0,writable:!0}):container[normalizedKey]=value,""},has:(container,key)=>key!==null&&typeof key=="object"?!1:Object.prototype.hasOwnProperty.call(container,String(key)),keys:container=>Object.keys(container),get:(container,key)=>{let normalizedKey=String(key);return Object.prototype.hasOwnProperty.call(container,normalizedKey)?container[normalizedKey]:null}}),setTag=defineMappingTag("tag:yaml.org,2002:set",{create:()=>new Set,identify:data=>data instanceof Set,represent:data=>{let map5=new Map;for(let key of data)map5.set(key,null);return map5},addPair:(container,key,value)=>value!==null?"cannot resolve a set item":(container.add(key),""),has:(container,key)=>container.has(key),keys:container=>container.keys(),get:()=>null});function createTagDefinitionMap(){return{scalar:Object.create(null),sequence:Object.create(null),mapping:Object.create(null)}}function createTagDefinitionListMap(){return{scalar:[],sequence:[],mapping:[]}}function compileTags(tags){let result=[];for(let tag2 of tags){let index2=result.length;for(let previousIndex=0;previousIndex<result.length;previousIndex++){let previous=result[previousIndex];if(previous.nodeKind===tag2.nodeKind&&previous.tagName===tag2.tagName&&previous.matchByTagPrefix===tag2.matchByTagPrefix){index2=previousIndex;break}}result[index2]=tag2}return result}var Schema3=class Schema4{tags;implicitScalarTags;implicitScalarByFirstChar;implicitScalarAnyFirstChar;defaultScalarTag;defaultSequenceTag;defaultMappingTag;exact;prefix;constructor(tags){let compiledTags=compileTags(tags),implicitScalarTags=[],exact=createTagDefinitionMap(),prefix=createTagDefinitionListMap();for(let tag2 of compiledTags){if(tag2.nodeKind==="scalar"&&tag2.implicit){if(tag2.matchByTagPrefix)throw new Error("Implicit scalar tags cannot match by tag prefix");implicitScalarTags.push(tag2)}switch(tag2.nodeKind){case"scalar":tag2.matchByTagPrefix?prefix.scalar.push(tag2):exact.scalar[tag2.tagName]=tag2;break;case"sequence":tag2.matchByTagPrefix?prefix.sequence.push(tag2):exact.sequence[tag2.tagName]=tag2;break;case"mapping":tag2.matchByTagPrefix?prefix.mapping.push(tag2):exact.mapping[tag2.tagName]=tag2;break}}let implicitScalarAnyFirstChar=implicitScalarTags.filter(tag2=>tag2.implicitFirstChars===null),keys=new Set;for(let tag2 of implicitScalarTags)if(tag2.implicitFirstChars!==null)for(let key of tag2.implicitFirstChars)keys.add(key);let implicitScalarByFirstChar=new Map;for(let key of keys)implicitScalarByFirstChar.set(key,implicitScalarTags.filter(tag2=>tag2.implicitFirstChars===null||tag2.implicitFirstChars.indexOf(key)!==-1));let defaultScalarTag=exact.scalar["tag:yaml.org,2002:str"];if(!defaultScalarTag)throw new Error("schema does not define the default scalar tag (tag:yaml.org,2002:str)");this.tags=compiledTags,this.implicitScalarTags=implicitScalarTags,this.implicitScalarByFirstChar=implicitScalarByFirstChar,this.implicitScalarAnyFirstChar=implicitScalarAnyFirstChar,this.defaultScalarTag=defaultScalarTag,this.defaultSequenceTag=exact.sequence["tag:yaml.org,2002:seq"],this.defaultMappingTag=exact.mapping["tag:yaml.org,2002:map"],this.exact=exact,this.prefix=prefix}lookupScalarTag(tagName){let exactTag=this.exact.scalar[tagName];if(exactTag)return exactTag;for(let tag2 of this.prefix.scalar)if(tagName.startsWith(tag2.tagName))return tag2}lookupSequenceTag(tagName){let exactTag=this.exact.sequence[tagName];if(exactTag)return exactTag;for(let tag2 of this.prefix.sequence)if(tagName.startsWith(tag2.tagName))return tag2}lookupMappingTag(tagName){let exactTag=this.exact.mapping[tagName];if(exactTag)return exactTag;for(let tag2 of this.prefix.mapping)if(tagName.startsWith(tag2.tagName))return tag2}resolveImplicitScalarTag(source){let candidates=this.implicitScalarByFirstChar.get(source.charAt(0))??this.implicitScalarAnyFirstChar;for(let tag3 of candidates){let value=tag3.resolve(source,!1,tag3.tagName);if(value!==NOT_RESOLVED)return{value,tag:tag3}}let tag2=this.defaultScalarTag;return{value:tag2.resolve(source,!1,tag2.tagName),tag:tag2}}withTags(...tags){let flatTags=[];for(let tag2 of tags)flatTags=flatTags.concat(tag2);return new Schema4([...this.tags,...flatTags])}},FAILSAFE_SCHEMA2=new Schema3([strTag,seqTag,mapTag]),JSON_SCHEMA2=new Schema3([...FAILSAFE_SCHEMA2.tags,nullJsonTag,boolJsonTag,intJsonTag,floatJsonTag]),CORE_SCHEMA2=new Schema3([...FAILSAFE_SCHEMA2.tags,nullCoreTag,boolCoreTag,intCoreTag,floatCoreTag]),YAML11_SCHEMA=new Schema3([...FAILSAFE_SCHEMA2.tags,nullYaml11Tag,boolYaml11Tag,intYaml11Tag,floatYaml11Tag,timestampTag,mergeTag,binaryTag,omapTag,pairsTag,setTag]),DUMP_SCHEMA=YAML11_SCHEMA.withTags({...intYaml11Tag,resolve:(source,isExplicit,tagName)=>{let result=intYaml11Tag.resolve(source,isExplicit,tagName);return result===NOT_RESOLVED?intCoreTag.resolve(source,isExplicit,tagName):result}},{...floatYaml11Tag,resolve:(source,isExplicit,tagName)=>{let result=floatYaml11Tag.resolve(source,isExplicit,tagName);return result===NOT_RESOLVED?floatCoreTag.resolve(source,isExplicit,tagName):result}}),realMapTag=defineMappingTag("tag:yaml.org,2002:map",{create:()=>new Map,addPair:(container,key,value)=>(container.set(key,value),""),has:(container,key)=>container.has(key),keys:container=>container.keys(),get:(container,key)=>container.get(key),identify:data=>data instanceof Map||isPlainObject(data),represent:data=>{if(data instanceof Map)return data;let map5=new Map,obj=data;for(let key of Object.keys(obj))map5.set(key,obj[key]);return map5}});function normalizeKey(key){if(Array.isArray(key)){let array=Array.prototype.slice.call(key);for(let index2=0;index2<array.length;index2++){if(Array.isArray(array[index2]))return null;typeof array[index2]=="object"&&Object.prototype.toString.call(array[index2])==="[object Object]"&&(array[index2]="[object Object]")}return String(array)}return typeof key=="object"&&Object.prototype.toString.call(key)==="[object Object]"?"[object Object]":String(key)}var legacyMapTag=defineMappingTag("tag:yaml.org,2002:map",{create:()=>({}),identify:isPlainObject,represent:o3=>{let map5=new Map;for(let key of Object.keys(o3))map5.set(key,o3[key]);return map5},addPair:(container,key,value)=>{let normalizedKey=normalizeKey(key);return normalizedKey===null?"nested arrays are not supported inside keys":(normalizedKey==="__proto__"?Object.defineProperty(container,normalizedKey,{value,enumerable:!0,configurable:!0,writable:!0}):container[normalizedKey]=value,"")},has:(container,key)=>{let normalizedKey=normalizeKey(key);return normalizedKey!==null&&Object.prototype.hasOwnProperty.call(container,normalizedKey)},keys:container=>Object.keys(container),get:(container,key)=>{let normalizedKey=String(key);return Object.prototype.hasOwnProperty.call(container,normalizedKey)?container[normalizedKey]:null}}),DEFAULT_SNIPPET_OPTIONS={maxLength:79,indent:1,linesBefore:3,linesAfter:2};function getLine(buffer,lineStart,lineEnd,position,maxLineLength){let head="",tail="",maxHalfLength=Math.floor(maxLineLength/2)-1;return position-lineStart>maxHalfLength&&(head=" ... ",lineStart=position-maxHalfLength+head.length),lineEnd-position>maxHalfLength&&(tail=" ...",lineEnd=position+maxHalfLength-tail.length),{str:head+buffer.slice(lineStart,lineEnd).replace(/\t/g,"\u2192")+tail,pos:position-lineStart+head.length}}function padStart(string,max2){return" ".repeat(Math.max(max2-string.length,0))+string}function makeSnippet(mark,options){if(!mark.buffer)return null;let opts={...DEFAULT_SNIPPET_OPTIONS,...options},re2=/\r?\n|\r|\0/g,lineStarts=[0],lineEnds=[],match,foundLineNo=-1;for(;match=re2.exec(mark.buffer);)lineEnds.push(match.index),lineStarts.push(match.index+match[0].length),mark.position<=match.index&&foundLineNo<0&&(foundLineNo=lineStarts.length-2);foundLineNo<0&&(foundLineNo=lineStarts.length-1);let result="",lineNoLength=Math.min(mark.line+opts.linesAfter,lineEnds.length).toString().length,maxLineLength=opts.maxLength-(opts.indent+lineNoLength+3);for(let i6=1;i6<=opts.linesBefore&&!(foundLineNo-i6<0);i6++){let line2=getLine(mark.buffer,lineStarts[foundLineNo-i6],lineEnds[foundLineNo-i6],mark.position-(lineStarts[foundLineNo]-lineStarts[foundLineNo-i6]),maxLineLength);result=`${" ".repeat(opts.indent)}${padStart((mark.line-i6+1).toString(),lineNoLength)} | ${line2.str}
+`],documentationUrl:"/docs/guides/workflows/task-types/eval",isAiNative:!0,requiresExternalService:!1}]};function bundledModelRegistryDocument(){return JSON.stringify(model_registry_default)}function bundledTaskKindRegistryDocument(){return JSON.stringify(task_kind_registry_default)}function convertTaskByKind(kind,typedProto,convertList){switch(kind){case WorkflowTaskKind.set_vars:return convertSetTask(typedProto);case WorkflowTaskKind.http_call:return convertHttpCallTask(typedProto);case WorkflowTaskKind.grpc_call:return convertGrpcCallTask(typedProto);case WorkflowTaskKind.switch_case:return convertSwitchTask(typedProto);case WorkflowTaskKind.for_each:return convertForTask(typedProto,convertList);case WorkflowTaskKind.fork:return convertForkTask(typedProto,convertList);case WorkflowTaskKind.try_catch:return convertTryTask(typedProto,convertList);case WorkflowTaskKind.listen:return convertListenTask(typedProto);case WorkflowTaskKind.wait:return convertWaitTask(typedProto);case WorkflowTaskKind.raise_error:return convertRaiseTask(typedProto);case WorkflowTaskKind.run_workflow:return convertRunTask(typedProto);case WorkflowTaskKind.agent_call:return convertAgentCallTask(typedProto);case WorkflowTaskKind.llm_call:return convertLlmCallTask(typedProto);case WorkflowTaskKind.transform:return convertTransformTask(typedProto);case WorkflowTaskKind.human_input:return convertHumanInputTask(typedProto);case WorkflowTaskKind.validate:return convertValidateTask(typedProto);case WorkflowTaskKind.emit_event:return convertEmitEventTask(typedProto);case WorkflowTaskKind.notification:return convertNotificationTask(typedProto);case WorkflowTaskKind.eval:return convertEvalTask(typedProto);case WorkflowTaskKind.activity_call:throw new Error("activity_call not yet implemented");default:throw new Error(`unsupported task kind: ${WorkflowTaskKind[kind]??kind}`)}}function convertSetTask(cfg){return{set:cfg.variables}}function convertHttpCallTask(cfg){let withBlock={method:cfg.method};cfg.endpoint!==void 0&&(withBlock.endpoint={uri:cfg.endpoint.uri}),Object.keys(cfg.headers).length>0&&(withBlock.headers=cfg.headers),cfg.timeoutSeconds>0&&(withBlock.timeout_seconds=cfg.timeoutSeconds);let body=structAsMap(cfg.body);return body!==void 0&&(withBlock.body=body),{call:"http",with:withBlock}}function convertGrpcCallTask(cfg){let withBlock={service:cfg.service,method:cfg.method},request=structAsMap(cfg.request);return request!==void 0&&(withBlock.request=request),{call:"grpc",with:withBlock}}function convertSwitchTask(cfg){return{switch:cfg.cases.map(switchCase=>{let caseBody={};return switchCase.when!==""&&(caseBody.when=switchCase.when),switchCase.then!==""&&(caseBody.then=switchCase.then),{[switchCase.name!==""?switchCase.name:"default"]:caseBody}})}}function convertForTask(cfg,convertList){let forMap={in:cfg.in};cfg.each!==""&&(forMap.each=cfg.each);let result={for:forMap};return cfg.do.length>0&&(result.do=wrapNestedError("for_each do block",()=>convertList(cfg.do))),result}function convertForkTask(cfg,convertList){let forkMap={branches:cfg.branches.map(branch=>{let branchBody={};return branch.do.length>0&&(branchBody.do=wrapNestedError(`fork branch "${branch.name}" do block`,()=>convertList(branch.do))),{[branch.name]:branchBody}})};return cfg.compete&&(forkMap.compete=!0),{fork:forkMap}}function convertTryTask(cfg,convertList){let result={};if(cfg.try.length>0&&(result.try=wrapNestedError("try block",()=>convertList(cfg.try))),cfg.catch!==void 0){let catchMap={};cfg.catch.as!==""&&(catchMap.as=cfg.catch.as),cfg.catch.do.length>0&&(catchMap.do=wrapNestedError("catch block",()=>convertList(cfg.catch.do))),cfg.catch.compensate&&(catchMap.compensate=!0),result.catch=catchMap}return result}function convertListenTask(cfg){if(cfg.to===void 0)throw new Error("listen task config carries no 'to' block");let eventFilters=cfg.to.signals.map(sig2=>({with:{id:sig2.id,type:sig2.type}})),to={};return cfg.to.mode==="one"&&eventFilters.length===1?to.one=eventFilters[0]:cfg.to.mode==="one"?to.any=eventFilters:to.all=eventFilters,{listen:{to}}}function convertWaitTask(cfg){switch(cfg.waitType.case){case"duration":{let d5=cfg.waitType.value,duration={};return d5.days>0&&(duration.days=d5.days),d5.hours>0&&(duration.hours=d5.hours),d5.minutes>0&&(duration.minutes=d5.minutes),d5.seconds>0&&(duration.seconds=d5.seconds),d5.milliseconds>0&&(duration.milliseconds=d5.milliseconds),{wait:duration}}case"until":return{wait:rfc3339Seconds3(timestampDate(cfg.waitType.value))};default:return{wait:{seconds:0}}}}function rfc3339Seconds3(date2){return date2.toISOString().replace(/\.\d{3}Z$/,"Z")}var RAISE_ERROR_TYPE_MAPPING={validationerror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/validation",status:400},authenticationerror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/authentication",status:401},authorizationerror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/authorization",status:403},configurationerror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/configuration",status:400},timeouterror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/timeout",status:408},communicationerror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/communication",status:502},expressionerror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/expression",status:400},runtimeerror:{typeUri:"https://serverlessworkflow.io/spec/1.0.0/errors/runtime",status:500}};function convertRaiseTask(cfg){let typeUri="https://serverlessworkflow.io/spec/1.0.0/errors/runtime",status=500,key=cfg.error.toLowerCase(),mapped=Object.hasOwn(RAISE_ERROR_TYPE_MAPPING,key)?RAISE_ERROR_TYPE_MAPPING[key]:void 0;mapped!==void 0?(typeUri=mapped.typeUri,status=mapped.status):cfg.error.startsWith("https://")&&(typeUri=cfg.error);let errorDef={type:typeUri,status,title:cfg.error};return cfg.message!==""&&(errorDef.detail=cfg.message),{raise:{error:errorDef}}}function convertRunTask(cfg){let workflow={name:cfg.workflow},input=structAsMap(cfg.input);return input!==void 0&&(workflow.input=input),{run:{workflow}}}function convertLlmCallTask(cfg){let withBlock={model:cfg.model,prompt:cfg.prompt};cfg.systemPrompt!==""&&(withBlock.system_prompt=cfg.systemPrompt);let responseSchema=structAsMap(cfg.responseSchema);return responseSchema!==void 0&&(withBlock.response_schema=responseSchema),cfg.temperature!==0&&(withBlock.temperature=cfg.temperature),cfg.maxTokens>0&&(withBlock.max_tokens=cfg.maxTokens),cfg.timeout>0&&(withBlock.timeout=cfg.timeout),cfg.onInvalid!==OnInvalidOutputPolicy.ON_INVALID_POLICY_UNSPECIFIED&&(withBlock.on_invalid=enumToJson(OnInvalidOutputPolicySchema,cfg.onInvalid)),cfg.maxRetries>0&&(withBlock.max_retries=cfg.maxRetries),cfg.fallbackTask!==""&&(withBlock.fallback_task=cfg.fallbackTask),cfg.maxCostMicros>0n&&(withBlock.max_cost_micros=Number(cfg.maxCostMicros)),cfg.maxTotalTokens>0n&&(withBlock.max_total_tokens=Number(cfg.maxTotalTokens)),{call:"llm",with:withBlock}}function convertTransformTask(cfg){let withBlock={engine:enumToJson(TransformEngineSchema,cfg.engine),expression:cfg.expression};return cfg.input!==""&&(withBlock.input=cfg.input),{call:"transform",with:withBlock}}function convertHumanInputTask(cfg){let withBlock={prompt:cfg.prompt},formSchema=structAsMap(cfg.formSchema);return formSchema!==void 0&&(withBlock.form_schema=formSchema),cfg.outcomes.length>0&&(withBlock.outcomes=cfg.outcomes.map(o3=>{let om={name:o3.name};return o3.label!==""&&(om.label=o3.label),o3.then!==""&&(om.then=o3.then),om})),cfg.approvers.length>0&&(withBlock.approvers=cfg.approvers),cfg.timeout>0&&(withBlock.timeout=cfg.timeout),cfg.onTimeout!==HumanInputTimeoutPolicy.HUMAN_INPUT_TIMEOUT_POLICY_UNSPECIFIED&&(withBlock.on_timeout=enumToJson(HumanInputTimeoutPolicySchema,cfg.onTimeout)),cfg.notificationChannels.length>0&&(withBlock.notification_channels=cfg.notificationChannels),cfg.payload!==void 0&&(withBlock.payload=valueAsInterface(cfg.payload)),cfg.uiHint!==""&&(withBlock.ui_hint=cfg.uiHint),{call:"human_input",with:withBlock}}function convertValidateTask(cfg){let withBlock={input:cfg.input},schema2=structAsMap(cfg.schema);return schema2!==void 0&&(withBlock.schema=schema2),cfg.rules.length>0&&(withBlock.rules=cfg.rules.map(r5=>{let rm2={name:r5.name,expression:r5.expression};return r5.message!==""&&(rm2.message=r5.message),rm2})),cfg.onFail!==ValidationFailPolicy.VALIDATION_FAIL_POLICY_UNSPECIFIED&&(withBlock.on_fail=enumToJson(ValidationFailPolicySchema,cfg.onFail)),cfg.fallbackTask!==""&&(withBlock.fallback_task=cfg.fallbackTask),{call:"validate",with:withBlock}}function convertEmitEventTask(cfg){if(cfg.event===void 0)throw new Error("emit_event task config carries no 'event' block");let event={type:cfg.event.type};cfg.event.source!==""&&(event.source=cfg.event.source),cfg.event.subject!==""&&(event.subject=cfg.event.subject);let data=structAsMap(cfg.event.data);data!==void 0&&(event.data=data);let withBlock={event};if(cfg.delivery.length>0){let targets=[];for(let target of cfg.delivery)switch(target.target.case){case"webhook":{let webhook={url:target.target.value.url};Object.keys(target.target.value.headers).length>0&&(webhook.headers=target.target.value.headers),targets.push({webhook});break}case"signal":targets.push({signal:{execution_id:target.target.value.executionId,signal_name:target.target.value.signalName}});break}withBlock.delivery=targets}return{call:"emit_event",with:withBlock}}function convertNotificationTask(cfg){let withBlock={channel:cfg.channel,recipients:cfg.recipients,body:cfg.body};return cfg.subject!==""&&(withBlock.subject=cfg.subject),cfg.template!==""&&(withBlock.template=cfg.template),Object.keys(cfg.metadata).length>0&&(withBlock.metadata=cfg.metadata),{call:"notification",with:withBlock}}function convertEvalTask(cfg){let withBlock={model:cfg.model,subject:cfg.subject,rubric:cfg.rubric};return cfg.scoringMode!==EvalScoringMode.EVAL_SCORING_MODE_UNSPECIFIED&&(withBlock.scoring_mode=enumToJson(EvalScoringModeSchema,cfg.scoringMode)),cfg.threshold!==0&&(withBlock.threshold=cfg.threshold),cfg.onFail!==EvalFailPolicy.EVAL_FAIL_POLICY_UNSPECIFIED&&(withBlock.on_fail=enumToJson(EvalFailPolicySchema,cfg.onFail)),cfg.fallbackTask!==""&&(withBlock.fallback_task=cfg.fallbackTask),cfg.systemPrompt!==""&&(withBlock.system_prompt=cfg.systemPrompt),cfg.criteria.length>0&&(withBlock.criteria=cfg.criteria.map(cr=>{let cm={name:cr.name,description:cr.description};return cr.weight!==0&&(cm.weight=cr.weight),cm})),cfg.maxCostMicros>0n&&(withBlock.max_cost_micros=Number(cfg.maxCostMicros)),{call:"eval",with:withBlock}}function convertAgentCallTask(cfg){let withBlock={agent:cfg.agent,message:cfg.message};Object.keys(cfg.env).length>0&&(withBlock.env=cfg.env);let rc=cfg.runConfig;if(rc!==void 0){let runConfig={};switch(rc.modelName!==""&&(runConfig.model_name=rc.modelName),rc.maxCostUsd>0&&(runConfig.max_cost_usd=rc.maxCostUsd),rc.maxToolRounds>0&&(runConfig.max_tool_rounds=rc.maxToolRounds),rc.serviceTier){case ServiceTier.STANDARD:runConfig.service_tier="standard";break;case ServiceTier.FAST:runConfig.service_tier="fast";break}switch(rc.thinkingMode){case ThinkingMode.DISABLED:runConfig.thinking_mode="disabled";break;case ThinkingMode.ENABLED:runConfig.thinking_mode="enabled";break}Object.keys(runConfig).length>0&&(withBlock.run_config=runConfig)}if(cfg.output!==void 0){let output={};cfg.output.schema!==void 0&&(output.schema=cfg.output.schema),cfg.output.onInvalid!==OnInvalidOutputPolicy.ON_INVALID_POLICY_UNSPECIFIED&&(output.on_invalid=enumToJson(OnInvalidOutputPolicySchema,cfg.output.onInvalid)),cfg.output.maxRetries>0&&(output.max_retries=cfg.output.maxRetries),cfg.output.fallbackTask!==""&&(output.fallback_task=cfg.output.fallbackTask),Object.keys(output).length>0&&(withBlock.output=output)}switch(cfg.harness){case Harness.NATIVE:withBlock.harness="native";break;case Harness.CURSOR:withBlock.harness="cursor";break}if(cfg.workspaceEntries.length>0){let entries=[];for(let entry of cfg.workspaceEntries){let m3={};if(entry.name!==""&&(m3.name=entry.name),entry.source?.source.case==="gitRepo"){let git=entry.source.source.value,gitRepo={url:git.url};git.branch!==""&&(gitRepo.branch=git.branch),m3.source={git_repo:gitRepo}}entries.push(m3)}withBlock.workspace_entries=entries}return{call:"agent",with:withBlock}}function structAsMap(s2){if(s2!==void 0)return Object.keys(s2).length>0?s2:void 0}function valueAsInterface(v){return toJson(ValueSchema,v)}function wrapNestedError(context2,fn){try{return fn()}catch(error2){throw new Error(`${context2}: ${error2 instanceof Error?error2.message:String(error2)}`)}}function protoToYaml(spec){if(spec===void 0)throw new Error("workflow spec cannot be nil");if(spec.document===void 0)throw new Error("workflow document cannot be nil");if(spec.tasks.length===0)throw new Error("workflow must have at least one task");let doTasks=spec.tasks.map(task=>{try{return convertTask(task)}catch(error2){throw new Error(`failed to convert task '${task.name}': ${errorMessage2(error2)}`)}}),workflow={document:buildDocument(spec.document),do:doTasks};return yaml.dump(workflow,{sortKeys:!0,lineWidth:-1,noRefs:!0})}function buildDocument(doc){let result={dsl:doc.dsl,namespace:doc.namespace,name:doc.name,version:doc.version};return doc.description!==""&&(result.description=doc.description),result}function convertTask(task){if(task.name==="")throw new Error("task name is required");let taskConfig;try{taskConfig=unmarshalTaskConfig(task.kind,task.taskConfig)}catch(error2){throw new Error(`failed to unmarshal task '${task.name}' config: ${errorMessage2(error2)}`)}let taskDef;try{taskDef=convertTaskByKind(task.kind,taskConfig,convertTaskList)}catch(error2){throw new Error(`task '${task.name}': ${errorMessage2(error2)}`)}if(task.export!==void 0&&task.export.as!==""&&(taskDef.export={as:task.export.as}),task.flow!==void 0&&task.flow.then!==""&&(taskDef.then=task.flow.then),task.compensate.length>0){let compTasks=wrapCompensateError(task.name,()=>convertTaskList(task.compensate)),metadata=taskDef.metadata??{};metadata.__stigmer_compensate=compTasks,taskDef.metadata=metadata}return{[task.name]:taskDef}}function convertTaskList(tasks){return tasks.map(task=>convertTask(task))}function wrapCompensateError(taskName,fn){try{return fn()}catch(error2){throw new Error(`task '${taskName}' compensate: ${errorMessage2(error2)}`)}}function errorMessage2(error2){return error2 instanceof Error?error2.message:String(error2)}var GO_2DP=new Intl.NumberFormat("en-US",{minimumFractionDigits:2,maximumFractionDigits:2,useGrouping:!1,roundingMode:"halfEven"});function checkBudgetWarnings(budget,tasks){let hasCostBearingTasks=tasks.some(task=>task.kind===WorkflowTaskKind.llm_call||task.kind===WorkflowTaskKind.agent_call);if(budget===void 0)return hasCostBearingTasks?["Workflow contains cost-incurring tasks (agent_call, llm_call) but no budget limit is set. Consider adding a budget to prevent unexpected costs."]:[];let warnings=[],hasLimits=budget.maxCostMicros>0n||budget.maxTotalTokens>0n||budget.maxDurationSeconds>0;if(budget.onExceeded===BudgetExceededPolicy.budget_exceeded_terminate&&(budget.maxCostMicros===0n&&warnings.push("Budget has zero max_cost_micros with terminate policy; workflow will fail immediately on first cost-bearing task"),budget.maxTotalTokens===0n&&warnings.push("Budget has zero max_total_tokens with terminate policy; workflow will fail immediately on first cost-bearing task")),!hasCostBearingTasks&&(budget.maxCostMicros>0n||budget.maxTotalTokens>0n)&&warnings.push("Budget is configured but workflow contains no cost-bearing task kinds (llm_call, agent_call)"),hasLimits&&budget.onExceeded===BudgetExceededPolicy.budget_exceeded_policy_unspecified&&warnings.push("Budget limits are set but on_exceeded policy is not specified; defaults to terminate"),budget.maxDurationSeconds>0&&budget.maxDurationSeconds<10&&warnings.push(`Budget duration of ${budget.maxDurationSeconds} seconds may be too short for workflow execution`),budget.maxCostMicros>0n){let perTaskEntries=[];for(let task of tasks)switch(task.kind){case WorkflowTaskKind.llm_call:{let cfg=tryUnmarshalTaskConfig(task.kind,task.taskConfig);cfg!==void 0&&cfg.maxCostMicros>0n&&perTaskEntries.push({name:task.name,costMicros:Number(cfg.maxCostMicros),fieldLabel:`max_cost_micros (${cfg.maxCostMicros})`});break}case WorkflowTaskKind.agent_call:{let usd=tryUnmarshalTaskConfig(task.kind,task.taskConfig)?.runConfig?.maxCostUsd??0;usd>0&&perTaskEntries.push({name:task.name,costMicros:usdToMicros(usd),fieldLabel:`run_config.max_cost_usd ($${GO_2DP.format(usd)})`});break}}let budgetMicros=Number(budget.maxCostMicros),perTaskCostSum=0;for(let entry of perTaskEntries)perTaskCostSum+=entry.costMicros,entry.costMicros>budgetMicros&&warnings.push(`Task '${entry.name}' has ${entry.fieldLabel} that exceeds the workflow budget max_cost_micros (${budget.maxCostMicros}).`);perTaskCostSum>budgetMicros&&perTaskEntries.length>1&&warnings.push(`Combined per-task cost limits ($${GO_2DP.format(perTaskCostSum/1e6)}) exceed the workflow budget ($${GO_2DP.format(budgetMicros/1e6)}). Some tasks may be terminated before reaching their individual limits.`)}return warnings}function usdToMicros(usd){return Math.round(usd*1e6)}function validateTaskKinds(spec){if(spec===void 0||spec.tasks.length===0)return[];let errors=[];for(let task of spec.tasks)(WorkflowTaskKind[task.kind]===void 0||task.kind===0)&&errors.push(`task '${task.name}': unknown or unspecified task kind (value=${task.kind})`);return errors}function validateCrossTaskReferences(spec){if(spec===void 0||spec.tasks.length===0)return[];let errors=[],taskNames=buildTaskNameSet(spec.tasks);errors.push(...validateUniqueTaskNames(spec.tasks)),errors.push(...validateFlowReferences(spec.tasks,taskNames));for(let task of spec.tasks)task.taskConfig!==void 0&&errors.push(...extractAndValidateRefs(task.name,task.kind,task.taskConfig,taskNames));return errors.push(...validateNoCycles(spec.tasks,taskNames)),errors}function buildTaskNameSet(tasks){let names=new Set;for(let t of tasks)t.name!==""&&names.add(t.name);return names}function validateUniqueTaskNames(tasks){let seen=new Map,errors=[];return tasks.forEach((task,i6)=>{if(task.name==="")return;let firstIdx=seen.get(task.name);firstIdx!==void 0&&errors.push(`duplicate task name "${task.name}" at tasks[${i6}]: already defined at tasks[${firstIdx}]`),seen.set(task.name,i6)}),errors}function validateFlowReferences(tasks,taskNames){let errors=[];for(let task of tasks){if(task.flow===void 0||task.flow.then==="")continue;let then=task.flow.then;if(then!=="end"&&!taskNames.has(then)){let suggestion=suggestSimilar(then,taskNames),msg=`task '${task.name}' flow.then references unknown task '${then}'`;suggestion!==""&&(msg+=` (did you mean '${suggestion}'?)`),errors.push(msg)}}return errors}function validateNoCycles(tasks,taskNames){let graph=new Map;for(let task of tasks)task.flow===void 0||task.flow.then===""||graph.set(task.name,task.flow.then);let visited=new Set,path14=new Set,pathOrder=[],errors=[],dfs=node=>{if(path14.has(node)){let startIdx=pathOrder.indexOf(node),cycleParts=[...pathOrder.slice(startIdx),node];errors.push(`circular dependency detected: ${cycleParts.join(" -> ")}`);return}if(visited.has(node))return;visited.add(node),path14.add(node),pathOrder.push(node);let next=graph.get(node);next!==void 0&&next!=="end"&&taskNames.has(next)&&dfs(next),path14.delete(node),pathOrder.pop()};for(let name of taskNames)visited.has(name)||dfs(name);return errors}function extractAndValidateRefs(taskName,kind,config2,validNames){let errors=[],fields2=config2;switch(kind){case WorkflowTaskKind.llm_call:case WorkflowTaskKind.validate:{let ref=getStringField(fields2,"fallbackTask","fallback_task");if(ref!==""&&!validNames.has(ref)){let suggestion=suggestSimilar(ref,validNames),msg=`task '${taskName}' (${enumToJson(WorkflowTaskKindSchema,kind)}) fallback_task references unknown task '${ref}'`;suggestion!==""&&(msg+=` (did you mean '${suggestion}'?)`),errors.push(msg)}break}case WorkflowTaskKind.agent_call:{let output=getStructField(fields2,"output");if(output!==void 0){let ref=getStringField(output,"fallbackTask","fallback_task");if(ref!==""&&!validNames.has(ref)){let suggestion=suggestSimilar(ref,validNames),msg=`task '${taskName}' (agent_call) output.fallback_task references unknown task '${ref}'`;suggestion!==""&&(msg+=` (did you mean '${suggestion}'?)`),errors.push(msg)}}break}case WorkflowTaskKind.switch_case:{getListField(fields2,"cases").forEach((c5,i6)=>{let caseStruct=structValueOf(c5);if(caseStruct===void 0)return;let ref=getStringField(caseStruct,"then");if(ref!==""&&ref!=="end"&&!validNames.has(ref)){let suggestion=suggestSimilar(ref,validNames),msg=`task '${taskName}' (switch_case) cases[${i6}].then references unknown task '${ref}'`;suggestion!==""&&(msg+=` (did you mean '${suggestion}'?)`),errors.push(msg)}});break}case WorkflowTaskKind.human_input:{getListField(fields2,"outcomes").forEach((o3,i6)=>{let outcomeStruct=structValueOf(o3);if(outcomeStruct===void 0)return;let ref=getStringField(outcomeStruct,"then");if(ref!==""&&ref!=="end"&&!validNames.has(ref)){let suggestion=suggestSimilar(ref,validNames),msg=`task '${taskName}' (human_input) outcomes[${i6}].then references unknown task '${ref}'`;suggestion!==""&&(msg+=` (did you mean '${suggestion}'?)`),errors.push(msg)}});break}}return errors}function validateTaskConfigSurfaceRules(spec){if(spec===void 0||spec.tasks.length===0)return[];let errors=[],visit2=task=>{if(errors.push(...taskSurfaceViolations(task)),task.taskConfig!==void 0){let config2;try{config2=unmarshalTaskConfig(task.kind,task.taskConfig)}catch{config2=void 0}if(config2!==void 0)for(let nested of nestedTasks(config2))visit2(nested)}for(let compensate of task.compensate)visit2(compensate)};for(let task of spec.tasks)visit2(task);return errors}function taskSurfaceViolations(task){switch(task.kind){case WorkflowTaskKind.agent_call:return agentCallWorkspaceViolations(task);case WorkflowTaskKind.run_workflow:return[`task '${task.name}' (run_workflow): running a child workflow is not supported yet \u2014 the child name cannot be resolved to a workflow the platform can run`];default:return[]}}function agentCallWorkspaceViolations(task){if(task.taskConfig===void 0)return[];let errors=[];return getListField(task.taskConfig,"workspace_entries").forEach((v,i6)=>{let entry=structValueOf(v);if(entry===void 0)return;let source=getStructField(entry,"source");source!==void 0&&getStructField(source,"git_repo")===void 0&&errors.push(`task '${task.name}' (agent_call): workspace_entries[${i6}] must use a git_repo source \u2014 no client is connected to serve a local_path when a workflow task fires`)}),errors}function getStringField(fields2,...keys){for(let key of keys){let v=fields2[key];if(typeof v=="string"&&v!=="")return v}return""}function getStructField(fields2,...keys){for(let key of keys){let v=fields2[key];if(v!==void 0)return structValueOf(v)}}function getListField(fields2,key){let v=fields2[key];return Array.isArray(v)?v:[]}function structValueOf(v){return typeof v=="object"&&v!==null&&!Array.isArray(v)?v:void 0}function suggestSimilar(target,names){let bestName="",bestDist=4;for(let name of[...names].sort()){let d5=levenshtein(target.toLowerCase(),name.toLowerCase());d5<bestDist&&(bestDist=d5,bestName=name)}return bestDist<=3?bestName:""}function levenshtein(a5,b7){let la=a5.length,lb=b7.length;if(la===0)return lb;if(lb===0)return la;let prev=new Array(lb+1),curr=new Array(lb+1);for(let j5=0;j5<=lb;j5++)prev[j5]=j5;for(let i6=1;i6<=la;i6++){curr[0]=i6;for(let j5=1;j5<=lb;j5++){let cost=a5.charCodeAt(i6-1)===b7.charCodeAt(j5-1)?0:1;curr[j5]=Math.min(curr[j5-1]+1,prev[j5]+1,prev[j5-1]+cost)}[prev,curr]=[curr,prev]}return prev[lb]}function checkExpressionWarnings(spec){if(spec===void 0||spec.tasks.length===0)return[];let warnings=[];for(let task of spec.tasks)if(task.taskConfig!==void 0)for(let envKey of findContextEnvRefs(task.taskConfig))warnings.push(`task '${task.name}': expression references '$context.env.${envKey}' which resolves to null. Environment variables are accessed via '$env.${envKey}', not '$context.env.${envKey}'. $context holds accumulated task outputs, not environment variables.`);return warnings}function findContextEnvRefs(s2){let keys=[];for(let v of Object.values(s2))keys.push(...findContextEnvRefsInValue(v));return keys}function findContextEnvRefsInValue(v){if(typeof v=="string")return extractContextEnvKeys(v);if(Array.isArray(v)){let keys=[];for(let elem of v)keys.push(...findContextEnvRefsInValue(elem));return keys}return typeof v=="object"&&v!==null?findContextEnvRefs(v):[]}function extractContextEnvKeys(s2){let pattern="$context.env.",keys=[];for(;;){let idx=s2.indexOf(pattern);if(idx<0)break;let rest=s2.slice(idx+pattern.length),keyEnd=0;for(;keyEnd<rest.length&&isEnvKeyChar(rest.charCodeAt(keyEnd));)keyEnd++;keyEnd>0&&keys.push(rest.slice(0,keyEnd)),s2=rest.slice(keyEnd)}return keys}function isEnvKeyChar(c5){return c5>=65&&c5<=90||c5>=97&&c5<=122||c5>=48&&c5<=57||c5===95}function validateHumanInputTimeoutPolicies(spec){if(spec===void 0||spec.tasks.length===0)return[];let escalate=HumanInputTimeoutPolicy.HUMAN_INPUT_TIMEOUT_ESCALATE,escalateName=enumToJson(HumanInputTimeoutPolicySchema,escalate),errors=[];for(let task of spec.tasks){if(task.kind!==WorkflowTaskKind.human_input||task.taskConfig===void 0)continue;let fields2=task.taskConfig,value=fields2.on_timeout;if(value===void 0)continue;let isEscalate=!1;typeof value=="string"?isEscalate=value===escalateName:typeof value=="number"&&(isEscalate=value===escalate),isEscalate&&(hasEscalateOutcomeWithThen(fields2.outcomes)||errors.push(`task '${task.name}' (human_input): on_timeout policy ${escalateName} requires an outcome named 'escalate' with 'then' set \u2014 the timeout resolves to that outcome and follows its 'then' branch`))}return errors}function hasEscalateOutcomeWithThen(outcomes){if(!Array.isArray(outcomes))return!1;for(let entry of outcomes)if(!(typeof entry!="object"||entry===null||Array.isArray(entry))&&stringValueOf(entry.name)==="escalate"&&stringValueOf(entry.then)!=="")return!0;return!1}function stringValueOf(v){return typeof v=="string"?v:""}function validateModelReferences(models,spec){if(spec===void 0||spec.tasks.length===0)return[];if(!models.hasAnyModels())return[];let errors=[];for(let task of spec.tasks){if(task.taskConfig===void 0)continue;let model,harness,kindLabel;switch(task.kind){case WorkflowTaskKind.agent_call:{kindLabel="agent_call";let cfg=tryUnmarshalTaskConfig(task.kind,task.taskConfig);if(cfg===void 0)continue;harness=harnessName(cfg.harness);let tierErr=validateAgentCallServiceTier(models,task.name,harness,cfg.runConfig);tierErr!==""&&errors.push(tierErr);let thinkingErr=validateAgentCallThinkingMode(models,task.name,harness,cfg.runConfig);if(thinkingErr!==""&&errors.push(thinkingErr),(cfg.runConfig?.modelName??"")==="")continue;model=cfg.runConfig.modelName;break}case WorkflowTaskKind.llm_call:{kindLabel="llm_call";let cfg=tryUnmarshalTaskConfig(task.kind,task.taskConfig);if(cfg===void 0||cfg.model==="")continue;model=cfg.model,harness=HARNESS_NAME_NATIVE;break}case WorkflowTaskKind.eval:{kindLabel="eval";let cfg=tryUnmarshalTaskConfig(task.kind,task.taskConfig);if(cfg===void 0||cfg.model==="")continue;model=cfg.model,harness=HARNESS_NAME_NATIVE;break}default:continue}models.hasHarness(harness)&&(models.isValidModel(harness,model)||errors.push(buildModelError(models,task.name,kindLabel,model,harness)))}return errors}function validateAgentCallServiceTier(models,taskName,harness,rc){if(rc?.serviceTier!==ServiceTier.FAST)return"";let modelName=(rc.modelName??"").trim();return modelName===""?`task '${taskName}' (agent_call): run_config.service_tier 'fast' requires run_config.model_name \u2014 the fast tier is a per-model price`:models.hasPricingVariantForHarness(harness,modelName,FAST_VARIANT_KEY)?"":`task '${taskName}' (agent_call): run_config.service_tier 'fast' is not available for model '${modelName}' on harness '${harness}': the model registry prices no fast variant for it${fastCapableSuffix2(models,harness)}`}function validateAgentCallThinkingMode(models,taskName,harness,rc){if(rc?.thinkingMode!==ThinkingMode.ENABLED)return"";let modelName=(rc.modelName??"").trim();return modelName===""?`task '${taskName}' (agent_call): run_config.thinking_mode 'enabled' requires run_config.model_name \u2014 thinking is a per-model capability`:models.hasCapabilityForHarness(harness,modelName,THINKING_CAPABILITY_KEY)?"":`task '${taskName}' (agent_call): run_config.thinking_mode 'enabled' is not available for model '${modelName}' on harness '${harness}': the model registry declares no thinking capability for it${thinkingCapableSuffix2(models,harness)}`}function thinkingCapableSuffix2(models,harness){let capable=models.canonicalModelsWithCapabilityForHarness(harness,THINKING_CAPABILITY_KEY);return capable.length===0?"":`; models with a thinking mode on '${harness}': ${capable.join(", ")}`}function fastCapableSuffix2(models,harness){let capable=models.canonicalModelsWithVariantForHarness(harness,FAST_VARIANT_KEY);return capable.length===0?"":`; models with a fast tier on '${harness}': ${capable.join(", ")}`}function buildModelError(models,taskName,kindLabel,model,harness){let suggestions=suggestSimilarModels(model,models.canonicalModels(harness)),msg=`task '${taskName}' (${kindLabel}): model '${model}' is not a valid model for harness '${harness}'`;if(suggestions.length>0){let quoted=suggestions.map(s2=>`'${s2}'`);msg+=`. Did you mean: ${quoted.join(", ")}?`}return msg}var InProcessValidator=class{modelRegistry;logger;constructor(modelRegistry,logger2){this.modelRegistry=modelRegistry,this.logger=logger2}validate(spec){if(spec===void 0)return create2(ServerlessWorkflowValidationSchema,{state:ValidationState2.FAILED,errors:["WorkflowSpec cannot be nil"],validatedAt:timestampNow()});this.logger.debug("starting in-process workflow validation");let kindErrors=validateTaskKinds(spec);if(kindErrors.length>0)return create2(ServerlessWorkflowValidationSchema,{state:ValidationState2.INVALID,errors:kindErrors,validatedAt:timestampNow()});let yaml2;try{yaml2=protoToYaml(spec)}catch(error2){let message6=error2 instanceof Error?error2.message:String(error2);return this.logger.error("YAML generation failed",{error:message6}),create2(ServerlessWorkflowValidationSchema,{state:ValidationState2.INVALID,errors:[`Failed to generate YAML: ${message6}`],validatedAt:timestampNow()})}this.logger.debug("YAML generation succeeded",{yamlLength:yaml2.length});let errors=[],warnings=[];return errors.push(...validateCrossTaskReferences(spec)),errors.push(...validateTaskConfigConstraints(spec)),errors.push(...validateTaskConfigSurfaceRules(spec)),errors.push(...validateModelReferences(this.modelRegistry,spec)),errors.push(...validateHumanInputTimeoutPolicies(spec)),warnings.push(...checkBudgetWarnings(spec.budget,spec.tasks)),warnings.push(...checkExpressionWarnings(spec)),errors.length>0?(this.logger.warn("validation failed (state: INVALID)",{errors:errors.length,warnings:warnings.length}),create2(ServerlessWorkflowValidationSchema,{state:ValidationState2.INVALID,yaml:yaml2,errors,warnings,validatedAt:timestampNow()})):(this.logger.info("validation passed (state: VALID)",{warnings:warnings.length}),create2(ServerlessWorkflowValidationSchema,{state:ValidationState2.VALID,yaml:yaml2,errors,warnings,validatedAt:timestampNow()}))}};var file_ai_stigmer_agentic_workflowinstance_v1_io=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dpbnN0YW5jZS92MS9pby5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEiKwoSV29ya2Zsb3dJbnN0YW5jZUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEihgEKJUdldFdvcmtmbG93SW5zdGFuY2VzQnlXb3JrZmxvd1JlcXVlc3QSGwoLd29ya2Zsb3dfaWQYASABKAlCBrpIA8gBARIzCglwYWdlX2luZm8YAiABKAsyIC5haS5zdGlnbWVyLmNvbW1vbnMucnBjLlBhZ2VJbmZvEgsKA29yZxgDIAEoCSKsAQoeVXBkYXRlRXhlY3V0aW9uVmlzaWJpbGl0eUlucHV0EhsKC3Jlc291cmNlX2lkGAEgASgJQga6SAPIAQESbQoUZXhlY3V0aW9uX3Zpc2liaWxpdHkYAiABKA4yQy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MS5Xb3JrZmxvd0V4ZWN1dGlvblZpc2liaWxpdHlCCrpIB4IBBBABIAAidgoUV29ya2Zsb3dJbnN0YW5jZUxpc3QSEwoLdG90YWxfcGFnZXMYASABKAUSSQoHZW50cmllcxgCIAMoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93SW5zdGFuY2ViBnByb3RvMw",[file_ai_stigmer_agentic_workflowinstance_v1_api,file_ai_stigmer_agentic_workflowinstance_v1_spec,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]),WorkflowInstanceIdSchema=messageDesc2(file_ai_stigmer_agentic_workflowinstance_v1_io,0);var WorkflowInstanceListSchema=messageDesc2(file_ai_stigmer_agentic_workflowinstance_v1_io,3);var file_ai_stigmer_agentic_workflowinstance_v1_command=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dpbnN0YW5jZS92MS9jb21tYW5kLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MTLvCAohV29ya2Zsb3dJbnN0YW5jZUNvbW1hbmRDb250cm9sbGVyEnsKBWFwcGx5EjguYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEuV29ya2Zsb3dJbnN0YW5jZRo4LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93SW5zdGFuY2USggEKBmNyZWF0ZRI4LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93SW5zdGFuY2UaOC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MS5Xb3JrZmxvd0luc3RhbmNlIgTQuBgBEr0BCgZ1cGRhdGUSOC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MS5Xb3JrZmxvd0luc3RhbmNlGjguYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEuV29ya2Zsb3dJbnN0YW5jZSI/wrgYOwgCEDMiC21ldGFkYXRhLmlkKih1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIHdvcmtmbG93IGluc3RhbmNlEs8BChB1cGRhdGVWaXNpYmlsaXR5EjUuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlVwZGF0ZVZpc2liaWxpdHlJbnB1dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93SW5zdGFuY2UiSsK4GEYIAhAzIgtyZXNvdXJjZV9pZCozdW5hdXRob3JpemVkIHRvIHVwZGF0ZSB3b3JrZmxvdyBpbnN0YW5jZSB2aXNpYmlsaXR5EvMBChl1cGRhdGVFeGVjdXRpb25WaXNpYmlsaXR5EkYuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEuVXBkYXRlRXhlY3V0aW9uVmlzaWJpbGl0eUlucHV0GjguYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEuV29ya2Zsb3dJbnN0YW5jZSJUwrgYUAgEEDMiC3Jlc291cmNlX2lkKj11bmF1dGhvcml6ZWQgdG8gdXBkYXRlIHdvcmtmbG93IGluc3RhbmNlIGV4ZWN1dGlvbiB2aXNpYmlsaXR5ErkBCgZkZWxldGUSOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MS5Xb3JrZmxvd0luc3RhbmNlSWQaOC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MS5Xb3JrZmxvd0luc3RhbmNlIjnCuBg1CAMQMyIFdmFsdWUqKHVuYXV0aG9yaXplZCB0byBkZWxldGUgd29ya2Zsb3cgaW5zdGFuY2UaBKD/KzNiBnByb3RvMw",[file_ai_stigmer_agentic_workflowinstance_v1_api,file_ai_stigmer_agentic_workflowinstance_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),WorkflowInstanceCommandController=serviceDesc(file_ai_stigmer_agentic_workflowinstance_v1_command,0);var file_ai_stigmer_agentic_workflowinstance_v1_query=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dpbnN0YW5jZS92MS9xdWVyeS5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93aW5zdGFuY2UudjEyiwQKH1dvcmtmbG93SW5zdGFuY2VRdWVyeUNvbnRyb2xsZXISswEKA2dldBI6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93SW5zdGFuY2VJZBo4LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLldvcmtmbG93SW5zdGFuY2UiNsK4GDIIARAzIgV2YWx1ZSoldW5hdXRob3JpemVkIHRvIGdldCB3b3JrZmxvdyBpbnN0YW5jZRKiAQoNZ2V0QnlXb3JrZmxvdxJNLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2luc3RhbmNlLnYxLkdldFdvcmtmbG93SW5zdGFuY2VzQnlXb3JrZmxvd1JlcXVlc3QaPC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MS5Xb3JrZmxvd0luc3RhbmNlTGlzdCIE0LgYARKGAQoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaOC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dpbnN0YW5jZS52MS5Xb3JrZmxvd0luc3RhbmNlIgTQuBgBGgSg/yszYgZwcm90bzM",[file_ai_stigmer_agentic_workflowinstance_v1_api,file_ai_stigmer_agentic_workflowinstance_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),WorkflowInstanceQueryController=serviceDesc(file_ai_stigmer_agentic_workflowinstance_v1_query,0);var PARENT_WORKFLOW_KEY="parent_workflow";function newLoadParentWorkflowStep(loaderProvider,logger2){return{name:"LoadParentWorkflow",async execute(ctx){let workflowId=ctx.input.spec?.workflowId??"";logger2.info("Loading parent workflow",{workflowId});let parent;try{parent=await loaderProvider().get(workflowId)}catch(error2){throw logger2.warn("Parent workflow not found",{error:error2 instanceof ConnectError?error2.rawMessage:String(error2),workflowId}),notFoundError("Workflow",workflowId)}ctx.set(PARENT_WORKFLOW_KEY,parent)}}}var WORKFLOW_INSTANCE_PARENT_DENIED_MESSAGE="You don't have permission to create instances of this workflow";function resolveWorkflowInstanceCreateTargets(ctx){let parent=ctx.get(PARENT_WORKFLOW_KEY);if(parent===void 0)throw new Error("parent workflow not found in context");let metadata=ctx.newState.metadata;return isDefaultInstance(metadata)&&isServerComposedRequest(ctx.callerIdentity)&&(metadata?.org??"")===(parent.metadata?.org??"")?[]:[{permission:IamPermission.can_execute,resourceKind:ApiResourceKind.workflow,resourceId:parent.metadata?.id??"",deniedMessage:WORKFLOW_INSTANCE_PARENT_DENIED_MESSAGE}]}function newValidateSameOrgBusinessRuleStep(logger2){return{name:"ValidateSameOrgBusinessRule",execute(ctx){let parent=ctx.get(PARENT_WORKFLOW_KEY);if(parent===void 0)throw new Error("parent workflow not found in context");let targetOrg=ctx.newState.metadata?.org??"",workflowOrg=parent.metadata?.org??"";if(workflowOrg!==targetOrg)throw logger2.warn("Business rule violation: cannot create instance of workflow in different org",{workflowId:parent.metadata?.id??"",workflowOrg,instanceOrg:targetOrg}),invalidArgumentError(`Cannot create instance of workflow in a different organization. Workflow belongs to org '${workflowOrg}', instance target is org '${targetOrg}'.`)}}}function newValidateInstanceUpdateStep2(){return{name:"ValidateInstanceUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing workflow instance not found in context"),"existing workflow instance not found in context");if(ctx.input.spec?.workflowId!==existing.spec?.workflowId)throw failedPreconditionError(`spec.workflow_id is immutable (instance runs workflow ${existing.spec?.workflowId??""}) \u2014 create a new instance to run a different workflow`)}}}function newRejectDefaultWorkflowInstanceVisibilityUpdateStep(store,instanceKey){return{name:"RejectDefaultInstanceVisibilityUpdate",async execute(ctx){let instance=ctx.get(instanceKey);isDefaultInstance(instance.metadata)&&rejectDefaultInstanceVisibilityUpdate();let parentId=instance.spec?.workflowId??"";if(parentId==="")return;let parent;try{parent=await store.getResource(ApiResourceKind.workflow,parentId,WorkflowSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw internalError(error2,"failed to load parent workflow for default-instance check")}parent.status?.defaultInstanceId===instance.metadata?.id&&rejectDefaultInstanceVisibilityUpdate()}}}function registerWorkflowInstanceServices(router,deps){router.service(WorkflowInstanceCommandController,{apply:(instance,ctx)=>apply14(deps,instance,ctx),create:(instance,ctx)=>createInstance2(deps,instance,ctx),update:(instance,ctx)=>update17(deps,instance,ctx),updateVisibility:(input,ctx)=>updateVisibility8(deps,input,ctx),updateExecutionVisibility:(input,ctx)=>updateExecutionVisibility(deps,input,ctx),delete:(id,ctx)=>deleteInstance2(deps,id,ctx)}),router.service(WorkflowInstanceQueryController,{get:(id,ctx)=>get24(deps,id,ctx),getByReference:(ref,ctx)=>getByReference15(deps,ref,ctx),getByWorkflow:(req,ctx)=>getByWorkflow(deps,req,ctx)})}function kindOf23(ctx){return ctx.values.get(apiResourceKindKey)}async function createInstance2(deps,instance,ctx){let reqCtx=new RequestContext(WorkflowInstanceSchema,instance,callerIdentityOf(ctx),kindOf23(ctx));return await newPipeline("workflow-instance-create",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newLoadParentWorkflowStep(deps.parentWorkflowLoader,deps.logger)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveWorkflowInstanceCreateTargets)).addStep(newValidateSameOrgBusinessRuleStep(deps.logger)).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,workflowInstanceSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update17(deps,instance,ctx){let reqCtx=new RequestContext(WorkflowInstanceSchema,instance,callerIdentityOf(ctx),kindOf23(ctx));return await newPipeline("workflow-instance-update",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateInstanceUpdateStep2()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,workflowInstanceSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply14(deps,instance,ctx){let reqCtx=new RequestContext(WorkflowInstanceSchema,instance,callerIdentityOf(ctx),kindOf23(ctx));await newPipeline("workflow-instance-apply",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createInstance2(deps,instance,ctx):update17(deps,withResolvedApplyId(WorkflowInstanceSchema,instance,reqCtx),ctx)}async function deleteInstance2(deps,instanceId,ctx){let reqCtx=new RequestContext(WorkflowInstanceCommandController.method.delete.input,instanceId,callerIdentityOf(ctx),kindOf23(ctx));await newPipeline("workflow-instance-delete",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,WorkflowInstanceSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted workflow instance not found in context"),"deleted workflow instance not found in context");return deleted}var UPDATE_VISIBILITY_INSTANCE_KEY2="updateVisibilityInstance";async function updateVisibility8(deps,input,ctx){let reqCtx=new RequestContext(WorkflowInstanceCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf23(ctx));return await newPipeline("workflow-instance-update-visibility",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadInstanceStep(deps.store,UPDATE_VISIBILITY_INSTANCE_KEY2,"LoadInstanceForVisibilityUpdate",c5=>c5.input.resourceId)).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_INSTANCE_KEY2)).addStep(newRejectDefaultWorkflowInstanceVisibilityUpdateStep(deps.store,UPDATE_VISIBILITY_INSTANCE_KEY2)).addStep(newValidateVisibilityUpdateStep()).addStep(newSetInstanceVisibilityStep2()).addStep(newPersistInstanceStep(deps.store,UPDATE_VISIBILITY_INSTANCE_KEY2,"PersistInstanceForVisibilityUpdate")).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_INSTANCE_KEY2)).addStep(newIndexInstanceStep(deps.store,deps.logger,UPDATE_VISIBILITY_INSTANCE_KEY2,"IndexInstanceAfterVisibilityUpdate")).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_INSTANCE_KEY2)}function newSetInstanceVisibilityStep2(){return{name:"SetInstanceVisibility",execute(ctx){let input=ctx.input,instance=ctx.get(UPDATE_VISIBILITY_INSTANCE_KEY2);instance.metadata.visibility=input.visibility;try{setAuditFieldsForUpdate(WorkflowInstanceSchema,instance,"status_audit",ctx.callerIdentity)}catch(error2){throw new Error(`failed to set audit fields: ${error2 instanceof Error?error2.message:String(error2)}`)}ctx.set(UPDATE_VISIBILITY_INSTANCE_KEY2,instance)}}}var UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY="updateExecutionVisibilityInstance";async function updateExecutionVisibility(deps,input,ctx){let reqCtx=new RequestContext(WorkflowInstanceCommandController.method.updateExecutionVisibility.input,input,callerIdentityOf(ctx),kindOf23(ctx));return await newPipeline("workflow-instance-update-execution-visibility",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceCommandController.method.updateExecutionVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadInstanceStep(deps.store,UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY,"LoadInstanceForExecutionVisibilityUpdate",c5=>c5.input.resourceId)).addStep(newSetInstanceExecutionVisibilityStep()).addStep(newPersistInstanceStep(deps.store,UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY,"PersistInstanceForExecutionVisibilityUpdate")).addStep(newIndexInstanceStep(deps.store,deps.logger,UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY,"IndexInstanceAfterExecutionVisibilityUpdate")).build().execute(reqCtx),reqCtx.get(UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY)}function newSetInstanceExecutionVisibilityStep(){return{name:"SetInstanceExecutionVisibility",execute(ctx){let input=ctx.input,instance=ctx.get(UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY);instance.spec??=create2(WorkflowInstanceSpecSchema),instance.spec.executionVisibility=input.executionVisibility;try{setAuditFieldsForUpdate(WorkflowInstanceSchema,instance,"status_audit",ctx.callerIdentity)}catch(error2){throw new Error(`failed to set audit fields: ${error2 instanceof Error?error2.message:String(error2)}`)}ctx.set(UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY,instance)}}}function newLoadInstanceStep(store,instanceKey,stepName,resourceIdOf2){return{name:stepName,async execute(ctx){let resourceId=resourceIdOf2(ctx),instance;try{instance=await store.getResource(ApiResourceKind.workflow_instance,resourceId,WorkflowInstanceSchema)}catch{throw notFoundError("workflow instance",resourceId)}ctx.set(instanceKey,instance)}}}function newPersistInstanceStep(store,instanceKey,stepName){return{name:stepName,async execute(ctx){let instance=ctx.get(instanceKey);try{await store.saveResource(ApiResourceKind.workflow_instance,instance.metadata?.id??"",WorkflowInstanceSchema,instance)}catch(error2){throw internalError(error2,"failed to save workflow instance")}}}}function newIndexInstanceStep(store,logger2,instanceKey,stepName){return{name:stepName,async execute(ctx){let instance=ctx.get(instanceKey),entry=workflowInstanceSearchExtractor.getSearchIndexEntry(instance);if(entry===void 0){logger2.warn(`${stepName}: extractor returned nil, skipping`,{id:instance.metadata?.id??""});return}try{await store.upsertSearchIndex(ApiResourceKind.workflow_instance,instance.metadata?.id??"",entry)}catch(error2){logger2.warn(`${stepName}: failed (best-effort)`,{error:error2 instanceof Error?error2.message:String(error2),id:instance.metadata?.id??""})}}}}async function get24(deps,instanceId,ctx){let reqCtx=new RequestContext(WorkflowInstanceQueryController.method.get.input,instanceId,callerIdentityOf(ctx),kindOf23(ctx));return await newPipeline("workflow-instance-get",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,WorkflowInstanceSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference15(deps,ref,ctx){let reqCtx=new RequestContext(WorkflowInstanceQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf23(ctx));return await newPipeline("workflow-instance-get-by-reference",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,WorkflowInstanceSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(WorkflowInstanceQueryController.method.get))).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var WORKFLOW_INSTANCE_LIST_KEY="workflow_instance_list";async function getByWorkflow(deps,request,ctx){let reqCtx=new RequestContext(WorkflowInstanceQueryController.method.getByWorkflow.input,request,callerIdentityOf(ctx),kindOf23(ctx));await newPipeline("workflow-instance-get-by-workflow",deps.logger).addStep(newAuthorizeStep(WorkflowInstanceQueryController.method.getByWorkflow,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByWorkflowStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx);let list12=reqCtx.get(WORKFLOW_INSTANCE_LIST_KEY);return list12===void 0?create2(WorkflowInstanceListSchema):list12}function newLoadByWorkflowStep(store,logger2,listReadScope){return{name:"LoadByWorkflow",async execute(ctx){let request=ctx.input,workflowId=request.workflowId,rows;try{rows=await store.listResources(ctx.apiResourceKind)}catch(error2){throw logger2.error("failed to list workflow instances",{error:error2 instanceof Error?error2.message:String(error2),workflowId}),internalError(error2,"failed to list workflow instances")}let decoded=[];for(let data of rows)try{decoded.push(fromBinary2(WorkflowInstanceSchema,data))}catch(error2){logger2.warn("failed to unmarshal workflow instance, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}let filtered=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.workflow_instance,decoded.filter(instance=>instance.spec?.workflowId===workflowId&&(request.org===""||instance.metadata?.org===request.org)),"");logger2.info("found workflow instances for workflow",{workflowId,count:filtered.length}),ctx.set(WORKFLOW_INSTANCE_LIST_KEY,create2(WorkflowInstanceListSchema,{entries:filtered}))}}}var file_ai_stigmer_agentic_workflowexecution_v1_event=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvZXZlbnQucHJvdG8SJ2FpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MSKGEQoWV29ya2Zsb3dFeGVjdXRpb25FdmVudBIZCghldmVudF9pZBgBIAEoCUIHukgEcgIQARJYCgpldmVudF90eXBlGAIgASgOMjouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXZlbnRUeXBlQgi6SAWCAQIQARIXCg9zZXF1ZW5jZV9udW1iZXIYAyABKAQSHAoLb2NjdXJyZWRfYXQYBCABKAlCB7pIBHICEAESEQoJdGFza19uYW1lGAUgASgJEl0KEWV4ZWN1dGlvbl9zdGFydGVkGAogASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvblN0YXJ0ZWRQYXlsb2FkSAASYQoTZXhlY3V0aW9uX2NvbXBsZXRlZBgLIAEoCzJCLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5FeGVjdXRpb25Db21wbGV0ZWRQYXlsb2FkSAASWwoQZXhlY3V0aW9uX2ZhaWxlZBgMIAEoCzI/LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5FeGVjdXRpb25GYWlsZWRQYXlsb2FkSAASWwoQZXhlY3V0aW9uX3BhdXNlZBgNIAEoCzI/LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5FeGVjdXRpb25QYXVzZWRQYXlsb2FkSAASXQoRZXhlY3V0aW9uX3Jlc3VtZWQYDiABKAsyQC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuRXhlY3V0aW9uUmVzdW1lZFBheWxvYWRIABJhChNleGVjdXRpb25fY2FuY2VsbGVkGA8gASgLMkIuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvbkNhbmNlbGxlZFBheWxvYWRIABJjChRleGVjdXRpb25fdGVybWluYXRlZBgQIAEoCzJDLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5FeGVjdXRpb25UZXJtaW5hdGVkUGF5bG9hZEgAElMKDHRhc2tfc3RhcnRlZBgUIAEoCzI7LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5UYXNrU3RhcnRlZFBheWxvYWRIABJXCg50YXNrX2NvbXBsZXRlZBgVIAEoCzI9LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5UYXNrQ29tcGxldGVkUGF5bG9hZEgAElEKC3Rhc2tfZmFpbGVkGBYgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLlRhc2tGYWlsZWRQYXlsb2FkSAASUwoMdGFza19za2lwcGVkGBcgASgLMjsuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLlRhc2tTa2lwcGVkUGF5bG9hZEgAElUKDXRhc2tfcmV0cnlpbmcYGCABKAsyPC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuVGFza1JldHJ5aW5nUGF5bG9hZEgAEl4KEmFnZW50X2NhbGxfc3RhcnRlZBgeIAEoCzJALmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5BZ2VudENhbGxTdGFydGVkUGF5bG9hZEgAEmAKE2FnZW50X2NhbGxfcHJvZ3Jlc3MYHyABKAsyQS5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuQWdlbnRDYWxsUHJvZ3Jlc3NQYXlsb2FkSAASYgoUYWdlbnRfY2FsbF9jb21wbGV0ZWQYICABKAsyQi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuQWdlbnRDYWxsQ29tcGxldGVkUGF5bG9hZEgAEl8KEmFwcHJvdmFsX3JlcXVlc3RlZBgoIAEoCzJBLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5BcHByb3ZhbFJlcXVlc3RlZFBheWxvYWRIABJdChFhcHByb3ZhbF9yZXNvbHZlZBgpIAEoCzJALmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5BcHByb3ZhbFJlc29sdmVkUGF5bG9hZEgAEl0KEWJ1ZGdldF9jaGVja3BvaW50GDIgASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkJ1ZGdldENoZWNrcG9pbnRQYXlsb2FkSAASWQoPc2lnbmFsX3JlY2VpdmVkGDwgASgLMj4uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLlNpZ25hbFJlY2VpdmVkUGF5bG9hZEgAElUKDWV2ZW50X2VtaXR0ZWQYPSABKAsyPC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuRXZlbnRFbWl0dGVkUGF5bG9hZEgAElsKEGFydGlmYWN0X2NyZWF0ZWQYRiABKAsyPy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuQXJ0aWZhY3RDcmVhdGVkUGF5bG9hZEgAQgkKB3BheWxvYWQiYQoXRXhlY3V0aW9uU3RhcnRlZFBheWxvYWQSEwoLdG90YWxfdGFza3MYASABKAUSEwoLd29ya2Zsb3dfaWQYAiABKAkSHAoUd29ya2Zsb3dfaW5zdGFuY2VfaWQYAyABKAkikgEKGUV4ZWN1dGlvbkNvbXBsZXRlZFBheWxvYWQSLwoOb3V0cHV0X3N1bW1hcnkYASABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0EhMKC2R1cmF0aW9uX21zGAIgASgDEhkKEXRvdGFsX2Nvc3RfbWljcm9zGAMgASgDEhQKDHRvdGFsX3Rva2VucxgEIAEoAyJWChZFeGVjdXRpb25GYWlsZWRQYXlsb2FkEg0KBWVycm9yGAEgASgJEhgKEGZhaWxlZF90YXNrX25hbWUYAiABKAkSEwoLZHVyYXRpb25fbXMYAyABKAMiOwoWRXhlY3V0aW9uUGF1c2VkUGF5bG9hZBIOCgZyZWFzb24YASABKAkSEQoJcGF1c2VkX2J5GAIgASgJIi0KF0V4ZWN1dGlvblJlc3VtZWRQYXlsb2FkEhIKCnJlc3VtZWRfYnkYASABKAkiQQoZRXhlY3V0aW9uQ2FuY2VsbGVkUGF5bG9hZBIOCgZyZWFzb24YASABKAkSFAoMY2FuY2VsbGVkX2J5GAIgASgJIkMKGkV4ZWN1dGlvblRlcm1pbmF0ZWRQYXlsb2FkEg4KBnJlYXNvbhgBIAEoCRIVCg10ZXJtaW5hdGVkX2J5GAIgASgJIqEBChJUYXNrU3RhcnRlZFBheWxvYWQSQwoJdGFza19raW5kGAEgASgOMjAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLldvcmtmbG93VGFza0tpbmQSLgoNaW5wdXRfc3VtbWFyeRgCIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSFgoOYXR0ZW1wdF9udW1iZXIYAyABKAUiywEKFFRhc2tDb21wbGV0ZWRQYXlsb2FkEkMKCXRhc2tfa2luZBgBIAEoDjIwLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS5Xb3JrZmxvd1Rhc2tLaW5kEhMKC2R1cmF0aW9uX21zGAIgASgDEi8KDm91dHB1dF9zdW1tYXJ5GAMgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBITCgtjb3N0X21pY3JvcxgEIAEoAxITCgt0b2tlbnNfdXNlZBgFIAEoAyK+AQoRVGFza0ZhaWxlZFBheWxvYWQSQwoJdGFza19raW5kGAEgASgOMjAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLldvcmtmbG93VGFza0tpbmQSDQoFZXJyb3IYAiABKAkSFgoOYXR0ZW1wdF9udW1iZXIYAyABKAUSFAoMbWF4X2F0dGVtcHRzGAQgASgFEhIKCndpbGxfcmV0cnkYBSABKAgSEwoLZHVyYXRpb25fbXMYBiABKAMiaQoSVGFza1NraXBwZWRQYXlsb2FkEkMKCXRhc2tfa2luZBgBIAEoDjIwLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS5Xb3JrZmxvd1Rhc2tLaW5kEg4KBnJlYXNvbhgCIAEoCSJVChNUYXNrUmV0cnlpbmdQYXlsb2FkEhYKDmZhaWxlZF9hdHRlbXB0GAEgASgFEhQKDG5leHRfYXR0ZW1wdBgCIAEoBRIQCghkZWxheV9tcxgDIAEoAyJiChdBZ2VudENhbGxTdGFydGVkUGF5bG9hZBIaChJjaGlsZF9leGVjdXRpb25faWQYASABKAkSEgoKYWdlbnRfc2x1ZxgCIAEoCRIXCg9tZXNzYWdlX3N1bW1hcnkYAyABKAki5wEKGEFnZW50Q2FsbFByb2dyZXNzUGF5bG9hZBIaChJjaGlsZF9leGVjdXRpb25faWQYASABKAkSSQoLYWdlbnRfcGhhc2UYAiABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRXhlY3V0aW9uUGhhc2USGQoRY3VycmVudF90b29sX25hbWUYAyABKAkSFwoPdG9rZW5zX2NvbnN1bWVkGAQgASgDEhYKDm1lc3NhZ2VzX2NvdW50GAUgASgFEhgKEHRvb2xfY2FsbHNfY291bnQYBiABKAUi1AEKGUFnZW50Q2FsbENvbXBsZXRlZFBheWxvYWQSGgoSY2hpbGRfZXhlY3V0aW9uX2lkGAEgASgJEkkKC2FnZW50X3BoYXNlGAIgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvblBoYXNlEhMKC2R1cmF0aW9uX21zGAMgASgDEhcKD3Rva2Vuc19jb25zdW1lZBgEIAEoAxITCgtjb3N0X21pY3JvcxgFIAEoAxINCgVlcnJvchgGIAEoCSI0ChVIdW1hbklucHV0T3V0Y29tZUluZm8SDAoEbmFtZRgBIAEoCRINCgVsYWJlbBgCIAEoCSLfAgoYQXBwcm92YWxSZXF1ZXN0ZWRQYXlsb2FkEg4KBnByb21wdBgBIAEoCRIRCglhcHByb3ZlcnMYAiADKAkSFwoPdGltZW91dF9zZWNvbmRzGAMgASgFEhQKDHRvb2xfY2FsbF9pZBgEIAEoCRIaChJjaGlsZF9leGVjdXRpb25faWQYBSABKAkSUAoIb3V0Y29tZXMYBiADKAsyPi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuSHVtYW5JbnB1dE91dGNvbWVJbmZvEiwKC2Zvcm1fc2NoZW1hGAcgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBInCgdwYXlsb2FkGAggASgLMhYuZ29vZ2xlLnByb3RvYnVmLlZhbHVlEg8KB3VpX2hpbnQYCSABKAkSGwoTcGF5bG9hZF9hcnRpZmFjdF9pZBgKIAEoCSLxAQoXQXBwcm92YWxSZXNvbHZlZFBheWxvYWQSRAoGYWN0aW9uGAEgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsQWN0aW9uEhMKC3Jlc29sdmVkX2J5GAIgASgJEg8KB2NvbW1lbnQYAyABKAkSGAoQd2FpdF9kdXJhdGlvbl9tcxgEIAEoAxJQChFyZXNvbHZlZF9ieV9hY3RvchgFIAEoCzI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0QWN0b3Ii9wEKF0J1ZGdldENoZWNrcG9pbnRQYXlsb2FkEhwKFGNvc3RfY29uc3VtZWRfbWljcm9zGAEgASgDEh0KFWNvc3RfcmVtYWluaW5nX21pY3JvcxgCIAEoAxIXCg90b2tlbnNfY29uc3VtZWQYAyABKAMSGAoQdG9rZW5zX3JlbWFpbmluZxgEIAEoAxIaChJ0aHJlc2hvbGRfYnJlYWNoZWQYBSABKAgSUAoSb25fZXhjZWVkZWRfcG9saWN5GAYgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLkJ1ZGdldEV4Y2VlZGVkUG9saWN5Il4KFVNpZ25hbFJlY2VpdmVkUGF5bG9hZBITCgtzaWduYWxfbmFtZRgBIAEoCRIwCg9wYXlsb2FkX3N1bW1hcnkYAiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0IlYKE0V2ZW50RW1pdHRlZFBheWxvYWQSEgoKZXZlbnRfdHlwZRgBIAEoCRIUCgxldmVudF9zb3VyY2UYAiABKAkSFQoNZXZlbnRfc3ViamVjdBgDIAEoCSJtChZBcnRpZmFjdENyZWF0ZWRQYXlsb2FkEhMKC2FydGlmYWN0X2lkGAEgASgJEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRIUCgxjb250ZW50X3R5cGUYAyABKAkSEgoKc2l6ZV9ieXRlcxgEIAEoAyqJBAoRV29ya2Zsb3dFdmVudFR5cGUSIwofd29ya2Zsb3dfZXZlbnRfdHlwZV91bnNwZWNpZmllZBAAEhUKEWV4ZWN1dGlvbl9zdGFydGVkEAESFwoTZXhlY3V0aW9uX2NvbXBsZXRlZBACEhQKEGV4ZWN1dGlvbl9mYWlsZWQQAxIUChBleGVjdXRpb25fcGF1c2VkEAQSFQoRZXhlY3V0aW9uX3Jlc3VtZWQQBRIXChNleGVjdXRpb25fY2FuY2VsbGVkEAYSGAoUZXhlY3V0aW9uX3Rlcm1pbmF0ZWQQBxIQCgx0YXNrX3N0YXJ0ZWQQCxISCg50YXNrX2NvbXBsZXRlZBAMEg8KC3Rhc2tfZmFpbGVkEA0SEAoMdGFza19za2lwcGVkEA4SEQoNdGFza19yZXRyeWluZxAPEhYKEmFnZW50X2NhbGxfc3RhcnRlZBAVEhcKE2FnZW50X2NhbGxfcHJvZ3Jlc3MQFhIYChRhZ2VudF9jYWxsX2NvbXBsZXRlZBAXEhYKEmFwcHJvdmFsX3JlcXVlc3RlZBAfEhUKEWFwcHJvdmFsX3Jlc29sdmVkECASFQoRYnVkZ2V0X2NoZWNrcG9pbnQQKRITCg9zaWduYWxfcmVjZWl2ZWQQMxIRCg1ldmVudF9lbWl0dGVkEDQSFAoQYXJ0aWZhY3RfY3JlYXRlZBA1YgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_workflow_v1_enum,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_struct]),WorkflowExecutionEventSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_event,0);var WorkflowEventType;(function(WorkflowEventType2){WorkflowEventType2[WorkflowEventType2.workflow_event_type_unspecified=0]="workflow_event_type_unspecified",WorkflowEventType2[WorkflowEventType2.execution_started=1]="execution_started",WorkflowEventType2[WorkflowEventType2.execution_completed=2]="execution_completed",WorkflowEventType2[WorkflowEventType2.execution_failed=3]="execution_failed",WorkflowEventType2[WorkflowEventType2.execution_paused=4]="execution_paused",WorkflowEventType2[WorkflowEventType2.execution_resumed=5]="execution_resumed",WorkflowEventType2[WorkflowEventType2.execution_cancelled=6]="execution_cancelled",WorkflowEventType2[WorkflowEventType2.execution_terminated=7]="execution_terminated",WorkflowEventType2[WorkflowEventType2.task_started=11]="task_started",WorkflowEventType2[WorkflowEventType2.task_completed=12]="task_completed",WorkflowEventType2[WorkflowEventType2.task_failed=13]="task_failed",WorkflowEventType2[WorkflowEventType2.task_skipped=14]="task_skipped",WorkflowEventType2[WorkflowEventType2.task_retrying=15]="task_retrying",WorkflowEventType2[WorkflowEventType2.agent_call_started=21]="agent_call_started",WorkflowEventType2[WorkflowEventType2.agent_call_progress=22]="agent_call_progress",WorkflowEventType2[WorkflowEventType2.agent_call_completed=23]="agent_call_completed",WorkflowEventType2[WorkflowEventType2.approval_requested=31]="approval_requested",WorkflowEventType2[WorkflowEventType2.approval_resolved=32]="approval_resolved",WorkflowEventType2[WorkflowEventType2.budget_checkpoint=41]="budget_checkpoint",WorkflowEventType2[WorkflowEventType2.signal_received=51]="signal_received",WorkflowEventType2[WorkflowEventType2.event_emitted=52]="event_emitted",WorkflowEventType2[WorkflowEventType2.artifact_created=53]="artifact_created"})(WorkflowEventType||(WorkflowEventType={}));var file_ai_stigmer_agentic_workflowexecution_v1_io=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvaW8ucHJvdG8SJ2FpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MSIsChNXb3JrZmxvd0V4ZWN1dGlvbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiIwoKV29ya2Zsb3dJZBIVCgV2YWx1ZRgBIAEoCUIGukgDyAEBIpIBChVXb3JrZmxvd0V4ZWN1dGlvbkxpc3QSEwoLdG90YWxfcGFnZXMYASABKAUSSwoHZW50cmllcxgCIAMoCzI6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbhIXCg9uZXh0X3BhZ2VfdG9rZW4YAyABKAki7QIKHUxpc3RXb3JrZmxvd0V4ZWN1dGlvbnNSZXF1ZXN0EhoKCXBhZ2Vfc2l6ZRgBIAEoBUIHukgEGgIoABISCgpwYWdlX3Rva2VuGAIgASgJEkYKBXBoYXNlGAMgASgOMjcuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvblBoYXNlEgwKBHRhZ3MYBCADKAkSUAoGZmlsdGVyGAUgASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvbkZpbHRlckNyaXRlcmlhEk8KCnNvcnRfZmllbGQYBiABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuRXhlY3V0aW9uU29ydEZpZWxkEhYKDnNvcnRfYXNjZW5kaW5nGAcgASgIEgsKA29yZxgIIAEoCSKxAgonTGlzdFdvcmtmbG93RXhlY3V0aW9uc0J5V29ya2Zsb3dSZXF1ZXN0EhsKC3dvcmtmbG93X2lkGAEgASgJQga6SAPIAQESGgoJcGFnZV9zaXplGAIgASgFQge6SAQaAigAEhIKCnBhZ2VfdG9rZW4YAyABKAkSUAoGZmlsdGVyGAQgASgLMkAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvbkZpbHRlckNyaXRlcmlhEk8KCnNvcnRfZmllbGQYBSABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuRXhlY3V0aW9uU29ydEZpZWxkEhYKDnNvcnRfYXNjZW5kaW5nGAYgASgIIuYCCiJXb3JrZmxvd0V4ZWN1dGlvblVwZGF0ZVN0YXR1c0lucHV0Eh0KDGV4ZWN1dGlvbl9pZBgBIAEoCUIHukgEcgIQARJYCgZzdGF0dXMYAiABKAsyQC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb25TdGF0dXNCBrpIA8gBARJPCgZldmVudHMYCiADKAsyPy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb25FdmVudBIgChh1cGRhdGVfcGVuZGluZ19hcHByb3ZhbHMYCyABKAgSIwobdXBkYXRlX3BlbmRpbmdfZmlsZV9yZXZpZXdzGAwgASgIEi8KJ3BlbmRpbmdfdXBkYXRlX2NoaWxkX2FnZW50X2V4ZWN1dGlvbl9pZBgNIAEoCSK+AQobU3VibWl0V29ya2Zsb3dBcHByb3ZhbElucHV0Eh0KDGV4ZWN1dGlvbl9pZBgBIAEoCUIHukgEcgIQARIdCgx0b29sX2NhbGxfaWQYAiABKAlCB7pIBHICEAESUAoGYWN0aW9uGAMgASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFwcHJvdmFsQWN0aW9uQgq6SAeCAQQQASAAEg8KB2NvbW1lbnQYBCABKAkioQMKH1N1Ym1pdFdvcmtmbG93RmlsZURlY2lzaW9uSW5wdXQSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABEikKGGNoaWxkX2FnZW50X2V4ZWN1dGlvbl9pZBgCIAEoCUIHukgEcgIQARIeCg1jaGFuZ2Vfc2V0X2lkGAMgASgJQge6SARyAhABElIKBXNjb3BlGAQgASgOMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVEZWNpc2lvblNjb3BlQgq6SAeCAQQQASAAEhYKDmZpbGVfY2hhbmdlX2lkGAUgASgJElQKBmFjdGlvbhgGIAEoDjI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5GaWxlRGVjaXNpb25BY3Rpb25CCrpIB4IBBBABIAASIAoPZXhwZWN0ZWRfZGlnZXN0GAcgASgJQge6SARyAhABEg4KBnJlYXNvbhgIIAEoCRIgChhhY2tub3dsZWRnZV91bnJldmlld2FibGUYCSABKAgixQEKH1N1Ym1pdFdvcmtmbG93VGFza0FwcHJvdmFsSW5wdXQSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABEhoKCXRhc2tfbmFtZRgCIAEoCUIHukgEcgIQARIYCgdvdXRjb21lGAMgASgJQge6SARyAhABEioKCWZvcm1fZGF0YRgEIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSEAoIcmV2aWV3ZXIYBSABKAkSDwoHY29tbWVudBgGIAEoCSJBCiFTdWJzY3JpYmVXb3JrZmxvd0V4ZWN1dGlvblJlcXVlc3QSHAoMZXhlY3V0aW9uX2lkGAEgASgJQga6SAPIAQEiQwocQ2FuY2VsV29ya2Zsb3dFeGVjdXRpb25JbnB1dBITCgJpZBgBIAEoCUIHukgEcgIQARIOCgZyZWFzb24YAiABKAkiRgofVGVybWluYXRlV29ya2Zsb3dFeGVjdXRpb25JbnB1dBITCgJpZBgBIAEoCUIHukgEcgIQARIOCgZyZWFzb24YAiABKAkiRAodUmVjb3ZlcldvcmtmbG93RXhlY3V0aW9uSW5wdXQSEwoCaWQYASABKAlCB7pIBHICEAESDgoGcmVhc29uGAIgASgJIkIKG1BhdXNlV29ya2Zsb3dFeGVjdXRpb25JbnB1dBITCgJpZBgBIAEoCUIHukgEcgIQARIOCgZyZWFzb24YAiABKAkiMwocUmVzdW1lV29ya2Zsb3dFeGVjdXRpb25JbnB1dBITCgJpZBgBIAEoCUIHukgEcgIQASKRAQoPU2VuZFNpZ25hbElucHV0Eh0KDGV4ZWN1dGlvbl9pZBgBIAEoCUIHukgEcgIQARIcCgtzaWduYWxfbmFtZRgCIAEoCUIHukgEcgIQARIoCgdwYXlsb2FkGAMgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBIXCg9pZGVtcG90ZW5jeV9rZXkYBCABKAkiwgEKEkdldEV2ZW50TG9nUmVxdWVzdBIdCgxleGVjdXRpb25faWQYASABKAlCB7pIBHICEAESFgoOYWZ0ZXJfc2VxdWVuY2UYAiABKAQSTwoLZXZlbnRfdHlwZXMYAyADKA4yOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFdmVudFR5cGUSEQoJdGFza19uYW1lGAQgASgJEhEKCXBhZ2Vfc2l6ZRgFIAEoBSKRAQoTR2V0RXZlbnRMb2dSZXNwb25zZRJPCgZldmVudHMYASADKAsyPy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb25FdmVudBIQCghoYXNfbW9yZRgCIAEoCBIXCg9sYXRlc3Rfc2VxdWVuY2UYAyABKAQioAEKFlN1YnNjcmliZUV2ZW50c1JlcXVlc3QSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABEhYKDmFmdGVyX3NlcXVlbmNlGAIgASgEEk8KC2V2ZW50X3R5cGVzGAMgAygOMjouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXZlbnRUeXBlIowDChdFeGVjdXRpb25GaWx0ZXJDcml0ZXJpYRJHCgZwaGFzZXMYASADKA4yNy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuRXhlY3V0aW9uUGhhc2USMQoNc3RhcnRlZF9hZnRlchgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASMgoOc3RhcnRlZF9iZWZvcmUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KDG1pbl9kdXJhdGlvbhgEIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhIvCgxtYXhfZHVyYXRpb24YBSABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb24SFwoPbWluX2Nvc3RfbWljcm9zGAYgASgDEhcKD21heF9jb3N0X21pY3JvcxgHIAEoAxIYChBmYWlsZWRfdGFza19uYW1lGAggASgJEhMKC2hhc19yZXRyaWVzGAkgASgIIpgBChpHZXRFeGVjdXRpb25TdW1tYXJ5UmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESTwoLdGltZV93aW5kb3cYAiABKA4yOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuU3VtbWFyeVRpbWVXaW5kb3cSEwoLd29ya2Zsb3dfaWQYAyABKAkiowQKEEV4ZWN1dGlvblN1bW1hcnkSFAoMYWN0aXZlX2NvdW50GAEgASgFEmAKDHBoYXNlX2NvdW50cxgCIAMoCzJKLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5FeGVjdXRpb25TdW1tYXJ5LlBoYXNlQ291bnRzRW50cnkSUAoKdG90YWxfY29zdBgDIAEoCzI8LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0Nvc3RTdW1tYXJ5Ei8KDGF2Z19kdXJhdGlvbhgEIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhJbChV0b3BfZmFpbGluZ193b3JrZmxvd3MYBSADKAsyPC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dGYWlsdXJlUmFuaxJYChBjb3N0X2J5X3dvcmtmbG93GAYgAygLMj4uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93Q29zdEJyZWFrZG93bhITCgt0b3RhbF9jb3VudBgHIAEoBRIUCgxzdWNjZXNzX3JhdGUYCCABKAEaMgoQUGhhc2VDb3VudHNFbnRyeRILCgNrZXkYASABKAUSDQoFdmFsdWUYAiABKAU6AjgBImYKE1dvcmtmbG93Q29zdFN1bW1hcnkSFgoOdG90YWxfY29zdF91c2QYASABKAESGgoSdG90YWxfaW5wdXRfdG9rZW5zGAIgASgDEhsKE3RvdGFsX291dHB1dF90b2tlbnMYAyABKAMiWgoTV29ya2Zsb3dGYWlsdXJlUmFuaxIVCg13b3JrZmxvd19zbHVnGAEgASgJEhUKDXdvcmtmbG93X25hbWUYAiABKAkSFQoNZmFpbHVyZV9jb3VudBgDIAEoBSJ2ChVXb3JrZmxvd0Nvc3RCcmVha2Rvd24SFQoNd29ya2Zsb3dfc2x1ZxgBIAEoCRIVCg13b3JrZmxvd19uYW1lGAIgASgJEhYKDnRvdGFsX2Nvc3RfdXNkGAMgASgBEhcKD2V4ZWN1dGlvbl9jb3VudBgEIAEoBSJjChtMaXN0UGVuZGluZ0FwcHJvdmFsc1JlcXVlc3QSFAoDb3JnGAEgASgJQge6SARyAhABEhoKCXBhZ2Vfc2l6ZRgCIAEoBUIHukgEGgIoABISCgpwYWdlX3Rva2VuGAMgASgJIoUCCg9QZW5kaW5nQXBwcm92YWwSFAoMZXhlY3V0aW9uX2lkGAEgASgJEhUKDXdvcmtmbG93X25hbWUYAiABKAkSEQoJdGFza19uYW1lGAMgASgJEhEKCXJlcXVlc3RlchgEIAEoCRIwCgxyZXF1ZXN0ZWRfYXQYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnRpbWVvdXRfYXQYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEiwKC2Zvcm1fc2NoZW1hGAcgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBIPCgd1aV9oaW50GAggASgJIo8BChRQZW5kaW5nQXBwcm92YWxzTGlzdBJJCgdlbnRyaWVzGAEgAygLMjguYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLlBlbmRpbmdBcHByb3ZhbBITCgt0b3RhbF9jb3VudBgCIAEoBRIXCg9uZXh0X3BhZ2VfdG9rZW4YAyABKAkqwgEKEkV4ZWN1dGlvblNvcnRGaWVsZBIkCiBFWEVDVVRJT05fU09SVF9GSUVMRF9VTlNQRUNJRklFRBAAEiMKH0VYRUNVVElPTl9TT1JUX0ZJRUxEX1NUQVJURURfQVQQARIhCh1FWEVDVVRJT05fU09SVF9GSUVMRF9EVVJBVElPThACEh0KGUVYRUNVVElPTl9TT1JUX0ZJRUxEX0NPU1QQAxIfChtFWEVDVVRJT05fU09SVF9GSUVMRF9TVEFUVVMQBCq/AQoRU3VtbWFyeVRpbWVXaW5kb3cSIwofU1VNTUFSWV9USU1FX1dJTkRPV19VTlNQRUNJRklFRBAAEiAKHFNVTU1BUllfVElNRV9XSU5ET1dfTEFTVF8yNEgQARIfChtTVU1NQVJZX1RJTUVfV0lORE9XX0xBU1RfN0QQAhIgChxTVU1NQVJZX1RJTUVfV0lORE9XX0xBU1RfMzBEEAMSIAocU1VNTUFSWV9USU1FX1dJTkRPV19BTExfVElNRRAEYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_workflowexecution_v1_api,file_ai_stigmer_agentic_workflowexecution_v1_enum,file_ai_stigmer_agentic_workflowexecution_v1_event,file_buf_validate_validate,file_google_protobuf_duration,file_google_protobuf_struct,file_google_protobuf_timestamp]);var WorkflowExecutionListSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,2);var GetEventLogResponseSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,17);var ExecutionSummarySchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,21),WorkflowCostSummarySchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,22),WorkflowFailureRankSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,23),WorkflowCostBreakdownSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,24);var PendingApprovalSchema2=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,26),PendingApprovalsListSchema=messageDesc2(file_ai_stigmer_agentic_workflowexecution_v1_io,27),ExecutionSortField;(function(ExecutionSortField2){ExecutionSortField2[ExecutionSortField2.UNSPECIFIED=0]="UNSPECIFIED",ExecutionSortField2[ExecutionSortField2.STARTED_AT=1]="STARTED_AT",ExecutionSortField2[ExecutionSortField2.DURATION=2]="DURATION",ExecutionSortField2[ExecutionSortField2.COST=3]="COST",ExecutionSortField2[ExecutionSortField2.STATUS=4]="STATUS"})(ExecutionSortField||(ExecutionSortField={}));var SummaryTimeWindow;(function(SummaryTimeWindow2){SummaryTimeWindow2[SummaryTimeWindow2.UNSPECIFIED=0]="UNSPECIFIED",SummaryTimeWindow2[SummaryTimeWindow2.LAST_24H=1]="LAST_24H",SummaryTimeWindow2[SummaryTimeWindow2.LAST_7D=2]="LAST_7D",SummaryTimeWindow2[SummaryTimeWindow2.LAST_30D=3]="LAST_30D",SummaryTimeWindow2[SummaryTimeWindow2.ALL_TIME=4]="ALL_TIME"})(SummaryTimeWindow||(SummaryTimeWindow={}));var file_ai_stigmer_agentic_workflowexecution_v1_command=fileDesc("CjVhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvY29tbWFuZC5wcm90bxInYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxMo0VCiJXb3JrZmxvd0V4ZWN1dGlvbkNvbW1hbmRDb250cm9sbGVyEoYBCgZjcmVhdGUSOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb24aOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb24iBNC4GAESwgEKBnVwZGF0ZRI6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbho6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiJAwrgYPAgCEDQiC21ldGFkYXRhLmlkKil1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIHdvcmtmbG93IGV4ZWN1dGlvbhLhAQoMdXBkYXRlU3RhdHVzEksuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uVXBkYXRlU3RhdHVzSW5wdXQaOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb24iSMK4GEQIAhA0IgxleGVjdXRpb25faWQqMHVuYXV0aG9yaXplZCB0byB1cGRhdGUgd29ya2Zsb3cgZXhlY3V0aW9uIHN0YXR1cxLiAQoOc3VibWl0QXBwcm92YWwSRC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuU3VibWl0V29ya2Zsb3dBcHByb3ZhbElucHV0GjouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uIk7CuBhKCAIQNCIMZXhlY3V0aW9uX2lkKjZ1bmF1dGhvcml6ZWQgdG8gc3VibWl0IGFwcHJvdmFsIGZvciB3b3JrZmxvdyBleGVjdXRpb24S7wEKEnN1Ym1pdEZpbGVEZWNpc2lvbhJILmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5TdWJtaXRXb3JrZmxvd0ZpbGVEZWNpc2lvbklucHV0GjouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uIlPCuBhPCAIQNCIMZXhlY3V0aW9uX2lkKjt1bmF1dGhvcml6ZWQgdG8gc3VibWl0IGZpbGUgZGVjaXNpb24gZm9yIHdvcmtmbG93IGV4ZWN1dGlvbhLpAQoac3VibWl0V29ya2Zsb3dUYXNrQXBwcm92YWwSSC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuU3VibWl0V29ya2Zsb3dUYXNrQXBwcm92YWxJbnB1dBo6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiJFwrgYQQgCEDQiDGV4ZWN1dGlvbl9pZCotdW5hdXRob3JpemVkIHRvIHN1Ym1pdCB3b3JrZmxvdyB0YXNrIGFwcHJvdmFsEq8BCgZkZWxldGUSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBo6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiI6wrgYNggCEDQiBXZhbHVlKil1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIHdvcmtmbG93IGV4ZWN1dGlvbhLNAQoKc2VuZFNpZ25hbBI4LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5TZW5kU2lnbmFsSW5wdXQaOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuV29ya2Zsb3dFeGVjdXRpb24iScK4GEUIAhA0IgxleGVjdXRpb25faWQqMXVuYXV0aG9yaXplZCB0byBzZW5kIHNpZ25hbCB0byB3b3JrZmxvdyBleGVjdXRpb24SxAEKBmNhbmNlbBJFLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5DYW5jZWxXb3JrZmxvd0V4ZWN1dGlvbklucHV0GjouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uIjfCuBgzCAIQNCICaWQqKXVuYXV0aG9yaXplZCB0byBjYW5jZWwgd29ya2Zsb3cgZXhlY3V0aW9uEs0BCgl0ZXJtaW5hdGUSSC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuVGVybWluYXRlV29ya2Zsb3dFeGVjdXRpb25JbnB1dBo6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiI6wrgYNggCEDQiAmlkKix1bmF1dGhvcml6ZWQgdG8gdGVybWluYXRlIHdvcmtmbG93IGV4ZWN1dGlvbhLHAQoHcmVjb3ZlchJGLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5SZWNvdmVyV29ya2Zsb3dFeGVjdXRpb25JbnB1dBo6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiI4wrgYNAgCEDQiAmlkKip1bmF1dGhvcml6ZWQgdG8gcmVjb3ZlciB3b3JrZmxvdyBleGVjdXRpb24SwQEKBXBhdXNlEkQuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLlBhdXNlV29ya2Zsb3dFeGVjdXRpb25JbnB1dBo6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiI2wrgYMggCEDQiAmlkKih1bmF1dGhvcml6ZWQgdG8gcGF1c2Ugd29ya2Zsb3cgZXhlY3V0aW9uEsQBCgZyZXN1bWUSRS5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuUmVzdW1lV29ya2Zsb3dFeGVjdXRpb25JbnB1dBo6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiI3wrgYMwgCEDQiAmlkKil1bmF1dGhvcml6ZWQgdG8gcmVzdW1lIHdvcmtmbG93IGV4ZWN1dGlvbhoEoP8rNGIGcHJvdG8z",[file_ai_stigmer_agentic_workflowexecution_v1_api,file_ai_stigmer_agentic_workflowexecution_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),WorkflowExecutionCommandController=serviceDesc(file_ai_stigmer_agentic_workflowexecution_v1_command,0);var file_ai_stigmer_agentic_workflowexecution_v1_query=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3dleGVjdXRpb24vdjEvcXVlcnkucHJvdG8SJ2FpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MTKDDAogV29ya2Zsb3dFeGVjdXRpb25RdWVyeUNvbnRyb2xsZXISuAEKA2dldBI8LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbklkGjouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uIjfCuBgzCAEQNCIFdmFsdWUqJnVuYXV0aG9yaXplZCB0byBnZXQgd29ya2Zsb3cgZXhlY3V0aW9uEpQBCgRsaXN0EkYuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkxpc3RXb3JrZmxvd0V4ZWN1dGlvbnNSZXF1ZXN0Gj4uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uTGlzdCIE0LgYARKoAQoObGlzdEJ5V29ya2Zsb3cSUC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3dleGVjdXRpb24udjEuTGlzdFdvcmtmbG93RXhlY3V0aW9uc0J5V29ya2Zsb3dSZXF1ZXN0Gj4uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uTGlzdCIE0LgYARLcAQoJc3Vic2NyaWJlEkouYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLlN1YnNjcmliZVdvcmtmbG93RXhlY3V0aW9uUmVxdWVzdBo6LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5Xb3JrZmxvd0V4ZWN1dGlvbiJFwrgYQQgBEDQiDGV4ZWN1dGlvbl9pZCotdW5hdXRob3JpemVkIHRvIGdldCB3b3JrZmxvdyBleGVjdXRpb24gc3RyZWFtMAES0gEKC2dldEV2ZW50TG9nEjsuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkdldEV2ZW50TG9nUmVxdWVzdBo8LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5HZXRFdmVudExvZ1Jlc3BvbnNlIkjCuBhECAEQNCIMZXhlY3V0aW9uX2lkKjB1bmF1dGhvcml6ZWQgdG8gZ2V0IHdvcmtmbG93IGV4ZWN1dGlvbiBldmVudCBsb2cS5QEKD3N1YnNjcmliZUV2ZW50cxI/LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5TdWJzY3JpYmVFdmVudHNSZXF1ZXN0Gj8uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLldvcmtmbG93RXhlY3V0aW9uRXZlbnQiTsK4GEoIARA0IgxleGVjdXRpb25faWQqNnVuYXV0aG9yaXplZCB0byBzdWJzY3JpYmUgdG8gd29ya2Zsb3cgZXhlY3V0aW9uIGV2ZW50czABEpsBChNnZXRFeGVjdXRpb25TdW1tYXJ5EkMuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkdldEV4ZWN1dGlvblN1bW1hcnlSZXF1ZXN0GjkuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvblN1bW1hcnkiBNC4GAESoQEKFGxpc3RQZW5kaW5nQXBwcm92YWxzEkQuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93ZXhlY3V0aW9uLnYxLkxpc3RQZW5kaW5nQXBwcm92YWxzUmVxdWVzdBo9LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvd2V4ZWN1dGlvbi52MS5QZW5kaW5nQXBwcm92YWxzTGlzdCIE0LgYARoEoP8rNGIGcHJvdG8z",[file_ai_stigmer_agentic_workflowexecution_v1_api,file_ai_stigmer_agentic_workflowexecution_v1_event,file_ai_stigmer_agentic_workflowexecution_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),WorkflowExecutionQueryController=serviceDesc(file_ai_stigmer_agentic_workflowexecution_v1_query,0);var TARGET_EXECUTION_KEY="targetResource",CHILD_EXECUTION_ID_KEY="childAgentExecutionId";async function submitApproval2(deps,input,identity2){let reqCtx=new RequestContext(WorkflowExecutionCommandController.method.submitApproval.input,input,identity2,ApiResourceKind.workflow_execution);await newPipeline("workflow-execution-submit-approval",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.submitApproval,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"LoadExisting",async execute(ctx){if(ctx.input.executionId==="")throw invalidArgumentError("execution_id is required");let execution2;try{execution2=await deps.store.getResource(ApiResourceKind.workflow_execution,ctx.input.executionId,WorkflowExecutionSchema)}catch{throw notFoundError("workflow_execution",ctx.input.executionId)}ctx.set(TARGET_EXECUTION_KEY,execution2)}}).addStep({name:"ValidateApproval",execute(ctx){let execution2=ctx.get(TARGET_EXECUTION_KEY),executionId=execution2.metadata?.id??"",requestedToolCallId=ctx.input.toolCallId,pendingApprovals=execution2.status?.pendingApprovals??[];if(pendingApprovals.length===0)throw failedPreconditionError(`workflow execution ${executionId} has no pending approvals`);let matched=pendingApprovals.find(entry=>entry.approval?.toolCallId===requestedToolCallId);if(matched===void 0)throw invalidArgumentError(`tool_call_id ${requestedToolCallId} not found in pending_approvals for workflow execution ${executionId}`);let childExecutionId=matched.childAgentExecutionId;if(childExecutionId==="")throw failedPreconditionError(`workflow execution ${executionId} has no child agent execution ID for tool_call ${requestedToolCallId} - approval must be submitted directly to the agent`);ctx.set(CHILD_EXECUTION_ID_KEY,childExecutionId)}}).addStep({name:"ForwardToChild",async execute(ctx){let childExecutionId=ctx.get(CHILD_EXECUTION_ID_KEY);deps.logger.info("Forwarding approval to child AgentExecution",{childExecutionId,toolCallId:ctx.input.toolCallId});try{await deps.approvalForwarder().submitApproval(create2(SubmitApprovalInputSchema,{agentExecutionId:childExecutionId,toolCallId:ctx.input.toolCallId,action:ctx.input.action,comment:ctx.input.comment}))}catch(error2){let embedded=error2 instanceof ConnectError?goGrpcErrorText(error2):error2 instanceof Error?error2.message:String(error2);throw unavailableError(`failed to forward approval to child agent: ${embedded}`)}}}).addStep({name:"BuildResponse",execute(ctx){let execution2=ctx.get(TARGET_EXECUTION_KEY);deps.logger.info("AUDIT: Workflow approval decision submitted and forwarded to child agent",{workflowExecutionId:execution2.metadata?.id??"",org:execution2.metadata?.org??"",toolCallId:ctx.input.toolCallId,childExecutionId:ctx.get(CHILD_EXECUTION_ID_KEY)})}}).build().execute(reqCtx);let execution=reqCtx.get(TARGET_EXECUTION_KEY);if(execution===void 0)throw internalError(new Error("execution not found in context"),"execution not found in context");return execution}var TARGET_EXECUTION_KEY2="targetResource";async function submitFileDecision2(deps,input,identity2){let reqCtx=new RequestContext(WorkflowExecutionCommandController.method.submitFileDecision.input,input,identity2,ApiResourceKind.workflow_execution);await newPipeline("workflow-execution-submit-file-decision",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.submitFileDecision,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"LoadExisting",async execute(ctx){if(ctx.input.executionId==="")throw invalidArgumentError("execution_id is required");let execution2;try{execution2=await deps.store.getResource(ApiResourceKind.workflow_execution,ctx.input.executionId,WorkflowExecutionSchema)}catch{throw notFoundError("workflow_execution",ctx.input.executionId)}ctx.set(TARGET_EXECUTION_KEY2,execution2)}}).addStep({name:"ValidateFileDecision",execute(ctx){let execution2=ctx.get(TARGET_EXECUTION_KEY2),executionId=execution2.metadata?.id??"",childId=ctx.input.childAgentExecutionId,changeSetId=ctx.input.changeSetId,pendingFileReviews=execution2.status?.pendingFileReviews??[];if(pendingFileReviews.length===0)throw failedPreconditionError(`workflow execution ${executionId} has no pending file reviews`);if(!pendingFileReviews.some(review=>review.childAgentExecutionId===childId&&review.changeSetId.includes(changeSetId)))throw failedPreconditionError(`workflow execution ${executionId} has no pending file review for child ${childId} change set ${changeSetId}`)}}).addStep({name:"ForwardToChild",async execute(ctx){deps.logger.info("Forwarding file decision to child AgentExecution",{childExecutionId:ctx.input.childAgentExecutionId,changeSetId:ctx.input.changeSetId});try{await deps.fileDecisionForwarder().submitFileDecision(create2(SubmitFileDecisionInputSchema,{agentExecutionId:ctx.input.childAgentExecutionId,changeSetId:ctx.input.changeSetId,scope:ctx.input.scope,fileChangeId:ctx.input.fileChangeId,action:ctx.input.action,expectedDigest:ctx.input.expectedDigest,reason:ctx.input.reason,acknowledgeUnreviewable:ctx.input.acknowledgeUnreviewable}))}catch(error2){throw error2 instanceof ConnectError?new ConnectError(error2.rawMessage,error2.code):error2}}}).addStep({name:"BuildResponse",execute(ctx){let execution2=ctx.get(TARGET_EXECUTION_KEY2);deps.logger.info("AUDIT: Workflow file decision submitted and forwarded to child agent",{workflowExecutionId:execution2.metadata?.id??"",org:execution2.metadata?.org??"",childExecutionId:ctx.input.childAgentExecutionId,changeSetId:ctx.input.changeSetId})}}).build().execute(reqCtx);let execution=reqCtx.get(TARGET_EXECUTION_KEY2);if(execution===void 0)throw internalError(new Error("execution not found in context"),"execution not found in context");return execution}var LOADED_EXECUTION_KEY2="loadedExecution";async function submitWorkflowTaskApproval(deps,input,identity2){let reqCtx=new RequestContext(WorkflowExecutionCommandController.method.submitWorkflowTaskApproval.input,input,identity2,ApiResourceKind.workflow_execution);await newPipeline("workflowexecution-submit-task-approval",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.submitWorkflowTaskApproval,deps.authorizer)).addStep({name:"ValidateTaskApprovalInput",execute(ctx){if(ctx.input.executionId==="")throw invalidArgumentError("execution_id is required");if(ctx.input.taskName==="")throw invalidArgumentError("task_name is required");if(ctx.input.outcome==="")throw invalidArgumentError("outcome is required")}}).addStep({name:"LoadExecutionForApproval",async execute(ctx){let execution2;try{execution2=await deps.store.getResource(ApiResourceKind.workflow_execution,ctx.input.executionId,WorkflowExecutionSchema)}catch{throw notFoundError("WorkflowExecution",ctx.input.executionId)}ctx.set(LOADED_EXECUTION_KEY2,execution2)}}).addStep({name:"ValidateApprovalSignalable",execute(ctx){let phase=ctx.get(LOADED_EXECUTION_KEY2).status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;if(phase!==ExecutionPhase2.EXECUTION_PENDING&&phase!==ExecutionPhase2.EXECUTION_IN_PROGRESS)throw failedPreconditionError(`cannot submit task approval: execution is in ${ExecutionPhase2[phase]} phase`)}}).addStep({name:"ValidateHumanInputTask",execute(ctx){let execution2=ctx.get(LOADED_EXECUTION_KEY2),taskName=ctx.input.taskName,task=(execution2.status?.tasks??[]).find(candidate=>candidate.taskName===taskName);if(task===void 0)throw invalidArgumentError(`task '${taskName}' not found in execution status`);if(task.taskType!==WorkflowTaskType.WORKFLOW_TASK_APPROVAL)throw invalidArgumentError(`task '${taskName}' is not a human_input task (type: ${WorkflowTaskType[task.taskType]})`)}}).addStep({name:"SendTaskApprovalSignal",async execute(ctx){let execution2=ctx.get(LOADED_EXECUTION_KEY2),executionId=ctx.input.executionId,humanInputSignalName=HUMAN_INPUT_SIGNAL_PREFIX+ctx.input.taskName,signalPayload={outcome:ctx.input.outcome,reviewer:ctx.input.reviewer,responded_at:new Date().toISOString().replace(/\.\d{3}Z$/,"Z")};ctx.input.formData!==void 0&&(signalPayload.form_data=ctx.input.formData),ctx.input.comment!==""&&(signalPayload.comment=ctx.input.comment);let engineState=deps.engineState();if(!engineState.connected)throw unavailableError(`workflow creator not configured for task '${ctx.input.taskName}'`);try{await engineState.engine.signalWithStart({executionId,workflowInstanceId:execution2.spec?.workflowInstanceId??"",workflowId:execution2.status?.temporalWorkflowId??"",orgId:execution2.metadata?.org??"",recoveryMode:!1,executionTarget:execution2.spec?.executionTarget??0},RELAY_SIGNAL_CHANNEL_NAME,{signalName:humanInputSignalName,payload:signalPayload})}catch(error2){throw unavailableError(`failed to send approval signal for task '${ctx.input.taskName}': ${error2 instanceof Error?error2.message:String(error2)}`)}deps.logger.info("AUDIT: Workflow task approval submitted via relaySignal",{executionId,taskName:ctx.input.taskName,outcome:ctx.input.outcome,signalName:humanInputSignalName})}}).build().execute(reqCtx);let execution=reqCtx.get(LOADED_EXECUTION_KEY2);if(execution===void 0)throw internalError(new Error("execution not found in context after pipeline"),"execution not found in context after pipeline");return execution}function newValidateWorkflowOrInstanceStep(){return{name:"ValidateWorkflowOrInstance",execute(ctx){let spec=ctx.input.spec;if((spec?.workflowInstanceId??"")===""&&(spec?.workflowId??"")==="")throw invalidArgumentError("either workflow_id or workflow_instance_id must be provided")}}}function newCreateDefaultInstanceIfNeededStep2(deps){return{name:"CreateDefaultInstanceIfNeeded",async execute(ctx){let input=ctx.input;if((input.spec?.workflowInstanceId??"")!=="")return;let workflowId=input.spec?.workflowId??"",execution=ctx.newState,workflow;try{workflow=await deps.store.getResource(ApiResourceKind.workflow,workflowId,WorkflowSchema)}catch{throw notFoundError("Workflow",workflowId)}let defaultInstanceId=workflow.status?.defaultInstanceId??"";if(defaultInstanceId!==""){setInstanceId(execution,defaultInstanceId);return}let slug=defaultWorkflowInstanceSlug(workflow.metadata?.slug??""),existingInstance;try{existingInstance=await findInstanceBySlug(deps,slug)}catch(error2){throw internalError(error2,"failed to look up existing default instance")}if(existingInstance!==void 0){let existingId=existingInstance.metadata?.id??"";deps.logger.info("Found existing default instance, updating workflow status",{instanceId:existingId,workflowId}),await backfillDefaultInstanceId(deps,workflow,workflowId,existingId,"failed to update workflow with existing default instance"),setInstanceId(execution,existingId);return}deps.logger.info("Default instance not found, creating new one",{workflowId});let instanceRequest=buildDefaultWorkflowInstanceRequest(workflow.metadata),createdInstance;try{createdInstance=await deps.workflowInstanceCreator().createAsCaller(instanceRequest,ctx.callerIdentity)}catch(error2){throw error2 instanceof ConnectError?goWrappedStatusError("failed to create default workflow instance",error2):internalError(error2,"failed to create default workflow instance")}let createdId=createdInstance.metadata?.id??"";await backfillDefaultInstanceId(deps,workflow,workflowId,createdId,"failed to update workflow with default instance"),setInstanceId(execution,createdId),deps.logger.info("Successfully created and registered default instance",{instanceId:createdId,workflowId})}}}function setInstanceId(execution,instanceId){execution.spec!==void 0&&(execution.spec.workflowInstanceId=instanceId)}async function backfillDefaultInstanceId(deps,workflow,workflowId,instanceId,failureMessage){let status=workflow.status??create2(WorkflowStatusSchema);workflow.status=status,status.defaultInstanceId=instanceId;try{await deps.store.saveResource(ApiResourceKind.workflow,workflowId,WorkflowSchema,workflow)}catch(error2){throw internalError(error2,failureMessage)}await notifyDefaultInstanceLinked(deps.authorizationLifecycle,{instanceKind:ApiResourceKind.workflow_instance,instanceId,blueprintKind:ApiResourceKind.workflow,blueprintId:workflowId})}async function findInstanceBySlug(deps,slug){let rows=await deps.store.listResources(ApiResourceKind.workflow_instance);for(let data of rows){let instance;try{instance=fromBinary2(WorkflowInstanceSchema,data)}catch{deps.logger.warn("Failed to unmarshal workflow instance during slug lookup");continue}if(instance.metadata?.slug===slug)return instance}}function newSetInitialPhaseStep2(){return{name:"SetInitialPhase",execute(ctx){let execution=ctx.newState;execution.status===void 0&&(execution.status=create2(WorkflowExecutionStatusSchema)),execution.status.phase=ExecutionPhase2.EXECUTION_PENDING}}}function newStartWorkflowStep2(deps){return{name:"StartWorkflow",async execute(ctx){let execution=ctx.newState,executionId=execution.metadata?.id??"",engineState=deps.engineState(),startError;if(!engineState.connected)startError=new Error("workflow engine disconnected after the create gate");else try{await engineState.engine.startInvokeWorkflow({executionId,workflowInstanceId:execution.spec?.workflowInstanceId??"",workflowId:execution.spec?.workflowId??"",orgId:execution.metadata?.org??"",recoveryMode:!1,executionTarget:execution.spec?.executionTarget??0})}catch(error2){startError=error2 instanceof Error?error2:new Error(String(error2))}if(startError===void 0){deps.logger.info("Temporal workflow started successfully",{executionId});return}deps.logger.error("Failed to start Temporal workflow - marking execution as FAILED",{executionId,error:startError.message}),execution.status===void 0&&(execution.status=create2(WorkflowExecutionStatusSchema)),execution.status.phase=ExecutionPhase2.EXECUTION_FAILED,execution.status.error=`Failed to start Temporal workflow: ${goErrorText(startError)}`;try{await deps.store.saveResource(ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema,execution)}catch(persistError){throw internalError(persistError,"failed to start workflow and failed to update status")}throw internalError(startError,"failed to start workflow")}}}function goErrorText(error2){return error2.message}function newCreateExecutionContextStep2(deps){return{name:"CreateExecutionContext",async execute(ctx){let execution=ctx.newState,executionId=execution.metadata?.id??"",executionOrg=execution.metadata?.org??"",workflowInstanceId=execution.spec?.workflowInstanceId??"";if(workflowInstanceId==="")throw internalError(new Error("workflow_instance_id not resolved from context or execution spec"),"workflow_instance_id not resolved from context or execution spec");let instance;try{instance=await deps.workflowInstanceLoader().get(workflowInstanceId)}catch(error2){throw error2 instanceof ConnectError?goWrappedStatusError(`load workflow instance ${workflowInstanceId}`,error2):internalError(error2,`load workflow instance ${workflowInstanceId}`)}let workflowId=instance.spec?.workflowId??"",workflow;try{workflow=await deps.store.getResource(ApiResourceKind.workflow,workflowId,WorkflowSchema)}catch(error2){throw internalError(error2,`load workflow ${workflowId}`)}let environments=await resolveEnvironments2(deps,instance.spec?.environmentRefs??[]),merged=mergeEnvironmentLayers(environments,execution.spec?.runtimeEnv??{}),workflowEnvDecls=workflow.spec?.env??{},{filtered,excludedKeys}=filterByDeclaredKeys(merged,workflowEnvDecls);excludedKeys.length>0&&deps.logger.warn("Filtered env vars not declared in workflow env",{executionId,workflowId,excludedKeys});let missingRequired=validateRequiredKeys(filtered,workflowEnvDecls);missingRequired.length>0&&deps.logger.warn("Required env vars missing after environment merge \u2014 execution may fail",{executionId,workflowId,missingRequired});let executionContext=create2(ExecutionContextSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"ExecutionContext",metadata:{name:`exec-ctx-${executionId}`,org:executionOrg},spec:{executionId,data:Object.fromEntries(filtered)}});try{let created=await deps.executionContextCreator().create(executionContext);deps.logger.info("Successfully created execution context",{executionContextId:created.metadata?.id??"",executionId,dataEntries:filtered.size})}catch(error2){throw error2 instanceof ConnectError?goWrappedStatusError(`create execution context for ${executionId}`,error2):internalError(error2,`create execution context for ${executionId}`)}execution.spec!==void 0&&Object.keys(execution.spec.runtimeEnv).length>0&&(execution.spec.runtimeEnv={})}}}async function resolveEnvironments2(deps,refs){if(refs.length===0)return[];let environments=[];for(let ref of refs)try{environments.push(await deps.environmentResolution.resolveByReference(ref))}catch(error2){let prefix=`resolve environment ref (org=${ref.org}, slug=${ref.slug})`;throw error2 instanceof ConnectError?goWrappedStatusError(prefix,error2):internalError(error2,prefix)}return environments}var EngineWorkflowNotFoundError2=class extends Error{constructor(workflowId){super(`workflow not found: ${workflowId}`),this.name="EngineWorkflowNotFoundError"}},ENGINE_DISCONNECTED2=Object.freeze({connected:!1});function newEnsureEngineAvailableStep2(engineState){return{name:"EnsureEngineAvailable",execute(_ctx){if(!engineState().connected)throw unavailableError(ENGINE_UNAVAILABLE_MESSAGE2)}}}var RFC3339_PATTERN2=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;function parseRfc3339Ms2(iso){return iso===""||!RFC3339_PATTERN2.test(iso)?Number.NaN:Date.parse(iso)}function matchesFilterCriteria(execution,filter){return filter===void 0||matchesFilter(execution,filter)}function matchesFilter(execution,f5){let status=execution.status;if(f5.phases.length>0){let phase=status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;if(!f5.phases.includes(phase))return!1}if(f5.startedAfter!==void 0){let started=parseRfc3339Ms2(status?.startedAt??"");if(Number.isNaN(started)||started<timestampMs(f5.startedAfter))return!1}if(f5.startedBefore!==void 0){let started=parseRfc3339Ms2(status?.startedAt??"");if(Number.isNaN(started)||started>timestampMs(f5.startedBefore))return!1}if(f5.minDuration!==void 0||f5.maxDuration!==void 0){let started=parseRfc3339Ms2(status?.startedAt??""),completed=parseRfc3339Ms2(status?.completedAt??"");if(Number.isNaN(started)||Number.isNaN(completed))return!1;let durationMs=completed-started;if(f5.minDuration!==void 0&&durationMs<durationToMs(f5.minDuration)||f5.maxDuration!==void 0&&durationMs>durationToMs(f5.maxDuration))return!1}let costMicros=status?.totalCostMicros??0n;return!(f5.minCostMicros>0n&&costMicros<f5.minCostMicros||f5.maxCostMicros>0n&&costMicros>f5.maxCostMicros||f5.failedTaskName!==""&&!(status?.tasks??[]).some(task=>task.status===WorkflowTaskStatus.WORKFLOW_TASK_FAILED&&task.taskName===f5.failedTaskName)||f5.hasRetries&&!(status?.tasks??[]).some(task=>extractRetryCountFromMetadata(task)>0))}function extractRetryCountFromMetadata(task){let fields2=task.metadata;if(fields2===void 0)return 0;let retryField=fields2.retry_count??fields2.retryCount;return typeof retryField!="number"||retryField<=0?0:Math.trunc(retryField)}function durationToMs(duration){return Number(duration.seconds)*1e3+duration.nanos/1e6}function applySortField(executions,sortField,ascending){executions.length<=1||executions.sort((a5,b7)=>lessBySortField(a5,b7,sortField)?ascending?-1:1:lessBySortField(b7,a5,sortField)?ascending?1:-1:0)}function lessBySortField(a5,b7,field3){switch(field3){case ExecutionSortField.DURATION:return executionDurationMs(a5)<executionDurationMs(b7);case ExecutionSortField.COST:return(a5.status?.totalCostMicros??0n)<(b7.status?.totalCostMicros??0n);case ExecutionSortField.STATUS:return(a5.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED)<(b7.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED);case ExecutionSortField.UNSPECIFIED:case ExecutionSortField.STARTED_AT:{let ta=orNegativeInfinity(parseRfc3339Ms2(a5.status?.startedAt??"")),tb=orNegativeInfinity(parseRfc3339Ms2(b7.status?.startedAt??""));return ta<tb}default:{let exhaustive=field3;throw new Error(`unhandled sort field: ${String(exhaustive)}`)}}}function executionDurationMs(execution){let started=parseRfc3339Ms2(execution.status?.startedAt??""),completed=parseRfc3339Ms2(execution.status?.completedAt??"");return Number.isNaN(started)||Number.isNaN(completed)?-1:completed-started}function orNegativeInfinity(value){return Number.isNaN(value)?Number.NEGATIVE_INFINITY:value}function matchesLegacyPhase(execution,phase){return phase===ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED||(execution.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED)===phase}var REASON_KEY2="reason",ALREADY_IN_TARGET_STATE_KEY2="alreadyInTargetState";function loadedExecution2(ctx){return ctx.get(LOADED_EXECUTION_KEY)}function newLoadExecutionByIdStep2(deps){return{name:"LoadExecutionById",async execute(ctx){let executionId=ctx.input.id;if(executionId==="")throw invalidArgumentError("execution id is required");let execution;try{execution=await deps.store.getResource(ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema)}catch{throw notFoundError("workflow_execution",executionId)}ctx.set(LOADED_EXECUTION_KEY,execution)}}}function newValidatePhaseStep2(name,idempotentPhase,allowedPhases,refusalMessage){return{name,execute(ctx){let phase=loadedExecution2(ctx).status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;if(phase===idempotentPhase){ctx.set(ALREADY_IN_TARGET_STATE_KEY2,!0);return}if(!allowedPhases.includes(phase))throw failedPreconditionError(refusalMessage(ExecutionPhase2[phase]))}}}function newEngineLifecycleStep2(deps,name,failureMessage,operation2){return{name,async execute(ctx){if(ctx.get(ALREADY_IN_TARGET_STATE_KEY2)===!0)return;let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError(TEMPORAL_UNAVAILABLE_MESSAGE);let execution=loadedExecution2(ctx);try{await operation2(engineState.engine,execution,ctx)}catch(error2){if(error2 instanceof EngineWorkflowNotFoundError2){deps.logger.warn("Temporal workflow not found, may have already completed",{executionId:execution.metadata?.id??""});return}throw internalError(error2,failureMessage)}}}}function applyLifecyclePhaseTransition2(execution,targetPhase,setError,clearError,reason){execution.status??=create2(WorkflowExecutionStatusSchema);let status=execution.status;status.phase=targetPhase,(targetPhase===ExecutionPhase2.EXECUTION_CANCELLED||targetPhase===ExecutionPhase2.EXECUTION_TERMINATED)&&(status.completedAt=new Date().toISOString().replace(/\.\d{3}Z$/,"Z")),targetPhase===ExecutionPhase2.EXECUTION_IN_PROGRESS&&(status.completedAt=""),setError&&(status.error=reason!==""?`Terminated: ${reason}`:"Terminated by user"),clearError&&(status.error="")}function newUpdateExecutionPhaseAndPersistStep2(deps,targetPhase,setError,clearError){return{name:"UpdateExecutionPhaseAndPersist",async execute(ctx){if(ctx.get(ALREADY_IN_TARGET_STATE_KEY2)===!0)return;let executionId=loadedExecution2(ctx).metadata?.id??"",reasonValue=ctx.get(REASON_KEY2),reason=typeof reasonValue=="string"?reasonValue:"",updated,previousPhase=ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;try{updated=await deps.store.updateResource(ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema,loaded=>{previousPhase=loaded.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED,applyLifecyclePhaseTransition2(loaded,targetPhase,setError,clearError,reason)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("workflow_execution",executionId):internalError(error2,"failed to persist execution")}ctx.set(LOADED_EXECUTION_KEY,updated),deps.sandboxTerminalObserver(executionId,previousPhase,updated.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED)}}}function newLifecycleBroadcastStep2(deps){return{name:"LifecycleBroadcast",execute(ctx){ctx.get(ALREADY_IN_TARGET_STATE_KEY2)!==!0&&deps.broker.broadcast(loadedExecution2(ctx))}}}function newTerminateExistingWorkflowStep(deps){return{name:"TerminateExistingWorkflow",async execute(ctx){if(ctx.get(ALREADY_IN_TARGET_STATE_KEY2)===!0)return;let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError(TEMPORAL_UNAVAILABLE_MESSAGE);let executionId=loadedExecution2(ctx).metadata?.id??"",targets=[[orchestratorWorkflowId(executionId),"orchestrator workflow"],[childWorkflowId(executionId),"child TS workflow"]];for(let[workflowId,description]of targets)try{await engineState.engine.terminateWorkflow(workflowId,"Recovery: terminating before fresh workflow start"),deps.logger.info(`Successfully terminated ${description}`,{executionId,workflowId})}catch(error2){if(error2 instanceof EngineWorkflowNotFoundError2){deps.logger.info(`${description} already completed/terminated (NOT_FOUND). Proceeding.`,{executionId,workflowId});continue}throw internalError(error2,`failed to terminate ${description} during recovery`)}}}}function newRecreateExecutionContextStep2(deps){return{name:"RecreateExecutionContext",async execute(ctx){if(ctx.get(ALREADY_IN_TARGET_STATE_KEY2)===!0)return;let builder2=deps.executionContextBuilder,execution=loadedExecution2(ctx),executionId=execution.metadata?.id??"",executionOrg=execution.metadata?.org??"",workflowInstanceId=execution.spec?.workflowInstanceId??"";await deleteStaleExecutionContext2(deps,executionId);let instance;try{instance=await builder2.workflowInstanceLoader().get(workflowInstanceId)}catch(error2){deps.logger.warn("WorkflowInstance not found during recovery EC recreation. Proceeding without environment \u2014 workflow tasks may fail if they need env vars.",{executionId,workflowInstanceId,error:error2 instanceof Error?error2.message:String(error2)});return}let workflowId=instance.spec?.workflowId??"",workflow;try{workflow=await builder2.store.getResource(ApiResourceKind.workflow,workflowId,WorkflowSchema)}catch(error2){deps.logger.warn("Workflow not found during recovery EC recreation. Proceeding without environment.",{executionId,workflowId,error:error2 instanceof Error?error2.message:String(error2)});return}let environments=[];for(let ref of instance.spec?.environmentRefs??[])try{environments.push(await builder2.environmentResolution.resolveByReference(ref))}catch(error2){deps.logger.warn("Failed to resolve environments during recovery. Proceeding without environment.",{executionId,error:error2 instanceof Error?error2.message:String(error2)});return}let merged=mergeEnvironmentLayers(environments,{}),{filtered}=filterByDeclaredKeys(merged,workflow.spec?.env??{});if(filtered.size===0){deps.logger.info("No environment variables to recreate for recovered execution",{executionId});return}let executionContext=create2(ExecutionContextSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"ExecutionContext",metadata:{name:`exec-ctx-${executionId}`,org:executionOrg},spec:{executionId,data:Object.fromEntries(filtered)}});try{let created=await builder2.executionContextCreator().create(executionContext);deps.logger.info("Recreated ExecutionContext for recovered execution",{executionContextId:created.metadata?.id??"",executionId,dataEntries:filtered.size})}catch(error2){let prefix=`recreate execution context for recovered execution ${executionId}`;throw error2 instanceof ConnectError?goWrappedStatusError(prefix,error2):internalError(error2,prefix)}}}}async function deleteStaleExecutionContext2(deps,executionId){let staleId="";try{staleId=(await deps.executionContextBuilder.store.findByField(ApiResourceKind.execution_context,"spec.executionId",executionId,ExecutionContextSchema)).metadata?.id??""}catch{return}if(staleId!==""){deps.logger.info("Deleting stale ExecutionContext before recreation",{executionContextId:staleId,executionId});try{await deps.executionContextBuilder.store.deleteResource(ApiResourceKind.execution_context,staleId)}catch(error2){deps.logger.warn("Failed to delete stale ExecutionContext (proceeding anyway)",{executionContextId:staleId,error:error2 instanceof Error?error2.message:String(error2)})}}}function newStartFreshWorkflowStep2(deps){return{name:"StartFreshWorkflow",async execute(ctx){if(ctx.get(ALREADY_IN_TARGET_STATE_KEY2)===!0)return;let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError(TEMPORAL_UNAVAILABLE_CREATOR_MESSAGE);let execution=loadedExecution2(ctx),executionId=execution.metadata?.id??"";try{await engineState.engine.startInvokeWorkflow({executionId,workflowInstanceId:execution.spec?.workflowInstanceId??"",workflowId:execution.spec?.workflowId??"",orgId:execution.metadata?.org??"",recoveryMode:!0,executionTarget:execution.spec?.executionTarget??0})}catch(error2){throw internalError(error2,"failed to start fresh Temporal workflow for recovered execution")}deps.logger.info("Started fresh Temporal workflow for recovered execution (recovery_mode=true)",{executionId})}}}async function runLifecyclePipeline2(deps,pipelineName,schema2,input,method,identity2,steps){let reqCtx=new RequestContext(schema2,input,identity2,ApiResourceKind.workflow_execution),builder2=newPipeline(pipelineName,deps.logger);builder2.addStep(newAuthorizeStep(method,deps.authorizer));for(let step of steps)builder2.addStep(step);await builder2.build().execute(reqCtx);let execution=reqCtx.get(LOADED_EXECUTION_KEY);if(execution===void 0)throw internalError(new Error(`execution not found in context after ${pipelineName}`),`execution not found in context after ${pipelineName.replace("workflowexecution-","")} pipeline`);return execution}async function cancelExecution2(deps,input,identity2){return runLifecyclePipeline2(deps,"workflowexecution-cancel",WorkflowExecutionCommandController.method.cancel.input,input,WorkflowExecutionCommandController.method.cancel,identity2,[newLoadExecutionByIdStep2(deps),newValidatePhaseStep2("ValidateCancellable",ExecutionPhase2.EXECUTION_CANCELLED,[ExecutionPhase2.EXECUTION_PENDING,ExecutionPhase2.EXECUTION_IN_PROGRESS,ExecutionPhase2.EXECUTION_PAUSED],phase=>`cannot cancel execution in phase ${phase}; only PENDING, IN_PROGRESS, or PAUSED can be cancelled`),newEngineLifecycleStep2(deps,"CancelTemporalWorkflow","failed to cancel Temporal workflow",(engine,execution)=>engine.cancelWorkflow(orchestratorWorkflowId(execution.metadata?.id??""))),newUpdateExecutionPhaseAndPersistStep2(deps,ExecutionPhase2.EXECUTION_CANCELLED,!1,!1),newLifecycleBroadcastStep2(deps)])}async function terminateExecution2(deps,input,identity2){return runLifecyclePipeline2(deps,"workflowexecution-terminate",WorkflowExecutionCommandController.method.terminate.input,input,WorkflowExecutionCommandController.method.terminate,identity2,[newLoadExecutionByIdStep2(deps),newValidatePhaseStep2("ValidateTerminable",ExecutionPhase2.EXECUTION_TERMINATED,[ExecutionPhase2.EXECUTION_PENDING,ExecutionPhase2.EXECUTION_IN_PROGRESS,ExecutionPhase2.EXECUTION_PAUSED],phase=>`cannot terminate execution in phase ${phase}; only PENDING, IN_PROGRESS, or PAUSED can be terminated`),newEngineLifecycleStep2(deps,"TerminateTemporalWorkflow","failed to terminate Temporal workflow",async(engine,execution,ctx)=>{let inputReason=ctx.input.reason,reason=inputReason!==""?inputReason:"Terminated by user";await engine.terminateWorkflow(orchestratorWorkflowId(execution.metadata?.id??""),reason),ctx.set(REASON_KEY2,reason)}),newUpdateExecutionPhaseAndPersistStep2(deps,ExecutionPhase2.EXECUTION_TERMINATED,!0,!1),newLifecycleBroadcastStep2(deps)])}async function pauseExecution2(deps,input,identity2){return runLifecyclePipeline2(deps,"workflowexecution-pause",WorkflowExecutionCommandController.method.pause.input,input,WorkflowExecutionCommandController.method.pause,identity2,[newLoadExecutionByIdStep2(deps),newValidatePhaseStep2("ValidatePausable",ExecutionPhase2.EXECUTION_PAUSED,[ExecutionPhase2.EXECUTION_PENDING,ExecutionPhase2.EXECUTION_IN_PROGRESS],phase=>`cannot pause execution in phase ${phase}; only PENDING or IN_PROGRESS can be paused`),newEngineLifecycleStep2(deps,"SignalPauseToTemporal","failed to send pause signal to Temporal workflow",async(engine,execution,ctx)=>{let inputReason=ctx.input.reason,reason=inputReason!==""?inputReason:"Paused by user";await engine.signalWorkflow(orchestratorWorkflowId(execution.metadata?.id??""),PAUSE_SIGNAL_NAME,reason),ctx.set(REASON_KEY2,reason)}),newUpdateExecutionPhaseAndPersistStep2(deps,ExecutionPhase2.EXECUTION_PAUSED,!1,!1),newLifecycleBroadcastStep2(deps)])}async function resumeExecution2(deps,input,identity2){return runLifecyclePipeline2(deps,"workflowexecution-resume",WorkflowExecutionCommandController.method.resume.input,input,WorkflowExecutionCommandController.method.resume,identity2,[newLoadExecutionByIdStep2(deps),newValidatePhaseStep2("ValidateResumable",ExecutionPhase2.EXECUTION_IN_PROGRESS,[ExecutionPhase2.EXECUTION_PAUSED],phase=>`cannot resume execution in phase ${phase}; only PAUSED executions can be resumed`),newEngineLifecycleStep2(deps,"SignalResumeToTemporal","failed to send resume signal to Temporal workflow",(engine,execution)=>engine.signalWorkflow(orchestratorWorkflowId(execution.metadata?.id??""),RESUME_SIGNAL_NAME,void 0)),newUpdateExecutionPhaseAndPersistStep2(deps,ExecutionPhase2.EXECUTION_IN_PROGRESS,!1,!1),newLifecycleBroadcastStep2(deps)])}async function recoverExecution2(deps,input,identity2){return runLifecyclePipeline2(deps,"workflowexecution-recover",WorkflowExecutionCommandController.method.recover.input,input,WorkflowExecutionCommandController.method.recover,identity2,[newLoadExecutionByIdStep2(deps),newValidatePhaseStep2("ValidateRecoverable",ExecutionPhase2.EXECUTION_IN_PROGRESS,[ExecutionPhase2.EXECUTION_FAILED],phase=>`cannot recover execution in phase ${phase}; only FAILED executions can be recovered`),...stepsForSlot(deps.gateSteps,"sandbox-acquisition:gate"),newTerminateExistingWorkflowStep(deps),newRecreateExecutionContextStep2(deps),{name:"EnsureWorkflowSandbox",async execute(ctx){ctx.get(ALREADY_IN_TARGET_STATE_KEY2)!==!0&&await ensureWorkflowSandboxForExecution({logger:deps.logger,lane:deps.sandboxLane,temporalConfig:deps.temporalConfig},loadedExecution2(ctx),ctx.callerIdentity)}},newStartFreshWorkflowStep2(deps),newUpdateExecutionPhaseAndPersistStep2(deps,ExecutionPhase2.EXECUTION_IN_PROGRESS,!1,!0),newLifecycleBroadcastStep2(deps)])}function newNormalizeWorkflowRefStep(store,logger2){return{name:"NormalizeWorkflowRef",async execute(ctx){let execution=ctx.newState,executionId=execution.metadata?.id??"";if((execution.spec?.workflowId??"")!=="")return;let instanceId=execution.spec?.workflowInstanceId??"";if(instanceId===""){logger2.warn("Cannot resolve spec.workflow_id: workflow_instance_id is empty",{executionId});return}let instance;try{instance=await store.getResource(ApiResourceKind.workflow_instance,instanceId,WorkflowInstanceSchema)}catch(error2){logger2.warn("Cannot resolve spec.workflow_id: failed to load workflow instance",{executionId,workflowInstanceId:instanceId,error:error2 instanceof Error?error2.message:String(error2)});return}let workflowId=instance.spec?.workflowId??"";if(workflowId===""){logger2.warn("Cannot resolve spec.workflow_id: instance has no workflow_id",{executionId,workflowInstanceId:instanceId});return}execution.spec!==void 0&&(execution.spec.workflowId=workflowId)}}}function newPinWorkflowVersionStep(store,logger2){return{name:"PinWorkflowVersion",async execute(ctx){let execution=ctx.newState,workflowId=execution.spec?.workflowId??"";if(workflowId===""&&(workflowId=ctx.input.spec?.workflowId??""),workflowId===""&&(workflowId=await resolveWorkflowIdFromInstance(store,logger2,ctx)),workflowId==="")return;let workflow;try{workflow=await store.getResource(ApiResourceKind.workflow,workflowId,WorkflowSchema)}catch(error2){logger2.warn("Failed to load workflow for version pinning \u2014 execution will use live workflow at hydration",{workflowId,error:error2 instanceof Error?error2.message:String(error2)});return}let versionHash=workflow.status?.versionHash??"";versionHash!==""&&(execution.status===void 0&&(execution.status=create2(WorkflowExecutionStatusSchema)),execution.status.workflowVersionHash=versionHash,logger2.info("Pinned workflow version on execution",{workflowId,versionHash:`${versionHash.slice(0,12)}...`}))}}}async function resolveWorkflowIdFromInstance(store,logger2,ctx){let instanceId=ctx.newState.spec?.workflowInstanceId??"";if(instanceId===""&&(instanceId=ctx.input.spec?.workflowInstanceId??""),instanceId==="")return"";try{return(await store.getResource(ApiResourceKind.workflow_instance,instanceId,WorkflowInstanceSchema)).spec?.workflowId??""}catch(error2){return logger2.debug("Could not load workflow instance for version pin resolution",{workflowInstanceId:instanceId,error:error2 instanceof Error?error2.message:String(error2)}),""}}var LOADED_EXECUTION_KEY3="loadedExecution",DEDUPE_CLAIMED_KEY="dedupe_claimed",DEDUPE_SKIPPED_KEY="dedupe_skipped";async function sendSignal(deps,input,identity2){let reqCtx=new RequestContext(WorkflowExecutionCommandController.method.sendSignal.input,input,identity2,ApiResourceKind.workflow_execution),pipeline2=newPipeline("workflowexecution-send-signal",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.sendSignal,deps.authorizer)).addStep({name:"ValidateSignalInput",execute(ctx){if(ctx.input.executionId==="")throw invalidArgumentError("execution_id is required");if(ctx.input.signalName==="")throw invalidArgumentError("signal_name is required")}}).addStep({name:"LoadExecutionByExecutionId",async execute(ctx){let execution2;try{execution2=await deps.store.getResource(ApiResourceKind.workflow_execution,ctx.input.executionId,WorkflowExecutionSchema)}catch{throw notFoundError("workflow_execution",ctx.input.executionId)}ctx.set(LOADED_EXECUTION_KEY3,execution2)}}).addStep({name:"ValidateSignalable",execute(ctx){let phase=ctx.get(LOADED_EXECUTION_KEY3).status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;if(phase!==ExecutionPhase2.EXECUTION_PENDING&&phase!==ExecutionPhase2.EXECUTION_IN_PROGRESS)throw failedPreconditionError(`cannot send signal to execution in phase ${ExecutionPhase2[phase]}; only PENDING or IN_PROGRESS executions can receive signals`)}}).addStep({name:"DedupeClaimStep",async execute(ctx){let idempotencyKey=ctx.input.idempotencyKey;if(idempotencyKey===""){ctx.set(DEDUPE_SKIPPED_KEY,!0);return}let execution2=ctx.get(LOADED_EXECUTION_KEY3),org=execution2.metadata?.org??"",executionId=execution2.metadata?.id??"",result;try{result=await deps.store.signalDedupe.claim(org,idempotencyKey,executionId,ctx.input.signalName,IN_FLIGHT_CLAIM_TTL_MS)}catch(error2){deps.logger.error("Failed to claim idempotency key",{executionId,idempotencyKey,error:error2 instanceof Error?error2.message:String(error2)}),ctx.set(DEDUPE_SKIPPED_KEY,!0);return}if(result.status==="DUPLICATE")throw result.record?.status==="DELIVERED"?alreadyExistsError("signal_with_idempotency_key",idempotencyKey):abortedError(`signal with idempotency_key "${idempotencyKey}" is currently being delivered; retry shortly`);ctx.set(DEDUPE_CLAIMED_KEY,!0)}}).addStep({name:"SendSignalToWorkflow",async execute(ctx){let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError(WORKFLOW_CREATOR_UNAVAILABLE_MESSAGE);let execution2=ctx.get(LOADED_EXECUTION_KEY3),executionId=execution2.metadata?.id??"",relayPayload={signalName:ctx.input.signalName,payload:ctx.input.payload??null};try{await engineState.engine.signalWithStart({executionId,workflowInstanceId:execution2.spec?.workflowInstanceId??"",workflowId:execution2.spec?.workflowId??"",orgId:execution2.metadata?.org??"",recoveryMode:!1,executionTarget:execution2.spec?.executionTarget??0},RELAY_SIGNAL_CHANNEL_NAME,relayPayload)}catch(error2){throw internalError(error2,"failed to send signal to workflow")}}}).addStep({name:"DedupeMarkDeliveredStep",async execute(ctx){if(ctx.get(DEDUPE_SKIPPED_KEY)===!0||ctx.get(DEDUPE_CLAIMED_KEY)!==!0)return;let execution2=ctx.get(LOADED_EXECUTION_KEY3),org=execution2.metadata?.org??"";try{await deps.store.signalDedupe.markDelivered(org,ctx.input.idempotencyKey)}catch(error2){deps.logger.warn("Failed to mark idempotency key as delivered (signal was sent)",{executionId:execution2.metadata?.id??"",idempotencyKey:ctx.input.idempotencyKey,error:error2 instanceof Error?error2.message:String(error2)})}}}).build();try{await pipeline2.execute(reqCtx)}catch(error2){throw await releaseDedupeClaimAfterFailure(deps,reqCtx,input),error2}let execution=reqCtx.get(LOADED_EXECUTION_KEY3);if(execution===void 0)throw internalError(new Error("execution not found in context after send signal pipeline"),"execution not found in context after send signal pipeline");return execution}async function releaseDedupeClaimAfterFailure(deps,reqCtx,input){if(reqCtx.get(DEDUPE_CLAIMED_KEY)!==!0)return;let execution=reqCtx.get(LOADED_EXECUTION_KEY3);if(execution!==void 0)try{await deps.store.signalDedupe.release(execution.metadata?.org??"",input.idempotencyKey)}catch(error2){deps.logger.warn("Failed to release idempotency key after failed delivery (claim self-heals when its hold lapses)",{executionId:input.executionId,idempotencyKey:input.idempotencyKey,error:error2 instanceof Error?error2.message:String(error2)})}}function eventTypeName(eventType){return WorkflowEventType[eventType]??""}async function getEventLog(deps,req,identity2){if(req.executionId==="")throw invalidArgumentError("execution_id is required");await authorizeDirect(WorkflowExecutionQueryController.method.getEventLog,deps.authorizer,identity2,req);let pageSize=req.pageSize;pageSize<=0&&(pageSize=DEFAULT_EVENT_PAGE_SIZE),pageSize>MAX_EVENT_PAGE_SIZE&&(pageSize=MAX_EVENT_PAGE_SIZE);let eventTypeFilter="";req.eventTypes.length===1&&(eventTypeFilter=eventTypeName(req.eventTypes[0]));let records;try{records=await deps.store.getWorkflowExecutionEvents(req.executionId,Number(req.afterSequence),eventTypeFilter,req.taskName,pageSize+1)}catch(error2){throw deps.logger.error("Failed to query execution events",{executionId:req.executionId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to query execution events")}let hasMore=records.length>pageSize;hasMore&&(records=records.slice(0,pageSize));let typeFilter;req.eventTypes.length>1&&(typeFilter=new Set(req.eventTypes.map(eventTypeName)));let events=[],latestSequence=0n;for(let record2 of records){if(typeFilter!==void 0&&!typeFilter.has(record2.eventType))continue;let event;try{event=fromBinary2(WorkflowExecutionEventSchema,record2.data)}catch{deps.logger.warn("Skipping malformed event record",{executionId:req.executionId,sequenceNumber:record2.sequenceNumber});continue}events.push(event),BigInt(record2.sequenceNumber)>latestSequence&&(latestSequence=BigInt(record2.sequenceNumber))}return create2(GetEventLogResponseSchema,{events,hasMore,latestSequence})}function decodeWorkflowExecution(data,logger2){try{return fromBinary2(WorkflowExecutionSchema,data)}catch(error2){logger2.warn("Failed to unmarshal workflow execution, skipping",{error:error2 instanceof Error?error2.message:String(error2)});return}}async function loadWorkflowExecutions(store,logger2,query,internalMessage){let rows;try{rows=await store.queryResources(workflowExecutionListIndex,query)}catch(error2){throw internalError(error2,internalMessage)}let executions=[];for(let row of rows){let execution=decodeWorkflowExecution(row.data,logger2);execution!==void 0&&executions.push(execution)}return executions}async function readWorkflowExecutionList(read3){let scope=executions2=>restrictListByReadScope(read3.listReadScope,read3.identity,ApiResourceKind.workflow_execution,executions2,"");if(read3.sortField===ExecutionSortField.UNSPECIFIED){let page=await readListPage({store:read3.store,declaration:workflowExecutionListIndex,query:read3.query,request:read3.request,fingerprint:listPageFingerprint(read3.fingerprint),decode:data=>decodeWorkflowExecution(data,read3.logger),keep:read3.keep,scope,failure:"failed to list workflow executions"});return create2(WorkflowExecutionListSchema,{entries:page.entries,nextPageToken:page.nextPageToken,totalPages:page.nextPageToken===""?1:0})}if(read3.request.pageToken!=="")throw invalidArgumentError("invalid page_token");if(read3.request.pageSize<0)throw invalidArgumentError("page_size must not be negative");let executions=await scope((await loadWorkflowExecutions(read3.store,read3.logger,read3.query,"failed to list workflow executions")).filter(read3.keep));applySortField(executions,read3.sortField,read3.sortAscending);let size=Math.min(read3.request.pageSize,LIST_PAGE_MAX_SIZE);return create2(WorkflowExecutionListSchema,{entries:size===0?executions:executions.slice(0,size),totalPages:1})}var RANK_LIMIT=10;async function getExecutionSummary2(deps,req,identity2){let cutoffMs=resolveTimeCutoffMs(req.timeWindow),executions=await loadWorkflowExecutions(deps.store,deps.logger,{org:req.org,...cutoffMs===void 0?{}:{createdAtOrAfter:listIndexInstantOfMillis(cutoffMs-1)}},"failed to list workflow executions for summary");if(deps.listReadScope!==void 0&&(executions=await restrictListByReadScope(deps.listReadScope,identity2,ApiResourceKind.workflow_execution,executions,""),executions.length===0))return create2(ExecutionSummarySchema);let workflowFilter=req.workflowId,phaseCounts={},activeCount=0,totalCount=0,completedCount=0,failedCount=0,completedDurationsMs=[],failureCounts=new Map,workflowNames=new Map,execByWorkflow=new Map,costByWorkflow=new Map,totalCostMicros=0n,totalInputTokens=0n,totalOutputTokens=0n;for(let execution of executions){let createdAtMs=auditCreatedAtMs2(execution.status?.audit?.specAudit?.createdAt);if(createdAtMs!==void 0&&cutoffMs!==void 0&&createdAtMs<cutoffMs||workflowFilter!==""&&execution.spec?.workflowId!==workflowFilter&&execution.spec?.workflowInstanceId!==workflowFilter)continue;let phase=execution.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;phaseCounts[phase]=(phaseCounts[phase]??0)+1,totalCount++,isActivePhase(phase)&&activeCount++,phase===ExecutionPhase2.EXECUTION_COMPLETED&&completedCount++,phase===ExecutionPhase2.EXECUTION_FAILED&&failedCount++;let slug=execution.metadata?.slug??"";if(slug!==""){execByWorkflow.set(slug,(execByWorkflow.get(slug)??0)+1);let name=execution.metadata?.name??"";name!==""&&workflowNames.set(slug,name)}let execCostMicros=execution.status?.totalCostMicros??0n;if(totalCostMicros+=execCostMicros,totalInputTokens+=execution.status?.totalInputTokens??0n,totalOutputTokens+=execution.status?.totalOutputTokens??0n,slug!==""&&execCostMicros>0n&&costByWorkflow.set(slug,(costByWorkflow.get(slug)??0)+Number(execCostMicros)/1e6),phase===ExecutionPhase2.EXECUTION_COMPLETED){let durationMs=completionDurationMs2(execution);durationMs>0&&completedDurationsMs.push(durationMs)}phase===ExecutionPhase2.EXECUTION_FAILED&&slug!==""&&failureCounts.set(slug,(failureCounts.get(slug)??0)+1)}let successRate=-1,terminal=completedCount+failedCount;terminal>0&&(successRate=completedCount/terminal);let summary=create2(ExecutionSummarySchema,{activeCount,phaseCounts,totalCost:create2(WorkflowCostSummarySchema,{totalCostUsd:Number(totalCostMicros)/1e6,totalInputTokens,totalOutputTokens}),totalCount,successRate});if(completedDurationsMs.length>0){let totalMs=0;for(let durationMs of completedDurationsMs)totalMs+=durationMs;summary.avgDuration=durationFromMs2(totalMs/completedDurationsMs.length)}return summary.topFailingWorkflows=buildFailureRanks(failureCounts,workflowNames,RANK_LIMIT),summary.costByWorkflow=buildCostBreakdown(costByWorkflow,execByWorkflow,workflowNames,RANK_LIMIT),summary}function resolveTimeCutoffMs(timeWindow){let nowMs=Date.now();switch(timeWindow){case SummaryTimeWindow.LAST_24H:return nowMs-1440*60*1e3;case SummaryTimeWindow.LAST_7D:return nowMs-10080*60*1e3;case SummaryTimeWindow.LAST_30D:return nowMs-720*60*60*1e3;case SummaryTimeWindow.ALL_TIME:return;default:return nowMs-10080*60*1e3}}function isActivePhase(phase){return phase===ExecutionPhase2.EXECUTION_PENDING||phase===ExecutionPhase2.EXECUTION_IN_PROGRESS||phase===ExecutionPhase2.EXECUTION_PAUSED}function auditCreatedAtMs2(createdAt){if(createdAt!==void 0)return timestampMs(createdAt)}function completionDurationMs2(execution){let started=parseRfc3339Ms2(execution.status?.startedAt??""),completed=parseRfc3339Ms2(execution.status?.completedAt??"");return Number.isNaN(started)||Number.isNaN(completed)?0:completed-started}function durationFromMs2(ms){let truncatedMs=Math.trunc(ms),seconds=Math.trunc(truncatedMs/1e3),nanos=Math.trunc((truncatedMs-seconds*1e3)*1e6);return create2(DurationSchema,{seconds:BigInt(seconds),nanos})}function buildFailureRanks(counts,names,limit){return[...counts.entries()].sort((a5,b7)=>b7[1]-a5[1]).slice(0,limit).map(([slug,count])=>create2(WorkflowFailureRankSchema,{workflowSlug:slug,workflowName:names.get(slug)??"",failureCount:count}))}function buildCostBreakdown(costs,execCounts,names,limit){return[...costs.entries()].sort((a5,b7)=>b7[1]-a5[1]).slice(0,limit).map(([slug,cost])=>create2(WorkflowCostBreakdownSchema,{workflowSlug:slug,workflowName:names.get(slug)??"",totalCostUsd:cost,executionCount:execCounts.get(slug)??0}))}async function listPendingApprovals(deps,req,identity2){if(req.pageSize<0)throw invalidArgumentError("page_size must not be negative");let fingerprint=listPageFingerprint({lane:"workflowExecution.listPendingApprovals",org:req.org}),after=req.pageToken===""?void 0:decodeListPageToken(req.pageToken,fingerprint),executions=await restrictListByReadScope(deps.listReadScope,identity2,ApiResourceKind.workflow_execution,(await loadWorkflowExecutions(deps.store,deps.logger,{org:req.org},"failed to list workflow executions for pending approvals")).filter(mayHavePendingApproval),""),pageSize=req.pageSize;pageSize===0&&(pageSize=DEFAULT_PENDING_APPROVALS_PAGE_SIZE),pageSize>MAX_PENDING_APPROVALS_PAGE_SIZE&&(pageSize=MAX_PENDING_APPROVALS_PAGE_SIZE);let approvals=[];for(let execution of executions){let cursor={createdAt:listIndexInstant(execution.status?.audit?.specAudit?.createdAt),id:execution.metadata?.id??""},position=0;for(let task of execution.status?.tasks??[])task.status===WorkflowTaskStatus.WORKFLOW_TASK_WAITING_APPROVAL&&(approvals.push({approval:create2(PendingApprovalSchema2,{executionId:execution.metadata?.id??"",workflowName:execution.metadata?.name??"",taskName:task.taskName,requester:execution.status?.audit?.specAudit?.createdBy?.id??"",requestedAt:parseTimestampString(task.startedAt),uiHint:task.uiHint}),at:{cursor,position}}),position+=1)}let start=after===void 0?0:approvals.findIndex(a5=>comesAfter(a5.at,after)),remaining=start<0?[]:approvals.slice(start),page=remaining.slice(0,pageSize),last=page[page.length-1];return create2(PendingApprovalsListSchema,{entries:page.map(a5=>a5.approval),totalCount:approvals.length,nextPageToken:remaining.length>pageSize&&last!==void 0?encodeListPageToken(last.at.cursor,fingerprint,last.at.position):""})}function comesAfter(at2,after){let order=compareListIndexOrder(at2.cursor,after.cursor);return order>0||order===0&&at2.position>(after.position??-1)}function parseTimestampString(value){let ms=parseRfc3339Ms2(value);if(!Number.isNaN(ms))return timestampFromMs(ms)}function mayHavePendingApproval(execution){return(execution.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED)===ExecutionPhase2.EXECUTION_IN_PROGRESS&&(execution.status?.tasks??[]).some(task=>task.status===WorkflowTaskStatus.WORKFLOW_TASK_WAITING_APPROVAL)}function workflowExecutionRunTarget(execution){let spec=execution.spec,workflowInstanceId=spec?.workflowInstanceId??"";if(workflowInstanceId!=="")return{...RUN_GATE_CHECKS.workflowInstance,resourceId:workflowInstanceId,deniedMessage:runWorkflowInstanceDeniedMessage(workflowInstanceId)};let workflowId=spec?.workflowId??"";if(workflowId!=="")return{...RUN_GATE_CHECKS.workflow,resourceId:workflowId,deniedMessage:runWorkflowDeniedMessage(workflowId)}}function isWorkflowTerminalPhase(phase){return phase===ExecutionPhase2.EXECUTION_COMPLETED||phase===ExecutionPhase2.EXECUTION_FAILED||phase===ExecutionPhase2.EXECUTION_CANCELLED}async function*subscribeExecution2(deps,request,context2){if(request.executionId==="")throw invalidArgumentError("execution_id is required");await authorizeDirect(WorkflowExecutionQueryController.method.subscribe,deps.authorizer,callerIdentityOf(context2),request);let id=request.executionId;deps.logger.info("Starting workflow execution subscription",{executionId:id});let subscription=deps.broker.subscribe(id);try{let snapshot;try{snapshot=await deps.store.getResource(ApiResourceKind.workflow_execution,id,WorkflowExecutionSchema)}catch{throw notFoundError("WorkflowExecution",id)}yield snapshot,deps.logger.debug("Sent initial workflow execution state, streaming live updates",{executionId:id});let lastSent=snapshot,abort=new Promise(resolve=>{context2.signal.addEventListener("abort",()=>resolve(),{once:!0})});for(;!context2.signal.aborted;){if(subscription.closed){deps.logger.warn("Updates channel closed unexpectedly",{executionId:id});return}if(subscription.queue.length===0){await Promise.race([abort,new Promise(resolve=>subscription.notify=resolve)]),subscription.notify=void 0;continue}let updated=subscription.queue.shift();if(updated===void 0||equals(WorkflowExecutionSchema,updated,lastSent))continue;yield updated,lastSent=updated;let phase=updated.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;if(isWorkflowTerminalPhase(phase)){deps.logger.info("Workflow execution reached terminal state, ending subscription",{executionId:id,phase:ExecutionPhase2[phase]});return}}deps.logger.info("Workflow execution subscription cancelled by client",{executionId:id})}finally{deps.broker.unsubscribe(id,subscription)}}async function*subscribeEvents(deps,request,context2){if(request.executionId==="")throw invalidArgumentError("execution_id is required");await authorizeDirect(WorkflowExecutionQueryController.method.subscribeEvents,deps.authorizer,callerIdentityOf(context2),request);let executionId=request.executionId;try{await deps.store.getResource(ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema)}catch{throw notFoundError("WorkflowExecution",executionId)}let typeFilter;request.eventTypes.length>0&&(typeFilter=new Set(request.eventTypes.map(eventTypeName)));let cursor=Number(request.afterSequence);deps.logger.info("Starting event subscription",{executionId,afterSequence:cursor});let abort=new Promise(resolve=>{context2.signal.addEventListener("abort",()=>resolve(),{once:!0})});for(;!context2.signal.aborted;){let records;try{records=await deps.store.getWorkflowExecutionEvents(executionId,cursor,"","",DEFAULT_EVENT_PAGE_SIZE)}catch(error2){throw deps.logger.error("Failed to poll execution events",{executionId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to poll execution events")}for(let record2 of records){if(typeFilter!==void 0&&!typeFilter.has(record2.eventType)){cursor=record2.sequenceNumber;continue}let event;try{event=fromBinary2(WorkflowExecutionEventSchema,record2.data)}catch{deps.logger.warn("Skipping malformed event record",{executionId,sequenceNumber:record2.sequenceNumber}),cursor=record2.sequenceNumber;continue}if(context2.signal.aborted)return;yield event,cursor=record2.sequenceNumber}try{let phase=(await deps.store.getResource(ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema)).status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;if(isWorkflowTerminalPhase(phase)){let remaining=[];try{remaining=await deps.store.getWorkflowExecutionEvents(executionId,cursor,"","",DEFAULT_EVENT_PAGE_SIZE)}catch{remaining=[]}for(let record2 of remaining){if(typeFilter!==void 0&&!typeFilter.has(record2.eventType))continue;let event;try{event=fromBinary2(WorkflowExecutionEventSchema,record2.data)}catch{continue}if(context2.signal.aborted)return;yield event}deps.logger.info("Execution reached terminal state, closing event stream",{executionId,phase:ExecutionPhase2[phase]});return}}catch{}await Promise.race([abort,sleep3(EVENT_POLL_INTERVAL_MS)])}deps.logger.info("Event subscription cancelled by client",{executionId})}function sleep3(ms){return new Promise(resolve=>{setTimeout(resolve,ms).unref()})}var EXECUTION_KEY3="execution";async function updateStatus2(deps,input,identity2){let reqCtx=new RequestContext(WorkflowExecutionCommandController.method.updateStatus.input,input,identity2,ApiResourceKind.workflow_execution);await newPipeline("workflowexecution-update-status",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.updateStatus,deps.authorizer)).addStep({name:"ValidateUpdateStatusInput",execute(ctx){if(ctx.input.executionId==="")throw invalidArgumentError("execution_id is required");if(ctx.input.status===void 0)throw invalidArgumentError("status is required")}}).addStep({name:"MergeAndPersistExecution",async execute(ctx){let updated,previousPhase=ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED;try{updated=await deps.store.updateResource(ApiResourceKind.workflow_execution,ctx.input.executionId,WorkflowExecutionSchema,execution=>{previousPhase=execution.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED,applyUpdateStatusMerge2(execution,ctx.input)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("WorkflowExecution",ctx.input.executionId):internalError(error2,"failed to update execution status")}ctx.set(EXECUTION_KEY3,updated),deps.sandboxTerminalObserver(ctx.input.executionId,previousPhase,updated.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED),deps.logger.info("Successfully updated execution status",{executionId:ctx.input.executionId,phase:ExecutionPhase2[updated.status?.phase??ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED]})}}).addStep({name:"PersistEvents",async execute(ctx){await persistEvents(deps,ctx.input)}}).addStep({name:"BroadcastToStreams",execute(ctx){let execution=ctx.get(EXECUTION_KEY3);if(execution===void 0)throw internalError(new Error("execution not found in context"),"execution not found in context");deps.broker.broadcast(execution)}}).build().execute(reqCtx);let merged=reqCtx.get(EXECUTION_KEY3);if(merged===void 0)throw internalError(new Error("execution not found in context after pipeline"),"execution not found in context after pipeline");return merged}function mergePendingByChild(existing,incoming,childOf,scopeChildId){let merged=[];for(let entry of existing)childOf(entry)!==scopeChildId&&merged.push(entry);return merged.push(...incoming),merged}function applyUpdateStatusMerge2(execution,input){execution.status===void 0&&(execution.status=create2(WorkflowExecutionStatusSchema));let status=execution.status,requestStatus=input.status;if(requestStatus===void 0)return;let previousPhase=status.phase;requestStatus.tasks.length>0&&(status.tasks=requestStatus.tasks),requestStatus.phase!==ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED&&(status.phase=requestStatus.phase),requestStatus.output!==void 0&&(status.output=requestStatus.output),requestStatus.error!==""&&(status.error=requestStatus.error),requestStatus.startedAt!==""&&(status.startedAt=requestStatus.startedAt),requestStatus.completedAt!==""&&(status.completedAt=requestStatus.completedAt),requestStatus.temporalWorkflowId!==""&&(status.temporalWorkflowId=requestStatus.temporalWorkflowId),requestStatus.totalCostMicros>0n&&(status.totalCostMicros=requestStatus.totalCostMicros),requestStatus.totalInputTokens>0n&&(status.totalInputTokens=requestStatus.totalInputTokens),requestStatus.totalOutputTokens>0n&&(status.totalOutputTokens=requestStatus.totalOutputTokens);let scopeChildId=input.pendingUpdateChildAgentExecutionId;if(input.updatePendingApprovals&&(status.pendingApprovals=mergePendingByChild(status.pendingApprovals,requestStatus.pendingApprovals,entry=>entry.childAgentExecutionId,scopeChildId)),input.updatePendingFileReviews&&(status.pendingFileReviews=mergePendingByChild(status.pendingFileReviews,requestStatus.pendingFileReviews,entry=>entry.childAgentExecutionId,scopeChildId)),requestStatus.phase!==ExecutionPhase2.EXECUTION_PHASE_UNSPECIFIED&&requestStatus.phase!==previousPhase){let audit=status.audit??create2(ApiResourceAuditSchema);status.audit=audit;let statusAudit=audit.statusAudit??create2(ApiResourceAuditInfoSchema);audit.statusAudit=statusAudit,statusAudit.updatedAt=timestampNow(),statusAudit.event="updated"}}async function persistEvents(deps,input){if(input.events.length===0)return;let executionId=input.executionId,records=[];for(let event of input.events){let data;try{data=toBinary(WorkflowExecutionEventSchema,event)}catch(error2){deps.logger.error("Failed to marshal event \u2014 dropping batch (non-fatal, timeline data lost)",{executionId,sequenceNumber:event.sequenceNumber,eventCount:input.events.length,error:error2 instanceof Error?error2.message:String(error2)});return}records.push({executionId,sequenceNumber:Number(event.sequenceNumber),eventType:WorkflowEventType[event.eventType]??"",taskName:event.taskName,data,createdAt:""})}let appended;try{appended=await deps.store.appendWorkflowExecutionEvents(executionId,records)}catch(error2){deps.logger.error("Failed to persist execution events (non-fatal, timeline data lost)",{executionId,submitted:records.length,error:error2 instanceof Error?error2.message:String(error2)});return}let skipped=records.length-appended;skipped>0?deps.logger.debug("Persisted execution events (idempotent retry skipped already-persisted sequences)",{executionId,appended,skippedDuplicates:skipped}):deps.logger.debug("Persisted execution events",{executionId,appended})}function registerWorkflowExecutionServices(router,deps){let lifecycleDeps={store:deps.store,logger:deps.logger,authorizer:deps.authorizer,broker:deps.broker,engineState:deps.engineState,executionContextBuilder:deps.executionContextBuilder,sandboxLane:deps.sandboxLane,temporalConfig:deps.temporalConfig,sandboxTerminalObserver:deps.sandboxTerminalObserver,gateSteps:deps.gateSteps};router.service(WorkflowExecutionCommandController,{create:(execution,ctx)=>createExecution2(deps,execution,ctx),update:(execution,ctx)=>update18(deps,execution,ctx),updateStatus:(input,ctx)=>updateStatus2(deps,input,callerIdentityOf(ctx)),submitApproval:(input,ctx)=>submitApproval2(deps,input,callerIdentityOf(ctx)),submitFileDecision:(input,ctx)=>submitFileDecision2(deps,input,callerIdentityOf(ctx)),submitWorkflowTaskApproval:(input,ctx)=>submitWorkflowTaskApproval(deps,input,callerIdentityOf(ctx)),delete:(id,ctx)=>deleteExecution2(deps,id,ctx),sendSignal:(input,ctx)=>sendSignal(deps,input,callerIdentityOf(ctx)),cancel:(input,ctx)=>cancelExecution2(lifecycleDeps,input,callerIdentityOf(ctx)),terminate:(input,ctx)=>terminateExecution2(lifecycleDeps,input,callerIdentityOf(ctx)),recover:(input,ctx)=>recoverExecution2(lifecycleDeps,input,callerIdentityOf(ctx)),pause:(input,ctx)=>pauseExecution2(lifecycleDeps,input,callerIdentityOf(ctx)),resume:(input,ctx)=>resumeExecution2(lifecycleDeps,input,callerIdentityOf(ctx))}),router.service(WorkflowExecutionQueryController,{get:(id,ctx)=>get25(deps,id,ctx),list:(req,ctx)=>list11(deps,req,callerIdentityOf(ctx)),listByWorkflow:(req,ctx)=>listByWorkflow(deps,req,callerIdentityOf(ctx)),subscribe:(req,ctx)=>subscribeExecution2(deps,req,ctx),getEventLog:(req,ctx)=>getEventLog(deps,req,callerIdentityOf(ctx)),subscribeEvents:(req,ctx)=>subscribeEvents(deps,req,ctx),getExecutionSummary:(req,ctx)=>getExecutionSummary2(deps,req,callerIdentityOf(ctx)),listPendingApprovals:(req,ctx)=>listPendingApprovals(deps,req,callerIdentityOf(ctx))})}async function createExecution2(deps,execution,ctx){let reqCtx=new RequestContext(WorkflowExecutionSchema,execution,callerIdentityOf(ctx),kindOf24(ctx)),builder2=newPipeline("workflowexecution-create",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newValidateWorkflowOrInstanceStep()).addStep(newAuthorizeRunTargetStep(deps.authorizer,workflowExecutionRunTarget)).addStep(newEnsureEngineAvailableStep2(deps.engineState)).addStep(newCreateDefaultInstanceIfNeededStep2({store:deps.store,logger:deps.logger,workflowInstanceCreator:deps.workflowInstanceCreator,authorizationLifecycle:deps.authorizationLifecycle})).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store));for(let step of stepsForSlot(deps.gateSteps,"sandbox-acquisition:gate"))builder2.addStep(step);return await builder2.addStep(newSetInitialPhaseStep2()).addStep(newNormalizeWorkflowRefStep(deps.store,deps.logger)).addStep(newPinWorkflowVersionStep(deps.store,deps.logger)).addStep(newCreateExecutionContextStep2(deps.executionContextBuilder)).addStep(newEnsureWorkflowSandboxStep({logger:deps.logger,lane:deps.sandboxLane,temporalConfig:deps.temporalConfig})).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,workflowExecutionSearchExtractor,deps.logger)).addStep(newStartWorkflowStep2({store:deps.store,logger:deps.logger,engineState:deps.engineState})).build().execute(reqCtx),reqCtx.newState}function kindOf24(ctx){return ctx.values.get(apiResourceKindKey)}async function update18(deps,execution,ctx){let reqCtx=new RequestContext(WorkflowExecutionSchema,execution,callerIdentityOf(ctx),kindOf24(ctx));return await newPipeline("workflowexecution-update",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,workflowExecutionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function deleteExecution2(deps,id,ctx){let reqCtx=new RequestContext(WorkflowExecutionCommandController.method.delete.input,id,callerIdentityOf(ctx),kindOf24(ctx));await newPipeline("workflowexecution-delete",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,WorkflowExecutionSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted workflow execution not found in context"),"deleted workflow execution not found in context");return deleted}async function get25(deps,id,ctx){let reqCtx=new RequestContext(WorkflowExecutionQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf24(ctx));return await newPipeline("workflowexecution-get",deps.logger).addStep(newAuthorizeStep(WorkflowExecutionQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,WorkflowExecutionSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function list11(deps,req,identity2){let legacyPhase=req.filter===void 0||req.filter.phases.length===0;return readWorkflowExecutionList({store:deps.store,logger:deps.logger,listReadScope:deps.listReadScope,identity:identity2,query:{org:req.org},request:req,sortField:req.sortField,sortAscending:req.sortAscending,keep:execution=>(!legacyPhase||matchesLegacyPhase(execution,req.phase))&&matchesFilterCriteria(execution,req.filter),fingerprint:{lane:"workflowExecution.list",org:req.org,phase:req.phase,tags:req.tags,filter:req.filter,sortField:req.sortField,sortAscending:req.sortAscending}})}async function listByWorkflow(deps,req,identity2){if(req.workflowId==="")throw invalidArgumentError("workflow_id is required");return readWorkflowExecutionList({store:deps.store,logger:deps.logger,listReadScope:deps.listReadScope,identity:identity2,query:{anyKey:[{name:"workflow",value:req.workflowId},{name:"workflow_instance",value:req.workflowId}]},request:req,sortField:req.sortField,sortAscending:req.sortAscending,keep:execution=>matchesFilterCriteria(execution,req.filter),fingerprint:{lane:"workflowExecution.listByWorkflow",workflowId:req.workflowId,filter:req.filter,sortField:req.sortField,sortAscending:req.sortAscending}})}var StreamBroker2=class{logger;subscribers=new Map;constructor(logger2){this.logger=logger2}subscribe(executionId){let subscription={queue:[],notify:void 0,closed:!1},set2=this.subscribers.get(executionId)??new Set;return set2.add(subscription),this.subscribers.set(executionId,set2),this.logger.debug("New subscriber registered",{executionId,totalSubscribers:set2.size}),subscription}unsubscribe(executionId,subscription){let set2=this.subscribers.get(executionId);set2===void 0||!set2.has(subscription)||(set2.delete(subscription),subscription.closed=!0,subscription.notify?.(),subscription.notify=void 0,this.logger.debug("Subscriber unregistered",{executionId,remainingSubscribers:set2.size}),set2.size===0&&this.subscribers.delete(executionId))}broadcast(execution){let executionId=execution.metadata?.id??"";if(executionId==="")return;let set2=this.subscribers.get(executionId);if(!(set2===void 0||set2.size===0)){this.logger.debug("Broadcasting execution update",{executionId,subscribers:set2.size});for(let subscription of set2){if(subscription.queue.length>=100){this.logger.warn("Subscriber channel full, dropping update",{executionId});continue}subscription.queue.push(execution),subscription.notify?.(),subscription.notify=void 0}}}getSubscriberCount(executionId){return this.subscribers.get(executionId)?.size??0}};var import_node_child_process=require("node:child_process"),import_node_util=require("node:util");var import_node_crypto29=require("node:crypto"),SCOPE_CODES={session:"ses",workflow:"wfx",connect:"mcp"},SANDBOX_MANAGED_BY_LABEL="stigmer.ai/managed-by",SANDBOX_SCOPE_LABEL="stigmer.ai/scope",SANDBOX_ID_LABEL="stigmer.ai/sandbox-id",SANDBOX_MANAGED_BY_VALUE="stigmer-server";function sandboxBaseName(scope,id){let digest3=(0,import_node_crypto29.createHash)("sha256").update(id).digest("hex").slice(0,12);return`sbx-${SCOPE_CODES[scope]}-${digest3}`}var execFileAsync=(0,import_node_util.promisify)(import_node_child_process.execFile),RUNNER_CONTAINER_COMMAND=["node","/runner/dist/main.js"],CONTAINER_WORKSPACE_DIR="/workspace",newDockerSandboxProvisioner=({config:config2,logger:logger2})=>{if(config2.backendEndpoint==="")throw new Error("sandbox provisioner 'docker' requires STIGMER_SANDBOX_BACKEND_ENDPOINT \u2014 a container cannot reach the server on this process's localhost");if(config2.temporalAddress==="")throw new Error("sandbox provisioner 'docker' requires STIGMER_SANDBOX_TEMPORAL_ADDRESS (or TEMPORAL_HOST_PORT) reachable from inside a container");async function docker(args,env2){let{stdout}=await execFileAsync("docker",args,{env:env2??process.env});return stdout.trim()}async function inspectState(name){try{return await docker(["inspect","--format","{{.State.Running}}",name])==="true"?"running":"stopped"}catch(error2){if(isNoSuchContainer(error2))return"absent";throw error2}}async function ensure(scope,id,env2){let name=sandboxBaseName(scope,id),state2=await inspectState(name);if(state2==="running")return;if(state2==="stopped"){await docker(["start",name]),logger2.info("Docker sandbox restarted",{scope,id,container:name});return}let runArgs=["run","--detach","--name",name,"--label",`${SANDBOX_MANAGED_BY_LABEL}=${SANDBOX_MANAGED_BY_VALUE}`,"--label",`${SANDBOX_SCOPE_LABEL}=${scope}`,"--label",`${SANDBOX_ID_LABEL}=${id}`,"--env","MODE=local","--env",`STIGMER_TASK_QUEUE=${env2.taskQueue}`,"--env",`STIGMER_BACKEND_ENDPOINT=${config2.backendEndpoint}`,"--env",`TEMPORAL_SERVICE_ADDRESS=${config2.temporalAddress}`,"--env",`TEMPORAL_NAMESPACE=${config2.temporalNamespace}`,"--env",`WORKSPACE_ROOT_DIR=${CONTAINER_WORKSPACE_DIR}`],secretEnv={...config2.temporalConnectionEnv};env2.stigmerToken!==""&&(secretEnv.STIGMER_TOKEN=env2.stigmerToken);let runEnv;if(Object.keys(secretEnv).length>0){for(let name2 of Object.keys(secretEnv))runArgs.push("--env",name2);runEnv={...process.env,...secretEnv}}runArgs.push(config2.runnerImage,...RUNNER_CONTAINER_COMMAND),await docker(runArgs,runEnv),logger2.info("Docker sandbox provisioned",{scope,id,container:name,taskQueue:env2.taskQueue,image:config2.runnerImage})}async function deprovision(scope,id){let name=sandboxBaseName(scope,id);try{await docker(["rm","--force",name]),logger2.info("Docker sandbox deprovisioned",{scope,id,container:name})}catch(error2){if(isNoSuchContainer(error2))return;throw error2}}return{ensureSessionSandbox:(sessionId,env2)=>ensure("session",sessionId,env2),deprovisionSessionSandbox:sessionId=>deprovision("session",sessionId),ensureWorkflowSandbox:(executionId,env2)=>ensure("workflow",executionId,env2),deprovisionWorkflowSandbox:executionId=>deprovision("workflow",executionId),async createConnectSandbox(connectRequestId,env2){return await ensure("connect",connectRequestId,env2),connectRequestId},deprovisionConnectSandbox:sandboxId=>deprovision("connect",sandboxId),probe:(scope,id)=>inspectState(sandboxBaseName(scope,id))}};function isNoSuchContainer(error2){let text2=error2 instanceof Error?`${error2.message} ${error2.stderr??""}`:String(error2);return text2.includes("No such container")||text2.includes("No such object")}var import_node_buffer2=require("node:buffer");typeof globalThis.File>"u"&&(globalThis.File=import_node_buffer2.File);var import_node_fs12=__toESM(require("node:fs"),1),import_node_https2=__toESM(require("node:https"),1),import_node_http2=__toESM(require("node:http"),1),import_node_tls=__toESM(require("node:tls"),1);var NOT_RESOLVED=Symbol("NOT_RESOLVED");function defineScalarTag(tagName,options){return{tagName,nodeKind:"scalar",implicit:options.implicit??!1,matchByTagPrefix:options.matchByTagPrefix??!1,implicitFirstChars:options.implicitFirstChars??null,resolve:options.resolve,identify:options.identify,represent:options.represent??(data=>String(data)),representTagName:options.representTagName??(()=>tagName)}}function defineSequenceTag(tagName,options){let carrierIsResult=options.finalize===void 0;return{tagName,nodeKind:"sequence",implicit:!1,matchByTagPrefix:options.matchByTagPrefix??!1,create:options.create,addItem:options.addItem,finalize:options.finalize??(carrier=>carrier),carrierIsResult,identify:options.identify,represent:options.represent??(data=>data),representTagName:options.representTagName??(()=>tagName)}}function defineMappingTag(tagName,options){let carrierIsResult=options.finalize===void 0;return{tagName,nodeKind:"mapping",implicit:!1,matchByTagPrefix:options.matchByTagPrefix??!1,create:options.create,addPair:options.addPair,has:options.has,keys:options.keys,get:options.get,finalize:options.finalize??(carrier=>carrier),carrierIsResult,identify:options.identify,represent:options.represent??(data=>data),representTagName:options.representTagName??(()=>tagName)}}var strTag=defineScalarTag("tag:yaml.org,2002:str",{resolve:source=>source,identify:data=>typeof data=="string"}),NULL_VALUES$1=["","~","null","Null","NULL"],nullCoreTag=defineScalarTag("tag:yaml.org,2002:null",{implicit:!0,implicitFirstChars:["","~","n","N"],resolve:source=>NULL_VALUES$1.indexOf(source)!==-1?null:NOT_RESOLVED,identify:object=>object===null,represent:()=>"null"}),nullJsonTag=defineScalarTag("tag:yaml.org,2002:null",{implicit:!0,implicitFirstChars:["n"],resolve:(source,isExplicit)=>source==="null"||isExplicit&&source===""?null:NOT_RESOLVED,identify:object=>object===null,represent:()=>"null"}),NULL_VALUES=["","~","null","Null","NULL"],nullYaml11Tag=defineScalarTag("tag:yaml.org,2002:null",{implicit:!0,implicitFirstChars:["","~","n","N"],resolve:source=>NULL_VALUES.indexOf(source)!==-1?null:NOT_RESOLVED,identify:object=>object===null,represent:()=>"null"}),TRUE_VALUES$2=["true","True","TRUE"],FALSE_VALUES$2=["false","False","FALSE"],boolCoreTag=defineScalarTag("tag:yaml.org,2002:bool",{implicit:!0,implicitFirstChars:["t","T","f","F"],resolve:source=>TRUE_VALUES$2.indexOf(source)!==-1?!0:FALSE_VALUES$2.indexOf(source)!==-1?!1:NOT_RESOLVED,identify:object=>Object.prototype.toString.call(object)==="[object Boolean]",represent:object=>object?"true":"false"}),TRUE_VALUES$1=["true"],FALSE_VALUES$1=["false"],boolJsonTag=defineScalarTag("tag:yaml.org,2002:bool",{implicit:!0,implicitFirstChars:["t","f"],resolve:source=>TRUE_VALUES$1.indexOf(source)!==-1?!0:FALSE_VALUES$1.indexOf(source)!==-1?!1:NOT_RESOLVED,identify:object=>Object.prototype.toString.call(object)==="[object Boolean]",represent:object=>object?"true":"false"}),TRUE_VALUES=["true","True","TRUE","y","Y","yes","Yes","YES","on","On","ON"],FALSE_VALUES=["false","False","FALSE","n","N","no","No","NO","off","Off","OFF"],boolYaml11Tag=defineScalarTag("tag:yaml.org,2002:bool",{implicit:!0,implicitFirstChars:["y","Y","n","N","t","T","f","F","o","O"],resolve:source=>TRUE_VALUES.indexOf(source)!==-1?!0:FALSE_VALUES.indexOf(source)!==-1?!1:NOT_RESOLVED,identify:object=>Object.prototype.toString.call(object)==="[object Boolean]",represent:object=>object?"true":"false"}),YAML_INTEGER_IMPLICIT_PATTERN$1=new RegExp("^(?:0o[0-7]+|0x[0-9a-fA-F]+|[-+]?[0-9]+)$"),YAML_INTEGER_EXPLICIT_PATTERN$1=new RegExp("^(?:[-+]?0b[0-1]+|[-+]?0o[0-7]+|[-+]?0x[0-9a-fA-F]+|[-+]?[0-9]+)$");function parseYamlInteger$2(source){let value=source,sign4=1;return(value[0]==="-"||value[0]==="+")&&(value[0]==="-"&&(sign4=-1),value=value.slice(1)),value.startsWith("0b")?sign4*parseInt(value.slice(2),2):value.startsWith("0o")?sign4*parseInt(value.slice(2),8):value.startsWith("0x")?sign4*parseInt(value.slice(2),16):sign4*parseInt(value,10)}function resolveYamlInteger$2(source,isExplicit){if(isExplicit){if(!YAML_INTEGER_EXPLICIT_PATTERN$1.test(source))return NOT_RESOLVED}else if(!YAML_INTEGER_IMPLICIT_PATTERN$1.test(source))return NOT_RESOLVED;let result=parseYamlInteger$2(source);return Number.isFinite(result)?result:NOT_RESOLVED}var intCoreTag=defineScalarTag("tag:yaml.org,2002:int",{implicit:!0,implicitFirstChars:["-","+",..."0123456789"],resolve:resolveYamlInteger$2,identify:object=>Number.isInteger(object)&&!Object.is(object,-0)&&object.toString(10).indexOf("e")<0,represent:object=>object.toString(10)}),YAML_INTEGER_IMPLICIT_PATTERN=new RegExp("^-?(?:0|[1-9][0-9]*)$"),YAML_INTEGER_EXPLICIT_PATTERN=new RegExp("^(?:[-+]?0b[0-1]+|[-+]?0o[0-7]+|[-+]?0x[0-9a-fA-F]+|[-+]?[0-9]+)$");function parseYamlInteger$1(source){let value=source,sign4=1;return(value[0]==="-"||value[0]==="+")&&(value[0]==="-"&&(sign4=-1),value=value.slice(1)),value.startsWith("0b")?sign4*parseInt(value.slice(2),2):value.startsWith("0o")?sign4*parseInt(value.slice(2),8):value.startsWith("0x")?sign4*parseInt(value.slice(2),16):sign4*parseInt(value,10)}function resolveYamlInteger$1(source,isExplicit){if(isExplicit){if(!YAML_INTEGER_EXPLICIT_PATTERN.test(source))return NOT_RESOLVED}else if(!YAML_INTEGER_IMPLICIT_PATTERN.test(source))return NOT_RESOLVED;let result=parseYamlInteger$1(source);return Number.isFinite(result)?result:NOT_RESOLVED}var intJsonTag=defineScalarTag("tag:yaml.org,2002:int",{implicit:!0,implicitFirstChars:["-",..."0123456789"],resolve:resolveYamlInteger$1,identify:object=>Number.isInteger(object)&&!Object.is(object,-0)&&object.toString(10).indexOf("e")<0,represent:object=>object.toString(10)}),YAML_INTEGER_PATTERN=new RegExp("^(?:[-+]?0b[0-1_]+|[-+]?0[0-7_]+|[-+]?0x[0-9a-fA-F_]+|[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+|[-+]?(?:0|[1-9][0-9_]*))$");function parseYamlInteger(source){let value=source.replace(/_/g,""),sign4=1;if((value[0]==="-"||value[0]==="+")&&(value[0]==="-"&&(sign4=-1),value=value.slice(1)),value.startsWith("0b"))return sign4*parseInt(value.slice(2),2);if(value.startsWith("0x"))return sign4*parseInt(value.slice(2),16);if(value.includes(":")){let result=0;for(let part of value.split(":"))result=result*60+Number(part);return sign4*result}return value!=="0"&&value[0]==="0"?sign4*parseInt(value,8):sign4*parseInt(value,10)}function resolveYamlInteger(source){if(!YAML_INTEGER_PATTERN.test(source))return NOT_RESOLVED;let result=parseYamlInteger(source);return Number.isFinite(result)?result:NOT_RESOLVED}var intYaml11Tag=defineScalarTag("tag:yaml.org,2002:int",{implicit:!0,implicitFirstChars:["-","+",..."0123456789"],resolve:resolveYamlInteger,identify:object=>Number.isInteger(object)&&!Object.is(object,-0)&&object.toString(10).indexOf("e")<0,represent:object=>object.toString(10)}),YAML_FLOAT_PATTERN$1=new RegExp("^(?:[-+]?[0-9]+(?:\\.[0-9]*)?(?:[eE][-+]?[0-9]+)?|[-+]?\\.[0-9]+(?:[eE][-+]?[0-9]+)?|[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$"),YAML_FLOAT_SPECIAL_PATTERN$1=new RegExp("^(?:[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$");function resolveYamlFloat$2(source){if(!YAML_FLOAT_PATTERN$1.test(source))return NOT_RESOLVED;let value=source.toLowerCase(),sign4=value[0]==="-"?-1:1;if("+-".includes(value[0])&&(value=value.slice(1)),value===".inf")return sign4===1?Number.POSITIVE_INFINITY:Number.NEGATIVE_INFINITY;if(value===".nan")return NaN;let result=sign4*parseFloat(value);return Number.isFinite(result)||YAML_FLOAT_SPECIAL_PATTERN$1.test(source)?result:NOT_RESOLVED}function representYamlFloat$2(object){if(isNaN(object))return".nan";if(object===Number.POSITIVE_INFINITY)return".inf";if(object===Number.NEGATIVE_INFINITY)return"-.inf";if(Object.is(object,-0))return"-0.0";let result=object.toString(10);return/^[-+]?[0-9]+e/.test(result)?result.replace("e",".e"):result}var floatCoreTag=defineScalarTag("tag:yaml.org,2002:float",{implicit:!0,implicitFirstChars:["-","+",".",..."0123456789"],resolve:resolveYamlFloat$2,identify:object=>typeof object=="number"&&(!Number.isInteger(object)||Object.is(object,-0)||object.toString(10).indexOf("e")>=0),represent:representYamlFloat$2}),YAML_FLOAT_IMPLICIT_PATTERN=new RegExp("^-?(?:0|[1-9][0-9]*)(?:\\.[0-9]*)?(?:[eE][-+]?[0-9]+)?$"),YAML_FLOAT_EXPLICIT_PATTERN=new RegExp("^(?:[-+]?[0-9]+(?:\\.[0-9]*)?(?:[eE][-+]?[0-9]+)?|[-+]?\\.[0-9]+(?:[eE][-+]?[0-9]+)?|[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$");function resolveYamlFloat$1(source,isExplicit){if(isExplicit){if(!YAML_FLOAT_EXPLICIT_PATTERN.test(source))return NOT_RESOLVED;let value=source.toLowerCase(),sign4=value[0]==="-"?-1:1;if("+-".includes(value[0])&&(value=value.slice(1)),value===".inf")return sign4===1?Number.POSITIVE_INFINITY:Number.NEGATIVE_INFINITY;if(value===".nan")return NaN;let result2=sign4*parseFloat(value);return Number.isFinite(result2)?result2:NOT_RESOLVED}if(!YAML_FLOAT_IMPLICIT_PATTERN.test(source))return NOT_RESOLVED;let result=Number(source);return Number.isFinite(result)?result:NOT_RESOLVED}function representYamlFloat$1(object){if(isNaN(object))return".nan";if(object===Number.POSITIVE_INFINITY)return".inf";if(object===Number.NEGATIVE_INFINITY)return"-.inf";if(Object.is(object,-0))return"-0.0";let result=object.toString(10);return/^[-+]?[0-9]+e/.test(result)?result.replace("e",".e"):result}var floatJsonTag=defineScalarTag("tag:yaml.org,2002:float",{implicit:!0,implicitFirstChars:["-",..."0123456789"],resolve:resolveYamlFloat$1,identify:object=>typeof object=="number"&&(!Number.isInteger(object)||Object.is(object,-0)||object.toString(10).indexOf("e")>=0),represent:representYamlFloat$1}),YAML_FLOAT_PATTERN=new RegExp("^(?:[-+]?(?:(?:[0-9][0-9_]*)?\\.[0-9_]*)(?:[eE][-+][0-9]+)?|[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+\\.[0-9_]*|[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$"),YAML_FLOAT_SPECIAL_PATTERN=new RegExp("^(?:[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$");function resolveYamlFloat(source){if(!YAML_FLOAT_PATTERN.test(source))return NOT_RESOLVED;let value=source.toLowerCase().replace(/_/g,""),sign4=value[0]==="-"?-1:1;if("+-".includes(value[0])&&(value=value.slice(1)),value===".inf")return sign4===1?Number.POSITIVE_INFINITY:Number.NEGATIVE_INFINITY;if(value===".nan")return NaN;let result=0;if(value.includes(":")){for(let part of value.split(":"))result=result*60+Number(part);result*=sign4}else result=sign4*parseFloat(value);return Number.isFinite(result)||YAML_FLOAT_SPECIAL_PATTERN.test(source)?result:NOT_RESOLVED}function representYamlFloat(object){if(isNaN(object))return".nan";if(object===Number.POSITIVE_INFINITY)return".inf";if(object===Number.NEGATIVE_INFINITY)return"-.inf";if(Object.is(object,-0))return"-0.0";let result=object.toString(10);return/^[-+]?[0-9]+e/.test(result)?result.replace("e",".e"):result}var floatYaml11Tag=defineScalarTag("tag:yaml.org,2002:float",{implicit:!0,implicitFirstChars:["-","+",".",..."0123456789"],resolve:resolveYamlFloat,identify:object=>typeof object=="number"&&(!Number.isInteger(object)||Object.is(object,-0)||object.toString(10).indexOf("e")>=0),represent:representYamlFloat}),mergeTag=defineScalarTag("tag:yaml.org,2002:merge",{implicit:!0,implicitFirstChars:["<"],resolve:(source,isExplicit)=>source==="<<"||isExplicit&&source===""?"<<":NOT_RESOLVED,identify:()=>!1}),BASE64_PATTERN=/^[A-Za-z0-9+/]*={0,2}$/;function resolveYamlBinary(source){let input=source.replace(/\s/g,"");if(input.length%4!==0||!BASE64_PATTERN.test(input))return NOT_RESOLVED;let binary2=atob(input),result=new Uint8Array(binary2.length);for(let index2=0;index2<binary2.length;index2++)result[index2]=binary2.charCodeAt(index2);return result}function representYamlBinary(object){let binary2="";for(let index2=0;index2<object.length;index2++)binary2+=String.fromCharCode(object[index2]);return btoa(binary2)}var binaryTag=defineScalarTag("tag:yaml.org,2002:binary",{resolve:resolveYamlBinary,identify:object=>Object.prototype.toString.call(object)==="[object Uint8Array]",represent:representYamlBinary}),YAML_DATE_REGEXP=new RegExp("^([0-9][0-9][0-9][0-9])-([0-9][0-9])-([0-9][0-9])$"),YAML_TIMESTAMP_REGEXP=new RegExp("^([0-9][0-9][0-9][0-9])-([0-9][0-9]?)-([0-9][0-9]?)(?:[Tt]|[ \\t]+)([0-9][0-9]?):([0-9][0-9]):([0-9][0-9])(?:\\.([0-9]*))?(?:[ \\t]*(Z|([-+])([0-9][0-9]?)(?::([0-9][0-9]))?))?$");function makeUtcDate(year2,month,day,hour=0,minute=0,second=0,fraction=0){let date2=new Date(Date.UTC(year2,month,day,hour,minute,second,fraction));return date2.setUTCFullYear(year2,month,day),date2}function resolveYamlTimestamp(source){let match=YAML_DATE_REGEXP.exec(source);if(match===null&&(match=YAML_TIMESTAMP_REGEXP.exec(source)),match===null)return NOT_RESOLVED;let year2=+match[1],month=+match[2]-1,day=+match[3];if(!match[4]){let date3=makeUtcDate(year2,month,day);return date3.getUTCFullYear()!==year2||date3.getUTCMonth()!==month||date3.getUTCDate()!==day?NOT_RESOLVED:date3}let hour=+match[4],minute=+match[5],second=+match[6],fraction=0;if(hour>23||minute>59||second>59)return NOT_RESOLVED;if(match[7]){let value=match[7].slice(0,3);for(;value.length<3;)value+="0";fraction=+value}let date2=makeUtcDate(year2,month,day,hour,minute,second,fraction);if(date2.getUTCFullYear()!==year2||date2.getUTCMonth()!==month||date2.getUTCDate()!==day)return NOT_RESOLVED;if(match[9]){let offsetHour=+match[10],offsetMinute=+(match[11]||0);if(offsetHour>23||offsetMinute>59)return NOT_RESOLVED;let offset=(offsetHour*60+offsetMinute)*6e4;date2.setTime(date2.getTime()-(match[9]==="-"?-offset:offset))}return date2}var timestampTag=defineScalarTag("tag:yaml.org,2002:timestamp",{implicit:!0,implicitFirstChars:[..."0123456789"],resolve:resolveYamlTimestamp,identify:object=>object instanceof Date,represent:object=>object.toISOString()}),seqTag=defineSequenceTag("tag:yaml.org,2002:seq",{create:()=>[],addItem:(container,item)=>{container.push(item)},identify:Array.isArray});function isPlainObject(data){if(data===null||typeof data!="object"||Array.isArray(data))return!1;let prototype=Object.getPrototypeOf(data);return prototype===null||prototype===Object.prototype}function pick(object,keys){let result={};for(let key of keys)object[key]!==void 0&&(result[key]=object[key]);return result}var omapTag=defineSequenceTag("tag:yaml.org,2002:omap",{create:()=>({list:[],seen:new Set}),addItem:(carrier,item)=>{let key;if(item instanceof Map){if(item.size!==1)return"cannot resolve an ordered map item";key=item.keys().next().value}else if(isPlainObject(item)){let itemKeys=Object.keys(item);if(itemKeys.length!==1)return"cannot resolve an ordered map item";key=itemKeys[0]}else return"cannot resolve an ordered map item";return carrier.seen.has(key)?"duplicate key in ordered map":(carrier.seen.add(key),carrier.list.push(item),"")},finalize:carrier=>carrier.list,identify:()=>!1}),pairsTag=defineSequenceTag("tag:yaml.org,2002:pairs",{create:()=>[],addItem:(container,item)=>{if(item instanceof Map)return item.size!==1?"cannot resolve a pairs item":(container.push(item.entries().next().value),"");if(Object.prototype.toString.call(item)!=="[object Object]")return"cannot resolve a pairs item";let object=item,keys=Object.keys(object);return keys.length!==1?"cannot resolve a pairs item":(container.push([keys[0],object[keys[0]]]),"")},identify:()=>!1}),mapTag=defineMappingTag("tag:yaml.org,2002:map",{create:()=>({}),identify:isPlainObject,represent:o3=>{let map5=new Map;for(let key of Object.keys(o3))map5.set(key,o3[key]);return map5},addPair:(container,key,value)=>{if(key!==null&&typeof key=="object")return"object-based map does not support complex keys";let normalizedKey=String(key);return normalizedKey==="__proto__"?Object.defineProperty(container,normalizedKey,{value,enumerable:!0,configurable:!0,writable:!0}):container[normalizedKey]=value,""},has:(container,key)=>key!==null&&typeof key=="object"?!1:Object.prototype.hasOwnProperty.call(container,String(key)),keys:container=>Object.keys(container),get:(container,key)=>{let normalizedKey=String(key);return Object.prototype.hasOwnProperty.call(container,normalizedKey)?container[normalizedKey]:null}}),setTag=defineMappingTag("tag:yaml.org,2002:set",{create:()=>new Set,identify:data=>data instanceof Set,represent:data=>{let map5=new Map;for(let key of data)map5.set(key,null);return map5},addPair:(container,key,value)=>value!==null?"cannot resolve a set item":(container.add(key),""),has:(container,key)=>container.has(key),keys:container=>container.keys(),get:()=>null});function createTagDefinitionMap(){return{scalar:Object.create(null),sequence:Object.create(null),mapping:Object.create(null)}}function createTagDefinitionListMap(){return{scalar:[],sequence:[],mapping:[]}}function compileTags(tags){let result=[];for(let tag2 of tags){let index2=result.length;for(let previousIndex=0;previousIndex<result.length;previousIndex++){let previous=result[previousIndex];if(previous.nodeKind===tag2.nodeKind&&previous.tagName===tag2.tagName&&previous.matchByTagPrefix===tag2.matchByTagPrefix){index2=previousIndex;break}}result[index2]=tag2}return result}var Schema3=class Schema4{tags;implicitScalarTags;implicitScalarByFirstChar;implicitScalarAnyFirstChar;defaultScalarTag;defaultSequenceTag;defaultMappingTag;exact;prefix;constructor(tags){let compiledTags=compileTags(tags),implicitScalarTags=[],exact=createTagDefinitionMap(),prefix=createTagDefinitionListMap();for(let tag2 of compiledTags){if(tag2.nodeKind==="scalar"&&tag2.implicit){if(tag2.matchByTagPrefix)throw new Error("Implicit scalar tags cannot match by tag prefix");implicitScalarTags.push(tag2)}switch(tag2.nodeKind){case"scalar":tag2.matchByTagPrefix?prefix.scalar.push(tag2):exact.scalar[tag2.tagName]=tag2;break;case"sequence":tag2.matchByTagPrefix?prefix.sequence.push(tag2):exact.sequence[tag2.tagName]=tag2;break;case"mapping":tag2.matchByTagPrefix?prefix.mapping.push(tag2):exact.mapping[tag2.tagName]=tag2;break}}let implicitScalarAnyFirstChar=implicitScalarTags.filter(tag2=>tag2.implicitFirstChars===null),keys=new Set;for(let tag2 of implicitScalarTags)if(tag2.implicitFirstChars!==null)for(let key of tag2.implicitFirstChars)keys.add(key);let implicitScalarByFirstChar=new Map;for(let key of keys)implicitScalarByFirstChar.set(key,implicitScalarTags.filter(tag2=>tag2.implicitFirstChars===null||tag2.implicitFirstChars.indexOf(key)!==-1));let defaultScalarTag=exact.scalar["tag:yaml.org,2002:str"];if(!defaultScalarTag)throw new Error("schema does not define the default scalar tag (tag:yaml.org,2002:str)");this.tags=compiledTags,this.implicitScalarTags=implicitScalarTags,this.implicitScalarByFirstChar=implicitScalarByFirstChar,this.implicitScalarAnyFirstChar=implicitScalarAnyFirstChar,this.defaultScalarTag=defaultScalarTag,this.defaultSequenceTag=exact.sequence["tag:yaml.org,2002:seq"],this.defaultMappingTag=exact.mapping["tag:yaml.org,2002:map"],this.exact=exact,this.prefix=prefix}lookupScalarTag(tagName){let exactTag=this.exact.scalar[tagName];if(exactTag)return exactTag;for(let tag2 of this.prefix.scalar)if(tagName.startsWith(tag2.tagName))return tag2}lookupSequenceTag(tagName){let exactTag=this.exact.sequence[tagName];if(exactTag)return exactTag;for(let tag2 of this.prefix.sequence)if(tagName.startsWith(tag2.tagName))return tag2}lookupMappingTag(tagName){let exactTag=this.exact.mapping[tagName];if(exactTag)return exactTag;for(let tag2 of this.prefix.mapping)if(tagName.startsWith(tag2.tagName))return tag2}resolveImplicitScalarTag(source){let candidates=this.implicitScalarByFirstChar.get(source.charAt(0))??this.implicitScalarAnyFirstChar;for(let tag3 of candidates){let value=tag3.resolve(source,!1,tag3.tagName);if(value!==NOT_RESOLVED)return{value,tag:tag3}}let tag2=this.defaultScalarTag;return{value:tag2.resolve(source,!1,tag2.tagName),tag:tag2}}withTags(...tags){let flatTags=[];for(let tag2 of tags)flatTags=flatTags.concat(tag2);return new Schema4([...this.tags,...flatTags])}},FAILSAFE_SCHEMA2=new Schema3([strTag,seqTag,mapTag]),JSON_SCHEMA2=new Schema3([...FAILSAFE_SCHEMA2.tags,nullJsonTag,boolJsonTag,intJsonTag,floatJsonTag]),CORE_SCHEMA2=new Schema3([...FAILSAFE_SCHEMA2.tags,nullCoreTag,boolCoreTag,intCoreTag,floatCoreTag]),YAML11_SCHEMA=new Schema3([...FAILSAFE_SCHEMA2.tags,nullYaml11Tag,boolYaml11Tag,intYaml11Tag,floatYaml11Tag,timestampTag,mergeTag,binaryTag,omapTag,pairsTag,setTag]),DUMP_SCHEMA=YAML11_SCHEMA.withTags({...intYaml11Tag,resolve:(source,isExplicit,tagName)=>{let result=intYaml11Tag.resolve(source,isExplicit,tagName);return result===NOT_RESOLVED?intCoreTag.resolve(source,isExplicit,tagName):result}},{...floatYaml11Tag,resolve:(source,isExplicit,tagName)=>{let result=floatYaml11Tag.resolve(source,isExplicit,tagName);return result===NOT_RESOLVED?floatCoreTag.resolve(source,isExplicit,tagName):result}}),realMapTag=defineMappingTag("tag:yaml.org,2002:map",{create:()=>new Map,addPair:(container,key,value)=>(container.set(key,value),""),has:(container,key)=>container.has(key),keys:container=>container.keys(),get:(container,key)=>container.get(key),identify:data=>data instanceof Map||isPlainObject(data),represent:data=>{if(data instanceof Map)return data;let map5=new Map,obj=data;for(let key of Object.keys(obj))map5.set(key,obj[key]);return map5}});function normalizeKey(key){if(Array.isArray(key)){let array=Array.prototype.slice.call(key);for(let index2=0;index2<array.length;index2++){if(Array.isArray(array[index2]))return null;typeof array[index2]=="object"&&Object.prototype.toString.call(array[index2])==="[object Object]"&&(array[index2]="[object Object]")}return String(array)}return typeof key=="object"&&Object.prototype.toString.call(key)==="[object Object]"?"[object Object]":String(key)}var legacyMapTag=defineMappingTag("tag:yaml.org,2002:map",{create:()=>({}),identify:isPlainObject,represent:o3=>{let map5=new Map;for(let key of Object.keys(o3))map5.set(key,o3[key]);return map5},addPair:(container,key,value)=>{let normalizedKey=normalizeKey(key);return normalizedKey===null?"nested arrays are not supported inside keys":(normalizedKey==="__proto__"?Object.defineProperty(container,normalizedKey,{value,enumerable:!0,configurable:!0,writable:!0}):container[normalizedKey]=value,"")},has:(container,key)=>{let normalizedKey=normalizeKey(key);return normalizedKey!==null&&Object.prototype.hasOwnProperty.call(container,normalizedKey)},keys:container=>Object.keys(container),get:(container,key)=>{let normalizedKey=String(key);return Object.prototype.hasOwnProperty.call(container,normalizedKey)?container[normalizedKey]:null}}),DEFAULT_SNIPPET_OPTIONS={maxLength:79,indent:1,linesBefore:3,linesAfter:2};function getLine(buffer,lineStart,lineEnd,position,maxLineLength){let head="",tail="",maxHalfLength=Math.floor(maxLineLength/2)-1;return position-lineStart>maxHalfLength&&(head=" ... ",lineStart=position-maxHalfLength+head.length),lineEnd-position>maxHalfLength&&(tail=" ...",lineEnd=position+maxHalfLength-tail.length),{str:head+buffer.slice(lineStart,lineEnd).replace(/\t/g,"\u2192")+tail,pos:position-lineStart+head.length}}function padStart(string,max2){return" ".repeat(Math.max(max2-string.length,0))+string}function makeSnippet(mark,options){if(!mark.buffer)return null;let opts={...DEFAULT_SNIPPET_OPTIONS,...options},re2=/\r?\n|\r|\0/g,lineStarts=[0],lineEnds=[],match,foundLineNo=-1;for(;match=re2.exec(mark.buffer);)lineEnds.push(match.index),lineStarts.push(match.index+match[0].length),mark.position<=match.index&&foundLineNo<0&&(foundLineNo=lineStarts.length-2);foundLineNo<0&&(foundLineNo=lineStarts.length-1);let result="",lineNoLength=Math.min(mark.line+opts.linesAfter,lineEnds.length).toString().length,maxLineLength=opts.maxLength-(opts.indent+lineNoLength+3);for(let i6=1;i6<=opts.linesBefore&&!(foundLineNo-i6<0);i6++){let line2=getLine(mark.buffer,lineStarts[foundLineNo-i6],lineEnds[foundLineNo-i6],mark.position-(lineStarts[foundLineNo]-lineStarts[foundLineNo-i6]),maxLineLength);result=`${" ".repeat(opts.indent)}${padStart((mark.line-i6+1).toString(),lineNoLength)} | ${line2.str}
 ${result}`}let line=getLine(mark.buffer,lineStarts[foundLineNo],lineEnds[foundLineNo],mark.position,maxLineLength);result+=`${" ".repeat(opts.indent)}${padStart((mark.line+1).toString(),lineNoLength)} | ${line.str}
 `,result+=`${"-".repeat(opts.indent+lineNoLength+3+line.pos)}^
 `;for(let i6=1;i6<=opts.linesAfter&&!(foundLineNo+i6>=lineEnds.length);i6++){let line2=getLine(mark.buffer,lineStarts[foundLineNo+i6],lineEnds[foundLineNo+i6],mark.position-(lineStarts[foundLineNo]-lineStarts[foundLineNo+i6]),maxLineLength);result+=`${" ".repeat(opts.indent)}${padStart((mark.line+i6+1).toString(),lineNoLength)} | ${line2.str}